Add a Flask security policy for the new XEN_DOMCTL_claim_memory hypercall introduced in the previous commit. When Flask is enabled, this permission controls whether a domain can stake memory claims for another domain.
The permission is granted to: - dom0_t: Dom0 needs this to claim memory for guest domains - create_domain_common: Domain builders need this during domain creation Signed-off-by: Bernhard Kaindl <[email protected]> --- tools/flask/policy/modules/dom0.te | 1 + tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 3 +++ xen/xsm/flask/policy/access_vectors | 2 ++ 4 files changed, 7 insertions(+) diff --git a/tools/flask/policy/modules/dom0.te b/tools/flask/policy/modules/dom0.te index d30edf8be1fb..f5c330d01cec 100644 --- a/tools/flask/policy/modules/dom0.te +++ b/tools/flask/policy/modules/dom0.te @@ -103,6 +103,7 @@ allow dom0_t dom0_t:domain2 { get_cpu_policy dt_overlay get_domain_state + claim_memory }; allow dom0_t dom0_t:resource { add diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index ef7d8f438c65..8e2dceb505cd 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -98,6 +98,7 @@ define(`create_domain_common', ` vuart_op set_llc_colors get_domain_state + claim_memory }; allow $1 $2:security check_context; allow $1 $2:shadow enable; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index b250b2706535..0cc04ada82a9 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -820,6 +820,9 @@ static int cf_check flask_domctl(struct domain *d, unsigned int cmd, case XEN_DOMCTL_set_llc_colors: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SET_LLC_COLORS); + case XEN_DOMCTL_claim_memory: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__CLAIM_MEMORY); + default: return avc_unknown_permission("domctl", cmd); } diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index ce907d50a45e..2c9337f7a145 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -255,6 +255,8 @@ class domain2 set_llc_colors # XEN_DOMCTL_get_domain_state get_domain_state +# XEN_DOMCTL_claim_memory + claim_memory } # Similar to class domain, but primarily contains domctls related to HVM domains -- 2.39.5
