Flask default policy mismatch vs dummy

Flask default policy mismatch vs dummy

[Andrew Cooper]

Hello,

Found while looking at some OSSTest logs.

Oct  9 14:03:09.579037 (XEN) avc:  denied  { setup } for domid=0 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:xen_t tclass=resource
Oct  9 14:03:09.590863 [    0.522193] Failed to report MMCONFIG reservation state for PCI MMCONFIG 0000 [bus 00-7f] to hypervisor (-13)

If someone has some tuits, please feel free.  If not, I'll see what I
can do when I've got some time.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: Flask default policy mismatch vs dummy

[Jan Beulich]

>>> On 11.10.18 at 10:05, <andrew.cooper3@citrix.com> wrote:
> Found while looking at some OSSTest logs.
> 
> Oct  9 14:03:09.579037 (XEN) avc:  denied  { setup } for domid=0 
> scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:xen_t 
> tclass=resource
> Oct  9 14:03:09.590863 [    0.522193] Failed to report MMCONFIG reservation 
> state for PCI MMCONFIG 0000 [bus 00-7f] to hypervisor (-13)
> 
> If someone has some tuits, please feel free.  If not, I'll see what I
> can do when I've got some time.

How about this?

Jan

flask: PHYSDEVOP_pci_mmcfg_reserved uses Dom0 context

Andrew found

(XEN) avc:  denied  { setup } for domid=0 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:xen_t tclass=resource
[    0.522193] Failed to report MMCONFIG reservation state for PCI MMCONFIG 0000 [bus 00-7f] to hypervisor (-13)

in some osstest log. The Xen side message made me guess that the wrong
SECINITSID_* value was used in the respective flask hook.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Untested, solely based on looking at the code.

--- unstable.orig/xen/xsm/flask/hooks.c	2018-10-05 08:04:17.229109051 +0200
+++ unstable/xen/xsm/flask/hooks.c	2018-10-11 13:37:56.917898113 +0200
@@ -1155,7 +1155,8 @@ static int flask_resource_setup_gsi(int
 
 static int flask_resource_setup_misc(void)
 {
-    return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL);
+    return avc_current_has_perm(SECINITSID_DOM0, SECCLASS_RESOURCE,
+                                RESOURCE__SETUP, NULL);
 }
 
 static inline int flask_page_offline(uint32_t cmd)



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Ping: Re: Flask default policy mismatch vs dummy

[Jan Beulich]

>>> On 11.10.18 at 13:40, <JBeulich@suse.com> wrote:
>>>> On 11.10.18 at 10:05, <andrew.cooper3@citrix.com> wrote:
>> Found while looking at some OSSTest logs.
>> 
>> Oct  9 14:03:09.579037 (XEN) avc:  denied  { setup } for domid=0 
>> scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:xen_t 
>> tclass=resource
>> Oct  9 14:03:09.590863 [    0.522193] Failed to report MMCONFIG reservation 
>> state for PCI MMCONFIG 0000 [bus 00-7f] to hypervisor (-13)
>> 
>> If someone has some tuits, please feel free.  If not, I'll see what I
>> can do when I've got some time.
> 
> How about this?
> 
> Jan

Daniel, do you have any thoughts here?

Thanks, Jan

> flask: PHYSDEVOP_pci_mmcfg_reserved uses Dom0 context
> 
> Andrew found
> 
> (XEN) avc:  denied  { setup } for domid=0 scontext=system_u:system_r:dom0_t 
> tcontext=system_u:system_r:xen_t tclass=resource
> [    0.522193] Failed to report MMCONFIG reservation state for PCI MMCONFIG 
> 0000 [bus 00-7f] to hypervisor (-13)
> 
> in some osstest log. The Xen side message made me guess that the wrong
> SECINITSID_* value was used in the respective flask hook.
> 
> Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> ---
> Untested, solely based on looking at the code.
> 
> --- unstable.orig/xen/xsm/flask/hooks.c	2018-10-05 08:04:17.229109051 +0200
> +++ unstable/xen/xsm/flask/hooks.c	2018-10-11 13:37:56.917898113 +0200
> @@ -1155,7 +1155,8 @@ static int flask_resource_setup_gsi(int
>  
>  static int flask_resource_setup_misc(void)
>  {
> -    return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, 
> RESOURCE__SETUP, NULL);
> +    return avc_current_has_perm(SECINITSID_DOM0, SECCLASS_RESOURCE,
> +                                RESOURCE__SETUP, NULL);
>  }
>  
>  static inline int flask_page_offline(uint32_t cmd)
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xenproject.org 
> https://lists.xenproject.org/mailman/listinfo/xen-devel 





_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel