Files
xen/tools/flask/policy/modules/domU.te
T
Daniel De Graaf a2c8399a91 flask/policy: split out rules for system_r
When the all_system_role module is enabled, any domain type can be
created using the system_r role, which was the default.  When it is
disabled, domains not using the default types (dom0_t and domU_t) must
use another role such as vm_r.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Doug Goldstein <cardoe@cardoe.com>
2016-06-21 15:29:17 +01:00

29 lines
942 B
Plaintext

###############################################################################
#
# Domain creation
#
###############################################################################
declare_domain(domU_t)
domain_self_comms(domU_t)
create_domain(dom0_t, domU_t)
manage_domain(dom0_t, domU_t)
domain_comms(dom0_t, domU_t)
domain_comms(domU_t, domU_t)
migrate_domain_out(dom0_t, domU_t)
domain_self_comms(domU_t)
# Device model for domU_t. You can define distinct types for device models for
# domains of other types, or add more make_device_model lines for this type.
declare_domain(dm_dom_t)
create_domain(dom0_t, dm_dom_t)
manage_domain(dom0_t, dm_dom_t)
domain_comms(dom0_t, dm_dom_t)
make_device_model(dom0_t, dm_dom_t, domU_t)
# This is required for PCI (or other device) passthrough
delegate_devices(dom0_t, domU_t)
# Both of these domain types can be created using the default (system) role
role system_r types { domU_t dm_dom_t };