diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index ef7d8f438c..5e366986e2 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -150,6 +150,7 @@ define(`create_domain_build_label', `
 # manage_domain(priv, target)
 #   Allow managing a running domain
 define(`manage_domain', `
+	allow $1 domxen_t:domain getdomaininfo;
 	allow $1 $2:domain {
 		getdomaininfo
 		getvcpuinfo
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 57b2e1b287..4e5b75dfaf 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -878,7 +878,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op)
     {
     /* These have individual XSM hooks */
     case XEN_SYSCTL_readconsole:
-    case XEN_SYSCTL_getdomaininfolist:
     case XEN_SYSCTL_page_offline_op:
 #ifdef CONFIG_X86
     case XEN_SYSCTL_cpu_hotplug:
@@ -925,6 +924,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op)
     case XEN_SYSCTL_get_cpu_policy:
         return domain_has_xen(current->domain, XEN__PHYSINFO);
 
+    case XEN_SYSCTL_getdomaininfolist:
+        return flask_getdomaininfo(dom_xen);
+
     case XEN_SYSCTL_psr_cmt_op:
         return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
                                     XEN2__PSR_CMT_OP, NULL);