From a56de9582a388801aee1160e5090437d5f20e2e9 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Fri, 23 Apr 2021 12:47:24 -0400 Subject: [PATCH 01/16] busybox: Enable pkill for usbvm vusb-daemon commit 5af2803853d6 "vusb: Fix initscript shutdown" switch to using pkill for stopping vusb-daemon. That is fine for dom0, but usbvm uses busybox instead of coreutils, and the command wasn't build. At shutdown there would be a pkill command not found error. Build pkill into busybox so it works. vusb-daemon shutdown didn't work before commit 5af2803853d6, so the lack of pkill wasn't changing that. Signed-off-by: Jason Andryuk --- recipes-core/busybox/files/process.cfg | 2 ++ 1 file changed, 2 insertions(+) diff --git a/recipes-core/busybox/files/process.cfg b/recipes-core/busybox/files/process.cfg index 949f9bb56d..41588ba447 100644 --- a/recipes-core/busybox/files/process.cfg +++ b/recipes-core/busybox/files/process.cfg @@ -8,3 +8,5 @@ CONFIG_FEATURE_SHOW_THREADS=y CONFIG_PS=y CONFIG_FEATURE_PS_TIME=n CONFIG_FEATURE_PS_ADDITIONAL_COLUMNS=n + +CONFIG_PKILL=y From 14b9c42055862ab5ecca02d8444ad0dacba41544 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Mon, 29 Mar 2021 14:24:56 -0400 Subject: [PATCH 02/16] images: Refactor ctrlaltdel-reboot into IMAGE_FEATURE Replace the three open-codings of the inittab modification by new IMAGE_FEATURE ctrlaltdel-reboot. It will bre re-used by usbvm. Signed-off-by: Jason Andryuk --- classes/openxt-image.bbclass | 8 ++++++++ recipes-core/images/xenclient-ndvm-image.bb | 4 +--- recipes-core/images/xenclient-syncvm-image.bb | 4 +--- recipes-core/images/xenclient-uivm-image.bb | 4 +--- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/classes/openxt-image.bbclass b/classes/openxt-image.bbclass index e078efacb0..05894e5779 100644 --- a/classes/openxt-image.bbclass +++ b/classes/openxt-image.bbclass @@ -81,3 +81,11 @@ remove_nonessential_initscripts() { fi } ROOTFS_POSTPROCESS_COMMAND += "remove_nonessential_initscripts; " + +# Xenstore reboot +ctrlaltdel_reboot() { + # PV driver synthesize ctrl+alt+del in response to a xenstore reboot + echo 'ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now' >> ${IMAGE_ROOTFS}/etc/inittab; +} +ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains("IMAGE_FEATURES", "ctrlaltdel-reboot", "ctrlaltdel_reboot; ", "",d)}' +IMAGE_FEATURES[validitems] += "ctrlaltdel-reboot" diff --git a/recipes-core/images/xenclient-ndvm-image.bb b/recipes-core/images/xenclient-ndvm-image.bb index 788630ec6f..50d92a5050 100644 --- a/recipes-core/images/xenclient-ndvm-image.bb +++ b/recipes-core/images/xenclient-ndvm-image.bb @@ -13,6 +13,7 @@ IMAGE_FEATURES += " \ read-only-rootfs \ empty-root-password \ root-bash-shell \ + ctrlaltdel-reboot \ " IMAGE_FSTYPES = "ext3.disk.vhd.gz" @@ -76,9 +77,6 @@ post_rootfs_shell_commands() { # Trick to resolve dom0 name with argo. echo '1.0.0.0 dom0' >> ${IMAGE_ROOTFS}/etc/hosts; - # enable ctrlaltdel reboot because PV driver uses ctrl+alt+del to interpret reboot issued via xenstore - echo 'ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now' >> ${IMAGE_ROOTFS}/etc/inittab; - # NDVM doesn't have a /dev/tty1, disable the login shell on it sed -i 's/[^#].*getty.*tty1$/#&/' ${IMAGE_ROOTFS}/etc/inittab ; } diff --git a/recipes-core/images/xenclient-syncvm-image.bb b/recipes-core/images/xenclient-syncvm-image.bb index 952ffbe8e7..9f9d20903c 100644 --- a/recipes-core/images/xenclient-syncvm-image.bb +++ b/recipes-core/images/xenclient-syncvm-image.bb @@ -12,6 +12,7 @@ IMAGE_FEATURES += " \ package-management \ read-only-rootfs \ root-bash-shell \ + ctrlaltdel-reboot \ " IMAGE_FSTYPES = "ext3.vhd.gz" @@ -47,9 +48,6 @@ require xenclient-version.inc inherit xenclient-licences post_rootfs_shell_commands() { - # enable ctrlaltdel reboot because PV driver uses ctrl+alt+del to interpret reboot issued via xenstore - echo 'ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now' >> ${IMAGE_ROOTFS}/etc/inittab; - # Trick to resolve dom0 name with argo. echo '1.0.0.0 dom0' >> ${IMAGE_ROOTFS}/etc/hosts; } diff --git a/recipes-core/images/xenclient-uivm-image.bb b/recipes-core/images/xenclient-uivm-image.bb index 3a93a51abe..00c4bd0225 100644 --- a/recipes-core/images/xenclient-uivm-image.bb +++ b/recipes-core/images/xenclient-uivm-image.bb @@ -13,6 +13,7 @@ IMAGE_FEATURES += " \ read-only-rootfs \ empty-root-password \ root-bash-shell \ + ctrlaltdel-reboot \ " IMAGE_FSTYPES = "ext3.vhd.gz" export IMAGE_BASENAME = "xenclient-uivm-image" @@ -107,9 +108,6 @@ post_rootfs_shell_commands() { # Start WM right away. echo 'x:5:respawn:/bin/su - root -c /usr/bin/startxfce4' >> ${IMAGE_ROOTFS}/etc/inittab - # enable ctrlaltdel reboot because PV driver uses ctrl+alt+del to interpret reboot issued via xenstore - echo 'ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now' >> ${IMAGE_ROOTFS}/etc/inittab - # Trick to resolve dom0 name with argo. echo '1.0.0.0 dom0' >> ${IMAGE_ROOTFS}/etc/hosts } From 623a9df1f362e25b93e464444c9a40b01d7287e1 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Fri, 24 Jan 2020 11:08:37 -0500 Subject: [PATCH 03/16] Add usbvm machine usbvm is a 64bit vm to control the PCI USB controllers and provide PV USB backends. Signed-off-by: Jason Andryuk --- conf/machine/usbvm.conf | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 conf/machine/usbvm.conf diff --git a/conf/machine/usbvm.conf b/conf/machine/usbvm.conf new file mode 100644 index 0000000000..7a29279ae1 --- /dev/null +++ b/conf/machine/usbvm.conf @@ -0,0 +1,13 @@ +# Copyright (C) 2010 Citrix Systems +# Released under the MIT license (see packages/COPYING) +#@TYPE: Machine +#@NAME: usbvm +#@DESCRIPTION: Machine configuration for USB VM + +require xenclient-common.conf + +MACHINE_FEATURES = "pci ext2 x86" + +APPEND = "root=/dev/xvda2 ro console=hvc0 iommu=soft" + +USE_VT = "0" From 97d0294548f4ec9f3cc2a5a4ff5fa510e4ab8f05 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Fri, 24 Jan 2020 11:09:54 -0500 Subject: [PATCH 04/16] linux: Add usbvm defconfig Add a minimized defconfig for usbvm. It's designed to run as an HVM. It has PCI driver for USB controllers and shares USB devices with the Xen PV USB backend driver. Actual USB device drivers are limited to USB HID devices. SELinux and yama security modules are enabled. Signed-off-by: Jason Andryuk --- .../linux/6.1/defconfigs/usbvm/defconfig | 176 ++++++++++++++++++ 1 file changed, 176 insertions(+) create mode 100644 recipes-kernel/linux/6.1/defconfigs/usbvm/defconfig diff --git a/recipes-kernel/linux/6.1/defconfigs/usbvm/defconfig b/recipes-kernel/linux/6.1/defconfigs/usbvm/defconfig new file mode 100644 index 0000000000..63ba63df66 --- /dev/null +++ b/recipes-kernel/linux/6.1/defconfigs/usbvm/defconfig @@ -0,0 +1,176 @@ +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_SYSVIPC=y +CONFIG_POSIX_MQUEUE=y +CONFIG_AUDIT=y +CONFIG_PREEMPT_VOLUNTARY=y +CONFIG_BSD_PROCESS_ACCT=y +CONFIG_BSD_PROCESS_ACCT_V3=y +CONFIG_TASKSTATS=y +CONFIG_TASK_DELAY_ACCT=y +CONFIG_LOG_BUF_SHIFT=16 +CONFIG_NAMESPACES=y +# CONFIG_UTS_NS is not set +# CONFIG_IPC_NS is not set +# CONFIG_PID_NS is not set +# CONFIG_NET_NS is not set +CONFIG_BLK_DEV_INITRD=y +# CONFIG_RD_BZIP2 is not set +# CONFIG_RD_LZMA is not set +# CONFIG_RD_XZ is not set +# CONFIG_RD_LZO is not set +# CONFIG_RD_LZ4 is not set +CONFIG_EXPERT=y +CONFIG_PROFILING=y +CONFIG_SMP=y +# CONFIG_X86_EXTENDED_PLATFORM is not set +CONFIG_HYPERVISOR_GUEST=y +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_DEBUG=y +CONFIG_XEN=y +CONFIG_XEN_DEBUG_FS=y +# CONFIG_XEN_DOM0 is not set +# CONFIG_KVM_GUEST is not set +CONFIG_PARAVIRT_TIME_ACCOUNTING=y +CONFIG_MCORE2=y +CONFIG_NR_CPUS=8 +# CONFIG_X86_MCE is not set +# CONFIG_PERF_EVENTS_INTEL_UNCORE is not set +# CONFIG_PERF_EVENTS_INTEL_RAPL is not set +# CONFIG_PERF_EVENTS_INTEL_CSTATE is not set +# CONFIG_X86_16BIT is not set +# CONFIG_MICROCODE is not set +CONFIG_X86_MSR=y +CONFIG_X86_CPUID=y +# CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set +CONFIG_HZ_100=y +CONFIG_HIBERNATION=y +CONFIG_ACPI_DOCK=y +CONFIG_ACPI_PROCESSOR_AGGREGATOR=y +# CONFIG_ACPI_TABLE_UPGRADE is not set +CONFIG_ACPI_DEBUG=y +CONFIG_ACPI_SBS=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_PCI_MMCONFIG is not set +# CONFIG_ISA_DMA_API is not set +CONFIG_IA32_EMULATION=y +# CONFIG_VIRTUALIZATION is not set +CONFIG_MODULES=y +CONFIG_MODULE_FORCE_LOAD=y +CONFIG_MODULE_UNLOAD=y +CONFIG_MODULE_FORCE_UNLOAD=y +CONFIG_MODVERSIONS=y +CONFIG_MODULE_SRCVERSION_ALL=y +CONFIG_MODULE_SIG=y +CONFIG_MODULE_SIG_FORCE=y +# CONFIG_MODULE_SIG_ALL is not set +CONFIG_MODULE_SIG_SHA384=y +CONFIG_BLK_DEV_BSGLIB=y +CONFIG_PARTITION_ADVANCED=y +# CONFIG_MQ_IOSCHED_DEADLINE is not set +# CONFIG_MQ_IOSCHED_KYBER is not set +CONFIG_SLAB=y +# CONFIG_COMPAT_BRK is not set +# CONFIG_COMPACTION is not set +CONFIG_DEFAULT_MMAP_MIN_ADDR=65536 +CONFIG_NET=y +CONFIG_UNIX=y +CONFIG_INET=y +# CONFIG_INET_DIAG is not set +# CONFIG_IPV6 is not set +# CONFIG_WIRELESS is not set +CONFIG_PCI=y +CONFIG_PCI_MSI=y +# CONFIG_VGA_ARB is not set +CONFIG_UEVENT_HELPER=y +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +# CONFIG_STANDALONE is not set +CONFIG_CONNECTOR=y +# CONFIG_DMIID is not set +# CONFIG_PNP_DEBUG_MESSAGES is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_RAM=y +CONFIG_NETDEVICES=y +# CONFIG_NET_CORE is not set +# CONFIG_ETHERNET is not set +# CONFIG_USB_NET_DRIVERS is not set +# CONFIG_WLAN is not set +# CONFIG_XEN_NETDEV_FRONTEND is not set +CONFIG_INPUT_EVDEV=y +# CONFIG_INPUT_KEYBOARD is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_SERIO is not set +# CONFIG_VT is not set +# CONFIG_LEGACY_PTYS is not set +CONFIG_SERIAL_8250=y +# CONFIG_HW_RANDOM is not set +# CONFIG_DEVMEM is not set +# CONFIG_DEVPORT is not set +# CONFIG_HWMON is not set +CONFIG_USB=y +CONFIG_USB_ANNOUNCE_NEW_DEVICES=y +CONFIG_USB_XHCI_HCD=m +CONFIG_USB_EHCI_HCD=m +CONFIG_USB_EHCI_ROOT_HUB_TT=y +CONFIG_USB_OHCI_HCD=m +CONFIG_USB_UHCI_HCD=m +CONFIG_SYNC_FILE=y +# CONFIG_VIRTIO_MENU is not set +CONFIG_XEN_BACKEND=y +CONFIG_XEN_GNTDEV=y +CONFIG_XEN_GRANT_DEV_ALLOC=y +CONFIG_XEN_PCIDEV_BACKEND=y +# CONFIG_X86_PLATFORM_DEVICES is not set +# CONFIG_IOMMU_SUPPORT is not set +CONFIG_RAS=y +CONFIG_EXT4_FS=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_VFAT_FS=m +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +CONFIG_CONFIGFS_FS=y +# CONFIG_MISC_FILESYSTEMS is not set +# CONFIG_NETWORK_FILESYSTEMS is not set +CONFIG_NLS_DEFAULT="utf8" +CONFIG_NLS_CODEPAGE_437=y +CONFIG_NLS_ASCII=y +CONFIG_NLS_ISO8859_1=y +CONFIG_NLS_ISO8859_15=y +CONFIG_NLS_UTF8=y +CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY=y +CONFIG_SECURITYFS=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_PATH=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_SECURITY_YAMA=y +# CONFIG_INTEGRITY is not set +CONFIG_CRYPTO_AES=y +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_CRC32C_INTEL=y +CONFIG_CRYPTO_CRCT10DIF_PCLMUL=y +# CONFIG_CRYPTO_HW is not set +CONFIG_CRC_CCITT=m +CONFIG_CRC_T10DIF=y +CONFIG_CRC_ITU_T=m +CONFIG_CRC7=m +CONFIG_LIBCRC32C=m +CONFIG_PRINTK_TIME=y +CONFIG_DYNAMIC_DEBUG=y +CONFIG_STRIP_ASM_SYMS=y +CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y +CONFIG_MAGIC_SYSRQ=y +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=0 +CONFIG_RCU_CPU_STALL_TIMEOUT=60 +# CONFIG_RCU_TRACE is not set +CONFIG_LATENCYTOP=y +CONFIG_FTRACE_SYSCALLS=y +CONFIG_BLK_DEV_IO_TRACE=y +# CONFIG_UPROBE_EVENTS is not set +CONFIG_EARLY_PRINTK_DBGP=y +CONFIG_UNWINDER_FRAME_POINTER=y From 8ddfb45a8e894ef0d75662bc3d7e5e264fc9c81e Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Fri, 24 Jan 2020 11:14:44 -0500 Subject: [PATCH 05/16] base-files: Add usbvm fstab{,.early} Add fstab & fstab.early for usbvm. Signed-off-by: Jason Andryuk --- recipes-core/base-files/files/usbvm/fstab | 24 +++++++++++++++++++ .../base-files/files/usbvm/fstab.early | 13 ++++++++++ 2 files changed, 37 insertions(+) create mode 100644 recipes-core/base-files/files/usbvm/fstab create mode 100644 recipes-core/base-files/files/usbvm/fstab.early diff --git a/recipes-core/base-files/files/usbvm/fstab b/recipes-core/base-files/files/usbvm/fstab new file mode 100644 index 0000000000..09b72c0b62 --- /dev/null +++ b/recipes-core/base-files/files/usbvm/fstab @@ -0,0 +1,24 @@ +# proc is presumably mounted by /etc/init.d/rcS script. +# /etc/init.d/rcS might use this file, so match this entry with +# /etc/fstab.early. +proc /proc proc nosuid,noexec,nodev 0 0 + +# OpenXT read-only root tmpfs: +# These have to be either absent from this file or match /etc/fstab.early +# exactly for mountearly.sh and mountall.sh to work correctly. +sysfs /sys sysfs nosuid,noexec,nodev 0 0 +devtmpfs /dev devtmpfs mode=0755,nosuid 0 0 +tmpfs /run tmpfs defaults,size=5M 0 0 + +tmpfs /var/volatile tmpfs defaults,size=5M 0 0 + +# OpenXT read-only root: +# mountall.sh should take care of these. +rootfs / auto defaults,ro,noatime 1 1 + +devpts /dev/pts devpts mode=0620,gid=5 0 0 +tmpfs /dev/shm tmpfs mode=0777,size=1M 0 0 + +xenfs /proc/xen xenfs defaults 0 0 + +tmpfs /var/lib/dbus tmpfs defaults,size=1M 0 0 diff --git a/recipes-core/base-files/files/usbvm/fstab.early b/recipes-core/base-files/files/usbvm/fstab.early new file mode 100644 index 0000000000..0cc9e183c6 --- /dev/null +++ b/recipes-core/base-files/files/usbvm/fstab.early @@ -0,0 +1,13 @@ +# proc is presumably mounted by /etc/init.d/rcS script. +# /etc/init.d/rcS might use /etc/fstab when not modified accordingly, so match +# this entry with /etc/fstab. +proc /proc proc nosuid,noexec,nodev 0 0 + +# OpenXT read-only root tmpfs: +# These have to be either absent from this file or match /etc/fstab +# exactly for mountearly.sh and mountall.sh to work correctly. +sysfs /sys sysfs nosuid,noexec,nodev 0 0 +devtmpfs /dev devtmpfs mode=0755,nosuid 0 0 +tmpfs /run tmpfs defaults,size=5M 0 0 + +tmpfs /var/volatile tmpfs defaults,size=5M 0 0 From 62e062de3dc265a2a82290264b423889d886e23b Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Fri, 24 Jan 2020 11:34:43 -0500 Subject: [PATCH 06/16] vusb: Add stub-mode packaging Allow starting the vusb-daemon in stub-mode when the relevant file is present. Place that file into its own package. Signed-off-by: Jason Andryuk --- recipes-openxt/vusb/files/xenclient-vusb.initscript | 6 +++++- recipes-openxt/vusb/vusb-daemon_git.bb | 6 ++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/recipes-openxt/vusb/files/xenclient-vusb.initscript b/recipes-openxt/vusb/files/xenclient-vusb.initscript index 5ead614f97..66d65dc2ae 100644 --- a/recipes-openxt/vusb/files/xenclient-vusb.initscript +++ b/recipes-openxt/vusb/files/xenclient-vusb.initscript @@ -22,12 +22,16 @@ # PROG=/usr/sbin/vusb-daemon +VUSB_MODE= +VUSB_MODE_FILE="/etc/default/vusb-mode" # Make sure the progam exists [ -f "$PROG" ] || exit 0 +[ -f "$VUSB_MODE_FILE" ] && . "$VUSB_MODE_FILE" + start() { - "$PROG" 2>&1 | logger -t 'vusb-daemon' & + "$PROG" "$VUSB_MODE" 2>&1 | logger -t 'vusb-daemon' & echo "OK" } stop() { diff --git a/recipes-openxt/vusb/vusb-daemon_git.bb b/recipes-openxt/vusb/vusb-daemon_git.bb index 6c2befb587..316599f355 100644 --- a/recipes-openxt/vusb/vusb-daemon_git.bb +++ b/recipes-openxt/vusb/vusb-daemon_git.bb @@ -22,8 +22,14 @@ inherit autotools update-rc.d pkgconfig xc-rpcgen-c INITSCRIPT_NAME = "xenclient-vusb-daemon" INITSCRIPT_PARAMS = "defaults 60 19" +FILES_${PN}-stub += "${sysconfdir}/default/vusb-mode" +RDEPENDS_${PN}-stub += "${PN}" +PACKAGE_BEFORE_PN += "${PN}-stub" + do_install_append (){ install -d ${D}/etc/init.d install -m 0755 ${WORKDIR}/xenclient-vusb.initscript \ ${D}/etc/init.d/xenclient-vusb-daemon + install -d ${D}${sysconfdir}/default + echo 'VUSB_MODE="stub-mode"' >> ${D}${sysconfdir}/default/vusb-mode } From 2f92a5180a74ef672414124eab10e50e5da544fe Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 29 Jan 2020 12:11:35 -0500 Subject: [PATCH 07/16] Add qubes-input-proxy recipe qubes-input-proxy will proxy the input events from usbvm to dom0. A receiver package runs in dom0 and a sender in usbvm. Dom0 needs /dev/uinput to inject the input events, but that is already built into the dom0 kernel. Signed-off-by: Jason Andryuk --- .../qubes-input-proxy/uinput.conf | 2 ++ .../qubes-input-proxy_1.0.32.bb | 26 +++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 recipes-qubes/qubes-input-proxy/qubes-input-proxy/uinput.conf create mode 100644 recipes-qubes/qubes-input-proxy/qubes-input-proxy_1.0.32.bb diff --git a/recipes-qubes/qubes-input-proxy/qubes-input-proxy/uinput.conf b/recipes-qubes/qubes-input-proxy/qubes-input-proxy/uinput.conf new file mode 100644 index 0000000000..d5b640cc5c --- /dev/null +++ b/recipes-qubes/qubes-input-proxy/qubes-input-proxy/uinput.conf @@ -0,0 +1,2 @@ +# Load uinput for qubes's input-proxy-receiver +uinput diff --git a/recipes-qubes/qubes-input-proxy/qubes-input-proxy_1.0.32.bb b/recipes-qubes/qubes-input-proxy/qubes-input-proxy_1.0.32.bb new file mode 100644 index 0000000000..dfc3c5a167 --- /dev/null +++ b/recipes-qubes/qubes-input-proxy/qubes-input-proxy_1.0.32.bb @@ -0,0 +1,26 @@ +SUMMARY = "Qubes Simple input events proxy" +LICENSE="GPLv2+" +LIC_FILES_CHKSUM = "file://debian/copyright;beginline=8;endline=22;md5=e4f60d1e5c91bab4e89cc83acb62bb9b" + +SRC_URI = " \ + git://github.com/QubesOS/qubes-app-linux-input-proxy.git;protocol=https \ + file://uinput.conf \ +" +SRCREV = "e952c35a7c46a18931880b0b08da7382e472406d" + +S = "${WORKDIR}/git" + +PACKAGES =+ "${PN}-sender ${PN}-receiver" + +FILES_${PN}-sender = "${bindir}/input-proxy-sender" +FILES_${PN}-receiver = "\ + ${bindir}/input-proxy-receiver \ + ${sysconfdir}/modules-load.d/ \ +" + +do_install() { + oe_runmake -C src install DESTDIR=${D} + + install -d ${D}${sysconfdir}/modules-load.d/ + install -m 0644 ${WORKDIR}/uinput.conf ${D}${sysconfdir}/modules-load.d/ +} From d0c24a57ee101168c6c5b046cbdfc605b72e5da0 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 29 Jan 2020 12:34:06 -0500 Subject: [PATCH 08/16] Add argo-exec & input sender/receiver helpers argo-exec execs a command with the commands stdin/stdout proxied over argo. This is analagous to qubes rpc. argo-input-receiver and argo-input-sender are wrappers to call qubes-input-sender/receiver with argo-exec. argo-input-receiver listens on argo port 7777 and forks off sub-processes for incoming connections. argo-input-receiver-wrapper ensures logger runs in argo_input_receiver_t and not initrc_t. argo-input-sender hits an ordering problem between udev and modutils initscripts. udev will launch argo-input-sender process for detected input devices, but the xen-argo kernel module isn't loaded until later in modutils. argo-input-sender-kick is a one-off init script to trigger udev to spawn argo-input-sender processes. Signed-off-by: Jason Andryuk --- recipes-openxt/argo-exec/argo-exec.bb | 60 +++ .../argo-exec/argo-exec/argo-exec.c | 386 ++++++++++++++++++ .../argo-exec/argo-exec/argo-input-receiver | 6 + .../argo-exec/argo-input-receiver.init | 32 ++ .../argo-exec/argo-exec/argo-input-sender | 7 + .../argo-exec/argo-input-sender-kick | 16 + .../argo-exec/argo-input-sender.rules | 22 + 7 files changed, 529 insertions(+) create mode 100644 recipes-openxt/argo-exec/argo-exec.bb create mode 100644 recipes-openxt/argo-exec/argo-exec/argo-exec.c create mode 100644 recipes-openxt/argo-exec/argo-exec/argo-input-receiver create mode 100644 recipes-openxt/argo-exec/argo-exec/argo-input-receiver.init create mode 100644 recipes-openxt/argo-exec/argo-exec/argo-input-sender create mode 100644 recipes-openxt/argo-exec/argo-exec/argo-input-sender-kick create mode 100644 recipes-openxt/argo-exec/argo-exec/argo-input-sender.rules diff --git a/recipes-openxt/argo-exec/argo-exec.bb b/recipes-openxt/argo-exec/argo-exec.bb new file mode 100644 index 0000000000..703cbec990 --- /dev/null +++ b/recipes-openxt/argo-exec/argo-exec.bb @@ -0,0 +1,60 @@ +DESCRIPTION = "Tool to pass stdio over argo" +LICENSE = "GPLv2" +LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6" + +inherit update-rc.d + +SRC_URI += "file://argo-exec.c \ + file://argo-input-sender \ + file://argo-input-sender-kick \ + file://argo-input-sender.rules \ + file://argo-input-receiver \ + file://argo-input-receiver.init \ +" + +DEPENDS = "xen-tools libargo" + +S = "${WORKDIR}" + +CFLAGS += "-Wall -Werror" +export LDLIBS="-largo" + +PACKAGES =+ "argo-input-receiver argo-input-sender" + +RDEPENDS_argo-input-receiver = "argo-exec qubes-input-proxy-receiver" +RDEPENDS_argo-input-sender = "argo-exec qubes-input-proxy-sender" + +INITSCRIPT_PACKAGES="argo-input-receiver argo-input-sender" +INITSCRIPT_NAME_argo-input-receiver = "argo-input-receiver" +INITSCRIPT_PARAMS_argo-input-receiver = "defaults 50" +INITSCRIPT_NAME_argo-input-sender = "argo-input-sender-kick" +INITSCRIPT_PARAMS_argo-input-sender = "start 99 S ." + +FILES_argo-input-sender = " \ + ${bindir}/argo-input-sender \ + ${sysconfdir}/udev/rules.d/argo-input-sender.rules \ + ${sysconfdir}/init.d/argo-input-sender-kick \ +" +FILES_argo-input-receiver = " \ + ${bindir}/argo-input-receiver \ + ${sysconfdir}/init.d/argo-input-receiver \ +" + +do_compile() { + oe_runmake argo-exec +} + +do_install() { + install -d ${D}${bindir} + install -m 0755 argo-exec ${D}${bindir} + install -m 0755 argo-input-sender ${D}${bindir} + install -m 0755 argo-input-receiver ${D}${bindir}/argo-input-receiver + + install -d ${D}${sysconfdir}/init.d + install -m 0755 argo-input-receiver.init \ + ${D}${sysconfdir}/init.d/argo-input-receiver + install -m 0755 argo-input-sender-kick ${D}${sysconfdir}/init.d + + install -d ${D}${sysconfdir}/udev/rules.d + install -m 0755 argo-input-sender.rules ${D}${sysconfdir}/udev/rules.d +} diff --git a/recipes-openxt/argo-exec/argo-exec/argo-exec.c b/recipes-openxt/argo-exec/argo-exec/argo-exec.c new file mode 100644 index 0000000000..3618ca64e2 --- /dev/null +++ b/recipes-openxt/argo-exec/argo-exec/argo-exec.c @@ -0,0 +1,386 @@ +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +/* child to remote and remote to child buffers */ +static char c2r_buf[4096], r2c_buf[4096]; +ssize_t c2r_sz, r2c_sz; + +pid_t my_pid; +pid_t child, waited_child; +static int child_running; + +static +void sig_child() +{ + int wstatus; + + waited_child = waitpid(-1, &wstatus, WNOHANG); + if (waited_child == 0 && WIFEXITED(wstatus)) { + child_running--; + } +} + +static +pid_t exec_cmd(char *argv[], int fds[2]) +{ + int fd_stdin[2], fd_stdout[2]; + pid_t pid; + int ret; + + ret = pipe2(fd_stdin, O_CLOEXEC); + if (ret) { + perror("pipe2 stdin"); + return -1; + } + fds[1] = fd_stdin[1]; + + ret = pipe2(fd_stdout, O_CLOEXEC); + if (ret) { + perror("pipe2 stdout"); + return -1; + } + fds[0] = fd_stdout[0]; + + pid = fork(); + switch (pid) { + case 0: + /* child */ + my_pid = getpid(); + if (fd_stdin[0] != 0) { + dup2(fd_stdin[0], 0); + close(fd_stdin[0]); + } + if (fd_stdout[1] != 1) { + dup2(fd_stdout[1], 1); + close(fd_stdout[1]); + } + fprintf(stderr, "%d: execvp(%s..)\n", my_pid, argv[0]); + ret = execvp(argv[0], argv); + perror("execvp"); + return ret; + break; + case -1: + perror("fork exec_cmd"); + return -1; + break; + default: + close(fd_stdin[0]); + close(fd_stdout[1]); + printf("%d: Forked child %d running %s\n", my_pid, pid, + argv[0]); + child_running++; + return pid; + break; + } +} + +static +ssize_t write_all(int fd, void *buf, ssize_t len) +{ + ssize_t sz = 0; + ssize_t ret; + + while (sz < len) { + ret = write(fd, buf + sz, len - sz); + if ( ret < 0 ) { + return ret; + } + sz += ret; + } + + return 0; +} + +static +ssize_t argo_send_all(int s, void *buf, ssize_t len) +{ + ssize_t sz = 0; + ssize_t ret; + + while (sz < len) { + ret = argo_send(s, buf + sz, len - sz, 0); + if ( ret < 0 ) { + return ret; + } + sz += ret; + } + + return 0; +} + +static +int shuffle(int s, int c2r, int r2c) +{ + fd_set _fdset_base, *fdset_base = &_fdset_base; + fd_set _fdset, *fdset = &_fdset; + int nfds = 2; + int ret; + + FD_ZERO(fdset_base); + FD_SET(s, fdset_base); + FD_SET(c2r, fdset_base); + + while (child_running && nfds) { + int maxfd; + + *fdset = *fdset_base; + + maxfd = (s > c2r ? s : c2r) + 1; + + ret = select(maxfd, fdset, NULL, NULL, NULL); + if (ret == -1) { + if (errno != EINTR) { + perror("select"); + return -1; + } else { + printf("%d: EINTR - child_running=%d\n", my_pid, + child_running); + continue; + } + } + + if (ret == 0) { + printf("select timeout\n"); + continue; + } + + if ( FD_ISSET(s, fdset) ) { + r2c_sz = argo_recv(s, r2c_buf, sizeof(r2c_buf), 0); + if (r2c_sz == 0) { + //maxfd = c2r + 1; + fprintf(stderr, "%d: closing fd s=%d\n", my_pid, + c2r); + FD_CLR(s, fdset_base); + nfds--; + return 0; + } + + ret = write_all(r2c, r2c_buf, r2c_sz); + if (ret < 0) { + perror("write_all"); + return -1; + } + } + + if ( FD_ISSET(c2r, fdset) ) { + c2r_sz = read(c2r, c2r_buf, sizeof(c2r_buf)); + if (c2r_sz == 0) { + //maxfd = s + 1; + fprintf(stderr, "%d: closing fd c2r=%d\n", + my_pid, c2r); + FD_CLR(c2r, fdset_base); + nfds--; + return 0; + } + + ret = argo_send_all(s, c2r_buf, c2r_sz); + if (ret < 0) { + perror("argo_send_all"); + return -1; + } + } + } + + return 0; +} + +static +int spawn_child(char *argv[], int s) +{ + int wstatus; + int fds[2] = { -1, -1 }; + int ret; + + signal(SIGCHLD, sig_child); + + child = exec_cmd(argv, fds); + + ret = shuffle(s, fds[0], fds[1]); + if (ret) { + perror("shuffle"); + } + + if (child_running) { + ret = kill(child, SIGTERM); + } + + close(fds[0]); + close(fds[1]); + argo_close(s); + + waitpid(child, &wstatus, 0); + + printf("%d: child %d exited %d\n", my_pid, child, WIFEXITED(wstatus)); + + return 0; +} + +static +int accept_loop(int s, xen_argo_addr_t addr, domid_t domid) { + int ret; + + int fd; + xen_argo_addr_t peer; + + addr.domain_id = XEN_ARGO_DOMID_ANY; + + ret = argo_bind(s, &addr, domid); + if (ret == -1) { + perror("argo_bind"); + return -1; + } + + ret = argo_listen(s, 1); + if (ret == -1) { + perror("argo_listen"); + return -1; + } + + signal(SIGCHLD, sig_child); + + while (1) { + fd = argo_accept(s, &peer); + if (fd < 0) { + if (errno == EINTR) { + if (waited_child) { + printf("%d: EINTR - child %d exited\n", + my_pid, waited_child); + waited_child = 0; + } + continue; + } + + perror("argo_accept"); + return -1; + } + + printf("%d: accepted connection from dom %d:%u\n", my_pid, + peer.domain_id, peer.aport); + + child = fork(); + switch (child) { + case -1: + perror("fork accept_loop"); + exit(1); + break; + case 0: + /* child */ + my_pid = getpid(); + argo_close(s); + s = fd; + return s; + break; + default: + /* parent */ + argo_close(fd); + printf("%d: spawned child %d\n", my_pid, child); + child_running++; + break; + } + } +} + +static +void usage(char *prog) +{ + printf( +"%s: -p port <-l | -d domid> -- cmd args ...\n" +"\t-p port - for argo comms\n" +"\t-l - listen for an argo connection on port\n" +"\t-d domid - Remote domid for argo connect\n" +"\tcmd args - command and arguments to exec.\n" +"\t stdin and stdout will be transfered over the argo connection.\n", prog); +} + +int main(int argc, char *argv[]) +{ + int s; + int opt; + int ret; + int port = 0; + int index; + int listen = 0; + domid_t domid = XEN_ARGO_DOMID_ANY; + xen_argo_addr_t addr = {}; + + struct option opts[] = { + {"domid", required_argument, NULL, 'd'}, + {"listen", no_argument, NULL, 'l'}, + {"port", required_argument, NULL, 'p'}, + {} + }; + + my_pid = getpid(); + setbuf(stdout, NULL); + + while ( (opt = getopt_long(argc, argv, "d:lp:", opts, &index)) != -1 ) + { + switch (opt) + { + case 'd': + domid = strtoul(optarg, NULL, 0); + break; + case 'l': + listen = 1; + break; + case 'p': + port = strtoul(optarg, NULL, 0); + break; + case '?': + printf("unknown option %c\n", optopt); + return -1; + } + } + + if (port == 0 || + (listen == 0 && domid == XEN_ARGO_DOMID_ANY)) { + usage(argv[0]); + return -1; + } + + s = argo_socket(SOCK_STREAM | SOCK_CLOEXEC); + if (s < 0) { + perror("argo_socket"); + return -1; + } + + if (listen) { + addr.aport = port; + s = accept_loop(s, addr, domid); + } else { + addr.domain_id = XEN_ARGO_DOMID_ANY; + /* bind local ring to random port */ + addr.aport = 0; + + ret = argo_bind(s, &addr, domid); + if (ret == -1) { + perror("argo_bind"); + return -1; + } + + addr.domain_id = domid; + addr.aport = port; + + ret = argo_connect(s, &addr); + if (ret == -1) { + perror("argo_connect"); + return -1; + } + } + + return spawn_child(&argv[optind], s); +} diff --git a/recipes-openxt/argo-exec/argo-exec/argo-input-receiver b/recipes-openxt/argo-exec/argo-exec/argo-input-receiver new file mode 100644 index 0000000000..e211eba54f --- /dev/null +++ b/recipes-openxt/argo-exec/argo-exec/argo-input-receiver @@ -0,0 +1,6 @@ +#!/bin/sh + +port="$1" +shift + +exec argo-exec -l -p "$port" -- input-proxy-receiver "$@" 2>&1 | logger -t argo-input-receiver & diff --git a/recipes-openxt/argo-exec/argo-exec/argo-input-receiver.init b/recipes-openxt/argo-exec/argo-exec/argo-input-receiver.init new file mode 100644 index 0000000000..f5d59af5c1 --- /dev/null +++ b/recipes-openxt/argo-exec/argo-exec/argo-input-receiver.init @@ -0,0 +1,32 @@ +#!/bin/sh + +OPTS="--mouse --keyboard --tablet" +port=7777 + +start() { + argo-input-receiver "$port" $OPTS & +} + + +stop() { + pkill argo-exec +} + +case "$1" in +start) + start + ;; +stop) + stop + ;; +restart) + stop + start + ;; +*) + echo "Unknown command $1" >&2 + exit 1; + ;; +esac + +exit 0 diff --git a/recipes-openxt/argo-exec/argo-exec/argo-input-sender b/recipes-openxt/argo-exec/argo-exec/argo-input-sender new file mode 100644 index 0000000000..aa66d6eaf1 --- /dev/null +++ b/recipes-openxt/argo-exec/argo-exec/argo-input-sender @@ -0,0 +1,7 @@ +#!/bin/sh + +event=$1 +domain=0 +port=7777 + +exec argo-exec -d "$domain" -p "$port" -- input-proxy-sender /dev/input/${event} 2>&1 | logger -t argo-input-sender & diff --git a/recipes-openxt/argo-exec/argo-exec/argo-input-sender-kick b/recipes-openxt/argo-exec/argo-exec/argo-input-sender-kick new file mode 100644 index 0000000000..e68ec58b84 --- /dev/null +++ b/recipes-openxt/argo-exec/argo-exec/argo-input-sender-kick @@ -0,0 +1,16 @@ +#!/bin/sh + +# Kick udev to launch any necessary argo-input-sender processes +start() { + udevadm trigger -c add -t devices -s input +} + +case "$1" in + start) + start + ;; + *) + echo "Command '$1' not supported" + exit 1 + ;; +esac diff --git a/recipes-openxt/argo-exec/argo-exec/argo-input-sender.rules b/recipes-openxt/argo-exec/argo-exec/argo-input-sender.rules new file mode 100644 index 0000000000..5e86c7d267 --- /dev/null +++ b/recipes-openxt/argo-exec/argo-exec/argo-input-sender.rules @@ -0,0 +1,22 @@ +SUBSYSTEM!="input", GOTO="qubes_input_proxy_end" + +# skip platform devices present in HVM guests +ENV{ID_BUS}=="i8042", GOTO="qubes_input_proxy_end" +ENV{ID_PATH}=="acpi-*", GOTO="qubes_input_proxy_end" +ENV{ID_PATH}=="platform-*", GOTO="qubes_input_proxy_end" +ENV{ID_MODEL}=="QEMU_USB_Tablet", GOTO="qubes_input_proxy_end" + +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_TABLET}=="1", ENV{ID_INPUT_KEY}!="1", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_TOUCHSCREEN}=="1", ENV{ID_INPUT_KEY}!="1", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" +#KERNEL=="event*", ACTION=="remove", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" + +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_MOUSE}=="1", ENV{ID_INPUT_KEY}!="1", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" +#KERNEL=="event*", ACTION=="remove", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" + +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEY}=="1", ENV{ID_INPUT_MOUSE}!="1", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" +#KERNEL=="event*", ACTION=="remove", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" + +KERNEL=="event*", ACTION=="add", ENV{ID_INPUT_KEY}=="1", ENV{ID_INPUT_MOUSE}=="1", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" +#KERNEL=="event*", ACTION=="remove", RUN+="/sbin/start-stop-daemon --start --background --exec /usr/bin/argo-input-sender -- %k" + +LABEL="qubes_input_proxy_end" From 5ee7c52456edf60e33b581fd386bea1e1f28c5d6 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 29 Jan 2020 12:36:28 -0500 Subject: [PATCH 09/16] packagegroup-dom0: Add argo-input-receiver Add argo-input-receiver to dom0. Signed-off-by: Jason Andryuk --- recipes-core/packagegroups/packagegroup-xenclient-dom0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/recipes-core/packagegroups/packagegroup-xenclient-dom0.bb b/recipes-core/packagegroups/packagegroup-xenclient-dom0.bb index 5893492ecd..eb7941ce0e 100644 --- a/recipes-core/packagegroups/packagegroup-xenclient-dom0.bb +++ b/recipes-core/packagegroups/packagegroup-xenclient-dom0.bb @@ -95,6 +95,7 @@ RDEPENDS_${PN} = " \ xenclient-pcrdiff \ eject \ linux-input \ + argo-input-receiver \ iputils-ping \ vusb-daemon \ xenmgr-data \ From 68087181134d6dca7f6c505e144f549f6427f907 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 29 Jan 2020 12:39:39 -0500 Subject: [PATCH 10/16] Add usbvm-image This is a basic recipe for the ubsvm image. It runs vusb-daemon in stub-mode and launches qubes-input-sender through argo-input-sender to relay input. Signed-off-by: Jason Andryuk --- recipes-core/images/usbvm-image.bb | 32 ++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 recipes-core/images/usbvm-image.bb diff --git a/recipes-core/images/usbvm-image.bb b/recipes-core/images/usbvm-image.bb new file mode 100644 index 0000000000..9f6e0dc44a --- /dev/null +++ b/recipes-core/images/usbvm-image.bb @@ -0,0 +1,32 @@ +DESCRIPTION = "usbvm to isolate USB hardware" +LICENSE = "GPLv2+" +LIC_FILES_CHKSUM = " \ + file://${COMMON_LICENSE_DIR}/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6 \ +" + +inherit openxt-image + +IMAGE_FEATURES += " \ + read-only-rootfs \ + empty-root-password \ + ctrlaltdel-reboot \ +" + +IMAGE_FSTYPES = "ext4.disk.vhd.gz" + +IMAGE_LINGUAS = "" + +COMPATIBLE_MACHINE = "usbvm" + +IMAGE_INSTALL += " \ + packagegroup-core-boot \ + kmod \ + openssh \ + rsyslog \ + usbutils \ + argo-module \ + grub-xen-conf \ + kernel-modules \ + vusb-daemon-stub \ + argo-input-sender \ +" From 4041bfc5a68d078237c4d95ab8bd6a958e06de34 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Thu, 6 Feb 2020 15:32:22 -0500 Subject: [PATCH 11/16] initscripts: s/tty0/console in populate-volatiles.sh /dev/tty0 is only present when a kernel is configured with CONFIG_VT_CONSOLE, so the output redirection is incorrect when /dev/tty0 is not present. A regular file will be created as /dev/tty0. Use /dev/tty since "it is a synonym for the controlling terminal of a process, if any." (from tty(4) manual page). But that may not be present either. Use /dev/console which as the system console makes sense for printing these messages. Signed-off-by: Jason Andryuk --- .../initscripts/initscripts-1.0/populate-volatile.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/recipes-core/initscripts/initscripts-1.0/populate-volatile.sh b/recipes-core/initscripts/initscripts-1.0/populate-volatile.sh index cac6c77456..c265f9c1b9 100644 --- a/recipes-core/initscripts/initscripts-1.0/populate-volatile.sh +++ b/recipes-core/initscripts/initscripts-1.0/populate-volatile.sh @@ -28,9 +28,9 @@ RESTORECON="${ROOT_DIR}/sbin/restorecon" create_file() { EXEC=" touch \"$1\"; - [ -x ${RESTORECON} ] && ${RESTORECON} \"$1\" >/dev/tty0 2>&1; - chown ${TUSER}.${TGROUP} $1 || echo \"Failed to set owner -${TUSER}- for -$1-.\" >/dev/tty0 2>&1; - chmod ${TMODE} $1 || echo \"Failed to set mode -${TMODE}- for -$1-.\" >/dev/tty0 2>&1 " + [ -x ${RESTORECON} ] && ${RESTORECON} \"$1\" >/dev/console 2>&1; + chown ${TUSER}.${TGROUP} $1 || echo \"Failed to set owner -${TUSER}- for -$1-.\" >/dev/console 2>&1; + chmod ${TMODE} $1 || echo \"Failed to set mode -${TMODE}- for -$1-.\" >/dev/console 2>&1 " test "$VOLATILE_ENABLE_CACHE" = yes && echo "$EXEC" >> /etc/volatile.cache.build @@ -52,9 +52,9 @@ create_file() { mk_dir() { EXEC=" mkdir -p \"$1\"; - [ -x ${RESTORECON} ] && ${RESTORECON} \"$1\" >/dev/tty0 2>&1; - chown ${TUSER}.${TGROUP} $1 || echo \"Failed to set owner -${TUSER}- for -$1-.\" >/dev/tty0 2>&1; - chmod ${TMODE} $1 || echo \"Failed to set mode -${TMODE}- for -$1-.\" >/dev/tty0 2>&1 " + [ -x ${RESTORECON} ] && ${RESTORECON} \"$1\" >/dev/console 2>&1; + chown ${TUSER}.${TGROUP} $1 || echo \"Failed to set owner -${TUSER}- for -$1-.\" >/dev/console 2>&1; + chmod ${TMODE} $1 || echo \"Failed to set mode -${TMODE}- for -$1-.\" >/dev/console 2>&1 " test "$VOLATILE_ENABLE_CACHE" = yes && echo "$EXEC" >> /etc/volatile.cache.build [ -e "$1" ] && { From b1ff1d67206c0f510450c504bd6500798330bef4 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Thu, 20 Feb 2020 12:54:59 -0500 Subject: [PATCH 12/16] refpolicy-mcs: Add argo-input modules This module provides SELinux labeling for the argo-input-sender and argo-input-receiver. Signed-off-by: Jason Andryuk --- .../refpolicy-mcs/policy/modules-openxt.conf | 7 ++ .../policy/modules/services/argo-input.fc | 2 + .../policy/modules/services/argo-input.if | 22 ++++++ .../policy/modules/services/argo-input.te | 68 +++++++++++++++++++ .../refpolicy/refpolicy-mcs_git.bbappend | 3 + 5 files changed, 102 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.fc create mode 100644 recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.if create mode 100644 recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.te diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules-openxt.conf b/recipes-security/refpolicy/refpolicy-mcs/policy/modules-openxt.conf index ac91a401dd..0727513306 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules-openxt.conf +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules-openxt.conf @@ -18,6 +18,13 @@ # statusreport = module +# Layer: services +# Module: argo-input +# +# argo-input +# +argo-input = module + # Layer: services # Module: blktap # diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.fc b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.fc new file mode 100644 index 0000000000..2320c905bc --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.fc @@ -0,0 +1,2 @@ +/usr/bin/argo-input-receiver -- gen_context(system_u:object_r:argo_input_receiver_exec_t,s0) +/usr/bin/argo-input-sender -- gen_context(system_u:object_r:argo_input_sender_exec_t,s0) diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.if b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.if new file mode 100644 index 0000000000..1a37118ea6 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.if @@ -0,0 +1,22 @@ +## argo-input-sender + +####################################### +## +## Run and transition into the +## argo_input_sender_t domain +## +## +## +## The type of the process launching argo-input-sender +## +## +# +interface(`argo_input_sender_domtrans',` + gen_require(` + type argo_input_sender_t, argo_input_sender_exec_t; + class dbus send_msg; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, argo_input_sender_exec_t, argo_input_sender_t) +') diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.te new file mode 100644 index 0000000000..dfd072428b --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/argo-input.te @@ -0,0 +1,68 @@ +policy_module(argo-input, 0.1) + +######################################## +# +# Declarations +# +type argo_input_sender_t; +type argo_input_sender_exec_t; +init_daemon_domain(argo_input_sender_t, argo_input_sender_exec_t) + +####################################### +# +# argo-input-sender Local Policy +# + +# We are a shell script +corecmd_exec_shell(argo_input_sender_t) +corecmd_exec_bin(argo_input_sender_t) + +# Reading input events and writing for LEDs +dev_rw_input_dev(argo_input_sender_t) +# And sending them over argo +xc_files_rw_argo_chr(argo_input_sender_t) +# With logging through /bin/logger +corecmd_exec_bin(argo_input_sender_t) +logging_send_syslog_msg(argo_input_sender_t) + +# Read /etc/nsswitch.conf +files_read_etc_files(argo_input_sender_t) + +# Pipes between argo-exec and logger +allow argo_input_sender_t self:fifo_file rw_fifo_file_perms; +allow argo_input_sender_t self:process { signal }; + +optional_policy(` + gen_require(` + type udev_t; + ') + argo_input_sender_domtrans(udev_t) +') +# +######################################## +# +# Declarations +# +type argo_input_receiver_t; +type argo_input_receiver_exec_t; +init_daemon_domain(argo_input_receiver_t, argo_input_receiver_exec_t) + +####################################### +# +# argo-input-receiver Local Policy +# + +# We are a shell script +corecmd_exec_shell(argo_input_receiver_t) + +# Injecting input events... +dev_rw_input_dev(argo_input_receiver_t) +# And sending them over argo +xc_files_rw_argo_chr(argo_input_receiver_t) +# Launching input-proxy-receiver +corecmd_exec_bin(argo_input_receiver_t) +logging_send_syslog_msg(argo_input_receiver_t) + +# Pipes between argo-exec and logger +allow argo_input_receiver_t self:fifo_file rw_fifo_file_perms; +allow argo_input_receiver_t self:process { signal }; diff --git a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend index 32ce2a4c8b..bd7cead831 100644 --- a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend +++ b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend @@ -31,6 +31,9 @@ SRC_URI += " \ file://policy/modules/apps/tpmutil.fc \ file://policy/modules/apps/tpmutil.if \ file://policy/modules/apps/tpmutil.te \ + file://policy/modules/services/argo-input.fc \ + file://policy/modules/services/argo-input.if \ + file://policy/modules/services/argo-input.te \ file://policy/modules/services/blktap.fc \ file://policy/modules/services/blktap.if \ file://policy/modules/services/blktap.te \ From 6f88152d454397107b661608a8241b748cb51fac Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Thu, 20 Feb 2020 13:19:21 -0500 Subject: [PATCH 13/16] usbvm-image: Enable SELinux Make the image SELinux enabled. Signed-off-by: Jason Andryuk --- recipes-core/images/usbvm-image.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/recipes-core/images/usbvm-image.bb b/recipes-core/images/usbvm-image.bb index 9f6e0dc44a..0162c49260 100644 --- a/recipes-core/images/usbvm-image.bb +++ b/recipes-core/images/usbvm-image.bb @@ -4,7 +4,7 @@ LIC_FILES_CHKSUM = " \ file://${COMMON_LICENSE_DIR}/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6 \ " -inherit openxt-image +inherit openxt-selinux-image IMAGE_FEATURES += " \ read-only-rootfs \ From 52f8654b96825b41f812319714908d024c2e3f4f Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Tue, 21 Jan 2020 07:52:55 -0500 Subject: [PATCH 14/16] busybox: Enable SELinux support We run an SELinux-enabled system, but the busybox support is disabled. Turn it on to enable the -Z option is assorted commands. Signed-off-by: Jason Andryuk --- recipes-core/busybox/busybox_%.bbappend | 2 ++ recipes-core/busybox/files/general.cfg | 1 + 2 files changed, 3 insertions(+) diff --git a/recipes-core/busybox/busybox_%.bbappend b/recipes-core/busybox/busybox_%.bbappend index e9fce8f556..72517fd6fc 100644 --- a/recipes-core/busybox/busybox_%.bbappend +++ b/recipes-core/busybox/busybox_%.bbappend @@ -1,5 +1,7 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/files:" +DEPENDS += "libselinux" + SRC_URI += " \ file://archive.cfg \ file://console.cfg \ diff --git a/recipes-core/busybox/files/general.cfg b/recipes-core/busybox/files/general.cfg index 853cb11460..302b05eeb9 100644 --- a/recipes-core/busybox/files/general.cfg +++ b/recipes-core/busybox/files/general.cfg @@ -1,2 +1,3 @@ +CONFIG_SELINUX=y CONFIG_UNICODE_SUPPORT=y CONFIG_UNICODE_WIDE_WCHARS=y From 949d3233e5370c677814bb8fe0410d08c6644a5c Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Thu, 20 Feb 2020 13:12:18 -0500 Subject: [PATCH 15/16] refpolicy-mcs: Add xenstore_dev_t and xen_rw_xenstore Label /dev/xen/xenbus as xenstore_dev_t so xenstore permissions can be separated out from other xen_device_t permissions. xenstore access is useful on its own and many programs only use xenstore access without the other xen devices. OXT-1731 Signed-off-by: Jason Andryuk --- ...olicy.modules.services.networkmanager.diff | 2 +- .../patches/xenstore-labeling.patch | 76 +++++++++++++++++++ .../policy/modules/services/dbusbouncer.te | 2 +- .../policy/modules/services/glass.te | 1 + .../policy/modules/services/ivcd.te | 1 + .../policy/modules/services/network-daemon.te | 2 +- .../policy/modules/services/vusb.te | 2 +- .../refpolicy/refpolicy-mcs_git.bbappend | 1 + 8 files changed, 83 insertions(+), 4 deletions(-) create mode 100644 recipes-security/refpolicy/refpolicy-mcs/patches/xenstore-labeling.patch diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.services.networkmanager.diff b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.services.networkmanager.diff index ff6f61c4fd..36dd4e79ca 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.services.networkmanager.diff +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/policy.modules.services.networkmanager.diff @@ -298,7 +298,7 @@ +optional_policy(` + xen_dontaudit_rw_unix_stream_sockets(NetworkManager_t) + xen_dbus_chat(NetworkManager_t) -+ dev_rw_xen(NetworkManager_t) ++ xen_rw_xenstore(NetworkManager_t) +') + ######################################## diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/xenstore-labeling.patch b/recipes-security/refpolicy/refpolicy-mcs/patches/xenstore-labeling.patch new file mode 100644 index 0000000000..2aaf246e9a --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/xenstore-labeling.patch @@ -0,0 +1,76 @@ +--- a/policy/modules/system/xen.if ++++ b/policy/modules/system/xen.if +@@ -237,6 +237,23 @@ interface(`xen_stream_connect_xenstore', + + ######################################## + ## ++## Connect to xenstore through unix ++## domain stream socket or over ++## /dev/xen/xenbus ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`xen_rw_xenstore',` ++ xen_stream_connect_xenstore($1) ++ dev_rw_xenstore($1) ++') ++ ++######################################## ++## + ## Connect to xend with a unix + ## domain stream socket. + ## +--- a/policy/modules/kernel/devices.fc ++++ b/policy/modules/kernel/devices.fc +@@ -187,7 +187,7 @@ ifdef(`distro_suse', ` + /dev/xen/gntdev -c gen_context(system_u:object_r:xen_device_t,s0) + /dev/xen/gntalloc -c gen_context(system_u:object_r:xen_device_t,s0) + /dev/xen/privcmd -c gen_context(system_u:object_r:xen_device_t,s0) +-/dev/xen/xenbus -c gen_context(system_u:object_r:xen_device_t,s0) ++/dev/xen/xenbus -c gen_context(system_u:object_r:xenstore_dev_t,s0) + /dev/xen/xenbus_backend -c gen_context(system_u:object_r:xen_device_t,s0) + /dev/xen/hypercall -c gen_context(system_u:object_r:xen_device_t,s0) + +--- a/policy/modules/kernel/devices.if ++++ b/policy/modules/kernel/devices.if +@@ -5025,6 +5025,24 @@ interface(`dev_rw_xen',` + + ######################################## + ## ++## Read and write Xenstore/xenbus devices. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_xenstore',` ++ gen_require(` ++ type device_t, xenstore_dev_t; ++ ') ++ ++ rw_chr_files_pattern($1, device_t, xenstore_dev_t) ++') ++ ++######################################## ++## + ## Create, read, write, and delete Xen devices. + ## + ## +--- a/policy/modules/kernel/devices.te ++++ b/policy/modules/kernel/devices.te +@@ -309,6 +309,9 @@ dev_node(wireless_device_t) + type xen_device_t; + dev_node(xen_device_t) + ++type xenstore_dev_t; ++dev_node(xenstore_dev_t) ++ + type xserver_misc_device_t; + dev_node(xserver_misc_device_t) + diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/dbusbouncer.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/dbusbouncer.te index 1797a770e6..3165588517 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/dbusbouncer.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/dbusbouncer.te @@ -36,7 +36,7 @@ networkmanager_dbus_chat(dbusbouncer_t) fs_rw_xenfs_files(dbusbouncer_t) # xen 4.6 uses /dev/xen/xenbus -dev_rw_xen(dbusbouncer_t) +xen_rw_xenstore(dbusbouncer_t) # Access /dev/argo_*. xc_files_rw_argo_chr(dbusbouncer_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te index 01def33f50..21355ebfca 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te @@ -56,6 +56,7 @@ dev_rw_dri(glass_t) dev_read_sysfs(glass_t) dev_rw_input_dev(glass_t) dev_rw_xen(glass_t) +xen_rw_xenstore(glass_t) files_read_usr_files(glass_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/ivcd.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/ivcd.te index 3afa7bb29f..5bf7cb826b 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/ivcd.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/ivcd.te @@ -29,6 +29,7 @@ manage_sock_files_pattern(ivcd_t, ivcd_var_run_t, ivcd_var_run_t) files_pid_filetrans(ivcd_t, ivcd_var_run_t, { sock_file }) dev_rw_xen(ivcd_t) +xen_rw_xenstore(ivcd_t) logging_send_syslog_msg(ivcd_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/network-daemon.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/network-daemon.te index 11fc28b3f1..0be9cf10d0 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/network-daemon.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/network-daemon.te @@ -130,7 +130,7 @@ kernel_read_xen_state(network_slave_t) kernel_write_xen_state(network_slave_t) fs_rw_xenfs_files(network_slave_t) # xen 4.6 uses /dev/xen/xenbus -dev_rw_xen(network_slave_t) +xen_rw_xenstore(network_slave_t) sysnet_manage_config(network_slave_t) read_fifo_files_pattern(network_slave_t, network_slave_t, network_slave_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/vusb.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/vusb.te index 990ac9308e..00c549cce0 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/vusb.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/vusb.te @@ -65,7 +65,7 @@ kernel_read_system_state(vusbd_t) kernel_read_xen_state(vusbd_t) kernel_write_xen_state(vusbd_t) kernel_write_xen_state(vusbd_t) -xen_stream_connect_xenstore(vusbd_t) +xen_rw_xenstore(vusbd_t) udev_read_db(vusbd_t) # For /var/run/udev/queue.bin udev_read_pid_files(vusbd_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend index bd7cead831..2f88d20731 100644 --- a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend +++ b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend @@ -164,6 +164,7 @@ SRC_URI += " \ file://patches/xl-sysadm-interfaces.patch \ file://patches/policy.modules.admin.bootloader.diff \ file://patches/monit-volatiles.patch \ + file://patches/xenstore-labeling.patch \ " DEPENDS_append += " \ From 5f39292990a9356023f81e1e8fe6c41f6acb94de Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Thu, 20 Feb 2020 13:15:47 -0500 Subject: [PATCH 16/16] refpolicy-mcs: Add xenpriv_device_t /dev/xen/privcmd is much more powerful than the other xen_device_t interfaces, so label it separately. OXT-1731 Signed-off-by: Jason Andryuk --- .../refpolicy-mcs/patches/xen-privcmd.patch | 99 +++++++++++++++++++ .../policy/modules/services/glass.te | 1 + .../policy/modules/system/stubdom-helpers.te | 1 + .../refpolicy/refpolicy-mcs_git.bbappend | 1 + 4 files changed, 102 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy-mcs/patches/xen-privcmd.patch diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/xen-privcmd.patch b/recipes-security/refpolicy/refpolicy-mcs/patches/xen-privcmd.patch new file mode 100644 index 0000000000..b266ae91e0 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/xen-privcmd.patch @@ -0,0 +1,99 @@ +--- a/policy/modules/system/xen.te ++++ b/policy/modules/system/xen.te +@@ -339,6 +339,7 @@ dev_filetrans_xen(xend_t) + dev_filetrans_blktap(xend_t, "blktap-2") + dev_rw_sysfs(xend_t) + dev_rw_xen(xend_t) ++dev_rw_xenpriv(xend_t) + dev_read_rand(xend_t) + dev_search_xen(xend_t) + dev_manage_xen(xend_t) +@@ -548,6 +549,7 @@ kernel_write_xen_state(xenconsoled_t) + kernel_read_xen_state(xenconsoled_t) + + dev_rw_xen(xenconsoled_t) ++dev_rw_xenpriv(xenconsoled_t) + dev_filetrans_xen(xenconsoled_t) + dev_rw_sysfs(xenconsoled_t) + +@@ -621,6 +623,7 @@ corecmd_search_bin(xenstored_t) + + dev_filetrans_xen(xenstored_t) + dev_rw_xen(xenstored_t) ++dev_rw_xenpriv(xenstored_t) + dev_read_sysfs(xenstored_t) + dev_create_generic_dirs(xenstored_t) + dev_manage_xen(xenstored_t) +@@ -753,6 +756,7 @@ xen_stream_connect(xm_t) + xen_stream_connect_xenstore(xm_t) + + dev_rw_xen(xm_t) ++dev_rw_xenpriv(xm_t) + + tunable_policy(`xen_use_fusefs',` + fs_manage_fusefs_dirs(xm_t) +--- a/policy/modules/kernel/devices.fc ++++ b/policy/modules/kernel/devices.fc +@@ -186,10 +186,10 @@ ifdef(`distro_suse', ` + /dev/xen/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) + /dev/xen/gntdev -c gen_context(system_u:object_r:xen_device_t,s0) + /dev/xen/gntalloc -c gen_context(system_u:object_r:xen_device_t,s0) +-/dev/xen/privcmd -c gen_context(system_u:object_r:xen_device_t,s0) ++/dev/xen/privcmd -c gen_context(system_u:object_r:xenpriv_device_t,s0) + /dev/xen/xenbus -c gen_context(system_u:object_r:xenstore_dev_t,s0) + /dev/xen/xenbus_backend -c gen_context(system_u:object_r:xen_device_t,s0) +-/dev/xen/hypercall -c gen_context(system_u:object_r:xen_device_t,s0) ++/dev/xen/hypercall -c gen_context(system_u:object_r:xenpriv_device_t,s0) + + + ifdef(`distro_debian',` +--- a/policy/modules/kernel/devices.if ++++ b/policy/modules/kernel/devices.if +@@ -5025,6 +5025,25 @@ interface(`dev_rw_xen',` + + ######################################## + ## ++## Read and write Xen privcmd devices. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_xenpriv',` ++ gen_require(` ++ type device_t, xenpriv_device_t; ++ ') ++ ++ rw_chr_files_pattern($1, device_t, xenpriv_device_t) ++ allow $1 xenpriv_device_t:chr_file { map }; ++') ++ ++######################################## ++## + ## Read and write Xenstore/xenbus devices. + ## + ## +--- a/policy/modules/kernel/devices.te ++++ b/policy/modules/kernel/devices.te +@@ -309,6 +309,9 @@ dev_node(wireless_device_t) + type xen_device_t; + dev_node(xen_device_t) + ++type xenpriv_device_t; ++dev_node(xenpriv_device_t) ++ + type xenstore_dev_t; + dev_node(xenstore_dev_t) + +--- a/policy/modules/apps/qemu.te ++++ b/policy/modules/apps/qemu.te +@@ -72,6 +72,7 @@ dbus_system_bus_client(qemu_t) + # leaked file descriptors + xen_dontaudit_rw_unix_stream_sockets(qemu_t) + dev_rw_xen(qemu_t) ++dev_rw_xenpriv(qemu_t) + dev_read_sysfs(qemu_t) + xen_stream_connect_xenstore(qemu_t) + allow qemu_t qemu_exec_t:file execute_no_trans; diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te index 21355ebfca..dee9372b6f 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/services/glass.te @@ -56,6 +56,7 @@ dev_rw_dri(glass_t) dev_read_sysfs(glass_t) dev_rw_input_dev(glass_t) dev_rw_xen(glass_t) +dev_rw_xenpriv(glass_t) xen_rw_xenstore(glass_t) files_read_usr_files(glass_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/system/stubdom-helpers.te b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/system/stubdom-helpers.te index 8cdd182bb2..f2d0930882 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules/system/stubdom-helpers.te +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules/system/stubdom-helpers.te @@ -163,6 +163,7 @@ allow varstored_t var_run_t:lnk_file read; # both the watch and varstored also need to write their # pid to the xenstore. dev_rw_xen(varstored_t) +dev_rw_xenpriv(varstored_t) xen_stream_connect_xenstore(varstored_t) xen_stream_connect_xenstore(varstored_watch_t) diff --git a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend index 2f88d20731..18ba9d053b 100644 --- a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend +++ b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend @@ -165,6 +165,7 @@ SRC_URI += " \ file://patches/policy.modules.admin.bootloader.diff \ file://patches/monit-volatiles.patch \ file://patches/xenstore-labeling.patch \ + file://patches/xen-privcmd.patch \ " DEPENDS_append += " \