mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Konrad Rzeszutek Wilk
a2fc8d514d
Most of XENVER_* have now an XSM check for their sub-ops. The subop for XENVER_commandline is now a priviliged operation. To not break guests we still return an string - but it is just '<denied>\0'. The XENVER_[version|platform_parameters|get_features] - will always return an value to the guest. The rest: XENVER_[extraversion|capabilities|page_size| guest_handle|changeset| compile_info] behave as before - allowed by default for all guests if using the XSM default policy or with the dummy one. And if the system admin wants to curtail access to some of them - they can do that now with a non-default XSM policy. Also we add a local variable block. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> --- Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov> Cc: Ian Jackson <ian.jackson@eu.citrix.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Cc: Wei Liu <wei.liu2@citrix.com> v2: Do XSM check for all the XENVER_ ops. - Add empty data conditions. - Return <denied> for priv subops. - Move extraversion from priv to normal. Drop the XSM check for the non-priv subops. v3: - Add +1 for strlen(xen_deny()) to include NULL. Move changeset, compile_info to non-priv subops. - Remove the \0 on xen_deny() - Add new XSM domain for xenver hypercall. Add all subops to it. - Remove the extra line, Add Ack from Daniel v4: - Rename the XSM from xen_version_op to xsm_xen_version. Prefix the types with 'xen' to distinguish it from another hypercall performing similar operation. Removed Ack from Daniel as it was so large. Add local variable block. v5: - Make XENVER_platform_parameters,get_features,version be excluded from the XSM check per Jans' review. Add BUILD_BUG_CHECK and fix odd line removals. Remove stray changes and fix spelling.