[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v12 8/9] xsm: add platform QoS related xsm policies
Add xsm policies for QoS monitoring related hypercalls. Signed-off-by: Dongxiao Xu <dongxiao.xu@xxxxxxxxx> --- tools/flask/policy/policy/modules/xen/xen.if | 2 +- tools/flask/policy/policy/modules/xen/xen.te | 3 ++- xen/xsm/flask/hooks.c | 7 +++++++ xen/xsm/flask/policy/access_vectors | 4 ++++ 4 files changed, 14 insertions(+), 2 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index dedc035..5e7042c 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -49,7 +49,7 @@ define(`create_domain_common', ` getdomaininfo hypercall setvcpucontext setextvcpucontext getscheduler getvcpuinfo getvcpuextstate getaddrsize getaffinity setaffinity }; - allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn }; + allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn pqos_monitor_op }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op }; diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index 562b8df..fc3fdb2 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -66,6 +66,7 @@ allow dom0_t xen_t:xen { }; allow dom0_t xen_t:xen2 { resource_op + pqos_monitor_op }; allow dom0_t xen_t:mmu memorymap; @@ -79,7 +80,7 @@ allow dom0_t dom0_t:domain { getpodtarget setpodtarget set_misc_info set_virq_handler }; allow dom0_t dom0_t:domain2 { - set_cpuid gettsc settsc setscheduler set_max_evtchn + set_cpuid gettsc settsc setscheduler set_max_evtchn pqos_monitor_op }; allow dom0_t dom0_t:resource { add remove }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index fcfed25..7d3fb52 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -715,6 +715,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_cacheflush: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__CACHEFLUSH); + case XEN_DOMCTL_pqos_monitor_op: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PQOS_MONITOR_OP); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; @@ -770,6 +773,10 @@ static int flask_sysctl(int cmd) case XEN_SYSCTL_numainfo: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_pqos_monitor_op: + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, + XEN2__PQOS_MONITOR_OP, NULL); + default: printk("flask_sysctl: Unknown op %d\n", cmd); return -EPERM; diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index b606441..fd71ac7 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -81,6 +81,8 @@ class xen2 { # XENPF_resource_op resource_op +# XEN_SYSCTL_pqos_monitor_op + pqos_monitor_op } # Classes domain and domain2 consist of operations that a domain performs on @@ -208,6 +210,8 @@ class domain2 cacheflush # Creation of the hardware domain when it is not dom0 create_hardware_domain +# XEN_DOMCTL_pqos_monitor_op + pqos_monitor_op } # Similar to class domain, but primarily contains domctls related to HVM domains -- 1.7.9.5 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |