[PATCH] xen/xsm/flask: Fix permission tables

[PATCH] xen/xsm/flask: Fix permission tables

[Stephen Smalley]

[-- Attachment #1: Type: text/plain, Size: 897 bytes --]

At some point, it seems that someone manually added Flask permission
definitions to one header file without updating the corresponding policy
configuration or the other related table.  The end result is that we can
get uninterpretable AVC messages like this:
# xl dmesg | grep avc
(XEN) avc:  denied  { 0x4000000 } for domid=0
scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t
tclass=domain

Fix this by updating the flask config and regenerating the headers from
it.  In the future, this can be further improved by integrating the
automatic generation of the headers into the build process as is
presently done in SELinux.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

---

 tools/flask/policy/policy/flask/access_vectors |    2 ++
 xen/xsm/flask/include/av_perm_to_string.h      |    2 ++
 2 files changed, 4 insertions(+)

-- 
Stephen Smalley
National Security Agency

[-- Attachment #2: xen-flask-permission-fix.patch --]
[-- Type: text/x-patch, Size: 1020 bytes --]

diff --git a/tools/flask/policy/policy/flask/access_vectors b/tools/flask/policy/policy/flask/access_vectors
--- a/tools/flask/policy/policy/flask/access_vectors
+++ b/tools/flask/policy/policy/flask/access_vectors
@@ -75,6 +75,8 @@
 	trigger
 	getextvcpucontext
 	setextvcpucontext
+	getvcpuextstate
+	setvcpuextstate
 }
 
 class hvm
diff --git a/xen/xsm/flask/include/av_perm_to_string.h b/xen/xsm/flask/include/av_perm_to_string.h
--- a/xen/xsm/flask/include/av_perm_to_string.h
+++ b/xen/xsm/flask/include/av_perm_to_string.h
@@ -50,6 +50,8 @@
    S_(SECCLASS_DOMAIN, DOMAIN__TRIGGER, "trigger")
    S_(SECCLASS_DOMAIN, DOMAIN__GETEXTVCPUCONTEXT, "getextvcpucontext")
    S_(SECCLASS_DOMAIN, DOMAIN__SETEXTVCPUCONTEXT, "setextvcpucontext")
+   S_(SECCLASS_DOMAIN, DOMAIN__GETVCPUEXTSTATE, "getvcpuextstate")
+   S_(SECCLASS_DOMAIN, DOMAIN__SETVCPUEXTSTATE, "setvcpuextstate")
    S_(SECCLASS_HVM, HVM__SETHVMC, "sethvmc")
    S_(SECCLASS_HVM, HVM__GETHVMC, "gethvmc")
    S_(SECCLASS_HVM, HVM__SETPARAM, "setparam")

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [PATCH] xen/xsm/flask: Fix permission tables

[Ian Jackson]

Stephen Smalley writes ("[Xen-devel] [PATCH] xen/xsm/flask: Fix permission tables"):
> Fix this by updating the flask config and regenerating the headers from
> it.  In the future, this can be further improved by integrating the
> automatic generation of the headers into the build process as is
> presently done in SELinux.

What rune, tool or Makefile target did you use to regenerate the
headers ?

Thanks,
Ian.

Re: [PATCH] xen/xsm/flask: Fix permission tables

[Stephen Smalley]

On Mon, 2011-04-11 at 15:15 +0100, Ian Jackson wrote:
> Stephen Smalley writes ("[Xen-devel] [PATCH] xen/xsm/flask: Fix permission tables"):
> > Fix this by updating the flask config and regenerating the headers from
> > it.  In the future, this can be further improved by integrating the
> > automatic generation of the headers into the build process as is
> > presently done in SELinux.
> 
> What rune, tool or Makefile target did you use to regenerate the
> headers ?

$ make -C tools/flask/policy/policy/flask
$ install -m 644 tools/flask/policy/policy/flask/*.h xen/xsm/flask/include/

-- 
Stephen Smalley
National Security Agency