# # Define the access vectors. # # class class_name { permission_name ... } # Class xen and xen2 consists of dom0-only operations dealing with the # hypervisor itself. Unless otherwise specified, the source is the domain # executing the hypercall, and the target is the xen initial sid (type xen_t). class xen { # XENPF_settime32 # XENPF_settime64 settime # XEN_SYSCTL_tbuf_op tbufcontrol # CONSOLEIO_read, XEN_SYSCTL_readconsole readconsole # XEN_SYSCTL_readconsole with clear=1 clearconsole # XEN_SYSCTL_perfc_op perfcontrol # XENPF_add_memtype mtrr_add # XENPF_del_memtype mtrr_del # XENPF_read_memtype mtrr_read # XENPF_microcode_update microcode # XEN_SYSCTL_physinfo, XEN_SYSCTL_cputopoinfo, XEN_SYSCTL_numainfo # XEN_SYSCTL_pcitopoinfo physinfo # XENPF_platform_quirk quirk # CONSOLEIO_write writeconsole # PHYSDEVOP_apic_read, PHYSDEVOP_alloc_irq_vector readapic # PHYSDEVOP_apic_write writeapic # Most XENOPROF_* privprofile # XENOPROF_{init,enable_virq,disable_virq,get_buffer} nonprivprofile # kexec hypercall kexec # XENPF_firmware_info, XENPF_efi_runtime_call firmware # XENPF_enter_acpi_sleep sleep # XENPF_change_freq frequency # XENPF_getidletime getidle # XEN_SYSCTL_debug_keys debug # XEN_SYSCTL_getcpuinfo, XENPF_get_cpu_version, XENPF_get_cpuinfo getcpuinfo # XEN_SYSCTL_availheap heap # XEN_SYSCTL_get_pmstat, XEN_SYSCTL_pm_op, XENPF_set_processor_pminfo, # XENPF_core_parking pm_op # mca hypercall mca_op # XEN_SYSCTL_lockprof_op lockprof # XEN_SYSCTL_cpupool_op cpupool_op # tmem hypercall (any access) tmem_op # XEN_SYSCTL_tmem_op command of tmem (part of sysctl) tmem_control # XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_getinfo, XEN_SYSCTL_sched_id getscheduler # XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_putinfo setscheduler } # This is a continuation of class xen, since only 32 permissions can be # defined per class class xen2 { # XENPF_resource_op resource_op # XEN_SYSCTL_psr_cmt_op psr_cmt_op # XEN_SYSCTL_psr_cat_op psr_cat_op # XENPF_get_symbol get_symbol # PMU control pmu_ctrl # PMU use (domains, including unprivileged ones, will be using this operation) pmu_use # XEN_SYSCTL_get_cpu_levelling_caps get_cpu_levelling_caps # XEN_SYSCTL_get_cpu_featureset get_cpu_featureset # XEN_SYSCTL_livepatch_op livepatch_op # XEN_SYSCTL_gcov_op gcov_op # XEN_SYSCTL_set_parameter set_parameter } # Classes domain and domain2 consist of operations that a domain performs on # another domain or on itself. Unless otherwise specified, the source is the # domain executing the hypercall, and the target is the domain being operated on # (which may result in a _self or _target type). # # transitions in class domain are used to produce the _self and _target types; # see docs/misc/xsm-flask.txt and the example XSM policy for details. class domain { # XEN_DOMCTL_setvcpucontext # XEN_DOMCTL_setvcpuextstate # XEN_DOMCTL_set_ext_vcpucontext # XEN_DOMCTL_set_vcpu_msrs setvcpucontext # XEN_DOMCTL_pausedomain pause # XEN_DOMCTL_unpausedomain unpause # XEN_DOMCTL_resumedomain resume # XEN_DOMCTL_arm_createdomain create # checked in FLASK_RELABEL_DOMAIN for any relabel operation: # source = the old label of the domain # target = the new label of the domain # see also the domain2 relabel{from,to,self} permissions transition # XEN_DOMCTL_max_vcpus max_vcpus # XEN_DOMCTL_destroydomain destroy # XEN_DOMCTL_setvcpuaffinity # XEN_DOMCTL_setnodeaffinity setaffinity # XEN_DOMCTL_getvcpuaffinity # XEN_DOMCTL_getnodeaffinity getaffinity # XEN_DOMCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_getinfo getscheduler # XEN_DOMCTL_getdomaininfo, XEN_SYSCTL_getdomaininfolist getdomaininfo # XEN_DOMCTL_getvcpuinfo getvcpuinfo # XEN_DOMCTL_getvcpucontext # XEN_DOMCTL_get_ext_vcpucontext # XEN_DOMCTL_getvcpuextstate # XEN_DOMCTL_get_vcpu_msrs getvcpucontext # XEN_DOMCTL_max_mem setdomainmaxmem # XEN_DOMCTL_setdomainhandle setdomainhandle # XEN_DOMCTL_setdebugging setdebugging # XEN_DOMCTL_hypercall_init hypercall # XEN_DOMCTL_settimeoffset settime # checked in XEN_DOMCTL_set_target: # source = the new device model domain # target = the new target domain # see also the domain2 make_priv_for and set_as_target checks set_target # SCHEDOP_remote_shutdown shutdown # XEN_DOMCTL_set{,_machine}_address_size setaddrsize # XEN_DOMCTL_get{,_machine}_address_size getaddrsize # XEN_DOMCTL_sendtrigger trigger # XENMEM_get_pod_target getpodtarget # XENMEM_set_pod_target setpodtarget # XEN_DOMCTL_subscribe, XEN_DOMCTL_disable_migrate, # XEN_DOMCTL_suppress_spurious_page_faults set_misc_info # XEN_DOMCTL_set_virq_handler set_virq_handler } # This is a continuation of class domain, since only 32 permissions can be # defined per class class domain2 { # checked in FLASK_RELABEL_DOMAIN with non-DOMID_SELF: # source = the domain making the hypercall # target = the old label of the domain being relabeled relabelfrom # checked in FLASK_RELABEL_DOMAIN with non-DOMID_SELF: # source = the domain making the hypercall # target = the new label of the domain being relabeled relabelto # checked in FLASK_RELABEL_DOMAIN, only with DOMID_SELF: # source = the old label of the domain # target = the new label of the domain # see also domain__transition relabelself # checked in XEN_DOMCTL_set_target: # source = the domain making the hypercall # target = the new device model domain make_priv_for # checked in XEN_DOMCTL_set_target: # source = the domain making the hypercall # target = the new target domain set_as_target # XEN_DOMCTL_set_cpuid set_cpuid # XEN_DOMCTL_gettscinfo gettsc # XEN_DOMCTL_settscinfo settsc # XEN_DOMCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_putinfo setscheduler # XENMEM_claim_pages setclaim # XEN_DOMCTL_set_max_evtchn set_max_evtchn # XEN_DOMCTL_cacheflush cacheflush # Creation of the hardware domain when it is not dom0 create_hardware_domain # XEN_DOMCTL_setvnumainfo set_vnumainfo # XENMEM_getvnumainfo get_vnumainfo # XEN_DOMCTL_psr_cmt_op psr_cmt_op # XEN_DOMCTL_set_access_required # XEN_DOMCTL_monitor_op # XEN_DOMCTL_vm_event_op vm_event # XEN_DOMCTL_soft_reset soft_reset # XENMEM_access_op mem_access # XENMEM_paging_op mem_paging # XENMEM_sharing_op mem_sharing # XEN_DOMCTL_psr_cat_op psr_cat_op # XEN_DOMCTL_set_gnttab_limits set_gnttab_limits } # Similar to class domain, but primarily contains domctls related to HVM domains class hvm { # XEN_DOMCTL_sethvmcontext sethvmc # XEN_DOMCTL_gethvmcontext, XEN_DOMCTL_gethvmcontext_partial gethvmc # HVMOP_set_param setparam # HVMOP_get_param getparam bind_irq # XEN_DOMCTL_pin_mem_cacheattr cacheattr # HVMOP_get_mem_type, # HVMOP_set_mem_access, HVMOP_get_mem_access, HVMOP_pagetable_dying hvmctl # XEN_DOMCTL_mem_sharing_op and XENMEM_sharing_op_{share,add_physmap} with: # source = the domain making the hypercall # target = domain whose memory is being shared mem_sharing # XEN_DOMCTL_audit_p2m audit_p2m # checked in XENMEM_sharing_op_{share,add_physmap} with: # source = domain whose memory is being shared # target = client domain share_mem # HVMOP_set_param setting HVM_PARAM_NESTEDHVM nested # HVMOP_set_param setting HVM_PARAM_ALTP2MHVM altp2mhvm # HVMOP_altp2m_set_domain_state HVMOP_altp2m_get_domain_state # HVMOP_altp2m_vcpu_enable_notify HVMOP_altp2m_create_p2m # HVMOP_altp2m_destroy_p2m HVMOP_altp2m_switch_p2m # HVMOP_altp2m_set_mem_access HVMOP_altp2m_change_gfn altp2mhvm_op # DMOP dm } # Class event describes event channels. Interdomain event channels have their # own security label which is computed using a type transition between the # source and target domains. Each endpoint has its own label, and the # permission checks must pass on both endpoints for an event channel to be # established. class event { # when creating an interdomain event channel endpoint: # source = event channel label # target = remote domain the event channel binds to. This may be a _self or # _target label if the endpoints are related as such. # This permission is checked when creating an unbound event channel and when the # interdomain event channel is established. bind # EVTCHNOP_send: # source = domain sending the event # target = event channel label send # EVTCHNOP_status; same as _send status # when creating an interdomain event channel endpoint: # source = the domain creating the channel (which might not be an endpoint) # target = event channel label create # EVTCHNOP_reset: # source = domain making the hypercall # target = domain whose event channels are being reset reset } # Class grant describes pages shared by grant mappings. Pages use the security # label of their owning domain. class grant { # GNTTABOP_map_grant_ref with any access map_read # GNTTABOP_map_grant_ref with write access map_write # GNTTABOP_unmap_grant_ref unmap # GNTTABOP_transfer transfer # GNTTABOP_setup_table, GNTTABOP_get_status_frames (target is commonly _self) setup # GNTTABOP_copy copy # GNTTABOP_query_size, GNTTABOP_get_version query } # Class mmu describes pages of memory not accessed using grants. Permissions # are checked using the domain ID used to access the page - the most common case # is a domain's own ID (the _self label). Using DOMID_IO in the map command to # restrict the mapping to IO memory will result in the target being domio_t, and # migration uses read-only mappings with a target of DOMID_XEN (domxen_t). class mmu { # checked when using mmu_update to map a page readably # source = domain making the hypercall (which might not own the page table) # target = domain whose pages are being mapped map_read # checked when using mmu_update to map a page writably # source = domain making the hypercall # target = domain whose pages are being mapped map_write # XEN_DOMCTL_getpageframeinfo3 pageinfo # XEN_DOMCTL_getmemlist pagelist # XENMEM_{increase,decrease}_reservation, XENMEM_populate_physmap adjust # XENMEM_{current,maximum}_reservation, XENMEM_maximum_gpfn stat # mmu_update MMU_MACHPHYS_UPDATE updatemp # XENMEM_add_to_physmap, XENMEM_remove_from_physmap physmap # MMUEXT_PIN_L*_TABLE pinpage # XENMEM_machine_memory_map (with target xen_t) # XENMEM_set_memory_map (with domain target) memorymap # checked when using mmu_update to update the page tables of another domain # source = domain making the hypercall # target = domain whose page tables are being modified remote_remap # the mmuext_op hypercall acting on the target domain mmuext_op # XENMEM_exchange: # source = domain making the hypercall # target = domain whose pages are being exchanged exchange # Allow a privileged domain to install a map of a page it does not own. Used # for stub domain device models with the PV framebuffer. target_hack } # control of the paging_domctl split by subop class shadow { # XEN_DOMCTL_SHADOW_OP_OFF disable # enable, get/set allocation enable # enable, read, and clean log logdirty } # Class resource is used to describe the resources used in hardware device # passthrough. Resources include: hardware IRQs, MMIO regions, x86 I/O ports, # and PCI devices; see docs/misc/xsm-flask.txt for how to label them. # # Access to the legacy PCI configuration space on x86 via port 0xCF8/CFC # requires IS_PRIV, even with FLASK. Writes to the BARs are checked as "setup", # while other reads/writes are "use"; the target is the PCI device whose # configuration space is being modified. Accesses to the MMIO-based PCI express # configuration space described by the ACPI MCFG table are controlled as MMIO # accesses, and cannot special-case BAR writes. # # The {add,remove}_{irq,ioport,iomem,device} permissions use: # source = domain making the hypercall # target = resource's security label class resource { # checked when adding a resource to a domain: # source = domain making the hypercall # target = domain which will have access to the resource add # checked when removing a resource from a domain: # source = domain making the hypercall # target = domain which will no longer have access to the resource remove # checked when using some core Xen devices (target xen_t) # source = domain which will have access to the resource # target = xen_t use # checked when adding a resource to a domain: # source = domain which will have access to the resource # target = resource's security label # Requires an active IOMMU capable of interrupt remapping in order to # enforce isolation. use_iommu # checked when adding a resource to a domain when an IOMMU is available # but it is not capable of interrupt mapping: # source = domain which will have access to the resource # target = resource's security label # Enable this to allow some less secure systems to still work. use_iommu_nointremap # checked when adding a resource to a domain when no IOMMU present: # source = domain which will have access to the resource # target = resource's security label # Enable this to allow resource use without an active IOMMU. use_noiommu # PHYSDEVOP_map_pirq and ioapic writes for dom0, when acting on real IRQs # For GSI interrupts, the IRQ's label is indexed by the IRQ number # For MSI interrupts, the label of the PCI device is used add_irq # PHYSDEVOP_unmap_pirq (same as map, and only for real IRQs) remove_irq # XEN_DOMCTL_ioport_permission, XEN_DOMCTL_ioport_mapping add_ioport remove_ioport # XEN_DOMCTL_iomem_permission, XEN_DOMCTL_memory_mapping add_iomem remove_iomem # XEN_DOMCTL_get_device_group, XEN_DOMCTL_test_assign_device: # source = domain making the hypercall # target = device being queried stat_device # XEN_DOMCTL_assign_device add_device # XEN_DOMCTL_deassign_device remove_device # checked for PCI hot and cold-plug hypercalls, with target as the PCI device # checked for CPU and memory hotplug with xen_t as the target plug # checked for PCI hot-unplug hypercalls, with target as the PCI device # checked for CPU offlining with xen_t as the target unplug # checked for PHYSDEVOP_restore_msi* (target PCI device) # checked for PHYSDEVOP_setup_gsi (target IRQ) # checked for PHYSDEVOP_pci_mmcfg_reserved (target xen_t) setup } # Class security describes the FLASK security server itself; these operations # are accessed using the xsm_op hypercall. The source is the domain invoking # the hypercall, and the target is security_t. # # Any domain with access to load_policy or setenforce must be trusted, since it # can bypass the rest of the security policy. class security { # use the security server to compute an access check compute_av # use the security server to compute a type transition compute_create # use the security server to compute member selection compute_member # sid <-> context string conversions check_context # allow loading a new XSM/FLASK policy load_policy # use the security server to compute an object relabel compute_relabel # allow switching between enforcing and permissive mode setenforce # allow changing policy booleans setbool # allow changing security server configuration parmeters setsecparam # add ocontext label definitions for resources add_ocontext # remove ocontext label definitions for resources del_ocontext } # Class version is used to describe the XENVER_ hypercall. # Almost all sub-ops are described here - in the default case all of them should # be allowed except the XENVER_commandline. # # The ones that are omitted are XENVER_version, XENVER_platform_parameters, # and XENVER_get_features - as they MUST always be returned to a guest. # class version { # Extra informations (-unstable). xen_extraversion # Compile information of the hypervisor. xen_compile_info # Such as "xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64". xen_capabilities # Source code changeset. xen_changeset # Page size the hypervisor uses. xen_pagesize # An value that the control stack can choose. xen_guest_handle # Xen command line. xen_commandline # Xen build id xen_build_id }