Re: [PATCH v2 1/3] xsm/xen_version: Add XSM for the xen_version hypercall.

From: "Jan Beulich" <JBeulich@suse.com>
To: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: wei.liu2@citrix.com, ian.campbell@citrix.com,
	andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com,
	mpohlack@amazon.de, xen-devel@lists.xenproject.org,
	dgdegra@tycho.nsa.gov
Subject: Re: [PATCH v2 1/3] xsm/xen_version: Add XSM for the xen_version hypercall.
Date: Tue, 10 Nov 2015 05:29:35 -0700	[thread overview]
Message-ID: <5641F13F02000078000B35D3@prv-mh.provo.novell.com> (raw)
In-Reply-To: <1446838577-7563-2-git-send-email-konrad.wilk@oracle.com>

>>> On 06.11.15 at 20:36, <konrad.wilk@oracle.com> wrote:
> All of XENVER_* have now an XSM check.
> 
> The subops for XENVER_[compile_info|changeset|commandline|
> extraversion] are now priviliged operations. To not break
> guests we still return an string - but it is just '<denied>'.

And I continue to question at least the extraversion part.

> The rest: XENVER_[version|capabilities|
> parameters|get_features|page_size|guest_handle] behave
> as before - allowed by default for all guests.
> 
> This is with the XSM default policy and with the dummy ones.

And with a non-default policy you now ignore one of the latter
ops to also get denied.

> @@ -354,10 +356,17 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
>          return 0;
>  
>      case XENVER_commandline:
> -        if ( copy_to_guest(arg, saved_cmdline, ARRAY_SIZE(saved_cmdline)) )
> +    {
> +        size_t len = ARRAY_SIZE(saved_cmdline);
> +
> +        if ( deny )
> +            len = strlen(xen_deny());

+1 (or else you fail to nul-terminate the output).

Jan