Re: [Xen-devel] [PATCH for-4.7] flask/policy: don't audit version queries

[Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>]

On Wed, May 04, 2016 at 02:44:56PM -0500, Doug Goldstein wrote:
> On 5/4/16 12:20 PM, Daniel De Graaf wrote:
> > Reported-by: Doug Goldstein <cardoe@xxxxxxxxxx>
> > Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
> > ---
> >  tools/flask/policy/policy/modules/xen/xen.te | 10 ++++++++++
> >  1 file changed, 10 insertions(+)
> > 
> > diff --git a/tools/flask/policy/policy/modules/xen/xen.te 
> > b/tools/flask/policy/policy/modules/xen/xen.te
> > index bef33b0..fed09a9 100644
> > --- a/tools/flask/policy/policy/modules/xen/xen.te
> > +++ b/tools/flask/policy/policy/modules/xen/xen.te
> > @@ -155,6 +155,16 @@ allow domain_type xen_t:version {
> >      xen_changeset xen_pagesize xen_guest_handle
> >  };
> >  
> > +# Version queries don't need auditing when denied.  They can be
> > +# encountered in normal operation by xl or by reading sysfs files in
> > +# Linux, so without this they will show up in the logs.  Since these
> > +# operations return valid responses (like "denied"), hiding the denials
> > +# should not break anything.
> > +dontaudit domain_type xen_t:version {
> > +   xen_extraversion xen_compile_info xen_capabilities xen_changeset
> > +   xen_pagesize xen_guest_handle xen_commandline xen_build_id
> > +};
> > +
> >  
> > ###############################################################################
> >  #
> >  # Domain creation
> > 
> 
> Daniel,
> 
> Locally I did:
> 
> dontaudit domain_type xen_t:version {
>       xen_commandline xen_build_id
> };

ah, so the only ones that keep on coming back (after you reloaded the policy)
where those two? (which is expected as those should only be provided to dom0?)

In which case - yes your patch sounds most definitly correct.

> 
> and that made the denies disappear for running "xl devd".
> 
> -- 
> Doug Goldstein
> 




> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel