From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vitaly Kuznetsov Subject: [PATCH v9 07/11] flask: DOMCTL_soft_reset support Date: Thu, 16 Jul 2015 18:27:22 +0200 Message-ID: <1437064046-12174-8-git-send-email-vkuznets@redhat.com> References: <1437064046-12174-1-git-send-email-vkuznets@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1ZFm0t-0004c0-CE for xen-devel@lists.xenproject.org; Thu, 16 Jul 2015 16:27:59 +0000 In-Reply-To: <1437064046-12174-1-git-send-email-vkuznets@redhat.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xenproject.org Cc: Andrew Jones , Julien Grall , Keir Fraser , Ian Campbell , Stefano Stabellini , Andrew Cooper , Ian Jackson , Olaf Hering , Tim Deegan , David Vrabel , Jan Beulich , Wei Liu , Daniel De Graaf List-Id: xen-devel@lists.xenproject.org Add new soft_reset vector to domain2 class, add it to create_domain in the default policy. Signed-off-by: Vitaly Kuznetsov Acked-by: Daniel De Graaf --- Changes since v8: - Add Daniel's A-b. --- tools/flask/policy/policy/modules/xen/xen.if | 2 +- xen/xsm/flask/hooks.c | 3 +++ xen/xsm/flask/policy/access_vectors | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index da4c95b..370e711 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -52,7 +52,7 @@ define(`create_domain_common', ` getaffinity setaffinity setvcpuextstate }; allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo cacheflush - psr_cmt_op psr_cat_op }; + psr_cmt_op psr_cat_op soft_reset }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 882681f..da3e1b2 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -738,6 +738,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_psr_cat_op: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CAT_OP); + case XEN_DOMCTL_soft_reset: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SOFT_RESET); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index b2a20c3..66bed41 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -232,6 +232,8 @@ class domain2 # XEN_DOMCTL_monitor_op # XEN_DOMCTL_vm_event_op vm_event +# XEN_DOMCTL_soft_reset + soft_reset # XENMEM_access_op mem_access # XENMEM_paging_op -- 2.4.3