[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH 11/23] xen: convert do_sysctl to use XSM
The xsm_sysctl hook now covers every sysctl, in addition to the more fine-grained XSM hooks in most sub-functions. Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx> Cc: Keir Fraser <keir@xxxxxxx> Cc: Jan Beulich <jbeulich@xxxxxxxx> --- xen/common/sysctl.c | 7 ++++--- xen/include/xsm/dummy.h | 7 +++++++ xen/include/xsm/xsm.h | 6 ++++++ xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 33 +++++++++++++++++++++++++++++++++ 5 files changed, 51 insertions(+), 3 deletions(-) diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 47142f4..599430e 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -33,15 +33,16 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) struct xen_sysctl curop, *op = &curop; static DEFINE_SPINLOCK(sysctl_lock); - if ( !IS_PRIV(current->domain) ) - return -EPERM; - if ( copy_from_guest(op, u_sysctl, 1) ) return -EFAULT; if ( op->interface_version != XEN_SYSCTL_INTERFACE_VERSION ) return -EACCES; + ret = xsm_sysctl(op->cmd); + if ( ret ) + return ret; + /* * Trylock here avoids deadlock with an existing sysctl critical section * which might (for some current or future reason) want to synchronise diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 1c19e15..e42965c 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -106,6 +106,13 @@ static XSM_INLINE int xsm_domctl(struct domain *d, int cmd) return 0; } +static XSM_INLINE int xsm_sysctl(int cmd) +{ + if ( !IS_PRIV(current->domain) ) + return -EPERM; + return 0; +} + static XSM_INLINE int xsm_set_virq_handler(struct domain *d, uint32_t virq) { return 0; diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index d8bf4a0..470e3c0 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -58,6 +58,7 @@ struct xsm_operations { int (*domain_settime) (struct domain *d); int (*set_target) (struct domain *d, struct domain *e); int (*domctl) (struct domain *d, int cmd); + int (*sysctl) (int cmd); int (*set_virq_handler) (struct domain *d, uint32_t virq); int (*tbufcontrol) (void); int (*readconsole) (uint32_t clear); @@ -267,6 +268,11 @@ static inline int xsm_domctl (struct domain *d, int cmd) return xsm_ops->domctl(d, cmd); } +static inline int xsm_sysctl (int cmd) +{ + return xsm_ops->sysctl(cmd); +} + static inline int xsm_set_virq_handler (struct domain *d, uint32_t virq) { return xsm_ops->set_virq_handler(d, virq); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 578757f..1e7f42c 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -45,6 +45,7 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, domain_settime); set_to_dummy_if_null(ops, set_target); set_to_dummy_if_null(ops, domctl); + set_to_dummy_if_null(ops, sysctl); set_to_dummy_if_null(ops, set_virq_handler); set_to_dummy_if_null(ops, tbufcontrol); set_to_dummy_if_null(ops, readconsole); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2e002f0..e25dd1c 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -675,6 +675,38 @@ static int flask_domctl(struct domain *d, int cmd) } } +static int flask_sysctl(int cmd) +{ + switch ( cmd ) + { + /* These have individual XSM hooks */ + case XEN_SYSCTL_readconsole: + case XEN_SYSCTL_tbuf_op: + case XEN_SYSCTL_sched_id: + case XEN_SYSCTL_perfc_op: + case XEN_SYSCTL_getdomaininfolist: + case XEN_SYSCTL_debug_keys: + case XEN_SYSCTL_getcpuinfo: + case XEN_SYSCTL_availheap: + case XEN_SYSCTL_get_pmstat: + case XEN_SYSCTL_pm_op: + case XEN_SYSCTL_page_offline_op: + case XEN_SYSCTL_lockprof_op: + case XEN_SYSCTL_cpupool_op: + case XEN_SYSCTL_scheduler_op: +#ifdef CONFIG_X86 + case XEN_SYSCTL_physinfo: + case XEN_SYSCTL_cpu_hotplug: + case XEN_SYSCTL_topologyinfo: + case XEN_SYSCTL_numainfo: +#endif + return 0; + default: + printk("flask_sysctl: Unknown op %d\n", cmd); + return -EPERM; + } +} + static int flask_set_virq_handler(struct domain *d, uint32_t virq) { return domain_has_perm(current->domain, d, SECCLASS_DOMAIN, DOMAIN__SET_VIRQ_HANDLER); @@ -1601,6 +1633,7 @@ static struct xsm_operations flask_ops = { .domain_settime = flask_domain_settime, .set_target = flask_set_target, .domctl = flask_domctl, + .sysctl = flask_sysctl, .set_virq_handler = flask_set_virq_handler, .tbufcontrol = flask_tbufcontrol, .readconsole = flask_readconsole, -- 1.7.11.7 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |