diff mbox

XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.

Message ID 1467899147-22315-1-git-send-email-anshul.makkar@citrix.com (mailing list archive)
State New, archived
Headers show

Commit Message

"Anshul Makkaranshul.makkar"@citrix.com July 7, 2016, 1:45 p.m. UTC 
From: Anshul Makkar <anshul.makkar@citrix.com>

This patch resolves the following permission denied scenarios while creating
new domU :
avc:  denied  { setdomainhandle } for domid=0 target=1
scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain

avc:  denied  { settime } for domid=0 target=1 scontext=system_u:system_r:dom0_t
tcontext=system_u:system_r:domU_t tclass=domain

Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
---
 tools/flask/policy/modules/xen.if | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Daniel De Graaf July 7, 2016, 2:49 p.m. UTC | #1 
On 07/07/2016 09:45 AM, Anshul.Makkar.anshul.makkar@citrix.com wrote:
> From: Anshul Makkar <anshul.makkar@citrix.com>
>
> This patch resolves the following permission denied scenarios while creating
> new domU :
> avc:  denied  { setdomainhandle } for domid=0 target=1
> scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain
>
> avc:  denied  { settime } for domid=0 target=1 scontext=system_u:system_r:dom0_t
> tcontext=system_u:system_r:domU_t tclass=domain
>
> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>

Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Wei Liu July 7, 2016, 2:52 p.m. UTC | #2 
On Thu, Jul 07, 2016 at 10:49:01AM -0400, Daniel De Graaf wrote:
> On 07/07/2016 09:45 AM, Anshul.Makkar.anshul.makkar@citrix.com wrote:
> >From: Anshul Makkar <anshul.makkar@citrix.com>
> >
> >This patch resolves the following permission denied scenarios while creating
> >new domU :
> >avc:  denied  { setdomainhandle } for domid=0 target=1
> >scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain
> >
> >avc:  denied  { settime } for domid=0 target=1 scontext=system_u:system_r:dom0_t
> >tcontext=system_u:system_r:domU_t tclass=domain
> >
> >Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
> 
> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>

Queued. Thank you both.
diff mbox

Patch

diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index fd96303..8c43c28 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -48,7 +48,8 @@  define(`declare_build_label', `
 define(`create_domain_common', `
 	allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
 			getdomaininfo hypercall setvcpucontext getscheduler
-			getvcpuinfo getaddrsize getaffinity setaffinity };
+			getvcpuinfo getaddrsize getaffinity setaffinity
+			settime setdomainhandle };
 	allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
 			set_max_evtchn set_vnumainfo get_vnumainfo cacheflush
 			psr_cmt_op psr_cat_op soft_reset };