kernel: StoragePermissions: add "kerneluser" storage access #3470
Conversation
|
I should have referenced #3457. |
kernel/src/storage_permissions.rs
Outdated
| if self.superuser { | ||
| // Superuser grants all permissions. | ||
| true |
There was a problem hiding this comment.
I have a few thoughts about this.
Obviously the kernel can do anything, it has direct access to the flash. But I think it would make more sense to allow apps to specify if the kernel can access their files. Accesses happen from capsules, which are only semi-trusted in Tock. That allows applications to apply some restrictions on what the kernel can/can't do.
I also worry about having a single branch instruction to allow/disallow access like this. Doesn't that expose us to glitch attacks? In saying that though, I'm not sure if anything else here is hardened against attacks like that.
I think it would be better to make the kernel ID 0x00 a user, the same as all other users. That way apps can choose to share data with the kernel or not.
There was a problem hiding this comment.
That seems reasonable to me. I think my current use case doesn't need superuser permissions, just having reserved kernel storage is sufficient. Updated.
no superuser
Pull Request Overview
This pull request adds a mechanism for the kernel to have special access to its items on a board, and to use a storage platform shared with processes while keeping keys reserved for itself. This should allow us to use TicKV in the kernel.
Since the TBF definition already effectively reserved write_id 0 to mean "this process cannot write items" this PR uses write_id 0 for the kernel. This also formalizes that 0 means no writing by saving
write_idas anOption<NonZeroU32>.To give the kernel access I added a
kerneluserflag to theStoragePermission. It allows the kernel to access items with write_id 0.To create a kernel level
StoragePermissionI added a capability (KerneluserStorageCapability) and then made the constructor protected on that capability.Testing Strategy
This pull request was tested by compiling. The changes are largely mechanical.
TODO or Help Wanted
Thoughts on reserving 0 for the kernel?
Documentation Updated
/docs, or no updates are required.The TBF doc already reserves the write id 0, so I didn't need to update anything.
Formatting
make prepush.