| Message ID | 20250107092719.26401-4-michal.orzel@amd.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | xen/flask: Wire up missing hypercalls | expand |
On 1/7/25 04:27, Michal Orzel wrote: > Addition of FLASK permission for this hypercall was overlooked in the > original patch. Fix it. Setting LLC colors is only possible during domain > creation. > > Fixes: 6985aa5e0c3c ("xen: extend domctl interface for cache coloring") > Signed-off-by: Michal Orzel <michal.orzel@amd.com> Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index def60da88301..f7cf7c43c80b 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -54,7 +54,7 @@ define(`create_domain_common', ` allow $1 $2:domain2 { set_cpu_policy settsc setscheduler setclaim set_vnumainfo get_vnumainfo cacheflush psr_cmt_op psr_alloc soft_reset - resource_map get_cpu_policy vuart_op }; + resource_map get_cpu_policy vuart_op set_llc_colors }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index e263e745d441..14d84df9cad6 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -847,6 +847,9 @@ static int cf_check flask_domctl(struct domain *d, unsigned int cmd, case XEN_DOMCTL_dt_overlay: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__DT_OVERLAY); + case XEN_DOMCTL_set_llc_colors: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SET_LLC_COLORS); + default: return avc_unknown_permission("domctl", cmd); } diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 78fe37583b18..320d77706dee 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -255,6 +255,8 @@ class domain2 vuart_op # XEN_DOMCTL_dt_overlay dt_overlay +# XEN_DOMCTL_set_llc_colors + set_llc_colors } # Similar to class domain, but primarily contains domctls related to HVM domains
Addition of FLASK permission for this hypercall was overlooked in the original patch. Fix it. Setting LLC colors is only possible during domain creation. Fixes: 6985aa5e0c3c ("xen: extend domctl interface for cache coloring") Signed-off-by: Michal Orzel <michal.orzel@amd.com> --- tools/flask/policy/modules/xen.if | 2 +- xen/xsm/flask/hooks.c | 3 +++ xen/xsm/flask/policy/access_vectors | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-)