From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konrad Rzeszutek Wilk Subject: Re: [PATCH v2 1/3] xsm/xen_version: Add XSM for the xen_version hypercall. Date: Mon, 16 Nov 2015 14:02:18 -0500 Message-ID: <20151116190218.GE15080@char.us.oracle.com> References: <1446838577-7563-1-git-send-email-konrad.wilk@oracle.com> <1446838577-7563-2-git-send-email-konrad.wilk@oracle.com> <56424AC7.7040200@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1ZyP3q-0003zH-BZ for xen-devel@lists.xenproject.org; Mon, 16 Nov 2015 19:03:30 +0000 Content-Disposition: inline In-Reply-To: <56424AC7.7040200@tycho.nsa.gov> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Daniel De Graaf Cc: wei.liu2@citrix.com, ian.campbell@citrix.com, andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com, mpohlack@amazon.de, JBeulich@suse.com, xen-devel@lists.xenproject.org List-Id: xen-devel@lists.xenproject.org On Tue, Nov 10, 2015 at 02:51:35PM -0500, Daniel De Graaf wrote: > On 06/11/15 14:36, Konrad Rzeszutek Wilk wrote: > >All of XENVER_* have now an XSM check. > > > >The subops for XENVER_[compile_info|changeset|commandline| > >extraversion] are now priviliged operations. To not break > >guests we still return an string - but it is just ''. > > > >The rest: XENVER_[version|capabilities| > >parameters|get_features|page_size|guest_handle] behave > >as before - allowed by default for all guests. > > > >This is with the XSM default policy and with the dummy ones. > > > >Signed-off-by: Konrad Rzeszutek Wilk > > Comments below, inline. > > [...] > >diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te > >index d35ae22..1ca0e65 100644 > >--- a/tools/flask/policy/policy/modules/xen/xen.te > >+++ b/tools/flask/policy/policy/modules/xen/xen.te > >@@ -73,6 +73,12 @@ allow dom0_t xen_t:xen2 { > > pmu_ctrl > > get_symbol > > }; > >+ > >+# Allow dom0 to use XENVER_compile_info|changeset|commandline]extraversion > >+allow dom0_t xen_t:xen2 { > >+ version_priv > >+}; > >+ > > allow dom0_t xen_t:mmu memorymap; > > > > # Allow dom0 to use these domctls on itself. For domctls acting on other > > Minor tweak: if you don't want to add the new to the block a few lines above, > the one-line permission syntax without braces (as seen below) looks better. OK. > > [...] > > DO(xen_version)(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) > > { > >+ bool_t deny = !!xsm_version_op(XSM_HOOK, cmd); > >+ > > Since this call produces denials in the default policy, it should be marked > as XSM_OTHER. > > >diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors > >index effb59f..273459f 100644 > >--- a/xen/xsm/flask/policy/access_vectors > >+++ b/xen/xsm/flask/policy/access_vectors > >@@ -93,6 +93,8 @@ class xen2 > > pmu_ctrl > > # PMU use (domains, including unprivileged ones, will be using this operation) > > pmu_use > >+# XENVER_[compile_info|changeset|commandline|extraversion] usage. > >+ version_priv > > } > > > > # Classes domain and domain2 consist of operations that a domain performs on > >@@ -242,6 +244,8 @@ class domain2 > > mem_sharing > > # XEN_DOMCTL_psr_cat_op > > psr_cat_op > >+# XENVER_[version|capabilities|parameters|get_features|page_size|guest_handle]. > >+ version_use > > } > > > > # Similar to class domain, but primarily contains domctls related to HVM domains > > > > I think that both version_priv and version_use belong in the same access > vector (xen2) rather than placing version_use in domain2. OK, it just that the 'xen2' says: "Class xen and xen2 consists of dom0-only operations dealing with the hypervisor itself." (from access_vectors) - hence the split in using domain2 and xen2. > > -- > Daniel De Graaf > National Security Agency