From: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
To: Ian Campbell <ian.campbell@citrix.com>,
Stefano Stabellini <stefano.stabellini@citrix.com>,
Julien Grall <julien.grall@linaro.org>,
xen-devel@lists.xen.org
Subject: [PATCH v03 03/10] xsm: arm: create domU_rpc_t security label
Date: Tue, 2 Sep 2014 18:46:03 +0300 [thread overview]
Message-ID: <1409672770-23164-4-git-send-email-andrii.tseglytskyi@globallogic.com> (raw)
In-Reply-To: <1409672770-23164-1-git-send-email-andrii.tseglytskyi@globallogic.com>
The following security label will be used for domU, which
can access to MMU of remoteprocessors, such as IPU or GPU.
Signed-off-by: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
---
tools/flask/policy/policy/modules/xen/xen.te | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te
index 999b351..d6184d7 100644
--- a/tools/flask/policy/policy/modules/xen/xen.te
+++ b/tools/flask/policy/policy/modules/xen/xen.te
@@ -110,6 +110,7 @@ admin_device(dom0_t, irq_t)
admin_device(dom0_t, ioport_t)
admin_device(dom0_t, iomem_t)
admin_device(domU_t, iomem_t)
+admin_device(domU_rpc_t, iomem_t)
domain_comms(dom0_t, dom0_t)
@@ -169,6 +170,18 @@ manage_domain(dom0_t, nomigrate_t)
domain_comms(dom0_t, nomigrate_t)
domain_self_comms(nomigrate_t)
+# declare domain which handles remoteprocessor
+declare_domain(domU_rpc_t)
+domain_self_comms(domU_rpc_t)
+create_domain(dom0_t, domU_rpc_t)
+manage_domain(dom0_t, domU_rpc_t)
+domain_comms(dom0_t, domU_rpc_t)
+domain_comms(domU_rpc_t, domU_rpc_t)
+domain_self_comms(domU_rpc_t)
+allow domU_rpc_t domU_rpc_t_self:resource add;
+allow dom0_t domU_rpc_t:domain2 access_remote_pagetable;
+allow domU_rpc_t domU_rpc_t_self:domain2 access_remote_pagetable;
+
###############################################################################
#
# Device delegation
@@ -181,6 +194,7 @@ admin_device(dom0_t, nic_dev_t)
use_device(domU_t, nic_dev_t)
delegate_devices(dom0_t, domU_t)
+delegate_devices(dom0_t, domU_rpc_t)
###############################################################################
#
--
1.9.1
next prev parent reply other threads:[~2014-09-02 15:46 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-02 15:46 [PATCH v03 00/10] arm: introduce remoteprocessor iommu module Andrii Tseglytskyi
2014-09-02 15:46 ` [PATCH v03 01/10] xen: implement guest_physmap_pin_range Andrii Tseglytskyi
2014-09-03 9:43 ` Jan Beulich
2014-09-11 1:12 ` Julien Grall
2014-09-02 15:46 ` [PATCH v03 02/10] domctl: introduce access_remote_pagetable call Andrii Tseglytskyi
2014-09-03 9:46 ` Jan Beulich
2014-09-02 15:46 ` Andrii Tseglytskyi [this message]
2014-09-02 15:46 ` [PATCH v03 04/10] arm: introduce remoteprocessor iommu module Andrii Tseglytskyi
2014-09-11 0:41 ` Julien Grall
2014-09-02 15:46 ` [PATCH v03 05/10] arm: omap: introduce iommu translation for IPU remoteproc Andrii Tseglytskyi
2014-09-02 15:46 ` [PATCH v03 06/10] arm: omap: introduce iommu translation for GPU remoteproc Andrii Tseglytskyi
2014-09-02 15:46 ` [PATCH v03 07/10] arm: introduce remoteproc_mmu_translate_pagetable mem subops call Andrii Tseglytskyi
2014-09-03 9:48 ` Jan Beulich
2014-09-13 0:04 ` Stefano Stabellini
2014-09-02 15:46 ` [PATCH v03 08/10] arm: add trap for remoteproc mmio accesses Andrii Tseglytskyi
2014-09-03 9:52 ` Jan Beulich
2014-09-02 15:46 ` [PATCH v03 09/10] arm: omap: introduce print pagetable function for IPU remoteproc Andrii Tseglytskyi
2014-09-02 15:46 ` [PATCH v03 10/10] arm: omap: introduce print pagetable function for GPU remoteproc Andrii Tseglytskyi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1409672770-23164-4-git-send-email-andrii.tseglytskyi@globallogic.com \
--to=andrii.tseglytskyi@globallogic.com \
--cc=ian.campbell@citrix.com \
--cc=julien.grall@linaro.org \
--cc=stefano.stabellini@citrix.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).