Re: [Xen-devel] default XSM policy for PCI passthrough for unlabeled resources.

[Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>]

On 07/06/2016 11:34 AM, anshul makkar wrote:
> Hi,
>
> Default XSM policy doesn't allow the use of unlabeled PCI resources that have 
> been passed through to target domain.
>
> xen.te
> # Resources must be declared using . resource_type
> neverallow * ~resource_type:resource use;
>
> It allows the resource to be added and removed by the source domain to target 
> domain, but its use by target domain is blocked.
This rule only mandates the use of resource_type for resource types.  If you 
are creating a new resource type, follow the example in nic_dev.te.

> The resource can be used only if it has been labeled using flask-label-pci 
> command which needs to be rerun after every boot and after every policy reload.
Yes; this gives the most control over what resources can be delegated.  Policy reloads 
are supposed to be rare (on a production system) and you already need special boot 
scripts (or parameters) to set up the device for passthrough, so this can be added there. 
 However, I agree this can be more work than a "default" FLASK policy should 
require.

> The above approach reduces the flexibility and necessitates admin intervention to give 
> passthrough rights after host has booted. Also, in general if I want to allow all domUs 
> to have PCI passthough access to all PCI device, I have no other way apart from disabling 
> the "neverallow" rule.
Try adding a module with the following rules, which should allow domU to use 
unlabeled devices:

use_device(domU_t, irq_t)
use_device(domU_t, ioport_t)
use_device(domU_t, iomem_t)
use_device(domU_t, device_t)

If this works, that module could be added to the default policy.

> Given that what we ship is just a sample default policy for reference which is expected 
> to be permissive in most of the scenarios so that it doesn't affect the basic 
> functionalities, is this "neverallow" rule needed ?
>
> Thanks
> Anshul Makkar
The neverallow rules are just there to ensure that the attributes are being 
used correctly.

--
Daniel De Graaf
National Security Agency

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel