[Xen-changelog] [xen-unstable] xsm/flask: report memory and IO ranges in audit messages

[Xen patchbot-unstable <patchbot@xxxxxxx>]

# HG changeset patch
# User Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
# Date 1324218746 0
# Node ID 3a27ab1ba08c7bf3d8377ce97a5fceb86dc1b23a
# Parent  a854e1660c477c08d31410c50f9dce629805ef30
xsm/flask: report memory and IO ranges in audit messages

This information is useful when determining the cause of an AVC denial
caused by missing label on device memory or IRQs.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
---


diff -r a854e1660c47 -r 3a27ab1ba08c xen/xsm/flask/avc.c
--- a/xen/xsm/flask/avc.c       Sun Dec 18 14:32:06 2011 +0000
+++ b/xen/xsm/flask/avc.c       Sun Dec 18 14:32:26 2011 +0000
@@ -568,8 +568,17 @@
         d = a->d;
     if ( d )
         printk("domid=%d ", d->domain_id);
-    if ( a && a->device )
+    switch ( a ? a->type : 0 ) {
+    case AVC_AUDIT_DATA_DEV:
         printk("device=0x%lx ", a->device);
+        break;
+    case AVC_AUDIT_DATA_IRQ:
+        printk("irq=%d ", a->irq);
+        break;
+    case AVC_AUDIT_DATA_RANGE:
+        printk("range=0x%lx-0x%lx ", a->range.start, a->range.end);
+        break;
+    }
 
     avc_dump_query(ssid, tsid, tclass);
     printk("\n");
diff -r a854e1660c47 -r 3a27ab1ba08c xen/xsm/flask/hooks.c
--- a/xen/xsm/flask/hooks.c     Sun Dec 18 14:32:06 2011 +0000
+++ b/xen/xsm/flask/hooks.c     Sun Dec 18 14:32:26 2011 +0000
@@ -670,8 +670,8 @@
     if ( rc )
         return rc;
 
-    AVC_AUDIT_DATA_INIT(&ad, DEV);
-    ad.device = (unsigned long) pirq;
+    AVC_AUDIT_DATA_INIT(&ad, IRQ);
+    ad.irq = pirq;
 
     rc = avc_has_perm(ssec->sid, rsid, SECCLASS_RESOURCE, perm, &ad);
     if ( rc )
@@ -694,8 +694,9 @@
     struct avc_audit_data ad;
     int rc = -EPERM;
 
-    AVC_AUDIT_DATA_INIT(&ad, DEV);
-    ad.device = start;
+    AVC_AUDIT_DATA_INIT(&ad, RANGE);
+    ad.range.start = start;
+    ad.range.end = end;
 
     rc = avc_has_perm(data->ssec->sid, sid, SECCLASS_RESOURCE, data->perm, 
&ad);
 
@@ -771,8 +772,9 @@
     struct avc_audit_data ad;
     int rc;
 
-    AVC_AUDIT_DATA_INIT(&ad, DEV);
-    ad.device = start;
+    AVC_AUDIT_DATA_INIT(&ad, RANGE);
+    ad.range.start = start;
+    ad.range.end = end;
 
     rc = avc_has_perm(data->ssec->sid, sid, SECCLASS_RESOURCE, data->perm, 
&ad);
 
@@ -1155,8 +1157,8 @@
     if ( rc )
         return rc;
 
-    AVC_AUDIT_DATA_INIT(&ad, DEV);
-    ad.device = (unsigned long)irq;
+    AVC_AUDIT_DATA_INIT(&ad, IRQ);
+    ad.irq = irq;
 
     ssec = current->domain->ssid;
     rc = avc_has_perm(ssec->sid, rsid, SECCLASS_HVM, HVM__BIND_IRQ, &ad);
diff -r a854e1660c47 -r 3a27ab1ba08c xen/xsm/flask/include/avc.h
--- a/xen/xsm/flask/include/avc.h       Sun Dec 18 14:32:06 2011 +0000
+++ b/xen/xsm/flask/include/avc.h       Sun Dec 18 14:32:26 2011 +0000
@@ -38,9 +38,18 @@
 /* Auxiliary data to use in generating the audit record. */
 struct avc_audit_data {
     char    type;
-#define AVC_AUDIT_DATA_DEV  1
+#define AVC_AUDIT_DATA_DEV   1
+#define AVC_AUDIT_DATA_IRQ   2
+#define AVC_AUDIT_DATA_RANGE 3
     struct domain *d;
-    unsigned long device;
+    union {
+        unsigned long device;
+        int irq;
+        struct {
+            unsigned long start;
+            unsigned long end;
+        } range;
+    };
 };
 
 #define v4info fam.v4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog