mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 10:40:03 +01:00
XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.
This patch resolves the following permission denied scenarios while creating
new domU :
avc: denied { setdomainhandle } for domid=0 target=1
scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain
avc: denied { settime } for domid=0 target=1 scontext=system_u:system_r:dom0_t
tcontext=system_u:system_r:domU_t tclass=domain
Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
This commit is contained in:
Anshul Makkar authored and 
Wei Liu committed
1 parent
4f7e0d54a5
commit
f755485cbd
1 file changed
+2
-1
@@ -48,7 +48,8 @@ define(`declare_build_label', `
|
||||
define(`create_domain_common', `
|
||||
allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
|
||||
getdomaininfo hypercall setvcpucontext getscheduler
|
||||
getvcpuinfo getaddrsize getaffinity setaffinity };
|
||||
getvcpuinfo getaddrsize getaffinity setaffinity
|
||||
settime setdomainhandle };
|
||||
allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
|
||||
set_max_evtchn set_vnumainfo get_vnumainfo cacheflush
|
||||
psr_cmt_op psr_cat_op soft_reset };
|
||||
|
||||