Re: [Xen-devel] [PATCH] flask: Add check for io{port, mem}con sorting

["DeGraaf, Daniel G" <dgdegra@xxxxxxx>]

> From: Jan Beulich <JBeulich@xxxxxxxx>
> >>> On 28.09.18 at 21:13, <dgdegra@xxxxxxxxxxxxx> wrote:
> > These entries are not always sorted by checkpolicy.  Enforce the sorting
> > (which can be done manually if using an unpatched checkpolicy) when
> > loading the policy so that later uses by the security server do not
> > incorrectly use the initial sid.
> 
> "Enforce the sorting" could mean two things - sorting what's unsorted,
> or (as you do) raise an error. Isn't raising an error here possibly going
> to impact systems which currently work?
> 
> Jan

A system whose iomemcon entries are unsorted is currently not enforcing the 
intended security policy.  It normally ends up enforcing a more restrictive 
policy, but not always (it depends on what you allow access to the default 
label). My guess is that anyone impacted by this problem would have noticed 
when they added the rule and it had no effect. However, I do agree this could 
cause an error on currently-working systems that do things like add iomemcon 
entries that they don't use.

Are you suggesting an update to the commit message to make this breakage clear, 
or does the problem need to be fixed in the hypervisor? It would be possible to 
sort the entries as they're added, but that's not as easy as just detecting the 
mis-sort (since they're a linked list), and the policy creation process should 
have already sorted them (except that that part was missing).
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel