From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel De Graaf Subject: Re: [PATCH v3 12/23] xsm/xen_version: Add XSM for the xen_version hypercall (v8). Date: Fri, 12 Feb 2016 16:52:52 -0500 Message-ID: <56BE5434.6020008@tycho.nsa.gov> References: <1455300361-13092-1-git-send-email-konrad.wilk@oracle.com> <1455300361-13092-13-git-send-email-konrad.wilk@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1aULeo-0000On-FY for xen-devel@lists.xenproject.org; Fri, 12 Feb 2016 21:53:42 +0000 In-Reply-To: <1455300361-13092-13-git-send-email-konrad.wilk@oracle.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Konrad Rzeszutek Wilk , xen-devel@lists.xenproject.org, andrew.cooper3@citrix.com, konrad@kernel.org, mpohlack@amazon.de, ross.lagerwall@citrix.com, sasha.levin@citrix.com, jinsong.liu@alibaba-inc.com, Ian Jackson , Stefano Stabellini , Ian Campbell , Wei Liu , xen-devel@lists.xen.org List-Id: xen-devel@lists.xenproject.org On 12/02/16 13:05, Konrad Rzeszutek Wilk wrote: > All of XENVER_* have now an XSM check for their sub-ops. > > The subop for XENVER_commandline is now a priviliged operation. > To not break guests we still return an string - but it is > just '\0'. > > The rest: XENVER_[version|extraversion|capabilities| > parameters|get_features|page_size|guest_handle|changeset| > compile_info] behave as before - allowed by default for all > guests if using the XSM default policy or with the dummy one. > > The admin can choose to change the sub-ops to be denied > as they see fit. > > Signed-off-by: Konrad Rzeszutek Wilk > --- > v2: Do XSM check for all the XENVER_ ops. > v3: Add empty data conditions. > v4: Return for priv subops. > v5: Move extraversion from priv to normal. Drop the XSM check > for the non-priv subops. > v6: Add +1 for strlen(xen_deny()) to include NULL. Move changeset, > compile_info to non-priv subops. > v7: Remove the \0 on xen_deny() > v8: Add new XSM domain for xenver hypercall. Add all subops to it. With one excess line removed: Acked-by: Daniel De Graaf [...] > diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c > index c856e1e..7e3bcdd 100644 > --- a/xen/xsm/flask/hooks.c > +++ b/xen/xsm/flask/hooks.c > @@ -26,6 +26,7 @@ > #include > #include > #include > +#include > > #include > > @@ -1626,6 +1627,48 @@ static int flask_pmu_op (struct domain *d, unsigned int op) > } > #endif /* CONFIG_X86 */ > > +static int flask_version_op (uint32_t op) > +{ > + u32 dsid = domain_sid(current->domain); > + > + switch ( op ) > + { > + case XENVER_version: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__VERSION, NULL); > + case XENVER_extraversion: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__EXTRAVERSION, NULL); > + case XENVER_compile_info: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__COMPILE_INFO, NULL); > + case XENVER_capabilities: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__CAPABILITIES, NULL); > + case XENVER_changeset: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__CHANGESET, NULL); > + case XENVER_platform_parameters: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__PLATFORM_PARAMETERS, NULL); > + case XENVER_get_features: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__GET_FEATURES, NULL); > + case XENVER_pagesize: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__PAGESIZE, NULL); > + case XENVER_guest_handle: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__GUEST_HANDLE, NULL); > + return 0; /* These MUST always be accessible to guests. */ This line seems to be misplaced. > + case XENVER_commandline: > + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, > + VERSION__COMMANDLINE, NULL); > + default: > + return -EPERM; > + } > +} > + > long do_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op); > int compat_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op); >