[PATCH <RFC> 00/15] Encode object type security status in code

["Daniel P. Berrangé" <berrange@redhat.com>]

Our docs/system/security.rst file loosely classifies code into that
applicable for 'virtualization' vs 'non-virtualization' use cases.
Only code relevant to the former group is eligible for security
bug handling. Peter's recent proposal pointed out that we are
increasingly hitting the limits of such a crude classification:

  https://lists.nongnu.org/archive/html/qemu-devel/2025-09/msg01520.html

Michael suggested that with the increased complexity, docs are not
going to be an effective way to convey the information, and we
need to re-consider embedding this info in code:

  https://lists.nongnu.org/archive/html/qemu-devel/2025-09/msg01566.html

This also allows users to validate a configuration's security status
when starting a guest, or modifying a running guest. This series is
an attempt to start the embedding process.

It starts with QOM, adding "bool secure" and "bool insecure"
properties to the TypeInfo struct, which get turned into flags
on the Type struct. This enables querying any ObjectClass to
ask whether or not it is declared secure or insecure.

By default no statement will be made about whether a class is
secure or insecure, reflecting our historical defaults. Over
time we should annotate as many classes as possible with an
explicit statement.

The "-machine" argument gains two new parameters

  * prohibit-insecure=yes|no  - a weak security boundary, only
    excluding stuff that is explicitly declared insecure,
    permiting stuff that is secure & anything without a stetement

  * require-secure=yes|no - a strong security boundary, only
    permitting stuff that is explicitly declared secure,
    excluding insecure stuff & anything without a statement

As illustration, I have added explicit annotations for many machine
types, some accelerators, all NICs (all insecure except xen,
e1000(e) and virtio), and all PCI virtio devices (all secure).

Example: TCG is explicitly insecure, KVM is explicitly secure,
         qtest has no statement:

  $ qemu-system-x86_64 -display none -machine pc,prohibit-insecure=yes -accel tcg
  qemu-system-x86_64: Type 'tcg-accel' is declared as insecure

  $ qemu-system-x86_64 -display none -machine pc,require-secure=yes -accel tcg
  qemu-system-x86_64: Type 'tcg-accel' is not declared as secure

  $ qemu-system-x86_64 -display none -machine pc,prohibit-insecure=yes -accel kvm
  ^Cqemu-system-x86_64: terminating on signal 2

  $ qemu-system-x86_64 -display none -machine pc,require-secure=yes -accel kvm
  ^Cqemu-system-x86_64: terminating on signal 2

  $ qemu-system-x86_64 -display none -machine pc,prohibit-insecure=yes -accel qtest
  ^Cqemu-system-x86_64: terminating on signal 2

  $ qemu-system-x86_64 -display none -machine pc,require-secure=yes -accel qtest
  qemu-system-x86_64: Type 'qtest-accel' is not declared as secure

Example: isapc machine type is explicitly insecure

  $ qemu-system-x86_64 -display none -machine isapc,require-secure=yes -accel kvm
  qemu-system-x86_64: Type 'isapc-machine' is not declared as secure

Example: devices which have no security statement are allowed if
         merely excluding insecure devices:

  $ qemu-system-x86_64 -display none -machine pc,prohibit-insecure=yes -accel kvm -device i6300esb
  ^Cqemu-system-x86_64: terminating on signal 2

Example: devices which have no security statement are rejected if
         requiring explicit security:

  $ qemu-system-x86_64 -display none -machine pc,require-secure=yes -accel kvm -device i6300esb
  qemu-system-x86_64: -device i6300esb: Type 'i6300esb' is not declared as secure

Example: checks also apply in HMP, rtl8139 is explicitly insecure,
         virtio is explicitly secure

  $ qemu-system-x86_64 -display none -machine pc,require-secure=yes -accel kvm -monitor stdio
  QEMU 10.1.50 monitor - type 'help' for more information
  (qemu) device_add rtl8139
  Error: Type 'rtl8139' is not declared as secure
  (qemu) device_add virtio-net

Example: checks also apply in QMP:

  $ ./scripts/qmp/qmp-shell-wrap qemu-system-x86_64 -display none -machine pc,require-secure=yes -accel kvm
  Welcome to the QMP low-level shell!
  Connected
  (QEMU) device_add driver=rtl8139
  {"error": {"class": "GenericError", "desc": "Type 'rtl8139' is not declared as secure"}}
  (QEMU) device_add driver=virtio-net
  {"return": {}}

Some questions....

  * Is using '-machine' the right place to express the policy ?

  * Can we change '-accel help' to report 'secure' / 'insecure'
    as we did for '-machine help' and '-device help'.

  * Should we have 'query-devices' for QMP to allow the 'secure'
    or 'insecure' status to be queried for every device.

  * Should we have 'query-accel' for QMP to allow the 'secure'
    or 'insecure' status to be queried for every accelerator.

  * Should we enforce checks for -object & object_add too ?
    Easy to add code for this, but do we need the ability to
    exclude some object backends of dubious code quality ?

  * Likewise for -chardev / -netdev / etc which are
    conceptual specializations of -object

  * BlockDriver structs don't use QOM, so we can't mark
    'vvfat' block backend as insecure

The first one about '-machine' is probably the main blocker
from a design POV. Other things are just potential future
incremental work.

This series has had only 1/2 a day's work / thought put into
it, hence RFC status. It has been compiled and minimally tested
with the examples shown above. I have not pushed this through
CI nor considered tests yet. Still it gives a good illustration
of what's involved in recording security info in code.

Daniel P. Berrangé (15):
  qom: replace 'abstract' with 'flags'
  qom: add tracking of security state of object types
  machine: add 'require-secure' and 'prohibit-insecure' properties
  machine: check security for machine and accelerator types
  system: report machine security status in help output
  system: check security of device types
  system: report device security status in help output
  hw/core: report secure/insecure status in query-machines
  accel: mark 'kvm' as secure and 'tcg' as insecure
  hw/virtio: mark all virtio PCI devices as secure
  hw: mark x86, s390, ppc, arm versioned machine types as secure
  hw: declare Xen & microvm machines as secure, isapc as insecure
  hw/core: declare 'none' machine to be insecure
  hw/net: mark all NICs as insecure except e1000, e1000e & xen
  docs: expand security docs with info about secure/insecure markers

 accel/kvm/kvm-all.c            |  1 +
 accel/tcg/tcg-all.c            |  1 +
 docs/system/security.rst       | 41 +++++++++++++++++++++
 hw/arm/virt.c                  |  1 +
 hw/arm/xen-pvh.c               |  1 +
 hw/core/machine-qmp-cmds.c     |  2 ++
 hw/core/machine.c              | 66 ++++++++++++++++++++++++++++++++++
 hw/core/null-machine.c         |  2 +-
 hw/i386/isapc.c                |  2 +-
 hw/i386/microvm.c              |  1 +
 hw/i386/pc_piix.c              |  4 +--
 hw/i386/xen/xen-pvh.c          |  1 +
 hw/i386/xen/xen_pvdevice.c     |  1 +
 hw/net/allwinner-sun8i-emac.c  |  1 +
 hw/net/allwinner_emac.c        |  3 +-
 hw/net/cadence_gem.c           |  1 +
 hw/net/can/can_kvaser_pci.c    |  1 +
 hw/net/can/can_mioe3680_pci.c  |  1 +
 hw/net/can/can_pcm3680_pci.c   |  1 +
 hw/net/can/ctucan_pci.c        |  1 +
 hw/net/can/xlnx-versal-canfd.c |  1 +
 hw/net/can/xlnx-zynqmp-can.c   |  1 +
 hw/net/dp8393x.c               |  1 +
 hw/net/e1000.c                 |  1 +
 hw/net/e1000e.c                |  1 +
 hw/net/eepro100.c              |  1 +
 hw/net/fsl_etsec/etsec.c       |  1 +
 hw/net/ftgmac100.c             |  1 +
 hw/net/igb.c                   |  1 +
 hw/net/igbvf.c                 |  1 +
 hw/net/imx_fec.c               |  2 ++
 hw/net/lan9118.c               |  1 +
 hw/net/lan9118_phy.c           |  1 +
 hw/net/lance.c                 |  1 +
 hw/net/lasi_i82596.c           |  1 +
 hw/net/mcf_fec.c               |  1 +
 hw/net/msf2-emac.c             |  1 +
 hw/net/mv88w8618_eth.c         |  1 +
 hw/net/ne2000-isa.c            |  1 +
 hw/net/ne2000-pci.c            |  1 +
 hw/net/npcm7xx_emc.c           |  1 +
 hw/net/npcm_gmac.c             |  1 +
 hw/net/npcm_pcs.c              |  1 +
 hw/net/opencores_eth.c         |  1 +
 hw/net/pcnet-pci.c             |  1 +
 hw/net/rocker/rocker.c         |  1 +
 hw/net/rtl8139.c               |  1 +
 hw/net/smc91c111.c             |  1 +
 hw/net/spapr_llan.c            |  1 +
 hw/net/stellaris_enet.c        |  1 +
 hw/net/sungem.c                |  1 +
 hw/net/sunhme.c                |  1 +
 hw/net/tulip.c                 |  1 +
 hw/net/virtio-net.c            |  1 +
 hw/net/vmxnet3.c               |  1 +
 hw/net/xen_nic.c               |  1 +
 hw/net/xgmac.c                 |  1 +
 hw/net/xilinx_axienet.c        |  1 +
 hw/net/xilinx_ethlite.c        |  1 +
 hw/ppc/spapr.c                 |  1 +
 hw/s390x/s390-virtio-ccw.c     |  1 +
 hw/virtio/virtio-pci.c         |  3 ++
 hw/xen/xen-pvh-common.c        |  1 +
 hw/xenpv/xen_machine_pv.c      |  2 +-
 include/hw/boards.h            | 18 +++++++++-
 include/hw/i386/pc.h           |  5 ++-
 include/qom/object.h           | 24 +++++++++++++
 qapi/machine.json              |  9 ++++-
 qom/object.c                   | 40 +++++++++++++++++----
 system/qdev-monitor.c          | 10 ++++++
 system/vl.c                    |  6 ++--
 71 files changed, 275 insertions(+), 18 deletions(-)

-- 
2.50.1