Files
xen/tools/flask/policy/modules/vm_role.te
T
Daniel De Graaf d72fd26d5f flask/policy: move user definitions and constraints into modules
This also renames the example users created by vm_role.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Reviewed-by: Doug Goldstein <cardoe@cardoe.com>
2016-06-21 15:29:17 +01:00

17 lines
525 B
Plaintext

# The vm role is used as part of user separation. Allow all domain types to use
# this role except dom0.
role vm_r;
role vm_r types { domain_type -dom0_t };
# Define some users that must use this role (full type "user_1:vm_r:domU_t").
gen_user(user_1,, vm_r, s0, s0)
gen_user(user_2,, vm_r, s0, s0)
gen_user(user_3,, vm_r, s0, s0)
# Alternate: define and use a macro to generate 1000 users
define(`def_vm_users',`gen_user(user_$1,, vm_r, s0, s0)
ifelse(`$1',`$2',,`def_vm_users(incr($1),$2)')dnl
')
# def_vm_users(0,999)