* [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
@ 2016-12-12 14:00 Anshul Makkar
2016-12-14 21:09 ` Daniel De Graaf
0 siblings, 1 reply; 11+ messages in thread
From: Anshul Makkar @ 2016-12-12 14:00 UTC (permalink / raw)
To: xen-devel; +Cc: ian.jackson, dgdegra, wei.liu2, Anshul Makkar
During guest migrate allow permission to prevent
spurious page faults.
Prevents these errors:
d73: Non-privileged (73) attempt to map I/O space 00000000
avc: denied { set_misc_info } for domid=0 target=11
scontext=system_u:system_r:dom0_t
tcontext=system_u:system_r:domU_t tclass=domain
GPU passthrough for hvm guest:
avc: denied { send_irq } for domid=0 target=10
scontext=system_u:system_r:dom0_t
tcontext=system_u:system_r:domU_t tclass=hvm
Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
---
tools/flask/policy/modules/xen.if | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index eb646f5..1aca75d 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -49,7 +49,7 @@ define(`create_domain_common', `
allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
getdomaininfo hypercall setvcpucontext getscheduler
getvcpuinfo getaddrsize getaffinity setaffinity
- settime setdomainhandle getvcpucontext };
+ settime setdomainhandle getvcpucontext set_misc_info };
allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
set_max_evtchn set_vnumainfo get_vnumainfo cacheflush
psr_cmt_op psr_cat_op soft_reset };
@@ -58,7 +58,7 @@ define(`create_domain_common', `
allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp };
allow $1 $2:grant setup;
allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc
- setparam pcilevel trackdirtyvram nested altp2mhvm altp2mhvm_op };
+ setparam pcilevel trackdirtyvram nested altp2mhvm altp2mhvm_op send_irq };
')
# create_domain(priv, target)
--
1.7.10.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-12 14:00 [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough Anshul Makkar
@ 2016-12-14 21:09 ` Daniel De Graaf
2016-12-16 11:20 ` Wei Liu
2016-12-19 16:02 ` Doug Goldstein
0 siblings, 2 replies; 11+ messages in thread
From: Daniel De Graaf @ 2016-12-14 21:09 UTC (permalink / raw)
To: Anshul Makkar, xen-devel; +Cc: ian.jackson, wei.liu2
On 12/12/2016 09:00 AM, Anshul Makkar wrote:
> During guest migrate allow permission to prevent
> spurious page faults.
> Prevents these errors:
> d73: Non-privileged (73) attempt to map I/O space 00000000
>
> avc: denied { set_misc_info } for domid=0 target=11
> scontext=system_u:system_r:dom0_t
> tcontext=system_u:system_r:domU_t tclass=domain
>
> GPU passthrough for hvm guest:
> avc: denied { send_irq } for domid=0 target=10
> scontext=system_u:system_r:dom0_t
> tcontext=system_u:system_r:domU_t tclass=hvm
>
> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-14 21:09 ` Daniel De Graaf
@ 2016-12-16 11:20 ` Wei Liu
2016-12-19 16:02 ` Doug Goldstein
1 sibling, 0 replies; 11+ messages in thread
From: Wei Liu @ 2016-12-16 11:20 UTC (permalink / raw)
To: Daniel De Graaf; +Cc: ian.jackson, Anshul Makkar, wei.liu2, xen-devel
On Wed, Dec 14, 2016 at 04:09:00PM -0500, Daniel De Graaf wrote:
> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
> >During guest migrate allow permission to prevent
> >spurious page faults.
> >Prevents these errors:
> >d73: Non-privileged (73) attempt to map I/O space 00000000
> >
> >avc: denied { set_misc_info } for domid=0 target=11
> >scontext=system_u:system_r:dom0_t
> >tcontext=system_u:system_r:domU_t tclass=domain
> >
> >GPU passthrough for hvm guest:
> >avc: denied { send_irq } for domid=0 target=10
> >scontext=system_u:system_r:dom0_t
> >tcontext=system_u:system_r:domU_t tclass=hvm
> >
> >Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>
> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>
Applied
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-14 21:09 ` Daniel De Graaf
2016-12-16 11:20 ` Wei Liu
@ 2016-12-19 16:02 ` Doug Goldstein
2016-12-20 4:03 ` Doug Goldstein
1 sibling, 1 reply; 11+ messages in thread
From: Doug Goldstein @ 2016-12-19 16:02 UTC (permalink / raw)
To: Daniel De Graaf, Anshul Makkar, xen-devel; +Cc: wei.liu2, ian.jackson
[-- Attachment #1.1.1: Type: text/plain, Size: 790 bytes --]
On 12/14/16 3:09 PM, Daniel De Graaf wrote:
> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
>> During guest migrate allow permission to prevent
>> spurious page faults.
