vfio/nvlink: Remove exec permission to avoid SELinux AVCs
If SELinux is setup without 'execmem' permission for qemu, all mmap with (PROT_WRITE | PROT_EXEC) will fail and print a warning in SELinux log. If "nvlink2-mr" memory allocation fails (fist diff), it will cause guest NUMA nodes to not be correctly configured (V100 memory will not be visible for guest, nor its NUMA nodes). Not having 'execmem' permission is intesting for virtual machines to avoid buffer-overflow based attacks, and it's adopted in distros like RHEL. So, removing the PROT_EXEC flag seems the right thing to do. Browsing some other code that mmaps memory for usage with memory_region_init_ram_device_ptr, I could notice it's usual to not have PROT_EXEC (only PROT_READ | PROT_WRITE), so it should be no problem around this. Signed-off-by: Leonardo Bras <leobras.c@gmail.com> Message-Id: <20200501055448.286518-1-leobras.c@gmail.com> Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
parent
47e112c4dd
commit
9c7c040702
|
@ -1620,7 +1620,7 @@ int vfio_pci_nvidia_v100_ram_init(VFIOPCIDevice *vdev, Error **errp)
|
|||
}
|
||||
cap = (void *) hdr;
|
||||
|
||||
p = mmap(NULL, nv2reg->size, PROT_READ | PROT_WRITE | PROT_EXEC,
|
||||
p = mmap(NULL, nv2reg->size, PROT_READ | PROT_WRITE,
|
||||
MAP_SHARED, vdev->vbasedev.fd, nv2reg->offset);
|
||||
if (p == MAP_FAILED) {
|
||||
ret = -errno;
|
||||
|
@ -1680,7 +1680,7 @@ int vfio_pci_nvlink2_init(VFIOPCIDevice *vdev, Error **errp)
|
|||
|
||||
/* Some NVLink bridges may not have assigned ATSD */
|
||||
if (atsdreg->size) {
|
||||
p = mmap(NULL, atsdreg->size, PROT_READ | PROT_WRITE | PROT_EXEC,
|
||||
p = mmap(NULL, atsdreg->size, PROT_READ | PROT_WRITE,
|
||||
MAP_SHARED, vdev->vbasedev.fd, atsdreg->offset);
|
||||
if (p == MAP_FAILED) {
|
||||
ret = -errno;
|
||||
|
|
Loading…
Reference in a new issue