[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen-unstable] tools/xsm: Expose Flask XSM AVC functions to user-space
# HG changeset patch # User Keir Fraser <keir.fraser@xxxxxxxxxx> # Date 1264492204 0 # Node ID 23a2ae169779e9fc29b93d5191c57a07b8399b08 # Parent cd453b3d7b25eaf2c620e91f1a1283aa2743ae49 tools/xsm: Expose Flask XSM AVC functions to user-space This patch exposes the flask_access, flask_avc_cachestats, flask_avc_hashstats, flask_getavc_threshold, flask_setavc_threshold, and flask_policyvers functions to user-space. A python wrapper was created for the flask_access function to facilitate policy based user-space access control decisions. flask.h was renamed to libflask.h to remove a naming conflict. Signed-off-by : Machon Gregory <mbgrego@xxxxxxxxxxxxxx> --- tools/flask/libflask/include/flask.h | 43 -------- tools/flask/libflask/Makefile | 2 tools/flask/libflask/flask_op.c | 159 +++++++++++++++++++++++++++++++- tools/flask/libflask/include/libflask.h | 53 ++++++++++ tools/flask/utils/getenforce.c | 2 tools/flask/utils/loadpolicy.c | 2 tools/flask/utils/setenforce.c | 2 tools/python/xen/lowlevel/flask/flask.c | 60 +++++++++++- 8 files changed, 274 insertions(+), 49 deletions(-) diff -r cd453b3d7b25 -r 23a2ae169779 tools/flask/libflask/Makefile --- a/tools/flask/libflask/Makefile Sat Jan 23 08:28:01 2010 +0000 +++ b/tools/flask/libflask/Makefile Tue Jan 26 07:50:04 2010 +0000 @@ -38,7 +38,7 @@ install: build $(INSTALL_DATA) libflask.a $(DESTDIR)$(LIBDIR) ln -sf libflask.so.$(MAJOR).$(MINOR) $(DESTDIR)$(LIBDIR)/libflask.so.$(MAJOR) ln -sf libflask.so.$(MAJOR) $(DESTDIR)$(LIBDIR)/libflask.so - $(INSTALL_DATA) include/flask.h $(DESTDIR)$(INCLUDEDIR) + $(INSTALL_DATA) include/libflask.h $(DESTDIR)$(INCLUDEDIR)/xen/xsm .PHONY: TAGS TAGS: diff -r cd453b3d7b25 -r 23a2ae169779 tools/flask/libflask/flask_op.c --- a/tools/flask/libflask/flask_op.c Sat Jan 23 08:28:01 2010 +0000 +++ b/tools/flask/libflask/flask_op.c Tue Jan 26 07:50:04 2010 +0000 @@ -19,7 +19,7 @@ #include <stdlib.h> #include <stdint.h> #include <sys/ioctl.h> -#include <flask.h> +#include <libflask.h> #include <xenctrl.h> int flask_load(int xc_handle, char *buf, uint32_t size) @@ -342,3 +342,160 @@ int flask_del_device(int xc_handle, unsi return 0; } + +int flask_access(int xc_handle, const char *scon, const char *tcon, + u_int16_t tclass, u_int32_t req, + u_int32_t *allowed, u_int32_t *decided, + u_int32_t *auditallow, u_int32_t *auditdeny, + u_int32_t *seqno) +{ +/* maximum number of digits in a 16-bit decimal number: */ +#define MAX_SHORT_DEC_LEN 5 + + char *buf; + int bufLen; + int err; + flask_op_t op; + u_int32_t dummy_allowed; + u_int32_t dummy_decided; + u_int32_t dummy_auditallow; + u_int32_t dummy_auditdeny; + u_int32_t dummy_seqno; + + if (!allowed) + allowed = &dummy_allowed; + if (!decided) + decided = &dummy_decided; + if (!auditallow) + auditallow = &dummy_auditallow; + if (!auditdeny) + auditdeny = &dummy_auditdeny; + if (!seqno) + seqno = &dummy_seqno; + + if (!scon) + return -EINVAL; + if (!tcon) + return -EINVAL; + + bufLen = strlen(scon) + 1 + strlen(tcon) + 1 + + MAX_SHORT_DEC_LEN + 1 + + sizeof(req)*2 + 1; + buf = malloc(bufLen); + snprintf(buf, bufLen, "%s %s %hu %x", scon, tcon, tclass, req); + + op.cmd = FLASK_ACCESS; + op.buf = buf; + op.size = strlen(buf)+1; + + if ( (err = xc_flask_op(xc_handle, &op)) != 0 ) + { + free(buf); + return err; + } + + if (sscanf(op.buf, "%x %x %x %x %u", + allowed, decided, + auditallow, auditdeny, + seqno) != 5) { + err = -EILSEQ; + } + + err = ((*allowed & req) == req)? 0 : -EPERM; + + return err; + +} + +int flask_avc_hashstats(int xc_handle, char *buf, int size) +{ + int err; + flask_op_t op; + + op.cmd = FLASK_AVC_HASHSTATS; + op.buf = buf; + op.size = size; + + if ( (err = xc_flask_op(xc_handle, &op)) != 0 ) + { + free(buf); + return err; + } + + return 0; +} + +int flask_avc_cachestats(int xc_handle, char *buf, int size) +{ + int err; + flask_op_t op; + + op.cmd = FLASK_AVC_CACHESTATS; + op.buf = buf; + op.size = size; + + if ( (err = xc_flask_op(xc_handle, &op)) != 0 ) + { + free(buf); + return err; + } + + return 0; +} + +int flask_policyvers(int xc_handle, char *buf, int size) +{ + int err; + flask_op_t op; + + op.cmd = FLASK_POLICYVERS; + op.buf = buf; + op.size = size; + + if ( (err = xc_flask_op(xc_handle, &op)) != 0 ) + { + free(buf); + return err; + } + + return 0; +} + +int flask_getavc_threshold(int xc_handle) +{ + int err; + flask_op_t op; + char buf[20]; + int size = 20; + int threshold; + + op.cmd = FLASK_GETAVC_THRESHOLD; + op.buf = buf; + op.size = size; + + if ( (err = xc_flask_op(xc_handle, &op)) != 0 ) + return err; + + sscanf(buf, "%i", &threshold); + + return threshold; +} + +int flask_setavc_threshold(int xc_handle, int threshold) +{ + int err; + flask_op_t op; + char buf[20]; + int size = 20; + + op.cmd = FLASK_SETAVC_THRESHOLD; + op.buf = buf; + op.size = size; + + snprintf(buf, size, "%i", threshold); + + if ( (err = xc_flask_op(xc_handle, &op)) != 0 ) + return err; + + return 0; +} diff -r cd453b3d7b25 -r 23a2ae169779 tools/flask/libflask/include/flask.h --- a/tools/flask/libflask/include/flask.h Sat Jan 23 08:28:01 2010 +0000 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,43 +0,0 @@ -/* - * - * Authors: Michael LeMay, <mdlemay@xxxxxxxxxxxxxx> - * George Coker, <gscoker@xxxxxxxxxxxxxx> - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2, - * as published by the Free Software Foundation. - */ - -#ifndef __FLASK_H__ -#define __FLASK_H__ - -#include <stdint.h> -#include <xen/xen.h> -#include <xen/xsm/flask_op.h> - -int flask_load(int xc_handle, char *buf, uint32_t size); -int flask_context_to_sid(int xc_handle, char *buf, uint32_t size, uint32_t *sid); -int flask_sid_to_context(int xc_handle, int sid, char *buf, uint32_t size); -int flask_getenforce(int xc_handle); -int flask_setenforce(int xc_handle, int mode); -int flask_add_pirq(int xc_handle, unsigned int pirq, char *scontext); -int flask_add_ioport(int xc_handle, unsigned long low, unsigned long high, - char *scontext); -int flask_add_iomem(int xc_handle, unsigned long low, unsigned long high, - char *scontext); -int flask_add_device(int xc_handle, unsigned long device, char *scontext); -int flask_del_pirq(int xc_handle, unsigned int pirq); -int flask_del_ioport(int xc_handle, unsigned long low, unsigned long high); -int flask_del_iomem(int xc_handle, unsigned long low, unsigned long high); -int flask_del_device(int xc_handle, unsigned long device); -#define flask_add_single_ioport(x, l, s) flask_add_ioport(x, l, l, s) -#define flask_add_single_iomem(x, l, s) flask_add_iomem(x, l, l, s) -#define flask_del_single_ioport(x, l) flask_del_ioport(x, l, l) -#define flask_del_single_iomem(x, l) flask_del_iomem(x, l, l); - -#define OCON_PIRQ_STR "pirq" -#define OCON_IOPORT_STR "ioport" -#define OCON_IOMEM_STR "iomem" -#define OCON_DEVICE_STR "pcidevice" -#define INITCONTEXTLEN 256 -#endif /* __FLASK_H__ */ diff -r cd453b3d7b25 -r 23a2ae169779 tools/flask/libflask/include/libflask.h --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tools/flask/libflask/include/libflask.h Tue Jan 26 07:50:04 2010 +0000 @@ -0,0 +1,53 @@ +/* + * + * Authors: Michael LeMay, <mdlemay@xxxxxxxxxxxxxx> + * George Coker, <gscoker@xxxxxxxxxxxxxx> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2, + * as published by the Free Software Foundation. + */ + +#ifndef __LIBFLASK_H__ +#define __LIBFLASK_H__ + +#include <stdint.h> +#include <xen/xen.h> +#include <xen/xsm/flask_op.h> + +int flask_load(int xc_handle, char *buf, uint32_t size); +int flask_context_to_sid(int xc_handle, char *buf, uint32_t size, uint32_t *sid); +int flask_sid_to_context(int xc_handle, int sid, char *buf, uint32_t size); +int flask_getenforce(int xc_handle); +int flask_setenforce(int xc_handle, int mode); +int flask_add_pirq(int xc_handle, unsigned int pirq, char *scontext); +int flask_add_ioport(int xc_handle, unsigned long low, unsigned long high, + char *scontext); +int flask_add_iomem(int xc_handle, unsigned long low, unsigned long high, + char *scontext); +int flask_add_device(int xc_handle, unsigned long device, char *scontext); +int flask_del_pirq(int xc_handle, unsigned int pirq); +int flask_del_ioport(int xc_handle, unsigned long low, unsigned long high); +int flask_del_iomem(int xc_handle, unsigned long low, unsigned long high); +int flask_del_device(int xc_handle, unsigned long device); +int flask_access(int xc_handle, const char *scon, const char *tcon, + u_int16_t tclass, u_int32_t req, + u_int32_t *allowed, u_int32_t *decided, + u_int32_t *auditallow, u_int32_t *auditdeny, + u_int32_t *seqno); +int flask_avc_cachestats(int xc_handle, char *buf, int size); +int flask_policyvers(int xc_handle, char *buf, int size); +int flask_avc_hashstats(int xc_handle, char *buf, int size); +int flask_getavc_threshold(int xc_handle); +int flask_setavc_threshold(int xc_handle, int threshold); +#define flask_add_single_ioport(x, l, s) flask_add_ioport(x, l, l, s) +#define flask_add_single_iomem(x, l, s) flask_add_iomem(x, l, l, s) +#define flask_del_single_ioport(x, l) flask_del_ioport(x, l, l) +#define flask_del_single_iomem(x, l) flask_del_iomem(x, l, l); + +#define OCON_PIRQ_STR "pirq" +#define OCON_IOPORT_STR "ioport" +#define OCON_IOMEM_STR "iomem" +#define OCON_DEVICE_STR "pcidevice" +#define INITCONTEXTLEN 256 +#endif /* __LIBFLASK_H__ */ diff -r cd453b3d7b25 -r 23a2ae169779 tools/flask/utils/getenforce.c --- a/tools/flask/utils/getenforce.c Sat Jan 23 08:28:01 2010 +0000 +++ b/tools/flask/utils/getenforce.c Tue Jan 26 07:50:04 2010 +0000 @@ -16,7 +16,7 @@ #include <sys/stat.h> #include <string.h> #include <unistd.h> -#include <flask.h> +#include <libflask.h> static void usage (int argCnt, const char *args[]) { diff -r cd453b3d7b25 -r 23a2ae169779 tools/flask/utils/loadpolicy.c --- a/tools/flask/utils/loadpolicy.c Sat Jan 23 08:28:01 2010 +0000 +++ b/tools/flask/utils/loadpolicy.c Tue Jan 26 07:50:04 2010 +0000 @@ -17,7 +17,7 @@ #include <sys/stat.h> #include <string.h> #include <unistd.h> -#include <flask.h> +#include <libflask.h> #define USE_MMAP diff -r cd453b3d7b25 -r 23a2ae169779 tools/flask/utils/setenforce.c --- a/tools/flask/utils/setenforce.c Sat Jan 23 08:28:01 2010 +0000 +++ b/tools/flask/utils/setenforce.c Tue Jan 26 07:50:04 2010 +0000 @@ -16,7 +16,7 @@ #include <sys/stat.h> #include <string.h> #include <unistd.h> -#include <flask.h> +#include <libflask.h> static void usage (int argCnt, const char *args[]) { diff -r cd453b3d7b25 -r 23a2ae169779 tools/python/xen/lowlevel/flask/flask.c --- a/tools/python/xen/lowlevel/flask/flask.c Sat Jan 23 08:28:01 2010 +0000 +++ b/tools/python/xen/lowlevel/flask/flask.c Tue Jan 26 07:50:04 2010 +0000 @@ -12,7 +12,7 @@ #include <Python.h> #include <xenctrl.h> -#include <flask.h> +#include <libflask.h> #define PKG "xen.lowlevel.flask" #define CLS "flask" @@ -188,6 +188,44 @@ static PyObject *pyflask_setenforce(PyOb } return Py_BuildValue("i", ret); +} + +static PyObject *pyflask_access(PyObject *self, PyObject *args, + PyObject *kwds) +{ + int xc_handle; + char *tcon, *scon; + uint16_t tclass; + uint32_t req, allowed, decided, auditallow, auditdeny, seqno; + int ret; + + static char *kwd_list[] = { "src_context", "tar_context", + "tar_class", "req_permissions", + "decided", "auditallow","auditdeny", + "seqno", NULL }; + + if ( !PyArg_ParseTupleAndKeywords(args, kwds, "ssil|llll", kwd_list, + &scon, &tcon, &tclass, &req, &decided, + &auditallow, &auditdeny, &seqno) ) + return NULL; + + xc_handle = xc_interface_open(); + if (xc_handle < 0) { + errno = xc_handle; + return PyErr_SetFromErrno(xc_error_obj); + } + + ret = flask_access(xc_handle, scon, tcon, tclass, req, &allowed, &decided, + &auditallow, &auditdeny, &seqno); + + xc_interface_close(xc_handle); + + if ( ret != 0 ) { + errno = -ret; + return PyErr_SetFromErrno(xc_error_obj); + } + + return Py_BuildValue("i",ret); } static PyMethodDef pyflask_methods[] = { @@ -224,7 +262,27 @@ static PyMethodDef pyflask_methods[] = { "Modifies the current mode for the Flask XSM module.\n" " mode [int]: mode to change to\n" "Returns: [int]: 0 on success; -1 on failure.\n" }, + + { "flask_access", + (PyCFunction)pyflask_access, + METH_KEYWORDS, "\n" + "Returns whether a source context has access to target context based on \ + class and permissions requested.\n" + " scon [str]: source context\n" + " tcon [str]: target context\n" + " tclass [int]: target security class\n" + " req [int] requested permissions\n" + " allowed [int] permissions allow for the target class between the source \ + and target context\n" + " decided [int] the permissions that were returned in the allowed \ + parameter\n" + " auditallow [int] permissions set to audit on allow\n" + " auditdeny [int] permissions set to audit on deny\n" + " seqno [int] not used\n" + "Returns: [int]: 0 on all permission granted; -1 if any permissions are \ + denied\n" }, { NULL, NULL, 0, NULL } + }; PyMODINIT_FUNC initflask(void) _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |