Re: [Xen-devel] [PATCH 11/15] flask: improve unknown permission handling

[Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>]

On 06/17/2016 01:13 PM, Konrad Rzeszutek Wilk wrote:
> On Fri, Jun 17, 2016 at 01:02:58PM -0400, Daniel De Graaf wrote:
> > On 06/17/2016 11:45 AM, Konrad Rzeszutek Wilk wrote:
> > > On Thu, Jun 09, 2016 at 10:47:14AM -0400, Daniel De Graaf wrote:
> > > > When an unknown domctl, sysctl, or other operation is encountered in the
> > > > FLASK security server, use the allow_unknown bit in the security policy
> > > > to decide if the permission should be allowed or denied.  This bit is
> > > > off by default, but it can be set by using checkpolicy -U allow when
> > > > compiling the policy.  This allows new operations to be tested without
> > > > needing to immediately add security checks; however, it is not flexible
> > > > enough to avoid adding the actual permission checks.  An error message
> > > > is printed to the hypervisor console when this fallback is encountered.
> > > .. and the operation is permitted.
> > The error message is printed either way (with a different priority).  Were
> correct.
> > you suggesting I expand this explanation to include both the error and
> > warning messages separately?
> It just that the patch changes the behavior. That is in the past if
> you had created an policy using checkpolicy -U allow it would print an
> error and return -EPERM.
>
> But now it will print an error and return 0 and pass the XSM check
> (aka operation ends being permitted).
I would be surprised if someone actually used allow_unknown before now,
since it did nothing and required manually enabling.  But if they did,
this is a functionality change.  I'll add a note of that.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel