From: Vitaly Kuznetsov Date: Thu, 10 Sep 2015 14:54:48 +0000 (+0200) Subject: flask: DOMCTL_soft_reset support X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~2556 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=8cc7f2727591d5525870031f28ecbdf0c1890772;p=xen.git flask: DOMCTL_soft_reset support Add new soft_reset vector to domain2 class, add it to create_domain in the default policy. Signed-off-by: Vitaly Kuznetsov Acked-by: Daniel De Graaf --- diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index a2f25e1fbe..32dd7b3906 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -52,7 +52,7 @@ define(`create_domain_common', ` getaffinity setaffinity setvcpuextstate }; allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo cacheflush - psr_cmt_op psr_cat_op }; + psr_cmt_op psr_cat_op soft_reset }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index fafb1a4ba1..4180f3babd 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -738,6 +738,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_psr_cat_op: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CAT_OP); + case XEN_DOMCTL_soft_reset: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SOFT_RESET); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 0aa68f81ae..effb59f8ef 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -232,6 +232,8 @@ class domain2 # XEN_DOMCTL_monitor_op # XEN_DOMCTL_vm_event_op vm_event +# XEN_DOMCTL_soft_reset + soft_reset # XENMEM_access_op mem_access # XENMEM_paging_op