diff options
| author | Daniel De Graaf <dgdegra@tycho.nsa.gov> | 2013-05-07 16:49:18 +0200 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-05-07 16:49:18 +0200 |
| commit | 919f59b3b99e1d845c6a1f30125e79e828805d87 (patch) | |
| tree | aa20c9a715a12b2ba54bf9ec992a7f4a507c4bb7 /xen/xsm | |
| parent | 013e34f5a61725012467f17650597d351fc0ca99 (diff) | |
| download | xen-919f59b3b99e1d845c6a1f30125e79e828805d87.tar.gz xen-919f59b3b99e1d845c6a1f30125e79e828805d87.tar.bz2 xen-919f59b3b99e1d845c6a1f30125e79e828805d87.zip | |
xsm: add hooks for claim
Adds XSM hooks for the recently introduced XENMEM_claim_pages and
XENMEM_get_outstanding_pages operations, and adds FLASK access vectors
for them. This makes the access control decisions for these operations
match those in the rest of the hypervisor.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release)
Acked-by: Keir Fraser <keir@xen.org>
Diffstat (limited to 'xen/xsm')
| -rw-r--r-- | xen/xsm/dummy.c | 2 | ||||
| -rw-r--r-- | xen/xsm/flask/hooks.c | 13 | ||||
| -rw-r--r-- | xen/xsm/flask/policy/access_vectors | 4 |
3 files changed, 18 insertions, 1 deletions
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index f7b0399c2c..3d84e73110 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -66,6 +66,8 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, memory_adjust_reservation); set_to_dummy_if_null(ops, memory_stat_reservation); set_to_dummy_if_null(ops, memory_pin_page); + set_to_dummy_if_null(ops, claim_pages); + set_to_dummy_if_null(ops, xenmem_get_outstanding_pages); set_to_dummy_if_null(ops, console_io); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 04c8a3913e..3291aa2e6c 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -417,6 +417,17 @@ static int flask_memory_pin_page(struct domain *d1, struct domain *d2, return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__PINPAGE); } +static int flask_claim_pages(struct domain *d) +{ + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SETCLAIM); +} + +static int flask_xenmem_get_outstanding_pages(void) +{ + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN, + XEN__HEAP, NULL); +} + static int flask_console_io(struct domain *d, int cmd) { u32 perm; @@ -1485,6 +1496,8 @@ static struct xsm_operations flask_ops = { .memory_adjust_reservation = flask_memory_adjust_reservation, .memory_stat_reservation = flask_memory_stat_reservation, .memory_pin_page = flask_memory_pin_page, + .claim_pages = flask_claim_pages, + .xenmem_get_outstanding_pages = flask_xenmem_get_outstanding_pages, .console_io = flask_console_io, diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index c8ae8060cd..544c3bae0f 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -54,7 +54,7 @@ class xen debug # XEN_SYSCTL_getcpuinfo, XENPF_get_cpu_version, XENPF_get_cpuinfo getcpuinfo -# XEN_SYSCTL_availheap +# XEN_SYSCTL_availheap, XENMEM_get_outstanding_pages heap # XEN_SYSCTL_get_pmstat, XEN_SYSCTL_pm_op, XENPF_set_processor_pminfo, # XENPF_core_parking @@ -192,6 +192,8 @@ class domain2 settsc # XEN_DOMCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_putinfo setscheduler +# XENMEM_claim_pages + setclaim } # Similar to class domain, but primarily contains domctls related to HVM domains |