From: Daniel De Graaf <dgdegra@tycho.nsa.gov>
To: David Vrabel <david.vrabel@citrix.com>
Cc: Keir Fraser <keir@xen.org>, Jan Beulich <jbeulich@suse.com>,
xen-devel@lists.xen.org
Subject: Re: [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use
Date: Mon, 07 Oct 2013 12:00:41 -0400 [thread overview]
Message-ID: <5252DAA9.7060607@tycho.nsa.gov> (raw)
In-Reply-To: <524EACD8.8000308@citrix.com>
On 10/04/2013 07:56 AM, David Vrabel wrote:
> On 02/10/13 18:06, David Vrabel wrote:
>> On 02/10/13 17:35, David Vrabel wrote:
>>>
>>> --- a/xen/xsm/flask/hooks.c
>>> +++ b/xen/xsm/flask/hooks.c
>>> @@ -727,6 +727,9 @@ static int flask_domctl(struct domain *d, int cmd)
>>> case XEN_DOMCTL_audit_p2m:
>>> return current_has_perm(d, SECCLASS_HVM, HVM__AUDIT_P2M);
>>>
>>> + case XEN_DOMCTL_set_max_evtchn:
>>> + return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__SET_MAX_EVTCHN);#
>>
>> Sorry, I forgot to try a build with XSM and FLASK enabled. This should
>> have been SECCLASS_DOMAIN2 and DOMAIN2__SET_MAX_EVTCHN.
>
> And here's a fixed version of the patch.
>
> Daniel, can you review the XSM parts of this, please?
>
> 8<-----------------------------------
> xen: Add DOMCTL to limit the number of event channels a domain may use
>
> Add XEN_DOMCTL_set_max_evtchn which may be used during domain creation to
> set the maximum event channel port a domain may use. This may be used to
> limit the amount of Xen resources (global mapping space and xenheap) that
> a domain may use for event channels.
>
> A domain that does not have a limit set may use all the event channels
> supported by the event channel ABI in use.
>
> Signed-off-by: David Vrabel <david.vrabel@citrix.com>
> Reviewed-by: Jan Beulich <jbeulich@suse.com>
> Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov>
With the policy changes tweaked so that it compiles (see below):
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
> ---
> tools/flask/policy/policy/mls | 2 +-
> tools/flask/policy/policy/modules/xen/xen.if | 2 +-
> tools/flask/policy/policy/modules/xen/xen.te | 2 +-
> xen/common/domctl.c | 8 ++++++++
> xen/common/event_channel.c | 7 ++++++-
> xen/include/public/domctl.h | 13 +++++++++++++
> xen/include/xen/sched.h | 1 +
> xen/xsm/flask/hooks.c | 3 +++
> xen/xsm/flask/policy/access_vectors | 2 ++
> 9 files changed, 36 insertions(+), 4 deletions(-)
>
> diff --git a/tools/flask/policy/policy/mls b/tools/flask/policy/policy/mls
> index 9290a76..fb603cd 100644
> --- a/tools/flask/policy/policy/mls
> +++ b/tools/flask/policy/policy/mls
> @@ -74,7 +74,7 @@ mlsconstrain domain { getaffinity getdomaininfo getvcpuinfo getvcpucontext getad
> ((l1 dom l2) or (t1 == mls_priv));
>
> # all the domain "write" ops
> -mlsconstrain domain { setvcpucontext pause unpause resume create max_vcpus destroy setaffinity scheduler setdomainmaxmem setdomainhandle setdebugging hypercall settime set_target shutdown setaddrsize trigger setextvcpucontext }
> +mlsconstrain domain { setvcpucontext pause unpause resume create max_vcpus destroy setaffinity scheduler setdomainmaxmem setdomainhandle setdebugging hypercall settime set_target shutdown setaddrsize trigger setextvcpucontext set_max_evtchn }
> ((l1 eq l2) or (t1 == mls_priv));
>
> # This is incomplete - similar constraints must be written for all classes
> diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if
> index 97af0a8..63e40f0 100644
> --- a/tools/flask/policy/policy/modules/xen/xen.if
> +++ b/tools/flask/policy/policy/modules/xen/xen.if
> @@ -48,7 +48,7 @@ define(`create_domain_common', `
> allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
> getdomaininfo hypercall setvcpucontext setextvcpucontext
> getscheduler getvcpuinfo getvcpuextstate getaddrsize
> - getaffinity setaffinity };
> + getaffinity setaffinity set_max_evtchn };
> allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim };
> allow $1 $2:security check_context;
> allow $1 $2:shadow enable;
> diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te
> index c89ce28..5f9de5c 100644
> --- a/tools/flask/policy/policy/modules/xen/xen.te
> +++ b/tools/flask/policy/policy/modules/xen/xen.te
> @@ -73,7 +73,7 @@ allow dom0_t dom0_t:domain {
> getdomaininfo getvcpuinfo getvcpucontext setdomainmaxmem setdomainhandle
> setdebugging hypercall settime setaddrsize getaddrsize trigger
> getextvcpucontext setextvcpucontext getvcpuextstate setvcpuextstate
> - getpodtarget setpodtarget set_misc_info set_virq_handler
> + getpodtarget setpodtarget set_misc_info set_virq_handler set_max_evtchn
> };
> allow dom0_t dom0_t:domain2 {
> set_cpuid gettsc settsc setscheduler
With the set_max_evtchn permission moved to domain2, these files also need to
be changed (just moving the addition down to domain2). The modification to mls
can be dropped: the existing domain2 controls are not present in this file, there
is already a comment noting that the constraints are incomplete, and the example
XSM policy does not use MLS.
