* [PATCH] flask: add gcov_op check
@ 2016-10-13 14:37 Wei Liu
2016-10-13 14:42 ` Konrad Rzeszutek Wilk
2016-10-13 18:55 ` Daniel De Graaf
0 siblings, 2 replies; 3+ messages in thread
From: Wei Liu @ 2016-10-13 14:37 UTC (permalink / raw)
To: Xen-devel; +Cc: Daniel De Graaf, Wei Liu
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
---
tools/flask/policy/modules/dom0.te | 2 +-
xen/xsm/flask/hooks.c | 3 +++
xen/xsm/flask/policy/access_vectors | 2 ++
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/tools/flask/policy/modules/dom0.te b/tools/flask/policy/modules/dom0.te
index 2d982d9..54c3572 100644
--- a/tools/flask/policy/modules/dom0.te
+++ b/tools/flask/policy/modules/dom0.te
@@ -15,7 +15,7 @@ allow dom0_t xen_t:xen {
};
allow dom0_t xen_t:xen2 {
resource_op psr_cmt_op psr_cat_op pmu_ctrl get_symbol
- get_cpu_levelling_caps get_cpu_featureset livepatch_op
+ get_cpu_levelling_caps get_cpu_featureset livepatch_op gcov_op
};
# Allow dom0 to use all XENVER_ subops that have checks.
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 177c11f..040a251 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -822,6 +822,9 @@ static int flask_sysctl(int cmd)
case XEN_SYSCTL_livepatch_op:
return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
XEN2__LIVEPATCH_OP, NULL);
+ case XEN_SYSCTL_gcov_op:
+ return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
+ XEN2__GCOV_OP, NULL);
default:
return avc_unknown_permission("sysctl", cmd);
diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
index 49c9a9e..92e6da9 100644
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -99,6 +99,8 @@ class xen2
get_cpu_featureset
# XEN_SYSCTL_livepatch_op
livepatch_op
+# XEN_SYSCTL_gcov_op
+ gcov_op
}
# Classes domain and domain2 consist of operations that a domain performs on
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] flask: add gcov_op check
2016-10-13 14:37 [PATCH] flask: add gcov_op check Wei Liu
@ 2016-10-13 14:42 ` Konrad Rzeszutek Wilk
2016-10-13 18:55 ` Daniel De Graaf
1 sibling, 0 replies; 3+ messages in thread
From: Konrad Rzeszutek Wilk @ 2016-10-13 14:42 UTC (permalink / raw)
To: Wei Liu; +Cc: Xen-devel, Daniel De Graaf
On Thu, Oct 13, 2016 at 03:37:13PM +0100, Wei Liu wrote:
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
> ---
> Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov>
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> ---
> tools/flask/policy/modules/dom0.te | 2 +-
> xen/xsm/flask/hooks.c | 3 +++
> xen/xsm/flask/policy/access_vectors | 2 ++
> 3 files changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/tools/flask/policy/modules/dom0.te b/tools/flask/policy/modules/dom0.te
> index 2d982d9..54c3572 100644
> --- a/tools/flask/policy/modules/dom0.te
> +++ b/tools/flask/policy/modules/dom0.te
> @@ -15,7 +15,7 @@ allow dom0_t xen_t:xen {
> };
> allow dom0_t xen_t:xen2 {
> resource_op psr_cmt_op psr_cat_op pmu_ctrl get_symbol
> - get_cpu_levelling_caps get_cpu_featureset livepatch_op
> + get_cpu_levelling_caps get_cpu_featureset livepatch_op gcov_op
> };
>
> # Allow dom0 to use all XENVER_ subops that have checks.
> diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
> index 177c11f..040a251 100644
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -822,6 +822,9 @@ static int flask_sysctl(int cmd)
> case XEN_SYSCTL_livepatch_op:
> return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
> XEN2__LIVEPATCH_OP, NULL);
> + case XEN_SYSCTL_gcov_op:
> + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
> + XEN2__GCOV_OP, NULL);
>
> default:
> return avc_unknown_permission("sysctl", cmd);
> diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
> index 49c9a9e..92e6da9 100644
> --- a/xen/xsm/flask/policy/access_vectors
> +++ b/xen/xsm/flask/policy/access_vectors
> @@ -99,6 +99,8 @@ class xen2
> get_cpu_featureset
> # XEN_SYSCTL_livepatch_op
> livepatch_op
> +# XEN_SYSCTL_gcov_op
> + gcov_op
> }
>
> # Classes domain and domain2 consist of operations that a domain performs on
> --
> 2.1.4
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] flask: add gcov_op check
2016-10-13 14:37 [PATCH] flask: add gcov_op check Wei Liu
2016-10-13 14:42 ` Konrad Rzeszutek Wilk
@ 2016-10-13 18:55 ` Daniel De Graaf
1 sibling, 0 replies; 3+ messages in thread
From: Daniel De Graaf @ 2016-10-13 18:55 UTC (permalink / raw)
To: Wei Liu, Xen-devel
On 10/13/2016 10:37 AM, Wei Liu wrote:
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-10-13 18:56 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-13 14:37 [PATCH] flask: add gcov_op check Wei Liu
2016-10-13 14:42 ` Konrad Rzeszutek Wilk
2016-10-13 18:55 ` Daniel De Graaf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.