From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: Re: [PATCH for-4.5] flask/policy: Example policy updates for migration Date: Mon, 8 Dec 2014 09:48:07 +0000 Message-ID: <1418032087.11028.5.camel@citrix.com> References: <1417798987-10325-1-git-send-email-dgdegra@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1417798987-10325-1-git-send-email-dgdegra@tycho.nsa.gov> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Daniel De Graaf , Konrad Rzeszutek Wilk Cc: wei.liu2@citrix.com, xen-devel@lists.xen.org List-Id: xen-devel@lists.xenproject.org On Fri, 2014-12-05 at 12:03 -0500, Daniel De Graaf wrote: > The example XSM policy was missing permission for dom0_t to migrate > domains; add these permissions. > > Reported-by: Wei Liu > Signed-off-by: Daniel De Graaf Acked-by: Ian Campbell Konrad, we should take this for 4.5, in order to have a working example XSM policy. There's 0 risk to non-XSM systems, or systems with custom XSM policies and clear benefits to XSM systems using the example policy. > --- > > This has been tested with xl save/restore on a PV domain, which now > succeeds without producing AVC denials. > > tools/flask/policy/policy/modules/xen/xen.if | 11 +++++++---- > tools/flask/policy/policy/modules/xen/xen.te | 3 +++ > 2 files changed, 10 insertions(+), 4 deletions(-) > > diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if > index fa69c9d..bf5e135 100644 > --- a/tools/flask/policy/policy/modules/xen/xen.if > +++ b/tools/flask/policy/policy/modules/xen/xen.if > @@ -48,11 +48,13 @@ define(`create_domain_common', ` > allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize > getdomaininfo hypercall setvcpucontext setextvcpucontext > getscheduler getvcpuinfo getvcpuextstate getaddrsize > - getaffinity setaffinity }; > - allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo psr_cmt_op configure_domain }; > + getaffinity setaffinity setvcpuextstate }; > + allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim > + set_max_evtchn set_vnumainfo get_vnumainfo cacheflush > + psr_cmt_op configure_domain }; > allow $1 $2:security check_context; > allow $1 $2:shadow enable; > - allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op }; > + allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; > allow $1 $2:grant setup; > allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc > setparam pcilevel trackdirtyvram nested }; > @@ -80,7 +82,7 @@ define(`create_domain_build_label', ` > define(`manage_domain', ` > allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity > getaddrsize pause unpause trigger shutdown destroy > - setaffinity setdomainmaxmem getscheduler }; > + setaffinity setdomainmaxmem getscheduler resume }; > allow $1 $2:domain2 set_vnumainfo; > ') > > @@ -88,6 +90,7 @@ define(`manage_domain', ` > # Allow creation of a snapshot or migration image from a domain > # (inbound migration is the same as domain creation) > define(`migrate_domain_out', ` > + allow $1 domxen_t:mmu map_read; > allow $1 $2:hvm { gethvmc getparam irqlevel }; > allow $1 $2:mmu { stat pageinfo map_read }; > allow $1 $2:domain { getaddrsize getvcpucontext getextvcpucontext getvcpuextstate pause destroy }; > diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te > index d214470..c0128aa 100644 > --- a/tools/flask/policy/policy/modules/xen/xen.te > +++ b/tools/flask/policy/policy/modules/xen/xen.te > @@ -129,12 +129,14 @@ create_domain(dom0_t, domU_t) > manage_domain(dom0_t, domU_t) > domain_comms(dom0_t, domU_t) > domain_comms(domU_t, domU_t) > +migrate_domain_out(dom0_t, domU_t) > domain_self_comms(domU_t) > > declare_domain(isolated_domU_t) > create_domain(dom0_t, isolated_domU_t) > manage_domain(dom0_t, isolated_domU_t) > domain_comms(dom0_t, isolated_domU_t) > +migrate_domain_out(dom0_t, isolated_domU_t) > domain_self_comms(isolated_domU_t) > > # Declare a boolean that denies creation of prot_domU_t domains > @@ -142,6 +144,7 @@ gen_bool(prot_doms_locked, false) > declare_domain(prot_domU_t) > if (!prot_doms_locked) { > create_domain(dom0_t, prot_domU_t) > + migrate_domain_out(dom0_t, prot_domU_t) > } > domain_comms(dom0_t, prot_domU_t) > domain_comms(domU_t, prot_domU_t)