From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vitaly Kuznetsov Subject: [PATCH v8 07/11] flask: DOMCTL_soft_reset support Date: Tue, 23 Jun 2015 18:11:49 +0200 Message-ID: <1435075913-335-8-git-send-email-vkuznets@redhat.com> References: <1435075913-335-1-git-send-email-vkuznets@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Z7QoD-0008F0-N6 for xen-devel@lists.xenproject.org; Tue, 23 Jun 2015 16:12:25 +0000 In-Reply-To: <1435075913-335-1-git-send-email-vkuznets@redhat.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xenproject.org Cc: Andrew Jones , Julien Grall , Keir Fraser , Ian Campbell , Stefano Stabellini , Andrew Cooper , Ian Jackson , Olaf Hering , Tim Deegan , David Vrabel , Jan Beulich , Wei Liu , Daniel De Graaf List-Id: xen-devel@lists.xenproject.org Add new soft_reset vector to domain2 class, add it to create_domain in the default policy. Signed-off-by: Vitaly Kuznetsov --- tools/flask/policy/policy/modules/xen/xen.if | 2 +- xen/xsm/flask/hooks.c | 3 +++ xen/xsm/flask/policy/access_vectors | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index f4cde11..0dcd620 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -52,7 +52,7 @@ define(`create_domain_common', ` getaffinity setaffinity setvcpuextstate }; allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo cacheflush - psr_cmt_op }; + psr_cmt_op soft_reset }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6e37d29..0c9a2ed 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -735,6 +735,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_psr_cmt_op: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CMT_OP); + case XEN_DOMCTL_soft_reset: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SOFT_RESET); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 68284d5..a1bb241 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -224,6 +224,8 @@ class domain2 # XEN_DOMCTL_monitor_op # XEN_DOMCTL_vm_event_op vm_event +# XEN_DOMCTL_soft_reset + soft_reset # XENMEM_access_op mem_access # XENMEM_paging_op -- 2.4.2