Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-06 Thread Jason Andryuk
On Wed, Apr 6, 2022 at 3:07 AM Jan Beulich wrote: > > On 05.04.2022 19:17, Jason Andryuk wrote: > > On Mon, Apr 4, 2022 at 11:34 AM Daniel P. Smith > > wrote: > >> On 3/31/22 09:16, Jason Andryuk wrote: > >>> For the default policy, you could start by creating the system domains > >>> as privile

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-06 Thread Roger Pau Monné
On Wed, Apr 06, 2022 at 11:16:10AM +0200, Jan Beulich wrote: > On 06.04.2022 11:09, Roger Pau Monné wrote: > > On Wed, Apr 06, 2022 at 10:48:23AM +0200, Jan Beulich wrote: > >> On 06.04.2022 10:46, Roger Pau Monné wrote: > >>> On Wed, Apr 06, 2022 at 09:06:59AM +0200, Jan Beulich wrote: > On 0

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-06 Thread Jan Beulich
On 06.04.2022 11:09, Roger Pau Monné wrote: > On Wed, Apr 06, 2022 at 10:48:23AM +0200, Jan Beulich wrote: >> On 06.04.2022 10:46, Roger Pau Monné wrote: >>> On Wed, Apr 06, 2022 at 09:06:59AM +0200, Jan Beulich wrote: On 05.04.2022 19:17, Jason Andryuk wrote: > On Mon, Apr 4, 2022 at 11:3

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-06 Thread Roger Pau Monné
On Wed, Apr 06, 2022 at 10:48:23AM +0200, Jan Beulich wrote: > On 06.04.2022 10:46, Roger Pau Monné wrote: > > On Wed, Apr 06, 2022 at 09:06:59AM +0200, Jan Beulich wrote: > >> On 05.04.2022 19:17, Jason Andryuk wrote: > >>> On Mon, Apr 4, 2022 at 11:34 AM Daniel P. Smith > >>> wrote: > On 3

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-06 Thread Jan Beulich
On 06.04.2022 10:46, Roger Pau Monné wrote: > On Wed, Apr 06, 2022 at 09:06:59AM +0200, Jan Beulich wrote: >> On 05.04.2022 19:17, Jason Andryuk wrote: >>> On Mon, Apr 4, 2022 at 11:34 AM Daniel P. Smith >>> wrote: On 3/31/22 09:16, Jason Andryuk wrote: > For the default policy, you coul

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-06 Thread Roger Pau Monné
On Wed, Apr 06, 2022 at 09:06:59AM +0200, Jan Beulich wrote: > On 05.04.2022 19:17, Jason Andryuk wrote: > > On Mon, Apr 4, 2022 at 11:34 AM Daniel P. Smith > > wrote: > >> On 3/31/22 09:16, Jason Andryuk wrote: > >>> For the default policy, you could start by creating the system domains > >>> as

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-06 Thread Jan Beulich
On 05.04.2022 19:17, Jason Andryuk wrote: > On Mon, Apr 4, 2022 at 11:34 AM Daniel P. Smith > wrote: >> On 3/31/22 09:16, Jason Andryuk wrote: >>> For the default policy, you could start by creating the system domains >>> as privileged and just have a single hook to drop privs. Then you >>> don'

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-05 Thread Daniel P. Smith
On 4/5/22 13:17, Jason Andryuk wrote: > On Mon, Apr 4, 2022 at 11:34 AM Daniel P. Smith > wrote: >> >> On 3/31/22 09:16, Jason Andryuk wrote: >>> On Wed, Mar 30, 2022 at 3:05 PM Daniel P. Smith >>> wrote: There are now instances where internal hypervisor logic needs to make resour

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-05 Thread Jason Andryuk
On Mon, Apr 4, 2022 at 11:34 AM Daniel P. Smith wrote: > > On 3/31/22 09:16, Jason Andryuk wrote: > > On Wed, Mar 30, 2022 at 3:05 PM Daniel P. Smith > > wrote: > >> > >> There are now instances where internal hypervisor logic needs to make > >> resource > >> allocation calls that are protected

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-05 Thread Roger Pau Monné
On Tue, Apr 05, 2022 at 08:06:31AM -0400, Daniel P. Smith wrote: > On 4/5/22 03:42, Roger Pau Monné wrote: > > On Mon, Apr 04, 2022 at 12:08:25PM -0400, Daniel P. Smith wrote: > >> On 4/4/22 11:12, Roger Pau Monné wrote: > >>> On Mon, Apr 04, 2022 at 10:21:18AM -0400, Daniel P. Smith wrote: >

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-05 Thread Daniel P. Smith
On 4/5/22 03:42, Roger Pau Monné wrote: > On Mon, Apr 04, 2022 at 12:08:25PM -0400, Daniel P. Smith wrote: >> On 4/4/22 11:12, Roger Pau Monné wrote: >>> On Mon, Apr 04, 2022 at 10:21:18AM -0400, Daniel P. Smith wrote: On 3/31/22 08:36, Roger Pau Monné wrote: > On Wed, Mar 30, 2022 at 07:0

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-05 Thread Roger Pau Monné
On Mon, Apr 04, 2022 at 12:08:25PM -0400, Daniel P. Smith wrote: > On 4/4/22 11:12, Roger Pau Monné wrote: > > On Mon, Apr 04, 2022 at 10:21:18AM -0400, Daniel P. Smith wrote: > >> On 3/31/22 08:36, Roger Pau Monné wrote: > >>> On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: >

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-04 Thread Daniel P. Smith
On 4/4/22 11:12, Roger Pau Monné wrote: > On Mon, Apr 04, 2022 at 10:21:18AM -0400, Daniel P. Smith wrote: >> On 3/31/22 08:36, Roger Pau Monné wrote: >>> On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: There are now instances where internal hypervisor logic needs to make >>>

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-04 Thread Daniel P. Smith
On 3/31/22 09:16, Jason Andryuk wrote: > On Wed, Mar 30, 2022 at 3:05 PM Daniel P. Smith > wrote: >> >> There are now instances where internal hypervisor logic needs to make >> resource >> allocation calls that are protected by XSM checks. The internal hypervisor >> logic >> is represented a num

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-04 Thread Jan Beulich
On 04.04.2022 17:12, Roger Pau Monné wrote: > On Mon, Apr 04, 2022 at 10:21:18AM -0400, Daniel P. Smith wrote: >> On 3/31/22 08:36, Roger Pau Monné wrote: >>> On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: There are now instances where internal hypervisor logic needs to make

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-04 Thread Roger Pau Monné
On Mon, Apr 04, 2022 at 10:21:18AM -0400, Daniel P. Smith wrote: > On 3/31/22 08:36, Roger Pau Monné wrote: > > On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: > >> There are now instances where internal hypervisor logic needs to make > >> resource > >> allocation calls that are p

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-04 Thread Daniel P. Smith
On 3/31/22 08:36, Roger Pau Monné wrote: > On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: >> There are now instances where internal hypervisor logic needs to make >> resource >> allocation calls that are protected by XSM checks. The internal hypervisor >> logic >> is represented

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-04 Thread Jan Beulich
On 04.04.2022 10:08, Roger Pau Monné wrote: > On Fri, Apr 01, 2022 at 06:52:46PM +0100, Julien Grall wrote: >> Hi, >> >> On 31/03/2022 13:36, Roger Pau Monné wrote: >>> On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: There are now instances where internal hypervisor logic need

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-04 Thread Roger Pau Monné
On Fri, Apr 01, 2022 at 06:52:46PM +0100, Julien Grall wrote: > Hi, > > On 31/03/2022 13:36, Roger Pau Monné wrote: > > On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: > > > There are now instances where internal hypervisor logic needs to make > > > resource > > > allocation call

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-01 Thread Julien Grall
Hi Daniel, On 31/03/2022 00:05, Daniel P. Smith wrote: There are now instances where internal hypervisor logic needs to make resource allocation calls that are protected by XSM checks. The internal hypervisor logic is represented a number of system domains which by designed are represented by no

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-04-01 Thread Julien Grall
Hi, On 31/03/2022 13:36, Roger Pau Monné wrote: On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: There are now instances where internal hypervisor logic needs to make resource allocation calls that are protected by XSM checks. The internal hypervisor logic is represented a numbe

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-03-31 Thread Jason Andryuk
On Wed, Mar 30, 2022 at 3:05 PM Daniel P. Smith wrote: > > There are now instances where internal hypervisor logic needs to make resource > allocation calls that are protected by XSM checks. The internal hypervisor > logic > is represented a number of system domains which by designed are represen

Re: [PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-03-31 Thread Roger Pau Monné
On Wed, Mar 30, 2022 at 07:05:48PM -0400, Daniel P. Smith wrote: > There are now instances where internal hypervisor logic needs to make resource > allocation calls that are protected by XSM checks. The internal hypervisor > logic > is represented a number of system domains which by designed are r

[PATCH 1/2] xsm: add ability to elevate a domain to privileged

2022-03-30 Thread Daniel P. Smith
There are now instances where internal hypervisor logic needs to make resource allocation calls that are protected by XSM checks. The internal hypervisor logic is represented a number of system domains which by designed are represented by non-privileged struct domain instances. To enable these logi