From de834631b6f678cfdd7b0ec6259b1a679ea78814 Mon Sep 17 00:00:00 2001 From: Daniel De Graaf Date: Thu, 10 Aug 2017 12:35:28 +0200 Subject: [PATCH] xsm: correct AVC lookups for two sysctls The current code was incorrectly using SECCLASS_XEN instead of SECCLASS_XEN2, resulting in the wrong permission being checked. GET_CPU_LEVELLING_CAPS was checking MTRR_DEL GET_CPU_FEATURESET was checking MTRR_READ The default XSM policy only allowed these permissions to dom0, so this didn't result in a security issue there. Signed-off-by: Daniel De Graaf Acked-by: Andrew Cooper --- xen/xsm/flask/hooks.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index fd84ac0f09..17560b152c 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -814,10 +814,12 @@ static int flask_sysctl(int cmd) return domain_has_xen(current->domain, XEN__TMEM_CONTROL); case XEN_SYSCTL_get_cpu_levelling_caps: - return domain_has_xen(current->domain, XEN2__GET_CPU_LEVELLING_CAPS); + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, + XEN2__GET_CPU_LEVELLING_CAPS); case XEN_SYSCTL_get_cpu_featureset: - return domain_has_xen(current->domain, XEN2__GET_CPU_FEATURESET); + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, + XEN2__GET_CPU_FEATURESET); case XEN_SYSCTL_livepatch_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, -- 2.30.2