From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chao Peng Subject: [PATCH v8 08/13] xsm: add CAT related xsm policies Date: Thu, 21 May 2015 16:41:39 +0800 Message-ID: <1432197704-20816-9-git-send-email-chao.p.peng@linux.intel.com> References: <1432197704-20816-1-git-send-email-chao.p.peng@linux.intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1432197704-20816-1-git-send-email-chao.p.peng@linux.intel.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: keir@xen.org, Ian.Campbell@citrix.com, stefano.stabellini@eu.citrix.com, andrew.cooper3@citrix.com, dario.faggioli@citrix.com, Ian.Jackson@eu.citrix.com, will.auld@intel.com, JBeulich@suse.com, wei.liu2@citrix.com, dgdegra@tycho.nsa.gov List-Id: xen-devel@lists.xenproject.org Add xsm policies for Cache Allocation Technology(CAT) related hypercalls to restrict the functions visibility to control domain only. Signed-off-by: Chao Peng Acked-by: Daniel De Graaf --- tools/flask/policy/policy/modules/xen/xen.if | 2 +- tools/flask/policy/policy/modules/xen/xen.te | 4 +++- xen/xsm/flask/hooks.c | 6 ++++++ xen/xsm/flask/policy/access_vectors | 4 ++++ 4 files changed, 14 insertions(+), 2 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index 620d151..aa5eb72 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -51,7 +51,7 @@ define(`create_domain_common', ` getaffinity setaffinity setvcpuextstate }; allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo cacheflush - psr_cmt_op }; + psr_cmt_op psr_cat_op }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index e555d11..6dcf953 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -67,6 +67,7 @@ allow dom0_t xen_t:xen { allow dom0_t xen_t:xen2 { resource_op psr_cmt_op + psr_cat_op }; allow dom0_t xen_t:mmu memorymap; @@ -80,7 +81,8 @@ allow dom0_t dom0_t:domain { getpodtarget setpodtarget set_misc_info set_virq_handler }; allow dom0_t dom0_t:domain2 { - set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo get_vnumainfo psr_cmt_op + set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo + get_vnumainfo psr_cmt_op psr_cat_op }; allow dom0_t dom0_t:resource { add remove }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 11b7453..c08d502 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -737,6 +737,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_psr_cmt_op: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CMT_OP); + case XEN_DOMCTL_psr_cat_op: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CAT_OP); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; @@ -796,6 +799,9 @@ static int flask_sysctl(int cmd) case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL); + case XEN_SYSCTL_psr_cat_op: + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, + XEN2__PSR_CAT_OP, NULL); default: printk("flask_sysctl: Unknown op %d\n", cmd); diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index ea556df..939bb1a 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -85,6 +85,8 @@ class xen2 resource_op # XEN_SYSCTL_psr_cmt_op psr_cmt_op +# XEN_SYSCTL_psr_cat_op + psr_cat_op } # Classes domain and domain2 consist of operations that a domain performs on @@ -230,6 +232,8 @@ class domain2 mem_paging # XENMEM_sharing_op mem_sharing +# XEN_DOMCTL_psr_cat_op + psr_cat_op } # Similar to class domain, but primarily contains domctls related to HVM domains -- 1.9.1