From: Daniel De Graaf Date: Thu, 10 Aug 2017 10:35:28 +0000 (+0200) Subject: xsm: correct AVC lookups for two sysctls X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~1709 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=de834631b6f678cfdd7b0ec6259b1a679ea78814;p=xen.git xsm: correct AVC lookups for two sysctls The current code was incorrectly using SECCLASS_XEN instead of SECCLASS_XEN2, resulting in the wrong permission being checked. GET_CPU_LEVELLING_CAPS was checking MTRR_DEL GET_CPU_FEATURESET was checking MTRR_READ The default XSM policy only allowed these permissions to dom0, so this didn't result in a security issue there. Signed-off-by: Daniel De Graaf Acked-by: Andrew Cooper --- diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index fd84ac0f09..17560b152c 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -814,10 +814,12 @@ static int flask_sysctl(int cmd) return domain_has_xen(current->domain, XEN__TMEM_CONTROL); case XEN_SYSCTL_get_cpu_levelling_caps: - return domain_has_xen(current->domain, XEN2__GET_CPU_LEVELLING_CAPS); + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, + XEN2__GET_CPU_LEVELLING_CAPS); case XEN_SYSCTL_get_cpu_featureset: - return domain_has_xen(current->domain, XEN2__GET_CPU_FEATURESET); + return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, + XEN2__GET_CPU_FEATURESET); case XEN_SYSCTL_livepatch_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,