1# Macro definitions for FLASK policy
2
3################################################################################
4#
5# Domain creation and setup
6#
7################################################################################
8define(`declare_domain_common', `
9	allow $1 $2:grant { query setup };
10	allow $1 $2:mmu { adjust physmap map_read map_write stat pinpage updatemp mmuext_op };
11	allow $1 $2:hvm { getparam setparam altp2mhvm_op };
12	allow $1 $2:domain2 get_vnumainfo;
13')
14
15# declare_domain(type, attrs...)
16#   Declare a domain type, along with associated _self and _channel types
17#   Allow the domain to perform basic operations on itself
18define(`declare_domain', `
19	type $1, domain_type`'ifelse(`$#', `1', `', `,shift($@)');
20	type $1_self, domain_type, domain_self_type;
21	type_transition $1 $1:domain $1_self;
22	type $1_channel, event_type;
23	type_transition $1 domain_type:event $1_channel;
24	declare_domain_common($1, $1_self)
25')
26
27# declare_singleton_domain(type, attrs...)
28#   Declare a domain type and associated _channel types.
29#   Note: Because the domain can perform basic operations on itself and any
30#   other domain of the same type, this constructor should be used for types
31#   containing at most one domain. This is not enforced by policy.
32define(`declare_singleton_domain', `
33	type $1, domain_type`'ifelse(`$#', `1', `', `,shift($@)');
34	define(`$1_self', `$1')
35	type $1_channel, event_type;
36	type_transition $1 domain_type:event $1_channel;
37	declare_domain_common($1, $1)
38')
39
40# declare_build_label(type)
41#   Declare a paired _building type for the given domain type
42define(`declare_build_label', `
43	type $1_building, domain_type;
44	type_transition $1_building domain_type:event $1_channel;
45	allow $1_building $1 : domain transition;
46')
47
48define(`create_domain_common', `
49	allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
50			getdomaininfo hypercall setvcpucontext getscheduler
51			getvcpuinfo getaddrsize getaffinity setaffinity
52			settime setdomainhandle getvcpucontext set_misc_info
53			getpagingmempool setpagingmempool };
54	allow $1 $2:domain2 { set_cpu_policy settsc setscheduler setclaim
55			set_vnumainfo get_vnumainfo cacheflush
56			psr_cmt_op psr_alloc soft_reset
57			resource_map get_cpu_policy };
58	allow $1 $2:security check_context;
59	allow $1 $2:shadow enable;
60	allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp };
61	allow $1 $2:grant setup;
62	allow $1 $2:hvm { getparam hvmctl sethvmc
63			setparam altp2mhvm altp2mhvm_op dm };
64')
65
66# xen_build_domain(target)
67#   Allow a domain to be created at boot by the hypervisor
68define(`xen_build_domain', `
69	allow xenboot_t $1:domain create;
70	allow xenboot_t $1_channel:event create;
71')
72
73# create_domain(priv, target)
74#   Allow a domain to be created directly
75define(`create_domain', `
76	create_domain_common($1, $2)
77	allow $1 $2_channel:event create;
78')
79
80# create_domain_build_label(priv, target)
81#   Allow a domain to be created via its domain build label
82define(`create_domain_build_label', `
83	create_domain_common($1, $2_building)
84	allow $1 $2_channel:event create;
85	allow $1 $2_building:domain2 relabelfrom;
86	allow $1 $2:domain2 relabelto;
87	allow $2_building $2:domain transition;
88')
89
90# manage_domain(priv, target)
91#   Allow managing a running domain
92define(`manage_domain', `
93	allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity
94			getaddrsize pause unpause trigger shutdown destroy
95			setaffinity setdomainmaxmem getscheduler resume
96			setpodtarget getpodtarget getpagingmempool setpagingmempool };
97    allow $1 $2:domain2 set_vnumainfo;
98')
99
100# migrate_domain_out(priv, target)
101#   Allow creation of a snapshot or migration image from a domain
102#   (inbound migration is the same as domain creation)
103define(`migrate_domain_out', `
104	allow $1 domxen_t:mmu map_read;
105	allow $1 $2:hvm { gethvmc getparam };
106	allow $1 $2:mmu { stat pageinfo map_read };
107	allow $1 $2:domain { getaddrsize getvcpucontext pause destroy };
108	allow $1 $2:domain2 gettsc;
