[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH] xen/xsm: Wire up get_dom0_console


  • To: <xen-devel@xxxxxxxxxxxxxxxxxxxx>
  • From: Jason Andryuk <jason.andryuk@xxxxxxx>
  • Date: Fri, 26 Apr 2024 00:04:32 -0400
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=lists.xenproject.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Bnfh6kTNBKvodPE/EuC15aadkQqwaauyRyjK4Ktf/oU=; b=c6XFad3iK3RDfX3HAJXRy1xk8DlEXOKInDwwdHdFkzSNYwwxcbe6PZalkYjHPoxrHGEoAJE/rAbQTjb7jTsOCEUOBM5EDS0T9h82KtDV2wmMSsC9OH3/+0L0JcEXIuvT9W4PyhA0Z0vqXM10ulBa0CZmHux1ULuSU3JOgMCGCAunzaVBgSoI6q76Pqv1yGPttD0JoE0ts2uYN2jKIdvAS92Uey1eqFYa8qydYd08PKbJhTXGqryJ++Ze/h6CQkp81Azxs4f+2zvWMA7vlpGiO8mdMdg1OC/N6QjsCj4tJeEbeLtsoUbegdo1R4zBDaQ/CLk1mCz2W3fYdJjWYKBskg==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jlKxpDhWj/u60ASyPYqcaJcxELoSjAM+MKFFIiN8fYsfeK22pryt+Zsk6qXdGmnFd6lvEuqkNMXLkP+YcUrDenoiXCmqRUvE7xuCD3hEDe92o3A27JIwJhCdCE84NgsF4HMcH0fypfn9wmE84T09JzPP/sVTr/kywIO1GQfjv73KgH4HSbZAzJpFFuNPQgfX6BUwoFrewgIV4Vf1+m4g1XHWgH65ia62ffwAJeXqyeWnxF0DsbzpRmtsTDgihuN5aROb6KOsyMXQGttH7p/asmPV32tbe4V8z7ncb3DfnNBHmtKXxBj9q+IG3m+o1u4TD4W5Wf99OEgvwHdGs6mmhw==
  • Cc: Jason Andryuk <jason.andryuk@xxxxxxx>, "Daniel P. Smith" <dpsmith@xxxxxxxxxxxxxxxxxxxx>, Anthony PERARD <anthony.perard@xxxxxxxxxx>
  • Delivery-date: Fri, 26 Apr 2024 18:52:35 +0000
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

An XSM hook for get_dom0_console is currently missing.  Using XSM with
a PVH dom0 shows:
(XEN) FLASK: Denying unknown platform_op: 64.

Wire up the hook, and allow it for dom0.

Fixes: 4dd160583c ("x86/platform: introduce hypercall to get initial video 
console settings")
Signed-off-by: Jason Andryuk <jason.andryuk@xxxxxxx>
---
 tools/flask/policy/modules/dom0.te  | 2 +-
 xen/xsm/flask/hooks.c               | 4 ++++
 xen/xsm/flask/policy/access_vectors | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/flask/policy/modules/dom0.te 
b/tools/flask/policy/modules/dom0.te
index f1dcff48e2..16b8c9646d 100644
--- a/tools/flask/policy/modules/dom0.te
+++ b/tools/flask/policy/modules/dom0.te
@@ -16,7 +16,7 @@ allow dom0_t xen_t:xen {
 allow dom0_t xen_t:xen2 {
        resource_op psr_cmt_op psr_alloc pmu_ctrl get_symbol
        get_cpu_levelling_caps get_cpu_featureset livepatch_op
-       coverage_op
+       coverage_op get_dom0_console
 };
 
 # Allow dom0 to use all XENVER_ subops that have checks.
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 78225f68c1..5e88c71b8e 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1558,6 +1558,10 @@ static int cf_check flask_platform_op(uint32_t op)
         return avc_has_perm(domain_sid(current->domain), SECINITSID_XEN,
                             SECCLASS_XEN2, XEN2__GET_SYMBOL, NULL);
 
+    case XENPF_get_dom0_console:
+        return avc_has_perm(domain_sid(current->domain), SECINITSID_XEN,
+                            SECCLASS_XEN2, XEN2__GET_DOM0_CONSOLE, NULL);
+
     default:
         return avc_unknown_permission("platform_op", op);
     }
diff --git a/xen/xsm/flask/policy/access_vectors 
b/xen/xsm/flask/policy/access_vectors
index 4e6710a63e..a35e3d4c51 100644
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -99,6 +99,8 @@ class xen2
     livepatch_op
 # XEN_SYSCTL_coverage_op
     coverage_op
+# XENPF_get_dom0_console
+    get_dom0_console
 }
 
 # Classes domain and domain2 consist of operations that a domain performs on
-- 
2.44.0




 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.