[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH for-4.5] flask/policy: Example policy updates for migration
The example XSM policy was missing permission for dom0_t to migrate domains; add these permissions. Reported-by: Wei Liu <wei.liu2@xxxxxxxxxx> Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx> --- This has been tested with xl save/restore on a PV domain, which now succeeds without producing AVC denials. tools/flask/policy/policy/modules/xen/xen.if | 11 +++++++---- tools/flask/policy/policy/modules/xen/xen.te | 3 +++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index fa69c9d..bf5e135 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -48,11 +48,13 @@ define(`create_domain_common', ` allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize getdomaininfo hypercall setvcpucontext setextvcpucontext getscheduler getvcpuinfo getvcpuextstate getaddrsize - getaffinity setaffinity }; - allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo psr_cmt_op configure_domain }; + getaffinity setaffinity setvcpuextstate }; + allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim + set_max_evtchn set_vnumainfo get_vnumainfo cacheflush + psr_cmt_op configure_domain }; allow $1 $2:security check_context; allow $1 $2:shadow enable; - allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op }; + allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; allow $1 $2:grant setup; allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc setparam pcilevel trackdirtyvram nested }; @@ -80,7 +82,7 @@ define(`create_domain_build_label', ` define(`manage_domain', ` allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy - setaffinity setdomainmaxmem getscheduler }; + setaffinity setdomainmaxmem getscheduler resume }; allow $1 $2:domain2 set_vnumainfo; ') @@ -88,6 +90,7 @@ define(`manage_domain', ` # Allow creation of a snapshot or migration image from a domain # (inbound migration is the same as domain creation) define(`migrate_domain_out', ` + allow $1 domxen_t:mmu map_read; allow $1 $2:hvm { gethvmc getparam irqlevel }; allow $1 $2:mmu { stat pageinfo map_read }; allow $1 $2:domain { getaddrsize getvcpucontext getextvcpucontext getvcpuextstate pause destroy }; diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index d214470..c0128aa 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -129,12 +129,14 @@ create_domain(dom0_t, domU_t) manage_domain(dom0_t, domU_t) domain_comms(dom0_t, domU_t) domain_comms(domU_t, domU_t) +migrate_domain_out(dom0_t, domU_t) domain_self_comms(domU_t) declare_domain(isolated_domU_t) create_domain(dom0_t, isolated_domU_t) manage_domain(dom0_t, isolated_domU_t) domain_comms(dom0_t, isolated_domU_t) +migrate_domain_out(dom0_t, isolated_domU_t) domain_self_comms(isolated_domU_t) # Declare a boolean that denies creation of prot_domU_t domains @@ -142,6 +144,7 @@ gen_bool(prot_doms_locked, false) declare_domain(prot_domU_t) if (!prot_doms_locked) { create_domain(dom0_t, prot_domU_t) + migrate_domain_out(dom0_t, prot_domU_t) } domain_comms(dom0_t, prot_domU_t) domain_comms(domU_t, prot_domU_t) -- 1.9.3 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |