On Thu, May 30, 2019 at 02:48:43PM -0700, Xing, Cedric wrote:

So I think the same rationale applies to enclaves. Your original idea of
MAXPERM is the policy set forth by system admin and shall *never* change at
runtime. If an enclave is dynamically linked and needs to bring in code pages
at runtime, the admin needs to enable it by setting, say ENCLAVE__EXECMOD, in
the sigstruct file. Then all EAUG'ed pages will receive RWX as MAXPERM. The
process would then mprotect() selective pages to be RX but which exact set of
pages doesn't concern LSM usually.

Because passing RWX means the enclave "requires" EXECMOD even if it never
actually does a RW->RX transition.  It's not broken per se, but at the
very least it's decidedly odd.

Dynamically detecting the EXECMOD case is not difficult and has the
advantage of simplifying userspace loaders, e.g. all EAUG pages are tagged
ALLOW_WRITE and the kernel takes care of the rest.

I *think* auditing/learning is also messed up with a MAXPERMS approach, as
mprotect() would fail (due to MAXPERMS clearing MAY_{READ,WRITE,EXEC})
before it calls security_file_mprotect().  Hooking mprotect() is the
obvious workaround, but then it's looking a lot like the new proposals.

In other words, the new proposals are rooted in the MAXPERMS concept, e.g.
MAXPERM is effectively "I want EXECMOD", which gets distilled down to
ALLOW_WRITE (or ALLOW_EXEC in Andy's proposal).