[Xen-changelog] [xen stable-4.8] xsm: allow relevant permission during migrate and gpu-passthrough.

[patchbot@xxxxxxx]

commit bdbfca040a087d7fc5f1a9cfdd0e3b3a45498d24
Author:     Anshul Makkar <anshul.makkar@xxxxxxxxxx>
AuthorDate: Mon Dec 12 14:00:05 2016 +0000
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Wed Jan 4 17:02:28 2017 +0000

    xsm: allow relevant permission during migrate and gpu-passthrough.
    
    During guest migrate allow permission to prevent
    spurious page faults.
    Prevents these errors:
    d73: Non-privileged (73) attempt to map I/O space 00000000
    
    avc: denied  { set_misc_info } for domid=0 target=11
    scontext=system_u:system_r:dom0_t
    tcontext=system_u:system_r:domU_t tclass=domain
    
    GPU passthrough for hvm guest:
    avc:  denied  { send_irq } for domid=0 target=10
    scontext=system_u:system_r:dom0_t
    tcontext=system_u:system_r:domU_t tclass=hvm
    
    Signed-off-by: Anshul Makkar <anshul.makkar@xxxxxxxxxx>
    Acked-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
    (cherry picked from commit f04722f78b0f64e1f147389962d8f393a2fa8a7a)
---
 tools/flask/policy/modules/xen.if | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/flask/policy/modules/xen.if 
b/tools/flask/policy/modules/xen.if
index eb646f5..1aca75d 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -49,7 +49,7 @@ define(`create_domain_common', `
        allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
                        getdomaininfo hypercall setvcpucontext getscheduler
                        getvcpuinfo getaddrsize getaffinity setaffinity
-                       settime setdomainhandle getvcpucontext };
+                       settime setdomainhandle getvcpucontext set_misc_info };
        allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
                        set_max_evtchn set_vnumainfo get_vnumainfo cacheflush
                        psr_cmt_op psr_cat_op soft_reset };
@@ -58,7 +58,7 @@ define(`create_domain_common', `
        allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage 
mmuext_op updatemp };
        allow $1 $2:grant setup;
        allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc
-                       setparam pcilevel trackdirtyvram nested altp2mhvm 
altp2mhvm_op };
+                       setparam pcilevel trackdirtyvram nested altp2mhvm 
altp2mhvm_op send_irq };
 ')
 
 # create_domain(priv, target)
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog