diff options
author | Daniel De Graaf <dgdegra@tycho.nsa.gov> | 2012-02-02 15:18:19 +0000 |
---|---|---|
committer | Daniel De Graaf <dgdegra@tycho.nsa.gov> | 2012-02-02 15:18:19 +0000 |
commit | f2aba4f387b67238cd3293167ee3ee6b674d5b4f (patch) | |
tree | 3df81d4ee5cdb96a508abc490f591ed61f3f53b9 /xen/xsm | |
parent | 99b70ee44e330cac545b13eae7085baffeb74ac0 (diff) | |
download | xen-f2aba4f387b67238cd3293167ee3ee6b674d5b4f.tar.gz xen-f2aba4f387b67238cd3293167ee3ee6b674d5b4f.tar.bz2 xen-f2aba4f387b67238cd3293167ee3ee6b674d5b4f.zip |
xsm: Add xsm_map_domain_pirq hook
When checking permissions in map_domain_pirq, the msi_desc field of
the irq_desc is not yet populated with the PCI device being used. Pass
in the msi_info structure which contains the intended PCI device whose
label will be used in the security check.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>
Diffstat (limited to 'xen/xsm')
-rw-r--r-- | xen/xsm/dummy.c | 6 | ||||
-rw-r--r-- | xen/xsm/flask/hooks.c | 37 |
2 files changed, 43 insertions, 0 deletions
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 83e5dba811..7027ee79c5 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -375,6 +375,11 @@ static char *dummy_show_irq_sid (int irq) return NULL; } +static int dummy_map_domain_pirq (struct domain *d, int irq, void *data) +{ + return 0; +} + static int dummy_irq_permission (struct domain *d, int pirq, uint8_t allow) { return 0; @@ -660,6 +665,7 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, schedop_shutdown); set_to_dummy_if_null(ops, show_irq_sid); + set_to_dummy_if_null(ops, map_domain_pirq); set_to_dummy_if_null(ops, irq_permission); set_to_dummy_if_null(ops, iomem_permission); set_to_dummy_if_null(ops, pci_config_permission); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 0dbf19d7f8..a0959157e4 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -757,6 +757,42 @@ static char *flask_show_irq_sid (int irq) return ctx; } +static int flask_map_domain_pirq (struct domain *d, int irq, void *data) +{ + u32 sid; + int rc = -EPERM; + struct msi_info *msi = data; + + struct domain_security_struct *ssec, *tsec; + struct avc_audit_data ad; + + rc = domain_has_perm(current->domain, d, SECCLASS_RESOURCE, RESOURCE__ADD); + + if ( rc ) + return rc; + + if ( irq >= nr_irqs_gsi && msi ) { + u32 machine_bdf = (msi->seg << 16) | (msi->bus << 8) | msi->devfn; + AVC_AUDIT_DATA_INIT(&ad, DEV); + ad.device = machine_bdf; + rc = security_device_sid(machine_bdf, &sid); + } else { + rc = get_irq_sid(irq, &sid, &ad); + } + if ( rc ) + return rc; + + ssec = current->domain->ssid; + tsec = d->ssid; + + rc = avc_has_perm(ssec->sid, sid, SECCLASS_RESOURCE, RESOURCE__ADD_IRQ, &ad); + if ( rc ) + return rc; + + rc = avc_has_perm(tsec->sid, sid, SECCLASS_RESOURCE, RESOURCE__USE, &ad); + return rc; +} + static int flask_irq_permission (struct domain *d, int irq, uint8_t access) { u32 perm; @@ -1582,6 +1618,7 @@ static struct xsm_operations flask_ops = { .show_irq_sid = flask_show_irq_sid, + .map_domain_pirq = flask_map_domain_pirq, .irq_permission = flask_irq_permission, .iomem_permission = flask_iomem_permission, .pci_config_permission = flask_pci_config_permission, |