aboutsummaryrefslogtreecommitdiffstats
path: root/tools/flask
Commit message (Collapse)AuthorAgeFilesLines
* flask: move policy headers into hypervisorDaniel De Graaf2013-01-104-47/+6
| | | | | | | | | | Rather than keeping around headers that are autogenerated in order to avoid adding build dependencies from xen/ to files in tools/, move the relevant parts of the FLASK policy into the hypervisor tree and generate the headers as part of the hypervisor's build. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* libxl: introduce XSM relabel on buildDaniel De Graaf2012-12-132-13/+53
| | | | | | | | | | | | | | | | | | | | | | Allow a domain to be built under one security label and run using a different label. This can be used to prevent the domain builder or control domain from having the ability to access a guest domain's memory via map_foreign_range except during the build process where this is required. Example domain configuration snippet: seclabel='customer_1:vm_r:nomigrate_t' init_seclabel='customer_1:vm_r:nomigrate_t_building' Note: this does not provide complete protection from a malicious dom0; mappings created during the build process may persist after the relabel, and could be used to indirectly access the guest's memory. However, if dom0 correctly unmaps the domain upon building, a the domU is protected against dom0 becoming malicious in the future. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xsm/flask: add domain relabel supportDaniel De Graaf2012-09-173-1/+9
| | | | | | | | | | | | | | | | This adds the ability to change a domain's XSM label after creation. The new label will be used for all future access checks; however, existing event channels and memory mappings will remain valid even if their creation would be denied by the new label. With appropriate security policy and hooks in the domain builder, this can be used to create domains that the domain builder does not have access to after building. It can also be used to allow a domain to drop privileges - for example, prior to launching a user-supplied kernel loaded by a pv-grub stubdom. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove unneeded create_sid fieldDaniel De Graaf2012-09-171-2/+0
| | | | | | | | | This field was only used to populate the ssid of dom0, which can be handled explicitly in the domain creation hook. This also removes the unnecessary permission check on the creation of dom0. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove inherited class attributesDaniel De Graaf2012-09-173-106/+2
| | | | | | | | | | | The ability to declare common permission blocks shared across multiple classes is not currently used in Xen. Currently, support for this feature is broken in the header generation scripts, and it is not expected that this feature will be used in the future, so remove the dead code. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: add accesses used by newer dom0sDaniel De Graaf2012-08-222-3/+3
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: add device model types to example policyDaniel De Graaf2012-02-092-1/+23
| | | | | | | This adds an example user for device_model_stubdomain_seclabel. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools/flask: remove libflaskDaniel De Graaf2012-02-0611-709/+25
| | | | | | | | This library has been deprecated since July 2010; remove the in-tree users and library. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: Add boolean exampleDaniel De Graaf2012-02-021-1/+9
| | | | | | | | | This shows an example boolean (prot_doms_locked) which can be set at runtime to prevent dom0 from mapping memory of domains of type prot_domU_t. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask: add flask-{get,set}-bool toolsDaniel De Graaf2012-02-023-1/+169
| | | | | | | | | | | These utilities can be used to modify policy booleans, which allow minor policy changes without reloading the security policy. This can be used to make security policy change based on external information such as time of day, user physical presence, completion of system boot, or other relevant variables. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* libflask: Add boolean manipulation functionsDaniel De Graaf2012-02-022-0/+62
| | | | | | | Add wrappers for getting and setting policy booleans by name or ID. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: use declare_domain for dom0_tDaniel De Graaf2012-02-022-5/+3
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: Add user and constraint examplesDaniel De Graaf2012-02-023-18/+39
| | | | | | | | | These examples show how to use constraints and the user field of the security label to prevent communication between virtual machines of different customers in a multi-tenant environment. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: Policy build updatesDaniel De Graaf2012-02-023-63/+20
