lkml.org 
[lkml]   [2019]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [RFC PATCH 21/21] KVM: x86: Add capability to grant VM access to privileged SGX attribute
    On Fri, Jul 26, 2019 at 10:52 PM Sean Christopherson
    <sean.j.christopherson@intel.com> wrote:
    >
    > The SGX subsystem restricts access to a subset of enclave attributes to
    > provide additional security for an uncompromised kernel, e.g. to prevent
    > malware from using the PROVISIONKEY to ensure its nodes are running
    > inside a geniune SGX enclave and/or to obtain a stable fingerprint.
    >
    > To prevent userspace from circumventing such restrictions by running an
    > enclave in a VM, KVM restricts guest access to privileged attributes by
    > default. Add a capability, KVM_CAP_SGX_ATTRIBUTE, that can be used by
    > userspace to grant a VM access to a priveleged attribute, with args[0]
    > holding a file handle to a valid SGX attribute file corresponding to
    > an attribute that is restricted by KVM (currently only PROVISIONKEY).

    Looks good to me. Thanks!

    > +can use KVM_CAP_SGX_ATTRIBUTE to grant a VM access to a priveleged attribute.

    Spelling.

    \
     
     \ /
      Last update: 2019-07-27 19:41    [W:3.445 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site