109	allow $1 $2:shadow { enable disable logdirty };
110')
111
112################################################################################
113#
114# Inter-domain communication
115#
116################################################################################
117
118# create_channel(source, dest, chan-label)
119#   This allows an event channel to be created from domains with labels
120#   <source> to <dest> and will label it <chan-label>
121define(`create_channel', `
122	allow $1 $3:event { create send status };
123	allow $3 $2:event { bind };
124')
125
126# domain_event_comms(dom1, dom2)
127#   Allow two domain types to communicate using event channels
128define(`domain_event_comms', `
129	create_channel($1, $2, $1_channel)
130	create_channel($2, $1, $2_channel)
131')
132
133# domain_comms(dom1, dom2)
134#   Allow two domain types to communicate using grants and event channels
135define(`domain_comms', `
136	domain_event_comms($1, $2)
137	allow $1 $2:grant { map_read map_write copy unmap };
138	allow $2 $1:grant { map_read map_write copy unmap };
139')
140
141# domain_self_comms(domain)
142#   Allow a non-singleton domain type to communicate with itself using grants
143#   and event channels
144define(`domain_self_comms', `
145	create_channel($1, $1_self, $1_channel)
146	allow $1 $1_self:grant { map_read map_write copy unmap };
147')
148
149# device_model(dm_dom, hvm_dom)
150#   Define how a device model domain interacts with its target
151define(`device_model', `
152	type $2_target, domain_type, domain_target_type;
153	type_transition $2 $1:domain $2_target;
154	allow $1 $2:domain set_target;
155
156	type_transition $2_target domain_type:event $2_channel;
157	create_channel($1, $2_target, $1_channel)
158	create_channel($2, $1, $2_channel)
159	allow $1 $2_channel:event create;
160
161	allow $1 $2_target:domain { getdomaininfo shutdown };
162	allow $1 $2_target:mmu { map_read map_write adjust physmap target_hack };
163	allow $1 $2_target:hvm { getparam setparam hvmctl dm };
164	allow $1 $2_target:domain2 resource_map;
165')
166
167# make_device_model(priv, dm_dom, hvm_dom)
168#   Allow creation of a device model and HVM domain pair
169define(`make_device_model', `
170	device_model($2, $3)
171	allow $1 $2:domain2 make_priv_for;
172	allow $1 $3:domain2 set_as_target;
173')
174################################################################################
175#
176# Device types and delegation (PCI passthrough)
177#
178################################################################################
179
180# use_device_iommu(domain, device)
181#   Allow a device to be used by a domain
182#   only if an IOMMU provides isolation.
183define(`use_device_iommu', `
184    allow $1 $1_self:mmu exchange;
185    allow $1 $2:resource use_iommu;
186    allow $1 domio_t:mmu { map_read map_write };
187')
188
189# use_device_iommu_nointremap(domain, device)
190#   Allow a device to be used by a domain
191#   only if an IOMMU is active, even if it does not support
192#   interrupt remapping.
193#   Allows acceptance of (typically older) less isolating hardware.
194define(`use_device_iommu_nointremap', `
195    allow $1 $1_self:mmu exchange;
196    allow $1 $2:resource { use_iommu use_iommu_nointremap };
197    allow $1 domio_t:mmu { map_read map_write };
198')
199
200# use_device_noiommu(domain, device)
201#   Allow a device to be used by a domain
202#   even without an IOMMU available.
203define(`use_device_noiommu', `
204    allow $1 $1_self:mmu exchange;
205    allow $1 $2:resource { use_iommu use_iommu_nointremap use_noiommu };
206    allow $1 domio_t:mmu { map_read map_write };
207')
208
209# admin_device(domain, device)
210#   Allow a device to be used and delegated by a domain
211define(`admin_device', `
212    allow $1 $2:resource { setup stat_device add_device add_irq add_iomem add_ioport remove_device remove_irq remove_iomem remove_ioport plug unplug };
213    allow $1 $2:hvm bind_irq;
214    use_device_noiommu($1, $2)
215')
216
217# delegate_devices(priv-domain, target-domain)
218#   Allow devices to be delegated
219define(`delegate_devices', `
220    allow $1 $2:resource { add remove };
221')
222