Re: [PATCH v6 05/10] xsm: add XENMEM_soft_reset support

[Vitaly Kuznetsov <vkuznets@redhat.com>]

Daniel De Graaf <dgdegra@tycho.nsa.gov> writes:

> On 05/13/2015 05:49 AM, Vitaly Kuznetsov wrote:
>> Dummy policy just checks that the current domain is privileged,
>> in flask policy soft_reset is added to create_domain.
>>
>> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
>
> I think the FLASK policy should also check that memory can be moved
> from d1 to d2, independent of the check that the toolstack can move
> the memory of d1 (or d2).  While I would expect that the security
> contexts of d1 and d2 would be identical in most cases (and only
> allow that in the example policy), there may be reasons to change
> the context along with the kexec operation.  The best examples I
> can think of are kexec from a bootloader domain of some kind, or
> an installation that transitions into an active system that needs
> access to a different network or set of peer domains.
>
> For the example, policy, I'd add something like
> 	allow $2 $2 : mmu reset_transfer;
> to the create_domain interface.

Hi Daniel, thank you for your review!

Did I get you right and you suggest we use two new vectors in MMU class
for soft reset: the first one to check that the domain making the
hypercall is allowed to do it and the second one to check that that
memory can be moved from d1 to d2? In that case the FLASK-related part
of the patch would look like that I suppose:

diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if
index 620d151..ab4fe7d 100644
--- a/tools/flask/policy/policy/modules/xen/xen.if
+++ b/tools/flask/policy/policy/modules/xen/xen.if
@@ -54,10 +54,12 @@ define(`create_domain_common', `
 			psr_cmt_op };
 	allow $1 $2:security check_context;
 	allow $1 $2:shadow enable;
-	allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp };
+	allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage
+			mmuext_op updatemp soft_reset };
 	allow $1 $2:grant setup;
 	allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc
 			setparam pcilevel trackdirtyvram nested };
+	allow $2 $2:mmu reset_transfer;
 ')
 
 # create_domain(priv, target)
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 11b7453..547d55c 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -383,6 +383,21 @@ static int flask_memory_exchange(struct domain *d)
     return current_has_perm(d, SECCLASS_MMU, MMU__EXCHANGE);
 }
 
+static int flask_memory_soft_reset(struct domain *d1, struct domain *d2)
+{
+    int rc;
+
+    rc = current_has_perm(d1, SECCLASS_MMU, MMU__SOFT_RESET);
+    if (rc)
+        return rc;
+
+    rc = current_has_perm(d2, SECCLASS_MMU, MMU__SOFT_RESET);
+    if (rc)
+        return rc;
+
+    return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__RESET_TRANSFER);
+}
+
 static int flask_memory_adjust_reservation(struct domain *d1, struct domain *d2)
 {
     return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__ADJUST);
@@ -1617,6 +1632,7 @@ static struct xsm_operations flask_ops = {
     .get_pod_target = flask_get_pod_target,
     .set_pod_target = flask_set_pod_target,
     .memory_exchange = flask_memory_exchange,
+    .memory_soft_reset = flask_memory_soft_reset,
     .memory_adjust_reservation = flask_memory_adjust_reservation,
     .memory_stat_reservation = flask_memory_stat_reservation,
     .memory_pin_page = flask_memory_pin_page,
diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
index ea556df..6872c1a 100644
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -366,6 +366,13 @@ class mmu
 #  source = domain making the hypercall
 #  target = domain whose pages are being exchanged
     exchange
+# XENMEM_soft_reset:
+#  source = domain making the hypercall
+#  target = domain being reset (source or destination)
+    soft_reset
+#  source = source domain being reset
+#  target = destination domain being reset
+    reset_transfer
 # Allow a privileged domain to install a map of a page it does not own.  Used
 # for stub domain device models with the PV framebuffer.
     target_hack

[...]

-- 
  Vitaly