From: Anshul Makkar <anshul.makkar@citrix.com>
To: xen-devel@lists.xen.org
Cc: ian.jackson@eu.citrix.com, dgdegra@tycho.nsa.gov,
wei.liu2@citrix.com, Anshul Makkar <anshul.makkar@citrix.com>
Subject: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
Date: Mon, 12 Dec 2016 14:00:05 +0000 [thread overview]
Message-ID: <1481551205-18758-1-git-send-email-anshul.makkar@citrix.com> (raw)
During guest migrate allow permission to prevent
spurious page faults.
Prevents these errors:
d73: Non-privileged (73) attempt to map I/O space 00000000
avc: denied { set_misc_info } for domid=0 target=11
scontext=system_u:system_r:dom0_t
tcontext=system_u:system_r:domU_t tclass=domain
GPU passthrough for hvm guest:
avc: denied { send_irq } for domid=0 target=10
scontext=system_u:system_r:dom0_t
tcontext=system_u:system_r:domU_t tclass=hvm
Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
---
tools/flask/policy/modules/xen.if | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index eb646f5..1aca75d 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -49,7 +49,7 @@ define(`create_domain_common', `
allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
getdomaininfo hypercall setvcpucontext getscheduler
getvcpuinfo getaddrsize getaffinity setaffinity
- settime setdomainhandle getvcpucontext };
+ settime setdomainhandle getvcpucontext set_misc_info };
allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
set_max_evtchn set_vnumainfo get_vnumainfo cacheflush
psr_cmt_op psr_cat_op soft_reset };
@@ -58,7 +58,7 @@ define(`create_domain_common', `
allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp };
allow $1 $2:grant setup;
allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc
- setparam pcilevel trackdirtyvram nested altp2mhvm altp2mhvm_op };
+ setparam pcilevel trackdirtyvram nested altp2mhvm altp2mhvm_op send_irq };
')
# create_domain(priv, target)
--
1.7.10.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
next reply other threads:[~2016-12-12 14:00 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-12 14:00 Anshul Makkar [this message]
2016-12-14 21:09 ` [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough Daniel De Graaf
2016-12-16 11:20 ` Wei Liu
2016-12-19 16:02 ` Doug Goldstein
2016-12-20 4:03 ` Doug Goldstein
2016-12-20 9:37 ` Anshul Makkar
2016-12-22 15:28 ` Doug Goldstein
2016-12-22 15:34 ` Jan Beulich
2017-01-03 18:20 ` Daniel De Graaf
2017-01-04 16:35 ` anshul makkar
2017-01-04 16:55 ` Ian Jackson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1481551205-18758-1-git-send-email-anshul.makkar@citrix.com \
--to=anshul.makkar@citrix.com \
--cc=dgdegra@tycho.nsa.gov \
--cc=ian.jackson@eu.citrix.com \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).