aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--tools/flask/policy/policy/flask/access_vectors7
-rw-r--r--tools/flask/policy/policy/flask/security_classes1
-rw-r--r--tools/flask/policy/policy/modules/xen/xen.te2
-rw-r--r--xen/include/public/xsm/flask_op.h8
-rw-r--r--xen/xsm/flask/flask_op.c49
-rw-r--r--xen/xsm/flask/include/av_perm_to_string.h3
-rw-r--r--xen/xsm/flask/include/av_permissions.h4
-rw-r--r--xen/xsm/flask/include/class_to_string.h1
-rw-r--r--xen/xsm/flask/include/flask.h15
9 files changed, 82 insertions, 8 deletions
diff --git a/tools/flask/policy/policy/flask/access_vectors b/tools/flask/policy/policy/flask/access_vectors
index a884312b01..c7e29abb32 100644
--- a/tools/flask/policy/policy/flask/access_vectors
+++ b/tools/flask/policy/policy/flask/access_vectors
@@ -73,6 +73,13 @@ class domain
set_virq_handler
}
+class domain2
+{
+ relabelfrom
+ relabelto
+ relabelself
+}
+
class hvm
{
sethvmc
diff --git a/tools/flask/policy/policy/flask/security_classes b/tools/flask/policy/policy/flask/security_classes
index 2ca35d277b..ef134a7457 100644
--- a/tools/flask/policy/policy/flask/security_classes
+++ b/tools/flask/policy/policy/flask/security_classes
@@ -9,6 +9,7 @@
class xen
class domain
+class domain2
class hvm
class mmu
class resource
diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te
index 9cc5240b5c..9550397f8e 100644
--- a/tools/flask/policy/policy/modules/xen/xen.te
+++ b/tools/flask/policy/policy/modules/xen/xen.te
@@ -169,7 +169,7 @@ delegate_devices(dom0_t, domU_t)
################################################################################
# Domains must be declared using domain_type
-neverallow * ~domain_type:domain create;
+neverallow * ~domain_type:domain { create transition };
# Resources must be declared using resource_type
neverallow * ~resource_type:resource use;
diff --git a/xen/include/public/xsm/flask_op.h b/xen/include/public/xsm/flask_op.h
index 1a251c9e01..233de8120b 100644
--- a/xen/include/public/xsm/flask_op.h
+++ b/xen/include/public/xsm/flask_op.h
@@ -142,6 +142,12 @@ struct xen_flask_peersid {
uint32_t sid;
};
+struct xen_flask_relabel {
+ /* IN */
+ uint32_t domid;
+ uint32_t sid;
+};
+
struct xen_flask_op {
uint32_t cmd;
#define FLASK_LOAD 1
@@ -167,6 +173,7 @@ struct xen_flask_op {
#define FLASK_ADD_OCONTEXT 21
#define FLASK_DEL_OCONTEXT 22
#define FLASK_GET_PEER_SID 23
+#define FLASK_RELABEL_DOMAIN 24
uint32_t interface_version; /* XEN_FLASK_INTERFACE_VERSION */
union {
struct xen_flask_load load;
@@ -185,6 +192,7 @@ struct xen_flask_op {
/* FLASK_ADD_OCONTEXT, FLASK_DEL_OCONTEXT */
struct xen_flask_ocontext ocontext;
struct xen_flask_peersid peersid;
+ struct xen_flask_relabel relabel;
} u;
};
typedef struct xen_flask_op xen_flask_op_t;
diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c
index bd4db3792c..9c8dfe76dd 100644
--- a/xen/xsm/flask/flask_op.c
+++ b/xen/xsm/flask/flask_op.c
@@ -573,6 +573,51 @@ static int flask_get_peer_sid(struct xen_flask_peersid *arg)
return rv;
}
+static int flask_relabel_domain(struct xen_flask_relabel *arg)
+{
+ int rc;
+ struct domain *d;
+ struct domain_security_struct *csec = current->domain->ssid;
+ struct domain_security_struct *dsec;
+ struct avc_audit_data ad;
+ AVC_AUDIT_DATA_INIT(&ad, NONE);
+
+ d = rcu_lock_domain_by_any_id(arg->domid);
+ if ( d == NULL )
+ return -ESRCH;
+
+ ad.sdom = current->domain;
+ ad.tdom = d;
+ dsec = d->ssid;
+
+ if ( arg->domid == DOMID_SELF )
+ {
+ rc = avc_has_perm(dsec->sid, arg->sid, SECCLASS_DOMAIN2, DOMAIN2__RELABELSELF, &ad);
+ if ( rc )
+ goto out;
+ }
+ else
+ {
+ rc = avc_has_perm(csec->sid, dsec->sid, SECCLASS_DOMAIN2, DOMAIN2__RELABELFROM, &ad);
+ if ( rc )
+ goto out;
+
+ rc = avc_has_perm(csec->sid, arg->sid, SECCLASS_DOMAIN2, DOMAIN2__RELABELTO, &ad);
+ if ( rc )
+ goto out;
+ }
+
+ rc = avc_has_perm(dsec->sid, arg->sid, SECCLASS_DOMAIN, DOMAIN__TRANSITION, &ad);
+ if ( rc )
+ goto out;
+
+ dsec->sid = arg->sid;
+
+ out:
+ rcu_unlock_domain(d);
+ return rc;
+}
+
long do_flask_op(XEN_GUEST_HANDLE(xsm_op_t) u_flask_op)
{
xen_flask_op_t op;
@@ -680,6 +725,10 @@ long do_flask_op(XEN_GUEST_HANDLE(xsm_op_t) u_flask_op)
rv = flask_get_peer_sid(&op.u.peersid);
break;
+ case FLASK_RELABEL_DOMAIN:
+ rv = flask_relabel_domain(&op.u.relabel);
+ break;
+
default:
rv = -ENOSYS;
}
diff --git a/xen/xsm/flask/include/av_perm_to_string.h b/xen/xsm/flask/include/av_perm_to_string.h
index 17a1c3695a..e7e20589f9 100644
--- a/xen/xsm/flask/include/av_perm_to_string.h
+++ b/xen/xsm/flask/include/av_perm_to_string.h
@@ -61,6 +61,9 @@
S_(SECCLASS_DOMAIN, DOMAIN__SETPODTARGET, "setpodtarget")
S_(SECCLASS_DOMAIN, DOMAIN__SET_MISC_INFO, "set_misc_info")
S_(SECCLASS_DOMAIN, DOMAIN__SET_VIRQ_HANDLER, "set_virq_handler")
+ S_(SECCLASS_DOMAIN2, DOMAIN2__RELABELFROM, "relabelfrom")
+ S_(SECCLASS_DOMAIN2, DOMAIN2__RELABELTO, "relabelto")
+ S_(SECCLASS_DOMAIN2, DOMAIN2__RELABELSELF, "relabelself")
S_(SECCLASS_HVM, HVM__SETHVMC, "sethvmc")
S_(SECCLASS_HVM, HVM__GETHVMC, "gethvmc")
S_(SECCLASS_HVM, HVM__SETPARAM, "setparam")
diff --git a/xen/xsm/flask/include/av_permissions.h b/xen/xsm/flask/include/av_permissions.h
index 42eaf81921..cb1c5dcdd6 100644
--- a/xen/xsm/flask/include/av_permissions.h
+++ b/xen/xsm/flask/include/av_permissions.h
@@ -63,6 +63,10 @@
#define DOMAIN__SET_MISC_INFO 0x40000000UL
#define DOMAIN__SET_VIRQ_HANDLER 0x80000000UL
+#define DOMAIN2__RELABELFROM 0x00000001UL
+#define DOMAIN2__RELABELTO 0x00000002UL
+#define DOMAIN2__RELABELSELF 0x00000004UL
+
#define HVM__SETHVMC 0x00000001UL
#define HVM__GETHVMC 0x00000002UL
#define HVM__SETPARAM 0x00000004UL
diff --git a/xen/xsm/flask/include/class_to_string.h b/xen/xsm/flask/include/class_to_string.h
index ab55700c4d..7716645f63 100644
--- a/xen/xsm/flask/include/class_to_string.h
+++ b/xen/xsm/flask/include/class_to_string.h
@@ -5,6 +5,7 @@
S_("null")
S_("xen")
S_("domain")
+ S_("domain2")
S_("hvm")
S_("mmu")
S_("resource")
diff --git a/xen/xsm/flask/include/flask.h b/xen/xsm/flask/include/flask.h
index 6d29c5a0ef..3bff99890f 100644
--- a/xen/xsm/flask/include/flask.h
+++ b/xen/xsm/flask/include/flask.h
@@ -7,13 +7,14 @@
*/
#define SECCLASS_XEN 1
#define SECCLASS_DOMAIN 2
-#define SECCLASS_HVM 3
-#define SECCLASS_MMU 4
-#define SECCLASS_RESOURCE 5
-#define SECCLASS_SHADOW 6
-#define SECCLASS_EVENT 7
-#define SECCLASS_GRANT 8
-#define SECCLASS_SECURITY 9
+#define SECCLASS_DOMAIN2 3
+#define SECCLASS_HVM 4
+#define SECCLASS_MMU 5
+#define SECCLASS_RESOURCE 6
+#define SECCLASS_SHADOW 7
+#define SECCLASS_EVENT 8
+#define SECCLASS_GRANT 9
+#define SECCLASS_SECURITY 10
/*
* Security identifier indices for initial entities
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-09 13:40:35 +0000