| Message ID | 1465483638-9489-3-git-send-email-dgdegra@tycho.nsa.gov (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Jun 09, 2016 at 10:47:05AM -0400, Daniel De Graaf wrote: > When the all_system_role module is enabled, any domain type can be > created using the system_r role, which was the default. When it is > disabled, domains not using the default types (dom0_t and domU_t) must > use another role such as vm_r. > > Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
On 6/9/16 9:47 AM, Daniel De Graaf wrote: > When the all_system_role module is enabled, any domain type can be > created using the system_r role, which was the default. When it is > disabled, domains not using the default types (dom0_t and domU_t) must > use another role such as vm_r. > > Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Reviewed-by: Doug Goldstein <cardoe@cardoe.com>
diff --git a/tools/flask/policy/modules/all_system_role.te b/tools/flask/policy/modules/all_system_role.te new file mode 100644 index 0000000..74f870f --- /dev/null +++ b/tools/flask/policy/modules/all_system_role.te @@ -0,0 +1,8 @@ +# Allow all domains to use system_r so that systems that are not using the +# user/role separation feature will work properly. +role system_r types domain_type; + +# The vm role is used as part of user separation. Allow all domain types to use +# this role except dom0. +role vm_r; +role vm_r types { domain_type -dom0_t }; diff --git a/tools/flask/policy/modules/domU.te b/tools/flask/policy/modules/domU.te index ca5eecd..b77df29 100644 --- a/tools/flask/policy/modules/domU.te +++ b/tools/flask/policy/modules/domU.te @@ -23,3 +23,6 @@ make_device_model(dom0_t, dm_dom_t, domU_t) # This is required for PCI (or other device) passthrough delegate_devices(dom0_t, domU_t) + +# Both of these domain types can be created using the default (system) role +role system_r types { domU_t dm_dom_t }; diff --git a/tools/flask/policy/modules/modules.conf b/tools/flask/policy/modules/modules.conf index dba4b40..d875dbf 100644 --- a/tools/flask/policy/modules/modules.conf +++ b/tools/flask/policy/modules/modules.conf @@ -32,3 +32,8 @@ nomigrate = on # Example device policy. Also see policy/device_contexts. nic_dev = on + +# This allows any domain type to be created using the system_r role. When it is +# disabled, domains not using the default types (dom0_t and domU_t) must use +# another role (such as vm_r) from the vm_role module. +all_system_role = on diff --git a/tools/flask/policy/modules/xen.te b/tools/flask/policy/modules/xen.te index 3ee5e75..f374dc5 100644 --- a/tools/flask/policy/modules/xen.te +++ b/tools/flask/policy/modules/xen.te @@ -78,12 +78,7 @@ neverallow * ~event_type:event { create send status }; # The object role (object_r) is used for devices, resources, and event channels; # it does not need to be defined here and should not be used for domains. -# The system role is used for utility domains and pseudo-domains +# The system role is used for utility domains and pseudo-domains. If roles are +# not being used for separation, all domains can use the system role. role system_r; -role system_r types { xen_type domain_type }; -# If you want to prevent domUs from being placed in system_r: -##role system_r types { xen_type dom0_t }; - -# The vm role is used for customer virtual machines -role vm_r; -role vm_r types { domain_type -dom0_t }; +role system_r types { xen_type dom0_t };
When the all_system_role module is enabled, any domain type can be created using the system_r role, which was the default. When it is disabled, domains not using the default types (dom0_t and domU_t) must use another role such as vm_r. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> --- tools/flask/policy/modules/all_system_role.te | 8 ++++++++ tools/flask/policy/modules/domU.te | 3 +++ tools/flask/policy/modules/modules.conf | 5 +++++ tools/flask/policy/modules/xen.te | 11 +++-------- 4 files changed, 19 insertions(+), 8 deletions(-) create mode 100644 tools/flask/policy/modules/all_system_role.te