From nobody Fri Apr 26 18:08:08 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail(p=none dis=none) header.from=eu.citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1589976913; cv=none; d=zohomail.com; s=zohoarc; b=EX0EmBows+D8gpa6ZB3H+Q4xCPt4PeJFZroOla/4iTGjLdG2g77LnF1gQSSBTs+pdVUerGkxRCz5Gsir2pdURZXVqMzHV1Yg1sCklBkdl8hgLc2HMSIFF7VDF9c8/ZAHbfNVwgBw+wCyrbj6BsULkqDuO3F67H30TRqyExz1Zb0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1589976913; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=t1F7DRLMtZ+KmfogZuyS5XJNlU/8Uhjg7K/q7TuQKJg=; b=LkYaIulSqSFkHoWhP+VML8ddcDZ37REgaqHogCArkYSO8+dHRjzvCqxZXMDaOAINQSEeZ3OtuYXXQ5+d9Nl108GwOpqyWG1ze6p9C5IvmaGFZiIVyZ8bJG+WD0NNLDsl4h3vHGExqN7L/O7lyydk0E/ICsQrh0MJOBjR9SwavSY= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1589976913212463.15906205295437; Wed, 20 May 2020 05:15:13 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jbNcI-00056Q-Pk; Wed, 20 May 2020 12:14:34 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jbNcH-00056L-JN for xen-devel@lists.xenproject.org; Wed, 20 May 2020 12:14:33 +0000 Received: from chiark.greenend.org.uk (unknown [2001:ba8:1e3::3]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 74c2b15c-9a93-11ea-b07b-bc764e2007e4; Wed, 20 May 2020 12:14:30 +0000 (UTC) Received: from [172.18.45.5] (helo=zealot.relativity.greenend.org.uk) by chiark.greenend.org.uk (Debian Exim 4.84_2 #1) with esmtp (return-path ijackson@chiark.greenend.org.uk) id 1jbNcD-0001Rk-DA; Wed, 20 May 2020 13:14:29 +0100 X-Inumbo-ID: 74c2b15c-9a93-11ea-b07b-bc764e2007e4 From: Ian Jackson To: grub-devel@gnu.org Subject: [GRUB PATCH 1/2] 20_linux_xen: Ignore xenpolicy and config files too Date: Wed, 20 May 2020 13:14:19 +0100 Message-Id: <20200520121420.7965-2-ian.jackson@eu.citrix.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200520121420.7965-1-ian.jackson@eu.citrix.com> References: <20200520121420.7965-1-ian.jackson@eu.citrix.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: xen-devel@lists.xenproject.org, Ian Jackson Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Content-Type: text/plain; charset="utf-8" "file_is_not_sym" currently only checks for xen-syms. Extend it to disregard xenpolicy (XSM policy files) and files ending .config (which are built by the Xen upstream build system in some configurations and can therefore end up in /boot). Rename the function accordingly, to "file_is_not_xen_garbage". Signed-off-by: Ian Jackson Reviewed-by: Daniel Kiper --- util/grub.d/20_linux_xen.in | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in index 81e5f0d7e..30da49d66 100644 --- a/util/grub.d/20_linux_xen.in +++ b/util/grub.d/20_linux_xen.in @@ -181,10 +181,14 @@ if [ "x${linux_list}" =3D "x" ] ; then exit 0 fi =20 -file_is_not_sym () { +file_is_not_xen_garbage () { case "$1" in */xen-syms-*) return 1;; + */xenpolicy-*) + return 1;; + */*.config) + return 1;; *) return 0;; esac @@ -192,7 +196,7 @@ file_is_not_sym () { =20 xen_list=3D for i in /boot/xen*; do - if grub_file_is_not_garbage "$i" && file_is_not_sym "$i" ; then xen_li= st=3D"$xen_list $i" ; fi + if grub_file_is_not_garbage "$i" && file_is_not_xen_garbage "$i" ; the= n xen_list=3D"$xen_list $i" ; fi done prepare_boot_cache=3D boot_device_id=3D --=20 2.20.1 From nobody Fri Apr 26 18:08:08 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail(p=none dis=none) header.from=eu.citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1589976914; cv=none; d=zohomail.com; s=zohoarc; b=Y/Hy3RCBJmaNLacKtZGYe3nuBV/QzoxzMM5dWqGCvWsENokWU3p2Vim0nZ0VGsoXv3Pwtjx0cC3kCBbRYp8fqAwtDkCFri96mJenXF207VtY9n987pt9DVV6rXOqSKrmVbqKTf2sF+qc8pGWBdTAHqNc46isviVYhIlk7tHJLjo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1589976914; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=FWZYfEKd9Zj2ZDcyBLCFX6CbAF8VDeMQgWK4Qtqk1sw=; b=hhF1XEYNZFTtQVCGDouy5rl4019yuHhsVC1ZXbcj1vUd2bDstkMhq3/otzcmlrpF3gPmoiVU1tqQxBsA1pZUbpz6H9wYB2t5ApAQkLG2T/5Q5hcyc4vF93AbrC+/bAUP8HMUSAYOdR3KnQ+py1LBlsJTW7iGBPMthy50PTZRt3A= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 158997691406798.40107566767915; Wed, 20 May 2020 05:15:14 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jbNcO-00056p-1F; Wed, 20 May 2020 12:14:40 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jbNcM-00056k-Jl for xen-devel@lists.xenproject.org; Wed, 20 May 2020 12:14:38 +0000 Received: from chiark.greenend.org.uk (unknown [2001:ba8:1e3::3]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 7544f0c2-9a93-11ea-b07b-bc764e2007e4; Wed, 20 May 2020 12:14:31 +0000 (UTC) Received: from [172.18.45.5] (helo=zealot.relativity.greenend.org.uk) by chiark.greenend.org.uk (Debian Exim 4.84_2 #1) with esmtp (return-path ijackson@chiark.greenend.org.uk) id 1jbNcE-0001Rk-AZ; Wed, 20 May 2020 13:14:30 +0100 X-Inumbo-ID: 7544f0c2-9a93-11ea-b07b-bc764e2007e4 From: Ian Jackson To: grub-devel@gnu.org Subject: [GRUB PATCH 2/2] 20_linux_xen: Support Xen Security Modules (XSM/FLASK) Date: Wed, 20 May 2020 13:14:20 +0100 Message-Id: <20200520121420.7965-3-ian.jackson@eu.citrix.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200520121420.7965-1-ian.jackson@eu.citrix.com> References: <20200520121420.7965-1-ian.jackson@eu.citrix.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: xen-devel@lists.xenproject.org, Ian Jackson Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" Content-Type: text/plain; charset="utf-8" XSM is enabled by adding "flask=3Denforcing" as a Xen command line argument, and providing the policy file as a grub module. We make entries for both with and without XSM. If XSM is not compiled into Xen, then there are no policy files, so no change to the boot options. Signed-off-by: Ian Jackson Reviewed-by: Daniel Kiper --- util/grub.d/20_linux_xen.in | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in index 30da49d66..7a092b898 100644 --- a/util/grub.d/20_linux_xen.in +++ b/util/grub.d/20_linux_xen.in @@ -94,6 +94,11 @@ esac title_correction_code=3D =20 linux_entry () +{ + linux_entry_xsm "$@" false + linux_entry_xsm "$@" true +} +linux_entry_xsm () { os=3D"$1" version=3D"$2" @@ -101,6 +106,18 @@ linux_entry () type=3D"$4" args=3D"$5" xen_args=3D"$6" + xsm=3D"$7" + # If user wants to enable XSM support, make sure there's + # corresponding policy file. + if ${xsm} ; then + xenpolicy=3D"xenpolicy-$xen_version" + if test ! -e "${xen_dirname}/${xenpolicy}" ; then + return + fi + xen_args=3D"$xen_args flask=3Denforcing" + xen_version=3D"$(gettext_printf "%s (XSM enabled)" "$xen_version")" + # xen_version is used for messages only; actual file is xen_basename + fi if [ -z "$boot_device_id" ]; then boot_device_id=3D"$(grub_get_device_id "${GRUB_DEVICE}")" fi @@ -154,6 +171,13 @@ EOF sed "s/^/$submenu_indentation/" << EOF echo '$(echo "$message" | grub_quote)' ${module_loader} --nounzip $(echo $initrd_path) +EOF + fi + if test -n "${xenpolicy}" ; then + message=3D"$(gettext_printf "Loading XSM policy ...")" + sed "s/^/$submenu_indentation/" << EOF + echo '$(echo "$message" | grub_quote)' + ${module_loader} ${rel_dirname}/${xenpolicy} EOF fi sed "s/^/$submenu_indentation/" << EOF --=20 2.20.1