Commit 9c7c0407 authored May 01, 2020 by Leonardo Bras Committed by David Gibson May 27, 2020

vfio/nvlink: Remove exec permission to avoid SELinux AVCs



If SELinux is setup without 'execmem' permission for qemu, all mmap
with (PROT_WRITE | PROT_EXEC) will fail and print a warning in
SELinux log.

If "nvlink2-mr" memory allocation fails (fist diff), it will cause
guest NUMA nodes to not be correctly configured (V100 memory will
not be visible for guest, nor its NUMA nodes).

Not having 'execmem' permission is intesting for virtual machines to
avoid buffer-overflow based attacks, and it's adopted in distros
like RHEL.

So, removing the PROT_EXEC flag seems the right thing to do.

Browsing some other code that mmaps memory for usage with
memory_region_init_ram_device_ptr, I could notice it's usual to
not have PROT_EXEC (only PROT_READ | PROT_WRITE), so it should be
no problem around this.

Signed-off-by: Leonardo Bras <leobras.c@gmail.com>
Message-Id: <20200501055448.286518-1-leobras.c@gmail.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

parent 47e112c4

hw/vfio/pci-quirks.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1620,7 +1620,7 @@ int vfio_pci_nvidia_v100_ram_init(VFIOPCIDevice vdev, Error *errp)
		}
		cap = (void *) hdr;

		p = mmap(NULL, nv2reg->size, PROT_READ \| PROT_WRITE \| PROT_EXEC,
		p = mmap(NULL, nv2reg->size, PROT_READ \| PROT_WRITE,
		MAP_SHARED, vdev->vbasedev.fd, nv2reg->offset);
		if (p == MAP_FAILED) {
		ret = -errno;
		@@ -1680,7 +1680,7 @@ int vfio_pci_nvlink2_init(VFIOPCIDevice vdev, Error *errp)

		/* Some NVLink bridges may not have assigned ATSD */
		if (atsdreg->size) {
		p = mmap(NULL, atsdreg->size, PROT_READ \| PROT_WRITE \| PROT_EXEC,
		p = mmap(NULL, atsdreg->size, PROT_READ \| PROT_WRITE,
		MAP_SHARED, vdev->vbasedev.fd, atsdreg->offset);
		if (p == MAP_FAILED) {
		ret = -errno;