mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
Andrew Cooper
e5eeca2fca
Having multiple values wrapped onto as few lines as practical is good for space efficiency, but causes complex collisions for hypercall backports and local policy changes. Reformat to use one value per line. No functional change, only whitespace changes. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
30 lines
1.1 KiB
Plaintext
30 lines
1.1 KiB
Plaintext
################################################################################
|
|
#
|
|
# Xenstore stubdomain
|
|
#
|
|
################################################################################
|
|
declare_singleton_domain(xenstore_t)
|
|
create_domain(dom0_t, xenstore_t)
|
|
manage_domain(dom0_t, xenstore_t)
|
|
|
|
# Xenstore requires the global VIRQ for domain destroy operations
|
|
allow dom0_t xenstore_t:domain set_virq_handler;
|
|
# Current xenstore stubdom uses the hypervisor console, not "xl console"
|
|
allow xenstore_t xen_t:xen writeconsole;
|
|
# Xenstore queries domaininfo on all domains
|
|
allow xenstore_t domain_type:domain getdomaininfo;
|
|
allow xenstore_t domain_type:domain2 get_domain_state;
|
|
|
|
# As a shortcut, the following 3 rules are used instead of adding a domain_comms
|
|
# rule between xenstore_t and every domain type that talks to xenstore
|
|
create_channel(xenstore_t, domain_type, xenstore_t_channel)
|
|
allow event_type xenstore_t: event bind;
|
|
allow xenstore_t domain_type:grant {
|
|
map_read
|
|
map_write
|
|
unmap
|
|
};
|
|
|
|
# Xenstore is a utility domain, so it should use the system role
|
|
role system_r types xenstore_t;
|