From 99ebf740680cafa9df3b83841961f9cc1d4f774f Mon Sep 17 00:00:00 2001 From: Andrii Anisov Date: Tue, 27 Mar 2018 10:26:17 +0200 Subject: [PATCH] xsm/schedop: introduce vcpuinfo permissions verification Introduce per-vcpu scheduler operations permission verification. As long as Xvcpuinfo are in fact scheduler configuration manipulations there is no need to introduce specific access vectors. Signed-off-by: Andrii Anisov Reviewed-by: Dario Faggioli Acked-by: Daniel De Graaf --- xen/xsm/flask/hooks.c | 2 ++ xen/xsm/flask/policy/access_vectors | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 1802d8dfe6..0276493d79 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -532,9 +532,11 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) switch ( op ) { case XEN_DOMCTL_SCHEDOP_putinfo: + case XEN_DOMCTL_SCHEDOP_putvcpuinfo: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SETSCHEDULER); case XEN_DOMCTL_SCHEDOP_getinfo: + case XEN_DOMCTL_SCHEDOP_getvcpuinfo: return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETSCHEDULER); default: diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 89b99966bb..dccd9a51a7 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -71,9 +71,9 @@ class xen tmem_op # XEN_SYSCTL_tmem_op command of tmem (part of sysctl) tmem_control -# XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_getinfo, XEN_SYSCTL_sched_id +# XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_getinfo, XEN_SYSCTL_sched_id, XEN_DOMCTL_SCHEDOP_getvcpuinfo getscheduler -# XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_putinfo +# XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_putinfo, XEN_DOMCTL_SCHEDOP_putvcpuinfo setscheduler } -- 2.39.5