You should be able to test the compilation using "make -C tools/flask/policy".
[...]
> diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
> index fa0589a..b1e2593 100644
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -727,6 +727,9 @@ static int flask_domctl(struct domain *d, int cmd)
> case XEN_DOMCTL_audit_p2m:
> return current_has_perm(d, SECCLASS_HVM, HVM__AUDIT_P2M);
>
> + case XEN_DOMCTL_set_max_evtchn:
> + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SET_MAX_EVTCHN);
> +
> default:
> printk("flask_domctl: Unknown op %d\n", cmd);
> return -EPERM;
> diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
> index 5dfe13b..1fbe241 100644
> --- a/xen/xsm/flask/policy/access_vectors
> +++ b/xen/xsm/flask/policy/access_vectors
> @@ -194,6 +194,8 @@ class domain2
> setscheduler
> # XENMEM_claim_pages
> setclaim
> +# XEN_DOMCTL_set_max_evtchn
> + set_max_evtchn
> }
>
> # Similar to class domain, but primarily contains domctls related to HVM domains
>
--
Daniel De Graaf
National Security Agency
next prev parent reply other threads:[~2013-10-07 16:00 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-02 16:35 [PATCHv5 0/11] Xen: FIFO-based event channel ABI David Vrabel
2013-10-02 16:35 ` [PATCH 01/11] debug: remove some event channel info from the 'i' and 'q' debug keys David Vrabel
2013-10-02 16:35 ` [PATCH 02/11] evtchn: refactor low-level event channel port ops David Vrabel
2013-10-02 16:35 ` [PATCH 03/11] evtchn: print ABI specific state with the 'e' debug key David Vrabel
2013-10-02 16:35 ` [PATCH 04/11] evtchn: use a per-domain variable for the max number of event channels David Vrabel
2013-10-02 16:35 ` [PATCH 05/11] evtchn: allow many more evtchn objects to be allocated per domain David Vrabel
2013-10-02 16:35 ` [PATCH 06/11] evtchn: add FIFO-based event channel ABI David Vrabel
2013-10-02 16:35 ` [PATCH 07/11] evtchn: implement EVTCHNOP_set_priority and add the set_priority hook David Vrabel
2013-10-02 16:35 ` [PATCH 08/11] evtchn: add FIFO-based event channel hypercalls and port ops David Vrabel
2013-10-04 16:00 ` Jan Beulich
2013-10-02 16:35 ` [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use David Vrabel
2013-10-02 17:06 ` David Vrabel
2013-10-04 11:56 ` David Vrabel
2013-10-04 16:02 ` Jan Beulich
2013-10-07 16:00 ` Daniel De Graaf [this message]
2013-10-02 16:35 ` [PATCH 10/11] libxc: add xc_domain_set_max_evtchn() David Vrabel
2013-10-02 16:36 ` [PATCH 11/11] libxl, xl: add event_channels option to xl configuration file David Vrabel
2013-10-03 8:29 ` Ian Campbell
2013-10-14 14:31 ` Ian Jackson
2013-10-14 16:43 ` David Vrabel
2013-10-14 16:58 ` Ian Jackson
-- strict thread matches above, loose matches on Subject: below --
2013-10-08 12:40 [PATCHv6 00/11] Xen: FIFO-based event channel ABI David Vrabel
2013-10-08 12:40 ` [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use David Vrabel
2013-09-27 10:55 [PATCHv4 0/11] Xen: FIFO-based event channel ABI David Vrabel
2013-09-27 10:55 ` [PATCH 09/11] xen: Add DOMCTL to limit the number of event channels a domain may use David Vrabel
2013-09-27 12:40 ` Jan Beulich
2013-09-27 14:29 ` Daniel De Graaf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5252DAA9.7060607@tycho.nsa.gov \
--to=dgdegra@tycho.nsa.gov \
--cc=david.vrabel@citrix.com \
--cc=jbeulich@suse.com \
--cc=keir@xen.org \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.