Re: [Xen-devel] [PATCH v03 02/10] domctl: introduce access_remote_pagetable call

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 02.09.14 at 17:46, <andrii.tseglytskyi@xxxxxxxxxxxxxxx> wrote:
> --- a/xen/include/public/domctl.h
> +++ b/xen/include/public/domctl.h
> @@ -1067,6 +1067,7 @@ struct xen_domctl {
>  #define XEN_DOMCTL_configure_domain              74
>  #define XEN_DOMCTL_dtdev_op                      75
>  #define XEN_DOMCTL_assign_dt_device              76
> +#define XEN_DOMCTL_access_remote_pagetable       77

What's the point of introducing but not handling this?

> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -718,6 +718,9 @@ static int flask_domctl(struct domain *d, int cmd)
>      case XEN_DOMCTL_configure_domain:
>          return current_has_perm(d, SECCLASS_DOMAIN2, 
> DOMAIN2__CONFIGURE_DOMAIN);
>  
> +    case XEN_DOMCTL_access_remote_pagetable:
> +        return current_has_perm(d, SECCLASS_DOMAIN2, 
> DOMAIN2__ACCESS_REMOTE_PAGETABLE);

This would seem too weak a check, as it's an all or nothing one. I
could easily see an entity to be permitted access to one GPU, but
not to others or IPUs.

Also you should Cc the XSM maintainer on XSM changes.

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel