From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel De Graaf Subject: Re: [PATCH v3 6/7] xsm: add platform QoS related xsm policies Date: Fri, 29 Nov 2013 10:50:52 -0500 Message-ID: <5298B7DC.30707@tycho.nsa.gov> References: <1385704092-89546-1-git-send-email-dongxiao.xu@intel.com> <1385704092-89546-7-git-send-email-dongxiao.xu@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1385704092-89546-7-git-send-email-dongxiao.xu@intel.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: dongxiao.xu@intel.com, xen-devel@lists.xen.org Cc: keir@xen.org, Ian.Campbell@citrix.com, stefano.stabellini@eu.citrix.com, andrew.cooper3@citrix.com, Ian.Jackson@eu.citrix.com, JBeulich@suse.com List-Id: xen-devel@lists.xenproject.org On 11/29/2013 12:48 AM, dongxiao.xu@intel.com wrote: > From: Dongxiao Xu > > Add xsm policies for attach/detach pqos services and get CQM info > hypercalls. > > Signed-off-by: Dongxiao Xu > --- > tools/flask/policy/policy/modules/xen/xen.if | 2 +- > tools/flask/policy/policy/modules/xen/xen.te | 5 ++++- > xen/xsm/flask/hooks.c | 7 +++++++ > xen/xsm/flask/policy/access_vectors | 17 ++++++++++++++--- > 4 files changed, 26 insertions(+), 5 deletions(-) > [...] > diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c > index b1e2593..884922b 100644 > --- a/xen/xsm/flask/hooks.c > +++ b/xen/xsm/flask/hooks.c > @@ -730,6 +730,10 @@ static int flask_domctl(struct domain *d, int cmd) > case XEN_DOMCTL_set_max_evtchn: > return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SET_MAX_EVTCHN); > > + case XEN_DOMCTL_attach_pqos: > + case XEN_DOMCTL_detach_pqos: > + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PQOS_OP); > + > default: > printk("flask_domctl: Unknown op %d\n", cmd); > return -EPERM; > @@ -785,6 +789,9 @@ static int flask_sysctl(int cmd) > case XEN_SYSCTL_numainfo: > return domain_has_xen(current->domain, XEN__PHYSINFO); > > + case XEN_SYSCTL_getcqminfo: > + return domain_has_xen(current->domain, XEN2__PQOS_OP); The domain_has_xen helper function assumes SECCLASS_XEN, but this call needs to pass SECCLASS_XEN2. The easy fix is to change this call to avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PQOS_OP, NULL) Otherwise, a class parameter would need to be added to domain_has_xen. With this changed, Acked-by: Daniel De Graaf -- Daniel De Graaf National Security Agency