aboutsummaryrefslogtreecommitdiffstats
path: root/tools/flask
Commit message (Collapse)AuthorAgeFilesLines
* Add DOMCTL to limit the number of event channels a domain may useDavid Vrabel2013-10-142-2/+2
| | | | | | | | | | | | | | | Add XEN_DOMCTL_set_max_evtchn which may be used during domain creation to set the maximum event channel port a domain may use. This may be used to limit the amount of Xen resources (global mapping space and xenheap) that a domain may use for event channels. A domain that does not have a limit set may use all the event channels supported by the event channel ABI in use. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Keir Fraser <keir@xen.org>
* flask: use DESTDIR directly in install target rulesVadim A. Misbakh-Soloviov2013-08-021-3/+3
| | | | | | | | | | 30.07.2013 13:51, Ian Campbell wrote: > I think it would be a bit less surprising for drive by patchers etc to > remove the DESTDIR from POLICY_LOADPATH and add it to the install > target, which is the usual way to do things. Up to you/Vadim though. Signed-off-by: Vadim A. Misbakh-Soloviov <mva@mva.name> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* flask: avoid installing policy file as '/boot'Vadim A. Misbakh-Soloviov2013-08-021-0/+1
| | | | | Signed-off-by: Vadim A. Misbakh-Soloviov <mva@mva.name> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* flask/policy: device model stubdom fixesDaniel De Graaf2013-06-121-1/+1
| | | | | | | | | This fixes framebuffer support for device model stubdoms after 3f28d007 which added the target_hack permission but did not allow the permission to the stubdom it was created for. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com>
* xsm: add hooks for claimDaniel De Graaf2013-05-071-1/+1
| | | | | | | | | | | Adds XSM hooks for the recently introduced XENMEM_claim_pages and XENMEM_get_outstanding_pages operations, and adds FLASK access vectors for them. This makes the access control decisions for these operations match those in the rest of the hypervisor. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release) Acked-by: Keir Fraser <keir@xen.org>
* x86/hvm: convert access check for nested HVM to XSMDaniel De Graaf2013-04-231-1/+2
| | | | | | | | | | | | This adds an XSM hook for enabling nested HVM support, replacing an IS_PRIV check. This hook is a partial duplicate with the xsm_hvm_param hook, but using the existing hook would require adding the index to the hook and would require the use of a custom hook for the xsm-disabled case (using XSM_OTHER, which is less immediately readable) - whereas adding a new hook retains the clarity of the existing code. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)
* xen: allow for explicitly specifying node-affinityDario Faggioli2013-04-173-6/+6
| | | | | | | | | | | | | | | Make it possible to pass the node-affinity of a domain to the hypervisor from the upper layers, instead of always being computed automatically. Note that this also required generalizing the Flask hooks for setting and getting the affinity, so that they now deal with both vcpu and node affinity. Signed-off-by: Dario Faggioli <dario.faggioli@citrix.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: Juergen Gross <juergen.gross@ts.fujitsu.com> Acked-by: Keir Fraser <keir@xen.org>
* tools/flask: add FLASK policy to buildDaniel De Graaf2013-02-221-2/+2
| | | | | | | | This patch enables the compilation of the FLASK policy as part of the tools build if the needed prerequisites are present. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* flask/policy: rework policy build systemDaniel De Graaf2013-02-226-153/+96
| | | | | | | | This adds the ability to define security classes and access vectors in FLASK policy not defined by the hypervisor, for the use of stub domains or applications without their own security policies. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* flask/policy: sort dom0 accessesDaniel De Graaf2013-02-221-12/+48
| | | | | | | | For the example policy shipped with Xen, it makes sense to allow dom0 access to all system calls so that policy does not need to be updated for each new hypervisor or toolstack feature used. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* xen/xsm: distinguish scheduler get/set operationsDaniel De Graaf2013-01-112-5/+5
| | | | | | | | Add getscheduler and setscheduler permissions to replace the monolithic scheduler permission in the scheduler_op domctl and sysctl. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* tmem: add XSM hooksDaniel De Graaf2013-01-111-1/+4
| | | | | | | | | | | This adds a pair of XSM hooks for tmem operations: xsm_tmem_op which controls any use of tmem, and xsm_tmem_control which allows use of the TMEM_CONTROL operations. By default, all domains can use tmem while only IS_PRIV domains can use control operations. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> Committed-by: Keir Fraser <keir@xen.org>
* xen: add XSM hook for XENMEM_exchangeDaniel De Graaf2013-01-111-0/+2
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: use XSM hooks for get_pg_owner access checksDaniel De Graaf2013-01-112-6/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three callers of get_pg_owner: * do_mmuext_op, which does not have XSM hooks on all subfunctions * do_mmu_update, which has hooks that are inefficient * do_update_va_mapping_otherdomain, which has a simple XSM hook In order to preserve return values for the do_mmuext_op hypercall, an additional XSM hook is required to check the operation even for those subfunctions that do not use the pg_owner field. This also covers the MMUEXT_UNPIN_TABLE operation which did previously have an XSM hook. The XSM hooks in do_mmu_update were capable of replacing the checks in get_pg_owner; however, the hooks are buried in the inner loop of the function - not very good for performance when XSM is enabled and these turn in to indirect function calls. This patch removes the PTE from the hooks and replaces it with a bitfield describing what accesses are being requested. The XSM hook can then be called only when additional bits are set instead of once per iteration of the loop. This patch results in a change in the FLASK permissions used for mapping an MMIO page: the target for the permisison check on the memory mapping is no longer resolved to the device-specific type, and is instead either the domain's own type or domio_t (depending on if the domain uses DOMID_SELF or DOMID_IO in the map command). Device-specific access is still controlled via the "resource use" permisison checked at domain creation (or device hotplug). Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: add distinct SIDs for self/target accessDaniel De Graaf2013-01-112-15/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because the FLASK XSM module no longer checks IS_PRIV for remote domain accesses covered by XSM permissions, domains now have the ability to perform memory management and other functions on all domains that have the same type. While it is possible to prevent this by only creating one domain per type, this solution significantly limits the flexibility of the type system. This patch introduces a domain type transition to represent a domain that is operating on itself. In the example policy, this is demonstrated by creating a type with _self appended when declaring a domain type which will be used for reflexive operations. AVCs for a domain of type domU_t will look like the following: scontext=system_u:system_r:domU_t tcontext=system_u:system_r:domU_t_self This change also allows policy to distinguish between event channels a domain creates to itself and event channels created between domains of the same type. The IS_PRIV_FOR check used for device model domains is also no longer checked by FLASK; a similar transition is performed when the target is set and used when the device model accesses its target domain. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: add missing hooksDaniel De Graaf2013-01-111-1/+3
| | | | | | | | The FLASK module was missing implementations of some hooks and did not have access vectors defined for 10 domctls; define these now. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Move flask policy files into hypervisor (missed from earlier commit).Keir Fraser2013-01-115-448/+0
| | | | | | | | | | | Signed-off-by: Keir Fraser <keir@xen.org> --HG-- rename : tools/flask/policy/policy/flask/access_vectors => xen/xsm/flask/policy/access_vectors rename : tools/flask/policy/policy/flask/initial_sids => xen/xsm/flask/policy/initial_sids rename : tools/flask/policy/policy/flask/mkaccess_vector.sh => xen/xsm/flask/policy/mkaccess_vector.sh rename : tools/flask/policy/policy/flask/mkflask.sh => xen/xsm/flask/policy/mkflask.sh rename : tools/flask/policy/policy/flask/security_classes => xen/xsm/flask/policy/security_classes
* flask: move policy headers into hypervisorDaniel De Graaf2013-01-104-47/+6
| | | | | | | | | | Rather than keeping around headers that are autogenerated in order to avoid adding build dependencies from xen/ to files in tools/, move the relevant parts of the FLASK policy into the hypervisor tree and generate the headers as part of the hypervisor's build. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* libxl: introduce XSM relabel on buildDaniel De Graaf2012-12-132-13/+53
| | | | | | | | | | | | | | | | | | | | | | Allow a domain to be built under one security label and run using a different label. This can be used to prevent the domain builder or control domain from having the ability to access a guest domain's memory via map_foreign_range except during the build process where this is required. Example domain configuration snippet: seclabel='customer_1:vm_r:nomigrate_t' init_seclabel='customer_1:vm_r:nomigrate_t_building' Note: this does not provide complete protection from a malicious dom0; mappings created during the build process may persist after the relabel, and could be used to indirectly access the guest's memory. However, if dom0 correctly unmaps the domain upon building, a the domU is protected against dom0 becoming malicious in the future. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xsm/flask: add domain relabel supportDaniel De Graaf2012-09-173-1/+9
| | | | | | | | | | | | | | | | This adds the ability to change a domain's XSM label after creation. The new label will be used for all future access checks; however, existing event channels and memory mappings will remain valid even if their creation would be denied by the new label. With appropriate security policy and hooks in the domain builder, this can be used to create domains that the domain builder does not have access to after building. It can also be used to allow a domain to drop privileges - for example, prior to launching a user-supplied kernel loaded by a pv-grub stubdom. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove unneeded create_sid fieldDaniel De Graaf2012-09-171-2/+0
| | | | | | | | | This field was only used to populate the ssid of dom0, which can be handled explicitly in the domain creation hook. This also removes the unnecessary permission check on the creation of dom0. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove inherited class attributesDaniel De Graaf2012-09-173-106/+2
| | | | | | | | | | | The ability to declare common permission blocks shared across multiple classes is not currently used in Xen. Currently, support for this feature is broken in the header generation scripts, and it is not expected that this feature will be used in the future, so remove the dead code. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: add accesses used by newer dom0sDaniel De Graaf2012-08-222-3/+3
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: add device model types to example policyDaniel De Graaf2012-02-092-1/+23
| | | | | | | This adds an example user for device_model_stubdomain_seclabel. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools/flask: remove libflaskDaniel De Graaf2012-02-0611-709/+25
| | | | | | | | This library has been deprecated since July 2010; remove the in-tree users and library. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: Add boolean exampleDaniel De Graaf2012-02-021-1/+9
| | | | | | | | | This shows an example boolean (prot_doms_locked) which can be set at runtime to prevent dom0 from mapping memory of domains of type prot_domU_t. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask: add flask-{get,set}-bool toolsDaniel De Graaf2012-02-023-1/+169
| | | | | | | | | | | These utilities can be used to modify policy booleans, which allow minor policy changes without reloading the security policy. This can be used to make security policy change based on external information such as time of day, user physical presence, completion of system boot, or other relevant variables. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* libflask: Add boolean manipulation functionsDaniel De Graaf2012-02-022-0/+62
| | | | | | | Add wrappers for getting and setting policy booleans by name or ID. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: use declare_domain for dom0_tDaniel De Graaf2012-02-022-5/+3
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: Add user and constraint examplesDaniel De Graaf2012-02-023-18/+39
| | | | | | | | | These examples show how to use constraints and the user field of the security label to prevent communication between virtual machines of different customers in a multi-tenant environment. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: Policy build updatesDaniel De Graaf2012-02-023-63/+20
| | | | | | | | | | Eliminate temporary files used in creating FLASK policy to improve error reporting during policy build. Syntax errors now point to the file and line number visible to the user, not the intermediate temporary file. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: allow global VIRQ handlers to be delegated to other domainsDaniel De Graaf2012-01-281-0/+1
| | | | | | | | | | | | | | | | | This patch sends global VIRQs to a domain designated as the VIRQ handler instead of sending all global VIRQ events to dom0. This is required in order to run xenstored in a stubdom, because VIRQ_DOM_EXC must be sent to xenstored for domain destruction to work properly. This patch was inspired by the xenstored stubdomain patch series sent to xen-devel by Alex Zeffertt in 2009. Signed-off-by: Diego Ongaro <diego.ongaro@citrix.com> Signed-off-by: Alex Zeffertt <alex.zeffertt@eu.citrix.com> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* flask/policy: add missing manage_domain rulesDaniel De Graaf2012-01-102-0/+9
| | | | | | | | The updated example policy did not include rules to allow managing the created domains (pause, unpause, destroy); allow these actions. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* docs: Update xsm-flask documentationDaniel De Graaf2012-01-101-1/+1
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* flask/policy: Update example policyDaniel De Graaf2011-12-202-152/+178
| | | | | | | | Rewrite the example policy to make it easier to understand and demonstrate some of the security goals that FLASK can enforce. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Ian Jackson <ian.jackson.citrix.com>
* xsm: Add missing access checksDaniel De Graaf2011-12-181-0/+14
| | | | | | | | | Actions requiring IS_PRIV should also require some XSM access control in order for XSM to be useful in confining multiple privileged domains. Add XSM hooks for new hypercalls and sub-commands that are under IS_PRIV but not currently under any access checks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* xsm: add remote_remap permissionDaniel De Graaf2011-12-181-0/+1
| | | | | | | | The mmu_update hypercall can be used to manipulate the page tables of a remote domain. Add a check for this in the XSM hook in addition to the existing check on mapping pages of a remote domain. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* flask: Fix 32-bit compilation of label-pci toolDaniel De Graaf2011-12-051-8/+9
| | | | | | | | | | The 32-bit tools need to support 64-bit addresses, so use the correct printf/scanf formats. Also, some systems declare fscanf with attribute warn_unused_result, so check the result instead of relying on the value of start being unmodified across a failed call. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask: Add flask-label-pci toolDaniel De Graaf2011-12-022-1/+127
| | | | | | | | | This allows a PCI device and its associated resources to be labeled without hardcoding addresses (which may change from system to system) in the security policy. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: clean up initial SIDsDaniel De Graaf2011-12-023-9/+7
| | | | | | | | | | The domU SID is never used before a policy load, and so does not belong in the initial_sids list. The PIRQ SID is now incorrectly named; it should simply be called IRQ. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: remove unused xsm_assign_vector checkDaniel De Graaf2011-12-023-3/+0
| | | | | | | | The PHYSDEVOP_alloc_irq_vector hypercall is a noop, so its XSM check is not useful. Remove it and the "event vector" FLASK permission. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* flask: Fix policy build with new checkpolicyDaniel De Graaf2011-12-021-0/+1
| | | | | | | | | Version 26 of checkpolicy (shipped with Fedora 16) now requires that roles be declared prior to setting types for a role. Add a declaration of the system_r role to fix the build of default XSM/FLASK policy. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Add support for HVMOP_track_dirty_vram.Jean Guyader2011-11-082-1/+2
| | | | | | | | | Xen try to inforce the xsm policy when a HVMOP_track_dirty_vram is received (xen/arch/x86/hvm/hvm.c:3637). It was failing because in flask_hvmcontext, xsm didn't have any case for this operation. Signed-off-by: Jean Guyader <jean.guyader@eu.citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* tools: remove pattern matched linking rulesIan Campbell2011-03-311-4/+7
| | | | | | | | | Most subdirs only build a single tool to start with and those which build multiple tools often have different linkage requirements. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: Remove $(CFLAGS) from links lines.Ian Campbell2011-03-312-2/+2
| | | | | | | | The relevant variable in these circumstances is called $(LDFLAGS). Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: drop further uses of -Wp,-MD,.$(@F).d to generate dependencies.Ian Campbell2011-03-231-3/+0
| | | | | | | | | | 19025:bd78714b8594 switched to "-MMD -MF" in preference, adding the correct runes to tools/Rules.mk but appears to have missed some other uses of -Wp,... Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: flask: remove $(LOADLIBES)Ian Campbell2011-03-231-1/+1
| | | | | | | | | Probably a typo and never defined, I can't tell what it was supposed to be. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: flask: Remove BASECFLAGS, just use CFLAGSIan Campbell2011-03-231-8/+4
| | | | | | Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: consistently use $({CFLAGS,LDLIBS}_libxenctrl) instead of open coding.Ian Campbell2011-03-212-8/+4
| | | | | | Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
* tools: consistently use $(CFLAGS_xeninclude) instead of open coding.Ian Campbell2011-03-212-2/+1
| | | | | | | | Renamed from the slightly ambiguous CFLAGS_include. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-19 05:52:41 +0000