>> Prevents these errors:
>> d73: Non-privileged (73) attempt to map I/O space 00000000
>>
>> avc: denied { set_misc_info } for domid=0 target=11
>> scontext=system_u:system_r:dom0_t
>> tcontext=system_u:system_r:domU_t tclass=domain
>>
>> GPU passthrough for hvm guest:
>> avc: denied { send_irq } for domid=0 target=10
>> scontext=system_u:system_r:dom0_t
>> tcontext=system_u:system_r:domU_t tclass=hvm
>>
>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>
> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>
Daniel,
Should this be backported to 4.8?
--
Doug Goldstein
[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 959 bytes --]
[-- Attachment #2: Type: text/plain, Size: 127 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-19 16:02 ` Doug Goldstein
@ 2016-12-20 4:03 ` Doug Goldstein
2016-12-20 9:37 ` Anshul Makkar
2017-01-03 18:20 ` Daniel De Graaf
0 siblings, 2 replies; 11+ messages in thread
From: Doug Goldstein @ 2016-12-20 4:03 UTC (permalink / raw)
To: Daniel De Graaf, Anshul Makkar, xen-devel; +Cc: wei.liu2, ian.jackson
[-- Attachment #1.1.1: Type: text/plain, Size: 940 bytes --]
On 12/19/16 10:02 AM, Doug Goldstein wrote:
> On 12/14/16 3:09 PM, Daniel De Graaf wrote:
>> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
>>> During guest migrate allow permission to prevent
>>> spurious page faults.
>>> Prevents these errors:
>>> d73: Non-privileged (73) attempt to map I/O space 00000000
>>>
>>> avc: denied { set_misc_info } for domid=0 target=11
>>> scontext=system_u:system_r:dom0_t
>>> tcontext=system_u:system_r:domU_t tclass=domain
>>>
>>> GPU passthrough for hvm guest:
>>> avc: denied { send_irq } for domid=0 target=10
>>> scontext=system_u:system_r:dom0_t
>>> tcontext=system_u:system_r:domU_t tclass=hvm
>>>
>>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>>
>> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>>
>
> Daniel,
>
> Should this be backported to 4.8?
>
FWIW, Daniel's email is bouncing. Anshul, do you want to test/confirm?
--
Doug Goldstein
[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 959 bytes --]
[-- Attachment #2: Type: text/plain, Size: 127 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-20 4:03 ` Doug Goldstein
@ 2016-12-20 9:37 ` Anshul Makkar
2016-12-22 15:28 ` Doug Goldstein
2017-01-03 18:20 ` Daniel De Graaf
1 sibling, 1 reply; 11+ messages in thread
From: Anshul Makkar @ 2016-12-20 9:37 UTC (permalink / raw)
To: Doug Goldstein, Daniel De Graaf, xen-devel; +Cc: wei.liu2, ian.jackson
On 20/12/2016 04:03, Doug Goldstein wrote:
> On 12/19/16 10:02 AM, Doug Goldstein wrote:
>> On 12/14/16 3:09 PM, Daniel De Graaf wrote:
>>> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
>>>> During guest migrate allow permission to prevent
>>>> spurious page faults.
>>>> Prevents these errors:
>>>> d73: Non-privileged (73) attempt to map I/O space 00000000
>>>>
>>>> avc: denied { set_misc_info } for domid=0 target=11
>>>> scontext=system_u:system_r:dom0_t
>>>> tcontext=system_u:system_r:domU_t tclass=domain
>>>>
>>>> GPU passthrough for hvm guest:
>>>> avc: denied { send_irq } for domid=0 target=10
>>>> scontext=system_u:system_r:dom0_t
>>>> tcontext=system_u:system_r:domU_t tclass=hvm
>>>>
>>>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>>>
>>> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>>>
>>
>> Daniel,
>>
>> Should this be backported to 4.8?
>>
>
> FWIW, Daniel's email is bouncing. Anshul, do you want to test/confirm?
>
Doug, yes, will backport and test.
Anshul
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-20 9:37 ` Anshul Makkar
@ 2016-12-22 15:28 ` Doug Goldstein
2016-12-22 15:34 ` Jan Beulich
0 siblings, 1 reply; 11+ messages in thread
From: Doug Goldstein @ 2016-12-22 15:28 UTC (permalink / raw)
To: Anshul Makkar, Daniel De Graaf, xen-devel
Cc: wei.liu2, ian.jackson, Jan Beulich
[-- Attachment #1.1.1: Type: text/plain, Size: 1175 bytes --]
On 12/20/16 3:37 AM, Anshul Makkar wrote:
> On 20/12/2016 04:03, Doug Goldstein wrote:
>> On 12/19/16 10:02 AM, Doug Goldstein wrote:
>>> On 12/14/16 3:09 PM, Daniel De Graaf wrote:
>>>> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
>>>>> During guest migrate allow permission to prevent
>>>>> spurious page faults.
>>>>> Prevents these errors:
>>>>> d73: Non-privileged (73) attempt to map I/O space 00000000
>>>>>
>>>>> avc: denied { set_misc_info } for domid=0 target=11
>>>>> scontext=system_u:system_r:dom0_t
>>>>> tcontext=system_u:system_r:domU_t tclass=domain
>>>>>
>>>>> GPU passthrough for hvm guest:
>>>>> avc: denied { send_irq } for domid=0 target=10
>>>>> scontext=system_u:system_r:dom0_t
>>>>> tcontext=system_u:system_r:domU_t tclass=hvm
>>>>>
>>>>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>>>>
>>>> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>>>>
>>>
>>> Daniel,
>>>
>>> Should this be backported to 4.8?
>>>
>>
>> FWIW, Daniel's email is bouncing. Anshul, do you want to test/confirm?
>>
>
> Doug, yes, will backport and test.
>
> Anshul
CCing Jan for the backport.
--
Doug Goldstein
[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 959 bytes --]
[-- Attachment #2: Type: text/plain, Size: 127 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-22 15:28 ` Doug Goldstein
@ 2016-12-22 15:34 ` Jan Beulich
0 siblings, 0 replies; 11+ messages in thread
From: Jan Beulich @ 2016-12-22 15:34 UTC (permalink / raw)
To: Doug Goldstein, Anshul Makkar
Cc: ian.jackson, Daniel De Graaf, wei.liu2, xen-devel
>>> On 22.12.16 at 16:28, <cardoe@cardoe.com> wrote:
> On 12/20/16 3:37 AM, Anshul Makkar wrote:
>> On 20/12/2016 04:03, Doug Goldstein wrote:
>>> On 12/19/16 10:02 AM, Doug Goldstein wrote:
>>>> On 12/14/16 3:09 PM, Daniel De Graaf wrote:
>>>>> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
>>>>>> During guest migrate allow permission to prevent
>>>>>> spurious page faults.
>>>>>> Prevents these errors:
>>>>>> d73: Non-privileged (73) attempt to map I/O space 00000000
>>>>>>
>>>>>> avc: denied { set_misc_info } for domid=0 target=11
>>>>>> scontext=system_u:system_r:dom0_t
>>>>>> tcontext=system_u:system_r:domU_t tclass=domain
>>>>>>
>>>>>> GPU passthrough for hvm guest:
>>>>>> avc: denied { send_irq } for domid=0 target=10
>>>>>> scontext=system_u:system_r:dom0_t
>>>>>> tcontext=system_u:system_r:domU_t tclass=hvm
>>>>>>
>>>>>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>>>>>
>>>>> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>>>>>
>>>>
>>>> Daniel,
>>>>
>>>> Should this be backported to 4.8?
>>>>
>>>
>>> FWIW, Daniel's email is bouncing. Anshul, do you want to test/confirm?
>>>
>>
>> Doug, yes, will backport and test.
>>
>> Anshul
>
> CCing Jan for the backport.
Well - I'll wait for the pending confirmation from Anshul (please
Cc me on that one). Or wait - this is under tools/, in which case
I'd rather leave this to Ian (so please Cc him when confirming).
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2016-12-20 4:03 ` Doug Goldstein
2016-12-20 9:37 ` Anshul Makkar
@ 2017-01-03 18:20 ` Daniel De Graaf
2017-01-04 16:35 ` anshul makkar
1 sibling, 1 reply; 11+ messages in thread
From: Daniel De Graaf @ 2017-01-03 18:20 UTC (permalink / raw)
To: Doug Goldstein, Anshul Makkar, xen-devel; +Cc: ian.jackson, wei.liu2
On 12/19/2016 11:03 PM, Doug Goldstein wrote:
> On 12/19/16 10:02 AM, Doug Goldstein wrote:
>> On 12/14/16 3:09 PM, Daniel De Graaf wrote:
>>> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
>>>> During guest migrate allow permission to prevent
>>>> spurious page faults.
>>>> Prevents these errors:
>>>> d73: Non-privileged (73) attempt to map I/O space 00000000
>>>>
>>>> avc: denied { set_misc_info } for domid=0 target=11
>>>> scontext=system_u:system_r:dom0_t
>>>> tcontext=system_u:system_r:domU_t tclass=domain
>>>>
>>>> GPU passthrough for hvm guest:
>>>> avc: denied { send_irq } for domid=0 target=10
>>>> scontext=system_u:system_r:dom0_t
>>>> tcontext=system_u:system_r:domU_t tclass=hvm
>>>>
>>>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>>>
>>> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>>>
>>
>> Daniel,
>>
>> Should this be backported to 4.8?
>>
Yes, I would consider this a candidate for backporting.
> FWIW, Daniel's email is bouncing. Anshul, do you want to test/confirm?
I believe this is fixed now; my email server was changed while I was gone
for the holiday and apparently the change was not tested properly.
--
Daniel De Graaf
National Security Agency
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough.
2017-01-03 18:20 ` Daniel De Graaf
@ 2017-01-04 16:35 ` anshul makkar
2017-01-04 16:55 ` Ian Jackson
0 siblings, 1 reply; 11+ messages in thread
From: anshul makkar @ 2017-01-04 16:35 UTC (permalink / raw)
To: xen-devel; +Cc: wei.liu2, Daniel De Graaf, Doug Goldstein, ian.jackson
On 03/01/17 18:20, Daniel De Graaf wrote:
> On 12/19/2016 11:03 PM, Doug Goldstein wrote:
>> On 12/19/16 10:02 AM, Doug Goldstein wrote:
>>> On 12/14/16 3:09 PM, Daniel De Graaf wrote:
>>>> On 12/12/2016 09:00 AM, Anshul Makkar wrote:
>>>>> During guest migrate allow permission to prevent
>>>>> spurious page faults.
>>>>> Prevents these errors:
>>>>> d73: Non-privileged (73) attempt to map I/O space 00000000
>>>>>
>>>>> avc: denied { set_misc_info } for domid=0 target=11
>>>>> scontext=system_u:system_r:dom0_t
>>>>> tcontext=system_u:system_r:domU_t tclass=domain
>>>>>
>>>>> GPU passthrough for hvm guest:
>>>>> avc: denied { send_irq } for domid=0 target=10
>>>>> scontext=system_u:system_r:dom0_t
>>>>> tcontext=system_u:system_r:domU_t tclass=hvm
>>>>>
>>>>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>>>>
>>>> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
>>>>
>>>
>>> Daniel,
>>>
>>> Should this be backported to 4.8?
>>>
>
> Yes, I would consider this a candidate for backporting.
>
>> FWIW, Daniel's email is bouncing. Anshul, do you want to test/confirm?
>
> I believe this is fixed now; my email server was changed while I was gone
> for the holiday and apparently the change was not tested properly.
>
Please backport the patch to stable-4.8. I have tested it.
Anshul
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2017-01-04 16:55 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-12 14:00 [PATCH] xsm: allow relevant permission during migrate and gpu-passthrough Anshul Makkar
2016-12-14 21:09 ` Daniel De Graaf
2016-12-16 11:20 ` Wei Liu
2016-12-19 16:02 ` Doug Goldstein
2016-12-20 4:03 ` Doug Goldstein
2016-12-20 9:37 ` Anshul Makkar
2016-12-22 15:28 ` Doug Goldstein
2016-12-22 15:34 ` Jan Beulich
2017-01-03 18:20 ` Daniel De Graaf
2017-01-04 16:35 ` anshul makkar
2017-01-04 16:55 ` Ian Jackson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).