Re: [Xen-devel] [PATCH for-4.5] flask/policy: Example policy updates for migration

[Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>]

On Mon, Dec 08, 2014 at 03:54:06PM +0000, Ian Campbell wrote:
> On Mon, 2014-12-08 at 10:52 -0500, Konrad Rzeszutek Wilk wrote:
> > On Mon, Dec 08, 2014 at 09:48:07AM +0000, Ian Campbell wrote:
> > > On Fri, 2014-12-05 at 12:03 -0500, Daniel De Graaf wrote:
> > > > The example XSM policy was missing permission for dom0_t to migrate
> > > > domains; add these permissions.
> > > > 
> > > > Reported-by: Wei Liu <wei.liu2@xxxxxxxxxx>
> > > > Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
> > > 
> > > Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
> > > 
> > > Konrad, we should take this for 4.5, in order to have a working example
> > > XSM policy. There's 0 risk to non-XSM systems, or systems with custom
> > 
> > Thought this looks like it never worked in the past then? As in, this
> > is not a regression but a bug that had existed for quite a while?
> 
> AIUI it has worked in the past, i.e. I remember applying other series
> from Daniel to fix it for previous releases. This patch is the policy
> catching up with the developments during 4.5.

OK then definilty RElease-Acked-by: Konrad Rzeszutek Wilk 
<konrad.wilk@xxxxxxxxxx>

Thanks!
> 
> > 
> > > XSM policies and clear benefits to XSM systems using the example policy.
> > > 
> > > > ---
> > > > 
> > > > This has been tested with xl save/restore on a PV domain, which now
> > > > succeeds without producing AVC denials.
> > > > 
> > > >  tools/flask/policy/policy/modules/xen/xen.if | 11 +++++++----
> > > >  tools/flask/policy/policy/modules/xen/xen.te |  3 +++
> > > >  2 files changed, 10 insertions(+), 4 deletions(-)
> > > > 
> > > > diff --git a/tools/flask/policy/policy/modules/xen/xen.if 
> > > > b/tools/flask/policy/policy/modules/xen/xen.if
> > > > index fa69c9d..bf5e135 100644
> > > > --- a/tools/flask/policy/policy/modules/xen/xen.if
> > > > +++ b/tools/flask/policy/policy/modules/xen/xen.if
> > > > @@ -48,11 +48,13 @@ define(`create_domain_common', `
> > > >         allow $1 $2:domain { create max_vcpus setdomainmaxmem 
> > > > setaddrsize
> > > >                         getdomaininfo hypercall setvcpucontext 
> > > > setextvcpucontext
> > > >                         getscheduler getvcpuinfo getvcpuextstate 
> > > > getaddrsize
> > > > -                       getaffinity setaffinity };
> > > > -       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim 
> > > > set_max_evtchn set_vnumainfo get_vnumainfo psr_cmt_op configure_domain 
> > > > };
> > > > +                       getaffinity setaffinity setvcpuextstate };
> > > > +       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
> > > > +                       set_max_evtchn set_vnumainfo get_vnumainfo 
> > > > cacheflush
> > > > +                       psr_cmt_op configure_domain };
> > > >         allow $1 $2:security check_context;
> > > >         allow $1 $2:shadow enable;
> > > > -       allow $1 $2:mmu { map_read map_write adjust memorymap physmap 
> > > > pinpage mmuext_op };
> > > > +       allow $1 $2:mmu { map_read map_write adjust memorymap physmap 
> > > > pinpage mmuext_op updatemp };
> > > >         allow $1 $2:grant setup;
> > > >         allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute 
> > > > sethvmc
> > > >                         setparam pcilevel trackdirtyvram nested };
> > > > @@ -80,7 +82,7 @@ define(`create_domain_build_label', `
> > > >  define(`manage_domain', `
> > > >         allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity
> > > >                         getaddrsize pause unpause trigger shutdown 
> > > > destroy
> > > > -                       setaffinity setdomainmaxmem getscheduler };
> > > > +                       setaffinity setdomainmaxmem getscheduler resume 
> > > > };
> > > >      allow $1 $2:domain2 set_vnumainfo;
> > > >  ')
> > > >  
> > > > @@ -88,6 +90,7 @@ define(`manage_domain', `
> > > >  #   Allow creation of a snapshot or migration image from a domain
> > > >  #   (inbound migration is the same as domain creation)
> > > >  define(`migrate_domain_out', `
> > > > +       allow $1 domxen_t:mmu map_read;
> > > >         allow $1 $2:hvm { gethvmc getparam irqlevel };
> > > >         allow $1 $2:mmu { stat pageinfo map_read };
> > > >         allow $1 $2:domain { getaddrsize getvcpucontext 
> > > > getextvcpucontext getvcpuextstate pause destroy };
> > > > diff --git a/tools/flask/policy/policy/modules/xen/xen.te 
> > > > b/tools/flask/policy/policy/modules/xen/xen.te
> > > > index d214470..c0128aa 100644
> > > > --- a/tools/flask/policy/policy/modules/xen/xen.te
> > > > +++ b/tools/flask/policy/policy/modules/xen/xen.te
> > > > @@ -129,12 +129,14 @@ create_domain(dom0_t, domU_t)
> > > >  manage_domain(dom0_t, domU_t)
> > > >  domain_comms(dom0_t, domU_t)
> > > >  domain_comms(domU_t, domU_t)
> > > > +migrate_domain_out(dom0_t, domU_t)
> > > >  domain_self_comms(domU_t)
> > > >  
> > > >  declare_domain(isolated_domU_t)
> > > >  create_domain(dom0_t, isolated_domU_t)
> > > >  manage_domain(dom0_t, isolated_domU_t)
> > > >  domain_comms(dom0_t, isolated_domU_t)
> > > > +migrate_domain_out(dom0_t, isolated_domU_t)
> > > >  domain_self_comms(isolated_domU_t)
> > > >  
> > > >  # Declare a boolean that denies creation of prot_domU_t domains
> > > > @@ -142,6 +144,7 @@ gen_bool(prot_doms_locked, false)
> > > >  declare_domain(prot_domU_t)
> > > >  if (!prot_doms_locked) {
> > > >         create_domain(dom0_t, prot_domU_t)
> > > > +       migrate_domain_out(dom0_t, prot_domU_t)
> > > >  }
> > > >  domain_comms(dom0_t, prot_domU_t)
> > > >  domain_comms(domU_t, prot_domU_t)
> > > 
> > > 
> 
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel