[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH 12/23] xsm/flask: add missing hooks



The FLASK module was missing implementations of some hooks and did not
have access vectors defined for 10 domctls; define these now.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
---
 tools/flask/policy/policy/flask/access_vectors |  5 ++
 tools/flask/policy/policy/modules/xen/xen.if   |  4 +-
 xen/xsm/flask/hooks.c                          | 66 +++++++++++++++++++++-----
 xen/xsm/flask/include/av_perm_to_string.h      |  5 ++
 xen/xsm/flask/include/av_permissions.h         |  5 ++
 5 files changed, 73 insertions(+), 12 deletions(-)

diff --git a/tools/flask/policy/policy/flask/access_vectors 
b/tools/flask/policy/policy/flask/access_vectors
index 11d02da..ea65e45 100644
--- a/tools/flask/policy/policy/flask/access_vectors
+++ b/tools/flask/policy/policy/flask/access_vectors
@@ -80,6 +80,9 @@ class domain2
        relabelself
        make_priv_for
        set_as_target
+       set_cpuid
+       gettsc
+       settsc
 }
 
 class hvm
@@ -97,6 +100,8 @@ class hvm
     hvmctl
     mem_event
     mem_sharing
+    audit_p2m
+    send_irq
 }
 
 class event
diff --git a/tools/flask/policy/policy/modules/xen/xen.if 
b/tools/flask/policy/policy/modules/xen/xen.if
index 2ad11b2..59ba171 100644
--- a/tools/flask/policy/policy/modules/xen/xen.if
+++ b/tools/flask/policy/policy/modules/xen/xen.if
@@ -29,6 +29,7 @@ define(`create_domain_common', `
                        getdomaininfo hypercall setvcpucontext setextvcpucontext
                        scheduler getvcpuinfo getvcpuextstate getaddrsize
                        getvcpuaffinity setvcpuaffinity };
+       allow $1 $2:domain2 { set_cpuid settsc };
        allow $1 $2:security check_context;
        allow $1 $2:shadow enable;
        allow $1 $2:mmu {map_read map_write adjust memorymap physmap pinpage};
@@ -67,6 +68,7 @@ define(`migrate_domain_out', `
        allow $1 $2:hvm { gethvmc getparam irqlevel };
        allow $1 $2:mmu { stat pageinfo map_read };
        allow $1 $2:domain { getaddrsize getvcpucontext getextvcpucontext 
getvcpuextstate pause destroy };
+       allow $1 $2:domain2 gettsc;
 ')
 
 
################################################################################
@@ -112,7 +114,7 @@ define(`device_model', `
        domain_comms($1, $2)
        allow $1 $2:domain { set_target shutdown };
        allow $1 $2:mmu { map_read map_write adjust physmap };
-       allow $1 $2:hvm { getparam setparam trackdirtyvram hvmctl irqlevel 
pciroute };
+       allow $1 $2:hvm { getparam setparam trackdirtyvram hvmctl irqlevel 
pciroute cacheattr send_irq };
 ')
 
################################################################################
 #
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index e25dd1c..dbbf34f 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -650,25 +650,32 @@ static int flask_domctl(struct domain *d, int cmd)
 #endif
         return 0;
 
+    case XEN_DOMCTL_debug_op:
+    case XEN_DOMCTL_gdbsx_guestmemio:
+    case XEN_DOMCTL_gdbsx_pausevcpu:
+    case XEN_DOMCTL_gdbsx_unpausevcpu:
+    case XEN_DOMCTL_gdbsx_domstatus:
+        return domain_has_perm(current->domain, d, SECCLASS_DOMAIN,
+                               DOMAIN__SETDEBUGGING);
+
     case XEN_DOMCTL_subscribe:
     case XEN_DOMCTL_disable_migrate:
+    case XEN_DOMCTL_suppress_spurious_page_faults:
         return domain_has_perm(current->domain, d, SECCLASS_DOMAIN,
                                DOMAIN__SET_MISC_INFO);
 
