Re: [Xen-devel] [PATCH v11 8/9] xsm: add platform QoS related xsm policies

[Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>]

On 06/20/2014 10:31 AM, Dongxiao Xu wrote:
> Add xsm policies for QoS monitoring related hypercalls.
>
> Signed-off-by: Dongxiao Xu <dongxiao.xu@xxxxxxxxx>
The XEN_DOMCTL_pqos_monitor_op case was not actually handled in this
patch.

> ---
>   tools/flask/policy/policy/modules/xen/xen.if | 2 +-
>   tools/flask/policy/policy/modules/xen/xen.te | 3 ++-
>   xen/xsm/flask/hooks.c                        | 4 ++++
>   xen/xsm/flask/policy/access_vectors          | 4 ++++
>   4 files changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/tools/flask/policy/policy/modules/xen/xen.if 
> b/tools/flask/policy/policy/modules/xen/xen.if
> index dedc035..5e7042c 100644
> --- a/tools/flask/policy/policy/modules/xen/xen.if
> +++ b/tools/flask/policy/policy/modules/xen/xen.if
> @@ -49,7 +49,7 @@ define(`create_domain_common', `
>                         getdomaininfo hypercall setvcpucontext setextvcpucontext
>                         getscheduler getvcpuinfo getvcpuextstate getaddrsize
>                         getaffinity setaffinity };
> -       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim  
> set_max_evtchn };
> +       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim 
> set_max_evtchn pqos_monitor_op };
>         allow $1 $2:security check_context;
>         allow $1 $2:shadow enable;
>         allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage 
> mmuext_op };
> diff --git a/tools/flask/policy/policy/modules/xen/xen.te 
> b/tools/flask/policy/policy/modules/xen/xen.te
> index 0e63e76..41d1995 100644
> --- a/tools/flask/policy/policy/modules/xen/xen.te
> +++ b/tools/flask/policy/policy/modules/xen/xen.te
> @@ -66,6 +66,7 @@ allow dom0_t xen_t:xen {
>   };
>   allow dom0_t xen_t:xen2 {
>       msr_op
> +    pqos_monitor_op
>   };
>   allow dom0_t xen_t:mmu memorymap;
>
> @@ -79,7 +80,7 @@ allow dom0_t dom0_t:domain {
>         getpodtarget setpodtarget set_misc_info set_virq_handler
>   };
>   allow dom0_t dom0_t:domain2 {
> -       set_cpuid gettsc settsc setscheduler set_max_evtchn
> +       set_cpuid gettsc settsc setscheduler set_max_evtchn pqos_monitor_op
>   };
>   allow dom0_t dom0_t:resource { add remove };
>
> diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
> index 277a5de..97dc1a3 100644
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -773,6 +773,10 @@ static int flask_sysctl(int cmd)
>       case XEN_SYSCTL_msr_op:
>           return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
>                                       XEN2__MSR_OP, NULL);
> +
> +    case XEN_SYSCTL_pqos_monitor_op:
> +        return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
> +                                    XEN2__PQOS_MONITOR_OP, NULL);
>
>       default:
>           printk("flask_sysctl: Unknown op %d\n", cmd);
> diff --git a/xen/xsm/flask/policy/access_vectors 
> b/xen/xsm/flask/policy/access_vectors
> index 82b5484..d573eea 100644
> --- a/xen/xsm/flask/policy/access_vectors
> +++ b/xen/xsm/flask/policy/access_vectors
> @@ -81,6 +81,8 @@ class xen2
>   {
>   # XEN_SYSCTL_msr_op
>       msr_op
> +# XEN_SYSCTL_pqos_monitor_op
> +    pqos_monitor_op
>   }
>
>   # Classes domain and domain2 consist of operations that a domain performs on
> @@ -208,6 +210,8 @@ class domain2
>       cacheflush
>   # Creation of the hardware domain when it is not dom0
>       create_hardware_domain
> +# XEN_DOMCTL_pqos_monitor_op
> +    pqos_monitor_op
>   }
>
>   # Similar to class domain, but primarily contains domctls related to HVM 
> domains

--
Daniel De Graaf
National Security Agency

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel