[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v9 08/13] xsm: add CAT related xsm policies
Add xsm policies for Cache Allocation Technology(CAT) related hypercalls to restrict the functions visibility to control domain only. Signed-off-by: Chao Peng <chao.p.peng@xxxxxxxxxxxxxxx> Acked-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx> --- tools/flask/policy/policy/modules/xen/xen.if | 2 +- tools/flask/policy/policy/modules/xen/xen.te | 4 +++- xen/xsm/flask/hooks.c | 6 ++++++ xen/xsm/flask/policy/access_vectors | 4 ++++ 4 files changed, 14 insertions(+), 2 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index 620d151..aa5eb72 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -51,7 +51,7 @@ define(`create_domain_common', ` getaffinity setaffinity setvcpuextstate }; allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo cacheflush - psr_cmt_op }; + psr_cmt_op psr_cat_op }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index ce70639..c9ecbc4 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -67,6 +67,7 @@ allow dom0_t xen_t:xen { allow dom0_t xen_t:xen2 { resource_op psr_cmt_op + psr_cat_op }; allow dom0_t xen_t:mmu memorymap; @@ -80,7 +81,8 @@ allow dom0_t dom0_t:domain { getpodtarget setpodtarget set_misc_info set_virq_handler }; allow dom0_t dom0_t:domain2 { - set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo get_vnumainfo psr_cmt_op + set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo + get_vnumainfo psr_cmt_op psr_cat_op }; allow dom0_t dom0_t:resource { add remove }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6e37d29..317f50f 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -735,6 +735,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_psr_cmt_op: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CMT_OP); + case XEN_DOMCTL_psr_cat_op: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CAT_OP); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; @@ -794,6 +797,9 @@ static int flask_sysctl(int cmd) case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); + case XEN_SYSCTL_psr_cat_op: + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, + XEN2__PSR_CAT_OP, NULL); default: printk("flask_sysctl: Unknown op %d\n", cmd); diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 68284d5..e1a11b2 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -85,6 +85,8 @@ class xen2 resource_op # XEN_SYSCTL_psr_cmt_op psr_cmt_op +# XEN_SYSCTL_psr_cat_op + psr_cat_op } # Classes domain and domain2 consist of operations that a domain performs on @@ -230,6 +232,8 @@ class domain2 mem_paging # XENMEM_sharing_op mem_sharing +# XEN_DOMCTL_psr_cat_op + psr_cat_op } # Similar to class domain, but primarily contains domctls related to HVM domains -- 1.9.1 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |