From db72faf69c94513e180568006a9d899ed422ff90 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 12 Oct 2017 14:36:30 +0200 Subject: [PATCH] x86: enforce proper privilege when (un)mapping pIRQ-s (Un)mapping of IRQs, just like other RESOURCE__ADD* / RESOURCE__REMOVE* actions (in FLASK terms) should be XSM_DM_PRIV rather than XSM_TARGET. This in turn requires bypassing the XSM check in physdev_unmap_pirq() for the HVM emuirq case just like is being done in physdev_map_pirq(). The primary goal security wise, however, is to no longer allow HVM guests, by specifying their own domain ID instead of DOMID_SELF, to enter code paths intended for PV guest and the control domains of HVM guests only. This is part of XSA-237. Reported-by: HW42 Signed-off-by: Jan Beulich Reviewed-by: George Dunlap --- xen/arch/x86/physdev.c | 7 ++++--- xen/include/xsm/dummy.h | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/xen/arch/x86/physdev.c b/xen/arch/x86/physdev.c index 0eb409758f..a5fedca671 100644 --- a/xen/arch/x86/physdev.c +++ b/xen/arch/x86/physdev.c @@ -110,7 +110,7 @@ int physdev_map_pirq(domid_t domid, int type, int *index, int *pirq_p, if ( d == NULL ) return -ESRCH; - ret = xsm_map_domain_pirq(XSM_TARGET, d); + ret = xsm_map_domain_pirq(XSM_DM_PRIV, d); if ( ret ) goto free_domain; @@ -144,13 +144,14 @@ int physdev_map_pirq(domid_t domid, int type, int *index, int *pirq_p, int physdev_unmap_pirq(domid_t domid, int pirq) { struct domain *d; - int ret; + int ret = 0; d = rcu_lock_domain_by_any_id(domid); if ( d == NULL ) return -ESRCH; - ret = xsm_unmap_domain_pirq(XSM_TARGET, d); + if ( domid != DOMID_SELF || !is_hvm_domain(d) || !has_pirq(d) ) + ret = xsm_unmap_domain_pirq(XSM_DM_PRIV, d); if ( ret ) goto free_domain; diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index ba89ea4bc1..b2cd56cdc5 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -441,7 +441,7 @@ static XSM_INLINE char *xsm_show_irq_sid(int irq) static XSM_INLINE int xsm_map_domain_pirq(XSM_DEFAULT_ARG struct domain *d) { - XSM_ASSERT_ACTION(XSM_TARGET); + XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); } @@ -453,7 +453,7 @@ static XSM_INLINE int xsm_map_domain_irq(XSM_DEFAULT_ARG struct domain *d, int i static XSM_INLINE int xsm_unmap_domain_pirq(XSM_DEFAULT_ARG struct domain *d) { - XSM_ASSERT_ACTION(XSM_TARGET); + XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); } -- 2.30.2