     case XEN_DOMCTL_set_cpuid:
-    case XEN_DOMCTL_suppress_spurious_page_faults:
-    case XEN_DOMCTL_debug_op:
+        return domain_has_perm(current->domain, d, SECCLASS_DOMAIN2, 
DOMAIN2__SET_CPUID);
+
     case XEN_DOMCTL_gettscinfo:
+        return domain_has_perm(current->domain, d, SECCLASS_DOMAIN2, 
DOMAIN2__GETTSC);
+
     case XEN_DOMCTL_settscinfo:
+        return domain_has_perm(current->domain, d, SECCLASS_DOMAIN2, 
DOMAIN2__SETTSC);
+
     case XEN_DOMCTL_audit_p2m:
-    case XEN_DOMCTL_gdbsx_guestmemio:
-    case XEN_DOMCTL_gdbsx_pausevcpu:
-    case XEN_DOMCTL_gdbsx_unpausevcpu:
-    case XEN_DOMCTL_gdbsx_domstatus:
-        /* TODO add per-subfunction hooks */
-        if ( !IS_PRIV(current->domain) )
-            return -EPERM;
-        return 0;
+        return domain_has_perm(current->domain, d, SECCLASS_HVM, 
HVM__AUDIT_P2M);
+
     default:
         printk("flask_domctl: Unknown op %d\n", cmd);
         return -EPERM;
@@ -921,6 +928,11 @@ static int flask_iomem_permission(struct domain *d, 
uint64_t start, uint64_t end
     return security_iterate_iomem_sids(start, end, _iomem_has_perm, &data);
 }
 
+static int flask_iomem_mapping(struct domain *d, uint64_t start, uint64_t end, 
uint8_t access)
+{
+    return flask_iomem_permission(d, start, end, access);
+}
+
 static int flask_pci_config_permission(struct domain *d, uint32_t machine_bdf, 
uint16_t start, uint16_t end, uint8_t access)
 {
     u32 rsid;
@@ -1128,7 +1140,6 @@ static int _ioport_has_perm(void *v, u32 sid, unsigned 
long start, unsigned long
     return avc_has_perm(data->tsec->sid, sid, SECCLASS_RESOURCE, 
RESOURCE__USE, &ad);
 }
 
-
 static int flask_ioport_permission(struct domain *d, uint32_t start, uint32_t 
end, uint8_t access)
 {
     int rc;
@@ -1151,6 +1162,11 @@ static int flask_ioport_permission(struct domain *d, 
uint32_t start, uint32_t en
     return security_iterate_ioport_sids(start, end, _ioport_has_perm, &data);
 }
 
+static int flask_ioport_mapping(struct domain *d, uint32_t start, uint32_t 
end, uint8_t access)
+{
+    return flask_ioport_permission(d, start, end, access);
+}
+
 static int flask_getpageframeinfo(struct domain *d)
 {
     return domain_has_perm(current->domain, d, SECCLASS_MMU, MMU__PAGEINFO);
@@ -1209,6 +1225,25 @@ static int flask_address_size(struct domain *d, uint32_t 
cmd)
     return domain_has_perm(current->domain, d, SECCLASS_DOMAIN, perm);
 }
 
+static int flask_machine_address_size(struct domain *d, uint32_t cmd)
+{
+    u32 perm;
+
+    switch ( cmd )
+    {
+    case XEN_DOMCTL_set_machine_address_size:
+        perm = DOMAIN__SETADDRSIZE;
+        break;
+    case XEN_DOMCTL_get_machine_address_size:
+        perm = DOMAIN__GETADDRSIZE;
+        break;
+    default:
+        return -EPERM;
+    }
+
+    return domain_has_perm(current->domain, d, SECCLASS_DOMAIN, perm);
+}
+
 static int flask_hvm_param(struct domain *d, unsigned long op)
 {
     u32 perm;
@@ -1246,6 +1281,11 @@ static int flask_hvm_set_pci_link_route(struct domain *d)
     return domain_has_perm(current->domain, d, SECCLASS_HVM, HVM__PCIROUTE);
 }
 
+static int flask_hvm_inject_msi(struct domain *d)
+{
+    return domain_has_perm(current->domain, d, SECCLASS_HVM, HVM__SEND_IRQ);
+}
+
 static int flask_mem_event(struct domain *d)
 {
     return domain_has_perm(current->domain, d, SECCLASS_HVM, HVM__MEM_EVENT);
@@ -1689,6 +1729,7 @@ static struct xsm_operations flask_ops = {
     .unmap_domain_pirq = flask_unmap_domain_pirq,
     .irq_permission = flask_irq_permission,
     .iomem_permission = flask_iomem_permission,
+    .iomem_mapping = flask_iomem_mapping,
     .pci_config_permission = flask_pci_config_permission,
 
     .resource_plug_core = flask_resource_plug_core,
@@ -1713,10 +1754,12 @@ static struct xsm_operations flask_ops = {
     .hypercall_init = flask_hypercall_init,
     .hvmcontext = flask_hvmcontext,
     .address_size = flask_address_size,
+    .machine_address_size = flask_machine_address_size,
     .hvm_param = flask_hvm_param,
     .hvm_set_pci_intx_level = flask_hvm_set_pci_intx_level,
     .hvm_set_isa_irq_level = flask_hvm_set_isa_irq_level,
     .hvm_set_pci_link_route = flask_hvm_set_pci_link_route,
+    .hvm_inject_msi = flask_hvm_inject_msi,
     .mem_event = flask_mem_event,
     .mem_sharing = flask_mem_sharing,
     .apic = flask_apic,
@@ -1749,6 +1792,7 @@ static struct xsm_operations flask_ops = {
     .ext_vcpucontext = flask_ext_vcpucontext,
     .vcpuextstate = flask_vcpuextstate,
     .ioport_permission = flask_ioport_permission,
+    .ioport_mapping = flask_ioport_mapping,
 #endif
 };
 
diff --git a/xen/xsm/flask/include/av_perm_to_string.h 
b/xen/xsm/flask/include/av_perm_to_string.h
index 10f8e80..894910c 100644
--- a/xen/xsm/flask/include/av_perm_to_string.h
+++ b/xen/xsm/flask/include/av_perm_to_string.h
@@ -66,6 +66,9 @@
    S_(SECCLASS_DOMAIN2, DOMAIN2__RELABELSELF, "relabelself")
    S_(SECCLASS_DOMAIN2, DOMAIN2__MAKE_PRIV_FOR, "make_priv_for")
    S_(SECCLASS_DOMAIN2, DOMAIN2__SET_AS_TARGET, "set_as_target")
+   S_(SECCLASS_DOMAIN2, DOMAIN2__SET_CPUID, "set_cpuid")
+   S_(SECCLASS_DOMAIN2, DOMAIN2__GETTSC, "gettsc")
+   S_(SECCLASS_DOMAIN2, DOMAIN2__SETTSC, "settsc")
    S_(SECCLASS_HVM, HVM__SETHVMC, "sethvmc")
    S_(SECCLASS_HVM, HVM__GETHVMC, "gethvmc")
    S_(SECCLASS_HVM, HVM__SETPARAM, "setparam")
@@ -79,6 +82,8 @@
    S_(SECCLASS_HVM, HVM__HVMCTL, "hvmctl")
    S_(SECCLASS_HVM, HVM__MEM_EVENT, "mem_event")
    S_(SECCLASS_HVM, HVM__MEM_SHARING, "mem_sharing")
+   S_(SECCLASS_HVM, HVM__AUDIT_P2M, "audit_p2m")
+   S_(SECCLASS_HVM, HVM__SEND_IRQ, "send_irq")
    S_(SECCLASS_EVENT, EVENT__BIND, "bind")
    S_(SECCLASS_EVENT, EVENT__SEND, "send")
    S_(SECCLASS_EVENT, EVENT__STATUS, "status")
diff --git a/xen/xsm/flask/include/av_permissions.h 
b/xen/xsm/flask/include/av_permissions.h
index f7cfee1..1bdb515 100644
--- a/xen/xsm/flask/include/av_permissions.h
+++ b/xen/xsm/flask/include/av_permissions.h
@@ -68,6 +68,9 @@
 #define DOMAIN2__RELABELSELF                      0x00000004UL
 #define DOMAIN2__MAKE_PRIV_FOR                    0x00000008UL
 #define DOMAIN2__SET_AS_TARGET                    0x00000010UL
+#define DOMAIN2__SET_CPUID                        0x00000020UL
+#define DOMAIN2__GETTSC                           0x00000040UL
+#define DOMAIN2__SETTSC                           0x00000080UL
 
 #define HVM__SETHVMC                              0x00000001UL
 #define HVM__GETHVMC                              0x00000002UL
@@ -82,6 +85,8 @@
 #define HVM__HVMCTL                               0x00000400UL
 #define HVM__MEM_EVENT                            0x00000800UL
 #define HVM__MEM_SHARING                          0x00001000UL
+#define HVM__AUDIT_P2M                            0x00002000UL
+#define HVM__SEND_IRQ                             0x00004000UL
 
 #define EVENT__BIND                               0x00000001UL
 #define EVENT__SEND                               0x00000002UL
-- 
1.7.11.7


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.