mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 18:21:39 +01:00
Jason Andryuk
647f7e50eb
An XSM hook for get_dom0_console is currently missing. Using XSM with
a PVH dom0 shows:
(XEN) FLASK: Denying unknown platform_op: 64.
Wire up the hook, and allow it for dom0.
Fixes: 4dd160583c ("x86/platform: introduce hypercall to get initial video console settings")
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
82 lines
3.1 KiB
Plaintext
82 lines
3.1 KiB
Plaintext
################################################################################
|
|
#
|
|
# Allow dom0 access to all sysctls, devices, and the security server.
|
|
#
|
|
# While this could be written more briefly using wildcards, the permissions are
|
|
# listed out to make removing specific permissions simpler.
|
|
#
|
|
################################################################################
|
|
allow dom0_t xen_t:xen {
|
|
settime tbufcontrol readconsole clearconsole perfcontrol mtrr_add
|
|
mtrr_del mtrr_read microcode physinfo quirk writeconsole readapic
|
|
writeapic privprofile nonprivprofile kexec firmware sleep frequency
|
|
getidle debug getcpuinfo heap pm_op mca_op lockprof cpupool_op
|
|
getscheduler setscheduler hypfs_op
|
|
};
|
|
allow dom0_t xen_t:xen2 {
|
|
resource_op psr_cmt_op psr_alloc pmu_ctrl get_symbol
|
|
get_cpu_levelling_caps get_cpu_featureset livepatch_op
|
|
coverage_op get_dom0_console
|
|
};
|
|
|
|
# Allow dom0 to use all XENVER_ subops that have checks.
|
|
# Note that dom0 is part of domain_type so this has duplicates.
|
|
allow dom0_t xen_t:version {
|
|
xen_extraversion xen_compile_info xen_capabilities
|
|
xen_changeset xen_pagesize xen_guest_handle xen_commandline
|
|
xen_build_id
|
|
};
|
|
|
|
allow dom0_t xen_t:mmu memorymap;
|
|
|
|
# Allow dom0 to use these domctls on itself. For domctls acting on other
|
|
# domains, see the definitions of create_domain and manage_domain.
|
|
allow dom0_t dom0_t:domain {
|
|
setvcpucontext max_vcpus setaffinity getaffinity getscheduler
|
|
getdomaininfo getvcpuinfo getvcpucontext setdomainmaxmem setdomainhandle
|
|
setdebugging hypercall settime setaddrsize getaddrsize trigger
|
|
getpodtarget setpodtarget getpagingmempool setpagingmempool set_misc_info
|
|
set_virq_handler
|
|
};
|
|
allow dom0_t dom0_t:domain2 {
|
|
set_cpu_policy gettsc settsc setscheduler set_vnumainfo
|
|
get_vnumainfo psr_cmt_op psr_alloc get_cpu_policy
|
|
};
|
|
allow dom0_t dom0_t:resource { add remove };
|
|
|
|
# These permissions allow using the FLASK security server to compute access
|
|
# checks locally, which could be used by a domain or service (such as xenstore)
|
|
# that does not have its own security server to make access decisions based on
|
|
# Xen's security policy.
|
|
allow dom0_t security_t:security {
|
|
compute_av compute_create compute_member compute_relabel
|
|
};
|
|
|
|
# Allow string/SID conversions (for "xl list -Z" and similar)
|
|
allow dom0_t security_t:security check_context;
|
|
|
|
# Allow flask-label-pci to add and change labels
|
|
allow dom0_t security_t:security { add_ocontext del_ocontext };
|
|
|
|
# Allow performance parameters of the security server to be tweaked
|
|
allow dom0_t security_t:security setsecparam;
|
|
|
|
# Allow changing the security policy
|
|
allow dom0_t security_t:security { load_policy setenforce setbool };
|
|
|
|
# Audit policy change events even when they are allowed
|
|
auditallow dom0_t security_t:security { load_policy setenforce setbool };
|
|
|
|
# Allow dom0 to report platform configuration changes back to the hypervisor
|
|
allow dom0_t xen_t:resource setup;
|
|
|
|
admin_device(dom0_t, device_t)
|
|
admin_device(dom0_t, irq_t)
|
|
admin_device(dom0_t, ioport_t)
|
|
admin_device(dom0_t, iomem_t)
|
|
|
|
domain_comms(dom0_t, dom0_t)
|
|
|
|
# Allow the hypervisor to build domains of type dom0_t
|
|
xen_build_domain(dom0_t)
|