On 11/03/2020 5:30 PM Mike Rapoport rppt@kernel.org wrote:
As long as the task share the file descriptor, they can share the secretmem pages, pretty much like normal memfd.
Including process_vm_readv() and process_vm_writev()? Let's take a hypothetical "dbus-daemon-secure" service that receives data from process A and wants to copy/distribute it to data areas of N other processes. Much like dbus but without SOCK_DGRAM rather direct copy into secretmem/mmap pages (ring-buffer). Should be possible, right?
I'm not sure I follow you here. For process_vm_readv() and process_vm_writev() secremem will be only accessible on the local part, but not on the remote. So copying data to secretmem pages using process_vm_writev wouldn't work.
A hypothetical "dbus-daemon-secure" service will not be *process related* with communication peers. E.g. a password-input process (reading a password into secured-memory page) will transfer the password to dbus-daemon-secure and this service will hand-over the password to two additional applications: a IPsec process on CPU0 und CPU1 (which itself use a secured-memory page).
So four applications IPC chain: password-input -> dbus-daemon-secure -> {IPsec0, IPsec1}
- password-input: uses a secured page to read/save the password locally after reading from TTY - dbus-daemon-secure: uses a secured page for IPC (legitimate user can write and read into the secured page) - IPSecN has secured page to save the password locally (and probably other data as well), IPC memory is memset'ed after copy
Goal: the whole password is never saved/touched on non secured pages during IPC transfer.
Question: maybe a *file-descriptor passing* mechanism can do the trick? I.e. dbus-daemon-secure allocates via memfd_secret/mmap secure pages and permitted processes will get the descriptor/mmaped-page passed so they can use the pages directly?
Hagen