| | | | | | | | | | Eliminate temporary files used in creating FLASK policy to improve error reporting during policy build. Syntax errors now point to the file and line number visible to the user, not the intermediate temporary file. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: allow global VIRQ handlers to be delegated to other domainsDaniel De Graaf2012-01-281-0/+1
| | | | | | | | | | | | | | | | | This patch sends global VIRQs to a domain designated as the VIRQ handler instead of sending all global VIRQ events to dom0. This is required in order to run xenstored in a stubdom, because VIRQ_DOM_EXC must be sent to xenstored for domain destruction to work properly. This patch was inspired by the xenstored stubdomain patch series sent to xen-devel by Alex Zeffertt in 2009. Signed-off-by: Diego Ongaro <diego.ongaro@citrix.com> Signed-off-by: Alex Zeffertt <alex.zeffertt@eu.citrix.com> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: add missing manage_domain rulesDaniel De Graaf2012-01-102-0/+9
| | | | | | | | The updated example policy did not include rules to allow managing the created domains (pause, unpause, destroy); allow these actions. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* docs: Update xsm-flask documentationDaniel De Graaf2012-01-101-1/+1
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* flask/policy: Update example policyDaniel De Graaf2011-12-202-152/+178
| | | | | | | | Rewrite the example policy to make it easier to understand and demonstrate some of the security goals that FLASK can enforce. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* xsm: Add missing access checksDaniel De Graaf2011-12-181-0/+14
| | | | | | | | | Actions requiring IS_PRIV should also require some XSM access control in order for XSM to be useful in confining multiple privileged domains. Add XSM hooks for new hypercalls and sub-commands that are under IS_PRIV but not currently under any access checks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* xsm: add remote_remap permissionDaniel De Graaf2011-12-181-0/+1
| | | | | | | | The mmu_update hypercall can be used to manipulate the page tables of a remote domain. Add a check for this in the XSM hook in addition to the existing check on mapping pages of a remote domain. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* flask: Fix 32-bit compilation of label-pci toolDaniel De Graaf2011-12-051-8/+9
| | | | | | | | | | The 32-bit tools need to support 64-bit addresses, so use the correct printf/scanf formats. Also, some systems declare fscanf with attribute warn_unused_result, so check the result instead of relying on the value of start being unmodified across a failed call. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask: Add flask-label-pci toolDaniel De Graaf2011-12-022-1/+127
| | | | | | | | | This allows a PCI device and its associated resources to be labeled without hardcoding addresses (which may change from system to system) in the security policy. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: clean up initial SIDsDaniel De Graaf2011-12-023-9/+7
| | | | | | | | | | The domU SID is never used before a policy load, and so does not belong in the initial_sids list. The PIRQ SID is now incorrectly named; it should simply be called IRQ. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: remove unused xsm_assign_vector checkDaniel De Graaf2011-12-023-3/+0
| | | | | | | | The PHYSDEVOP_alloc_irq_vector hypercall is a noop, so its XSM check is not useful. Remove it and the "event vector" FLASK permission. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask: Fix policy build with new checkpolicyDaniel De Graaf2011-12-021-0/+1
| | | | | | | | | Version 26 of checkpolicy (shipped with Fedora 16) now requires that roles be declared prior to setting types for a role. Add a declaration of the system_r role to fix the build of default XSM/FLASK policy. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Add support for HVMOP_track_dirty_vram.Jean Guyader2011-11-082-1/+2
| | | | | | | | | Xen try to inforce the xsm policy when a HVMOP_track_dirty_vram is received (xen/arch/x86/hvm/hvm.c:3637). It was failing because in flask_hvmcontext, xsm didn't have any case for this operation. Signed-off-by: Jean Guyader <jean.guyader@eu.citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* tools: remove pattern matched linking rulesIan Campbell2011-03-311-4/+7
| | | | | | | | | Most subdirs only build a single tool to start with and those which build multiple tools often have different linkage requirements. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: Remove $(CFLAGS) from links lines.Ian Campbell2011-03-312-2/+2
| | | | | | | | The relevant variable in these circumstances is called $(LDFLAGS). Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: drop further uses of -Wp,-MD,.$(@F).d to generate dependencies.Ian Campbell2011-03-231-3/+0
| | | | | | | | | | 19025:bd78714b8594 switched to "-MMD -MF" in preference, adding the correct runes to tools/Rules.mk but appears to have missed some other uses of -Wp,... Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: flask: remove $(LOADLIBES)Ian Campbell2011-03-231-1/+1
| | | | | | | | | Probably a typo and never defined, I can't tell what it was supposed to be. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: flask: Remove BASECFLAGS, just use CFLAGSIan Campbell2011-03-231-8/+4
| | | | | | Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: consistently use $({CFLAGS,LDLIBS}_libxenctrl) instead of open coding.Ian Campbell2011-03-212-8/+4
| | | | | | Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: consistently use $(CFLAGS_xeninclude) instead of open coding.Ian Campbell2011-03-212-2/+1
| | | | | | | | Renamed from the slightly ambiguous CFLAGS_include. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: remove unnecessary uses of -I.Ian Campbell2011-03-211-1/+0
| | | | | | | | | | It's not needed unless you are including headers in the current directory _and_ you can't use "" instead of <> because the headers are to be installed. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: remove unnecessary uses of -L.Ian Campbell2011-03-212-2/+1
| | | | | | | | | It's not needed unless you are linking against a library in the current directory. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: Drop use of $(INCLUDES)Ian Campbell2011-03-211-1/+1
| | | | | | | | | | Several places include it in CFLAGS even though it is never defined. A few others use it as nothing more than a gathering point for CFLAGS. Get rid of it. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* build: Make XEN_ROOT an absolute path.Keir Fraser2011-03-173-3/+3
| | | | | | | | Otherwise make can search the path relative to certain standard paths such as /usr/include (e.g., the line '-include $(XEN_ROOT)/.config' in Config.mk suffers from this). Signed-off-by: Keir Fraser <keir@xen.org>
* xsm/flask: Fix permission tablesKeir Fraser2011-02-061-0/+2
| | | | | | | | | | | | | | | | | | At some point, it seems that someone manually added Flask permission definitions to one header file without updating the corresponding policy configuration or the other related table. The end result is that we can get uninterpretable AVC messages like this: # xl dmesg | grep avc (XEN) avc: denied { 0x4000000 } for domid=0 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain Fix this by updating the flask config and regenerating the headers from it. In the future, this can be further improved by integrating the automatic generation of the headers into the build process as is presently done in SELinux. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* split LDLIBS from LDFLAGS to fix link errors in recent toolchainsStefano Stabellini2010-08-112-3/+3
| | | | | | | | | | | | | | | | Linker command lines are order-sensitive. Move linker options -Lfoo -lfoo from LDFLAGS to LDLIBS and place this new variable after the objects to link. This resolves build errors in xenpagin and blktap with recent toolchains. rename SHLIB_CFLAGS to SHLIB_LDFLAGS rename LDFLAGS_* to LDLIBS_* move LDFLAGS usage after CFLAGS in CC calls remove stale comments in xenpaging Makefile Signed-off-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
* libxc: eliminate static variables, use xentoollog; API changeKeir Fraser2010-05-285-48/+48
| | | | | | | | | | | | | | | | | | | | This patch eliminate the global variables in libxenctrl (used for logging and error reporting). Instead the information which was in the global variables is now in a new xc_interface* opaque structure, which xc_interface open returns instead of the raw file descriptor; furthermore, logging is done via xentoollog. There are three new parameters to xc_interface_open to control the logging, but existing callers can just pass "0" for all three to get the old behaviour. All libxc callers have been adjusted accordingly. Also update QEMU_TAG for corresponding qemu change. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* Fix Makefile targets that generate several files at onceKeir Fraser2010-03-051-2/+4
| | | | | | | | | | | | | | | | | | | | In a few places in the tree the Makefiles have constructs like this: one_file another_file: $(COMMAND_WHICH_GENERATES_BOTH_AT_ONCE) This is wrong, because make will run _two copies_ of the same command at once. This generally causes races and hard-to-reproduce build failures. Notably, `make -j4' at the top level will build stubdom libxc twice simultaneously! In this patch we replace the occurrences of this construct with the correct idiom: one_file: another_file another_file: $(COMMAND_WHICH_GENERATES_BOTH_AT_ONCE) Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools/xsm: Expose Flask XSM AVC functions to user-spaceKeir Fraser2010-01-266-8/+175
| | | | | | | | | | | This patch exposes the flask_access, flask_avc_cachestats, flask_avc_hashstats, flask_getavc_threshold, flask_setavc_threshold, and flask_policyvers functions to user-space. A python wrapper was created for the flask_access function to facilitate policy based user-space access control decisions. flask.h was renamed to libflask.h to remove a naming conflict. Signed-off-by : Machon Gregory <mbgrego@tycho.ncsc.mil>
* xsm: Change format strings from signed to unsignedKeir Fraser2009-11-231-6/+6
| | | | | | ...to reflect the variables being passed in. Signed-off-by : Paul Nuzzi <pjnuzzi@tycho.ncsc.mil>
* xsm: Dynamic update to device ocontextsKeir Fraser2009-11-134-1/+255
| | | | | | | | | | | | | | Added the ability to add and delete ocontexts dynamically on a running system. Two new commands have been added to the xsm hypercall, add and delete ocontext. Twelve new library functions have been implemented that use the hypercall commands to label and unlabel pirqs, PCI devices, I/O ports and memory. The base policy has been updated so dom0 has the ability to use the hypercall commands by default. Items added to the list will not be present next time the system reloads. They will need to be added to the static policy. Signed-off-by : George Coker <gscoker@alpha.ncsc.mil> Signed-off-by : Paul Nuzzi <pjnuzzi@tycho.ncsc.mil>
* xsm: Add support for Xen device policiesKeir Fraser2009-10-273-1/+81
| | | | | | | | | | | | | Add support for Xen ocontext records to enable device polices. The default policy will not be changed and instructions have been added to enable the new functionality. Examples on how to use the new policy language have been added but commented out. The newest version of checkpolicy (>= 2.0.20) and libsepol (>= 2.0.39) is needed in order to compile it. Devices can be labeled and enforced using the following new commands; pirqcon, iomemcon, ioportcon and pcidevicecon. Signed-off-by : George Coker <gscoker@alpha.ncsc.mil> Signed-off-by : Paul Nuzzi <pjnuzzi@tycho.ncsc.mil>
* xsm: Add getenforce and setenforce functionality to toolsKeir Fraser2009-10-237-6/+183
| | | | | | | | This patch exposes the getenforce and setenforce functionality for the Flask XSM module. Signed-off-by : Machon Gregory <mbgrego@tycho.ncsc.mil> Signed-off-by : George S. Coker, II <gscoker@alpha.ncsc.mil>
* tools/flask/policy: Updates to policy and policy build infrastructureKeir Fraser2009-08-2012-1217/+342
| | | | | | | | | | | | | | | The original xen policy infrastructure was based off of an early version of refpolicy. Because of this there was a lot of cruft that does not apply to building a policy for xen. This patch does several things. First it cleans up the makefile as to remove many unnecessary build targets. Second it fixes an issue that the policy build process wasn't handling interface files properly. Third it pulls in the MLS suppport functions from current ref policy and makes use of them. Finally it updates the xen policy with new rules to address changes in xen since the policy was last worked on, and provides several new abstractions for creating domains. Signed-off-by: David P. Quigley <dpquigl@tycho.nsa.gov>
* Update Xen Flask module to policy.24.Keir Fraser2009-08-191-1/+1
| | | | | | | | | | This is a back-port of the latest SELinux code to Xen, adjusted for Xen coding style and interfaces. Unneeded functionality such as most object context config data, handle_unknown, MLS field defaulting, etc has been omitted. Signed-off-by: Stephen D. Smalley <sds@tycho.nsa.gov> Signed-off-by: George S. Coker, II <gscoker@alpha.ncsc.mil>
* tools: clean up handling of xen config and scripts directories.Keir Fraser2009-05-191-1/+1
| | | | | | | For now hardcode /etc w/o a prefix as there are hardcoded config paths in the code which would break otherwise. Signed-off-by: Christoph Egger <Christoph.Egger@amd.com>
* Use -MMD -MF in tools/* rather than -Wp,-M...Keir Fraser2009-01-122-6/+2
| | | | | | | | | | | | | | | | | | | | | | If you use -MMD -MF then the correct .o filename is written to the .*.d file as the compiler driver arranges everything. This was done in 19010:275abe1c5d24 for the hypervisor. In this patch we do the same elsewhere in the xen-unstable tree, particularly tools/. Specifically: * Change tools/Rules.mk to add -MMD -MF ... to CFLAGS and set DEPS. * Remove -Wp,-MD... from every other Makefile * Remove setting of DEPS from every other Makefile * Ensure that every Makefile says -include $(DEPS) * Ensure that every Makefile's clean target removes $(DEPS) Some Makefiles were already halfway there, but often for a different variable name eg PROG_DEP. The variable name is now standardised in Rules.mk as DEPS. I have done a test build with this change, on Debian etch. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 09:47:17 +0000