From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Smalley Subject: [PATCH] xen/xsm/flask: Fix permission tables Date: Wed, 02 Feb 2011 11:43:44 -0500 Message-ID: <1296665024.26511.14.camel@moss-pluto> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-BPU25mN4Ryl9dr1uN92N" Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Xen List-Id: xen-devel@lists.xenproject.org --=-BPU25mN4Ryl9dr1uN92N Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit At some point, it seems that someone manually added Flask permission definitions to one header file without updating the corresponding policy configuration or the other related table. The end result is that we can get uninterpretable AVC messages like this: # xl dmesg | grep avc (XEN) avc: denied { 0x4000000 } for domid=0 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain Fix this by updating the flask config and regenerating the headers from it. In the future, this can be further improved by integrating the automatic generation of the headers into the build process as is presently done in SELinux. Signed-off-by: Stephen Smalley --- tools/flask/policy/policy/flask/access_vectors | 2 ++ xen/xsm/flask/include/av_perm_to_string.h | 2 ++ 2 files changed, 4 insertions(+) -- Stephen Smalley National Security Agency --=-BPU25mN4Ryl9dr1uN92N Content-Disposition: attachment; filename="xen-flask-permission-fix.patch" Content-Type: text/x-patch; name="xen-flask-permission-fix.patch"; charset="UTF-8" Content-Transfer-Encoding: 7bit diff --git a/tools/flask/policy/policy/flask/access_vectors b/tools/flask/policy/policy/flask/access_vectors --- a/tools/flask/policy/policy/flask/access_vectors +++ b/tools/flask/policy/policy/flask/access_vectors @@ -75,6 +75,8 @@ trigger getextvcpucontext setextvcpucontext + getvcpuextstate + setvcpuextstate } class hvm diff --git a/xen/xsm/flask/include/av_perm_to_string.h b/xen/xsm/flask/include/av_perm_to_string.h --- a/xen/xsm/flask/include/av_perm_to_string.h +++ b/xen/xsm/flask/include/av_perm_to_string.h @@ -50,6 +50,8 @@ S_(SECCLASS_DOMAIN, DOMAIN__TRIGGER, "trigger") S_(SECCLASS_DOMAIN, DOMAIN__GETEXTVCPUCONTEXT, "getextvcpucontext") S_(SECCLASS_DOMAIN, DOMAIN__SETEXTVCPUCONTEXT, "setextvcpucontext") + S_(SECCLASS_DOMAIN, DOMAIN__GETVCPUEXTSTATE, "getvcpuextstate") + S_(SECCLASS_DOMAIN, DOMAIN__SETVCPUEXTSTATE, "setvcpuextstate") S_(SECCLASS_HVM, HVM__SETHVMC, "sethvmc") S_(SECCLASS_HVM, HVM__GETHVMC, "gethvmc") S_(SECCLASS_HVM, HVM__SETPARAM, "setparam") --=-BPU25mN4Ryl9dr1uN92N Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --=-BPU25mN4Ryl9dr1uN92N--