diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index ba9e91d302..b5adc7dd16 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -90,6 +90,7 @@ define(`create_domain_build_label', `
 # manage_domain(priv, target)
 #   Allow managing a running domain
 define(`manage_domain', `
+	allow $1 domxen_t:domain getdomaininfo;
 	allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity
 			getaddrsize pause unpause trigger shutdown destroy
 			setaffinity setdomainmaxmem getscheduler resume
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index de0fdecb6e..b21f379a84 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -898,7 +898,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op)
     {
     /* These have individual XSM hooks */
     case XEN_SYSCTL_readconsole:
-    case XEN_SYSCTL_getdomaininfolist:
     case XEN_SYSCTL_page_offline_op:
 #ifdef CONFIG_X86
     case XEN_SYSCTL_cpu_hotplug:
@@ -945,6 +944,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op)
     case XEN_SYSCTL_get_cpu_policy:
         return domain_has_xen(current->domain, XEN__PHYSINFO);
 
+    case XEN_SYSCTL_getdomaininfolist:
+        return flask_getdomaininfo(dom_xen);
+
     case XEN_SYSCTL_psr_cmt_op:
         return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
                                     XEN2__PSR_CMT_OP, NULL);