[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v4 9/9] xsm: add XEN_DOMCTL_devour support
Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx> --- xen/common/domctl.c | 6 ++++++ xen/include/xsm/dummy.h | 6 ++++++ xen/include/xsm/xsm.h | 6 ++++++ xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 17 +++++++++++++++++ xen/xsm/flask/policy/access_vectors | 10 ++++++++++ 6 files changed, 46 insertions(+) diff --git a/xen/common/domctl.c b/xen/common/domctl.c index 7e7fb47..7c22e35 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -1190,6 +1190,12 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) break; } + ret = xsm_devour(XSM_HOOK, d, recipient_dom); + if ( ret ) { + put_domain(recipient_dom); + break; + } + if ( recipient_dom->tot_pages != 0 ) { put_domain(recipient_dom); diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index f20e89c..6e9e38b 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -113,6 +113,12 @@ static XSM_INLINE int xsm_set_target(XSM_DEFAULT_ARG struct domain *d, struct do return xsm_default_action(action, current->domain, NULL); } +static XSM_INLINE int xsm_devour(XSM_DEFAULT_ARG struct domain *d, struct domain *e) +{ + XSM_ASSERT_ACTION(XSM_HOOK); + return xsm_default_action(action, current->domain, NULL); +} + static XSM_INLINE int xsm_domctl(XSM_DEFAULT_ARG struct domain *d, int cmd) { XSM_ASSERT_ACTION(XSM_OTHER); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 4ce089f..7db7433 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -58,6 +58,7 @@ struct xsm_operations { int (*domctl_scheduler_op) (struct domain *d, int op); int (*sysctl_scheduler_op) (int op); int (*set_target) (struct domain *d, struct domain *e); + int (*devour) (struct domain *d, struct domain *e); int (*domctl) (struct domain *d, int cmd); int (*sysctl) (int cmd); int (*readconsole) (uint32_t clear); @@ -213,6 +214,11 @@ static inline int xsm_set_target (xsm_default_t def, struct domain *d, struct do return xsm_ops->set_target(d, e); } +static inline int xsm_devour (xsm_default_t def, struct domain *d, struct domain *r) +{ + return xsm_ops->devour(d, r); +} + static inline int xsm_domctl (xsm_default_t def, struct domain *d, int cmd) { return xsm_ops->domctl(d, cmd); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 8eb3050..f3c2f9e 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -35,6 +35,7 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, domctl_scheduler_op); set_to_dummy_if_null(ops, sysctl_scheduler_op); set_to_dummy_if_null(ops, set_target); + set_to_dummy_if_null(ops, devour); set_to_dummy_if_null(ops, domctl); set_to_dummy_if_null(ops, sysctl); set_to_dummy_if_null(ops, readconsole); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d48463f..097c8c2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -565,6 +565,21 @@ static int flask_set_target(struct domain *d, struct domain *t) return rc; } +static int flask_devour(struct domain *d, struct domain *r) +{ + int rc; + struct domain_security_struct *dsec, *rsec; + dsec = d->ssid; + rsec = r->ssid; + + rc = current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SET_AS_SOURCE); + if ( rc ) + return rc; + if ( r ) + rc = current_has_perm(r, SECCLASS_DOMAIN2, DOMAIN2__SET_AS_RECIPIENT); + return rc; +} + static int flask_domctl(struct domain *d, int cmd) { switch ( cmd ) @@ -580,6 +595,7 @@ static int flask_domctl(struct domain *d, int cmd) #ifdef HAS_MEM_ACCESS case XEN_DOMCTL_mem_event_op: #endif + case XEN_DOMCTL_devour: #ifdef CONFIG_X86 /* These have individual XSM hooks (arch/x86/domctl.c) */ case XEN_DOMCTL_shadow_op: @@ -1512,6 +1528,7 @@ static struct xsm_operations flask_ops = { .domctl_scheduler_op = flask_domctl_scheduler_op, .sysctl_scheduler_op = flask_sysctl_scheduler_op, .set_target = flask_set_target, + .devour = flask_devour, .domctl = flask_domctl, .sysctl = flask_sysctl, .readconsole = flask_readconsole, diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 1da9f63..64c3424 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -142,6 +142,8 @@ class domain # target = the new target domain # see also the domain2 make_priv_for and set_as_target checks set_target +# XEN_DOMCTL_devour + devour # SCHEDOP_remote_shutdown shutdown # XEN_DOMCTL_set{,_machine}_address_size @@ -196,6 +198,14 @@ class domain2 # source = the domain making the hypercall # target = the new target domain set_as_target +# checked in XEN_DOMCTL_devour: +# source = the domain making the hypercall +# target = the new source domain + set_as_source +# checked in XEN_DOMCTL_devour: +# source = the domain making the hypercall +# target = the new recipient domain + set_as_recipient # XEN_DOMCTL_set_cpuid set_cpuid # XEN_DOMCTL_gettscinfo -- 1.9.3 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |