[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH v11 8/9] xsm: add platform QoS related xsm policies



On 06/20/2014 10:31 AM, Dongxiao Xu wrote:
Add xsm policies for QoS monitoring related hypercalls.

Signed-off-by: Dongxiao Xu <dongxiao.xu@xxxxxxxxx>

The XEN_DOMCTL_pqos_monitor_op case was not actually handled in this
patch.

---
  tools/flask/policy/policy/modules/xen/xen.if | 2 +-
  tools/flask/policy/policy/modules/xen/xen.te | 3 ++-
  xen/xsm/flask/hooks.c                        | 4 ++++
  xen/xsm/flask/policy/access_vectors          | 4 ++++
  4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/tools/flask/policy/policy/modules/xen/xen.if 
b/tools/flask/policy/policy/modules/xen/xen.if
index dedc035..5e7042c 100644
--- a/tools/flask/policy/policy/modules/xen/xen.if
+++ b/tools/flask/policy/policy/modules/xen/xen.if
@@ -49,7 +49,7 @@ define(`create_domain_common', `
                        getdomaininfo hypercall setvcpucontext setextvcpucontext
                        getscheduler getvcpuinfo getvcpuextstate getaddrsize
                        getaffinity setaffinity };
-       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim  
set_max_evtchn };
+       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim 
set_max_evtchn pqos_monitor_op };
        allow $1 $2:security check_context;
        allow $1 $2:shadow enable;
        allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage 
mmuext_op };
diff --git a/tools/flask/policy/policy/modules/xen/xen.te 
b/tools/flask/policy/policy/modules/xen/xen.te
index 0e63e76..41d1995 100644
--- a/tools/flask/policy/policy/modules/xen/xen.te
+++ b/tools/flask/policy/policy/modules/xen/xen.te
@@ -66,6 +66,7 @@ allow dom0_t xen_t:xen {
  };
  allow dom0_t xen_t:xen2 {
      msr_op
+    pqos_monitor_op
  };
  allow dom0_t xen_t:mmu memorymap;

@@ -79,7 +80,7 @@ allow dom0_t dom0_t:domain {
        getpodtarget setpodtarget set_misc_info set_virq_handler
  };
  allow dom0_t dom0_t:domain2 {
-       set_cpuid gettsc settsc setscheduler set_max_evtchn
+       set_cpuid gettsc settsc setscheduler set_max_evtchn pqos_monitor_op
  };
  allow dom0_t dom0_t:resource { add remove };

diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 277a5de..97dc1a3 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -773,6 +773,10 @@ static int flask_sysctl(int cmd)
      case XEN_SYSCTL_msr_op:
          return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
                                      XEN2__MSR_OP, NULL);
+
+    case XEN_SYSCTL_pqos_monitor_op:
+        return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
+                                    XEN2__PQOS_MONITOR_OP, NULL);

      default:
          printk("flask_sysctl: Unknown op %d\n", cmd);
diff --git a/xen/xsm/flask/policy/access_vectors 
b/xen/xsm/flask/policy/access_vectors
index 82b5484..d573eea 100644
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -81,6 +81,8 @@ class xen2
  {
  # XEN_SYSCTL_msr_op
      msr_op
+# XEN_SYSCTL_pqos_monitor_op
+    pqos_monitor_op
  }

  # Classes domain and domain2 consist of operations that a domain performs on
@@ -208,6 +210,8 @@ class domain2
      cacheflush
  # Creation of the hardware domain when it is not dom0
      create_hardware_domain
+# XEN_DOMCTL_pqos_monitor_op
+    pqos_monitor_op
  }

  # Similar to class domain, but primarily contains domctls related to HVM 
domains



--
Daniel De Graaf
National Security Agency

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.