xsm: add CMT related xsm policies

Add xsm policies for CMT related hypercalls.

Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Release-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if
index 32b51b60b75d47ea67a36cd99f1795d7b42f7743..641c7979947007108902d3d40b7519530ebc0b84 100644 (file)
--- a/tools/flask/policy/policy/modules/xen/xen.if
+++ b/tools/flask/policy/policy/modules/xen/xen.if
@@ -49,7 +49,7 @@ define(`create_domain_common', `
                        getdomaininfo hypercall setvcpucontext setextvcpucontext
                        getscheduler getvcpuinfo getvcpuextstate getaddrsize
                        getaffinity setaffinity };
-       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo };
+       allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo psr_cmt_op };
        allow $1 $2:security check_context;
        allow $1 $2:shadow enable;
        allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op };

diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te
index 6cecf977c7cabcd58d04762d4ddf0939970c63c6..d2144703974b3b8d81cbc543edb9b2dc2e7d969a 100644 (file)
--- a/tools/flask/policy/policy/modules/xen/xen.te
+++ b/tools/flask/policy/policy/modules/xen/xen.te
@@ -66,6 +66,7 @@ allow dom0_t xen_t:xen {
 };
 allow dom0_t xen_t:xen2 {
     resource_op
+    psr_cmt_op
 };
 allow dom0_t xen_t:mmu memorymap;
 
@@ -79,7 +80,7 @@ allow dom0_t dom0_t:domain {
        getpodtarget setpodtarget set_misc_info set_virq_handler
 };
 allow dom0_t dom0_t:domain2 {
-       set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo get_vnumainfo
+       set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo get_vnumainfo psr_cmt_op
 };
 allow dom0_t dom0_t:resource { add remove };
 

diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 904aacf57deb860450340bb0a4e28f224bb41f58..6d0fe72859a4e5053af215e8773aaa61343482c3 100644 (file)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -724,6 +724,8 @@ static int flask_domctl(struct domain *d, int cmd)
 
     case XEN_DOMCTL_setvnumainfo:
         return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN2__SET_VNUMAINFO);
+    case XEN_DOMCTL_psr_cmt_op:
+        return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__PSR_CMT_OP);
 
     default:
         printk("flask_domctl: Unknown op %d\n", cmd);
@@ -780,6 +782,10 @@ static int flask_sysctl(int cmd)
     case XEN_SYSCTL_numainfo:
         return domain_has_xen(current->domain, XEN__PHYSINFO);
 
+    case XEN_SYSCTL_psr_cmt_op:
+        return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
+                                    XEN2__PSR_CMT_OP, NULL);
+
     default:
         printk("flask_sysctl: Unknown op %d\n", cmd);
         return -EPERM;

diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
index daf0de599f9e361f40b7b0272ca762cd91ae7a03..de0c707fdf692f359dcee6c321c9a3136a4b5752 100644 (file)
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -81,6 +81,8 @@ class xen2
 {
 # XENPF_resource_op
     resource_op
+# XEN_SYSCTL_psr_cmt_op
+    psr_cmt_op
 }
 
 # Classes domain and domain2 consist of operations that a domain performs on
@@ -212,6 +214,8 @@ class domain2
     set_vnumainfo
 # XENMEM_getvnumainfo
     get_vnumainfo
+# XEN_DOMCTL_psr_cmt_op
+    psr_cmt_op
 }
 
 # Similar to class domain, but primarily contains domctls related to HVM domains