[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 17/24] XSM: make Argo hooks well-formed ones
- To: Jan Beulich <jbeulich@xxxxxxxx>, "Daniel P. Smith" <dpsmith@xxxxxxxxxxxxxxxxxxxx>
- From: Jason Andryuk <jason.andryuk@xxxxxxx>
- Date: Thu, 6 Aug 2026 10:09:23 -0400
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=suse.com smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HTnl1ehLlzrWHapilZ0dYORgkBNrPt2rSXy3za9bZWQ=; b=xCmKOP8vnqehGKTrcRLz9Hzz+OpQ7iF2H4wCKHn1/9qS94l4osWOG0RqouEATG2EQmiARUNoCnYlJi627OhQFkW/C++XZbeDzFIyEsI78V+GpwQH5CEjZlVTna5s3yaQTYdi13HaSl3FBFeshEwSbn77DgUpKxfAi89xHzQbh3qaVglmSqdS8FfpWdcVxDH6cpZGuuLKS1Ztk7vRameYhm6a7GBxbF+ngxFikjs8xOLXALcfUdcpcLTHRJo+/vF7/a056zQRsww4PO2x5NXISaxWF0wrB6PGIgrEJIoX5URjQ81zDPf8IAl9zYjvVrdULYwRtzqWSvK0lnaIV/QtoA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Fhipckk14ODah3M+iu7gSTZr3+Ig0ZIvkTY0vt94EUexvA9iVdvc4/wU/XNd4P0T7F60KXOfz/fL7rLTGQgwMa7QrvF35TZELIYZAEC0UxPPH6+YlhQTX8B4/C/xcdZz4IEh4Ne+/A/3e5ecz7f1l29HV3tBcuWqufMsCDZ2G/+TbqJV+LJk6LYGvOSA18P3ZK48rqHu1xe3WjpbQcSsCSdDM3sp5ijhctazKv55bx9c3VlWweLMi0wFEUqrzdFDKDoyy7fbM6GtjGhJWCN9Uv3mG+L8lFsKnRJp45Ps/tVlLfJ5ReT26Mt8+DlzgdSvX7aBa/KhappmaRD+XCU+wQ==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=amd.com header.i="@amd.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Cc: "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- Delivery-date: Thu, 06 Aug 2026 14:09:48 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 2026-08-06 03:16, Jan Beulich wrote:
On 06.08.2026 01:02, Daniel P. Smith wrote:
On 7/28/26 9:22 AM, Jan Beulich wrote:
@@ -2307,7 +2308,7 @@ argo_init(struct domain *d)
{
struct argo_domain *argo;
- if ( !opt_argo || xsm_argo_enable(d) )
+ if ( !opt_argo || xsm_argo_enable(XSM_HOOK, d) )
This question came up on another thread, so thought I might point it out
that when FLASK is in use this can return a nubmer of error codes beyond
an access deny. While I know it's the existing behavior, but if the
error code is anything other than -EPERM, then it's not that the policy
denied the access but something cause a fault in the security server. In
that case the domain is still being allowed to construct with the
assumption that it was a policy deny. At a minimum should the error code
at least get reported, and perhaps it should be passed up to domain
construction to allowing it to make an informed decision on construction?
Sounds plausible, but definitely wants doing in a separate patch.
I think this is a mis-use of xsm_argo_enable(). As I wrote in [1], this
isn't an access decision, but an ~optimization to skip initializing argo
data structures when a domain is not allowed to use argo.
With Flask, this prints an AVC denial during domain construction when
the domain doesn't have argo enabled. That is misleading as it isn't
the domain's action causing the access. In OpenXT, I wrote a patch to
add a noaudit variant to hide the denial. I didn't upstream it because
I didn't really like it.
The issue is really the conditional initialization of d->argo. It seems
like it would be simpler to always initialized argo for all domains.
xsm_argo_enable() would still prevent using it, but internal checking of
d->argo could be removed.
Regards,
Jason
[1]
https://lore.kernel.org/xen-devel/758c8410-a18e-45dc-8944-5913e5832397@xxxxxxxx/T/#m149e1571b819a0cf481eea558c6220a5a24d5285
|
