flask/policy: add missing manage_domain rules

The updated example policy did not include rules to allow managing the
created domains (pause, unpause, destroy); allow these actions.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Ian Jackson <ian.jackson.citrix.com>

tools/flask/policy/policy/modules/xen/xen.if

@@ -29,6 +29,13 @@ define(`create_domain', `
 	allow $1 $2_$1_channel:event create;
 ')
 
+# manage_domain(priv, target)
+#   Allow managing a running domain
+define(`manage_domain', `
+	allow $1 $2:domain { getdomaininfo getvcpuinfo getvcpuaffinity
+			getaddrsize pause unpause trigger shutdown destroy
+			setvcpuaffinity setdomainmaxmem };
+')
 ################################################################################
 #
 # Inter-domain communication

tools/flask/policy/policy/modules/xen/xen.te

@@ -86,10 +86,12 @@ auditallow dom0_t security_t:security { load_policy setenforce };
 declare_domain(domU_t)
 domain_self_comms(domU_t)
 create_domain(dom0_t, domU_t)
+manage_domain(dom0_t, domU_t)
 domain_comms(dom0_t, domU_t)
 
 declare_domain(isolated_domU_t)
 create_domain(dom0_t, isolated_domU_t)
+manage_domain(dom0_t, isolated_domU_t)
 domain_comms(dom0_t, isolated_domU_t)
 
 ###############################################################################