[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH v6 05/10] xsm: add XENMEM_soft_reset support

On 05/21/2015 05:49 AM, Vitaly Kuznetsov wrote:
Daniel De Graaf <dgdegra@xxxxxxxxxxxxx> writes:

On 05/13/2015 05:49 AM, Vitaly Kuznetsov wrote:
Dummy policy just checks that the current domain is privileged,
in flask policy soft_reset is added to create_domain.

Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx>

I think the FLASK policy should also check that memory can be moved
from d1 to d2, independent of the check that the toolstack can move
the memory of d1 (or d2).  While I would expect that the security
contexts of d1 and d2 would be identical in most cases (and only
allow that in the example policy), there may be reasons to change
the context along with the kexec operation.  The best examples I
can think of are kexec from a bootloader domain of some kind, or
an installation that transitions into an active system that needs
access to a different network or set of peer domains.

For the example, policy, I'd add something like
        allow $2 $2 : mmu reset_transfer;
to the create_domain interface.

Hi Daniel, thank you for your review!

Did I get you right and you suggest we use two new vectors in MMU class
for soft reset: the first one to check that the domain making the
hypercall is allowed to do it and the second one to check that that
memory can be moved from d1 to d2? In that case the FLASK-related part
of the patch would look like that I suppose:

diff --git a/tools/flask/policy/policy/modules/xen/xen.if 
index 620d151..ab4fe7d 100644
--- a/tools/flask/policy/policy/modules/xen/xen.if
+++ b/tools/flask/policy/policy/modules/xen/xen.if
@@ -54,10 +54,12 @@ define(`create_domain_common', `
                        psr_cmt_op };
        allow $1 $2:security check_context;
        allow $1 $2:shadow enable;
-       allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage 
mmuext_op updatemp };
+       allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage
+                       mmuext_op updatemp soft_reset };
        allow $1 $2:grant setup;
        allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc
                        setparam pcilevel trackdirtyvram nested };
+       allow $2 $2:mmu reset_transfer;

  # create_domain(priv, target)
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 11b7453..547d55c 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -383,6 +383,21 @@ static int flask_memory_exchange(struct domain *d)
      return current_has_perm(d, SECCLASS_MMU, MMU__EXCHANGE);

+static int flask_memory_soft_reset(struct domain *d1, struct domain *d2)
+    int rc;
+    rc = current_has_perm(d1, SECCLASS_MMU, MMU__SOFT_RESET);
+    if (rc)
+        return rc;
+    rc = current_has_perm(d2, SECCLASS_MMU, MMU__SOFT_RESET);
+    if (rc)
+        return rc;
+    return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__RESET_TRANSFER);
  static int flask_memory_adjust_reservation(struct domain *d1, struct domain 
      return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__ADJUST);
@@ -1617,6 +1632,7 @@ static struct xsm_operations flask_ops = {
      .get_pod_target = flask_get_pod_target,
      .set_pod_target = flask_set_pod_target,
      .memory_exchange = flask_memory_exchange,
+    .memory_soft_reset = flask_memory_soft_reset,
      .memory_adjust_reservation = flask_memory_adjust_reservation,
      .memory_stat_reservation = flask_memory_stat_reservation,
      .memory_pin_page = flask_memory_pin_page,
diff --git a/xen/xsm/flask/policy/access_vectors 
index ea556df..6872c1a 100644
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -366,6 +366,13 @@ class mmu
  #  source = domain making the hypercall
  #  target = domain whose pages are being exchanged
+# XENMEM_soft_reset:
+#  source = domain making the hypercall
+#  target = domain being reset (source or destination)
+    soft_reset
+#  source = source domain being reset
+#  target = destination domain being reset
+    reset_transfer
  # Allow a privileged domain to install a map of a page it does not own.  Used
  # for stub domain device models with the PV framebuffer.


Yes, this is what I was looking for.  When combined with the rest of the patch:

Acked-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>

Daniel De Graaf
National Security Agency

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.