xen/xsm/flask: Fix permission tables

At some point, it seems that someone manually added Flask permission definitions to one header file without updating the corresponding policy configuration or the other related table. The end result is that we can get uninterpretable AVC messages like this:

# xl dmesg | grep avc
(XEN) avc:  denied  { 0x4000000 } for domid=0
scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t
tclass=domain

Fix this by updating the flask config and regenerating the headers from it. In the future, this can be further improved by integrating the automatic generation of the headers into the build process as is presently done in SELinux.

---

 tools/flask/policy/policy/flask/access_vectors |    2 ++
 xen/xsm/flask/include/av_perm_to_string.h      |    2 ++
 2 files changed, 4 insertions(+)

Stephen Smalley
National Security Agency

@@ -75,6 +75,8 @@
 	trigger
 	getextvcpucontext
 	setextvcpucontext
+	getvcpuextstate
+	setvcpuextstate
 }
 
 class hvm

@@ -50,6 +50,8 @@
    S_(SECCLASS_DOMAIN, DOMAIN__TRIGGER, "trigger")
    S_(SECCLASS_DOMAIN, DOMAIN__GETEXTVCPUCONTEXT, "getextvcpucontext")
    S_(SECCLASS_DOMAIN, DOMAIN__SETEXTVCPUCONTEXT, "setextvcpucontext")
+   S_(SECCLASS_DOMAIN, DOMAIN__GETVCPUEXTSTATE, "getvcpuextstate")
+   S_(SECCLASS_DOMAIN, DOMAIN__SETVCPUEXTSTATE, "setvcpuextstate")
    S_(SECCLASS_HVM, HVM__SETHVMC, "sethvmc")
    S_(SECCLASS_HVM, HVM__GETHVMC, "gethvmc")
    S_(SECCLASS_HVM, HVM__SETPARAM, "setparam")

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel

Stephen Smalley writes ("[Xen-devel] [PATCH] xen/xsm/flask: Fix permission tables"):

What rune, tool or Makefile target did you use to regenerate the headers ?

Thanks,
Ian.

$ make -C tools/flask/policy/policy/flask
$ install -m 644 tools/flask/policy/policy/flask/*.h xen/xsm/flask/include/

Stephen Smalley
National Security Agency