mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Daniel De Graaf
a2c8399a91
When the all_system_role module is enabled, any domain type can be created using the system_r role, which was the default. When it is disabled, domains not using the default types (dom0_t and domU_t) must use another role such as vm_r. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Reviewed-by: Doug Goldstein <cardoe@cardoe.com>
40 lines
1.3 KiB
Plaintext
40 lines
1.3 KiB
Plaintext
#
|
|
# This file contains a listing of available modules.
|
|
#
|
|
# To prevent a module from being used in policy creation, set the module name
|
|
# to "off"; otherwise, set the module name on "on".
|
|
#
|
|
# The order the modules appear in this file is the order they will be parsed;
|
|
# this can be important if you plan to use types defined in one file in another.
|
|
#
|
|
|
|
# Basic types and classes for the Xen hypervisor. This module is required.
|
|
xen = on
|
|
|
|
# Permissions for domain 0. Most of these are required to boot.
|
|
dom0 = on
|
|
|
|
# Allow all domains the ability to use access-controlled features and hypercalls
|
|
# that are not restricted when XSM is disabled.
|
|
guest_features = on
|
|
|
|
# The default domain type (domU_t) and its device model (dm_dom_t). The domain
|
|
# is created and managed by dom0_t, and has no special restrictions.
|
|
#
|
|
# This is required if you want to be able to create domains without specifying
|
|
# their XSM label in the configuration.
|
|
domU = on
|
|
|
|
# Example types with restrictions
|
|
isolated_domU = on
|
|
prot_domU = on
|
|
nomigrate = on
|
|
|
|
# Example device policy. Also see policy/device_contexts.
|
|
nic_dev = on
|
|
|
|
# This allows any domain type to be created using the system_r role. When it is
|
|
# disabled, domains not using the default types (dom0_t and domU_t) must use
|
|
# another role (such as vm_r) from the vm_role module.
|
|
all_system_role = on
|