Re: [PATCH v4 6/7] xsm: add platform QoS related xsm policies

[Daniel De Graaf <dgdegra@tycho.nsa.gov>]

On 12/03/2013 03:47 AM, Dongxiao Xu wrote:
> Add xsm policies for attach/detach pqos services and get CQM info
> hypercalls.
>
> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
> Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
> ---
>   tools/flask/policy/policy/modules/xen/xen.if |    2 +-
>   tools/flask/policy/policy/modules/xen/xen.te |    5 ++++-
>   xen/xsm/flask/hooks.c                        |    7 +++++++
>   xen/xsm/flask/policy/access_vectors          |   17 ++++++++++++++---
>   4 files changed, 26 insertions(+), 5 deletions(-)
>
[...]
> diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
> index b1e2593..6f9f355 100644
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -730,6 +730,10 @@ static int flask_domctl(struct domain *d, int cmd)
>       case XEN_DOMCTL_set_max_evtchn:
>           return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SET_MAX_EVTCHN);
>
> +    case XEN_DOMCTL_attach_pqos:
> +    case XEN_DOMCTL_detach_pqos:
> +        return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PQOS_OP);
> +
>       default:
>           printk("flask_domctl: Unknown op %d\n", cmd);
>           return -EPERM;
> @@ -785,6 +789,9 @@ static int flask_sysctl(int cmd)
>       case XEN_SYSCTL_numainfo:
>           return domain_has_xen(current->domain, XEN__PHYSINFO);
>
> +    case XEN_SYSCTL_getcqminfo:
> +        avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PQOS_OP, NULL);
> +
>       default:
>           printk("flask_sysctl: Unknown op %d\n", cmd);
>           return -EPERM;

This needs to be "return avc_current_has_perm..."

-- 
Daniel De Graaf
National Security Agency