xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xen/privcmd: add IOCTL_PRIVCMD_RESTRICT

Browse Source 
The purpose if this ioctl is to allow a user of privcmd to restrict its
operation such that it will no longer service arbitrary hypercalls via
IOCTL_PRIVCMD_HYPERCALL, and will check for a matching domid when
servicing IOCTL_PRIVCMD_DM_OP or IOCTL_PRIVCMD_MMAP*. The aim of this
is to limit the attack surface for a compromised device model.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
This commit is contained in:
Paul Durrant
2017-02-13 17:03:24 +00:00
committed by Boris Ostrovsky
parent ab520be8cd
commit 4610d240d6
2 changed files with 81 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/uapi/xen/privcmd.h
View File

@@ -111,5 +111,7 @@ struct privcmd_dm_op {
_IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2))
#define IOCTL_PRIVCMD_DM_OP \
_IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_dm_op))
#define IOCTL_PRIVCMD_RESTRICT \
_IOC(_IOC_NONE, 'P', 6, sizeof(domid_t))
#endif /* __LINUX_PUBLIC_PRIVCMD_H__ */