mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 02:30:03 +01:00
Andrew Cooper
345135942b
These were overlooked in the original patch, and noticed by OSSTest which does
run some Flask tests.
Fixes: 22b20bd98c ("xen: Introduce non-broken hypercalls for the paging mempool size")
Suggested-by: Daniel Smith <dpsmith@apertussolutions.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jason Andryuk <jandryuk@gmail.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
Release-acked-by: Henry Wang <Henry.Wang@arm.com>
82 lines
3.0 KiB
Plaintext
82 lines
3.0 KiB
Plaintext
################################################################################
|
|
#
|
|
# Allow dom0 access to all sysctls, devices, and the security server.
|
|
#
|
|
# While this could be written more briefly using wildcards, the permissions are
|
|
# listed out to make removing specific permissions simpler.
|
|
#
|
|
################################################################################
|
|
allow dom0_t xen_t:xen {
|
|
settime tbufcontrol readconsole clearconsole perfcontrol mtrr_add
|
|
mtrr_del mtrr_read microcode physinfo quirk writeconsole readapic
|
|
writeapic privprofile nonprivprofile kexec firmware sleep frequency
|
|
getidle debug getcpuinfo heap pm_op mca_op lockprof cpupool_op
|
|
getscheduler setscheduler hypfs_op
|
|
};
|
|
allow dom0_t xen_t:xen2 {
|
|
resource_op psr_cmt_op psr_alloc pmu_ctrl get_symbol
|
|
get_cpu_levelling_caps get_cpu_featureset livepatch_op
|
|
coverage_op
|
|
};
|
|
|
|
# Allow dom0 to use all XENVER_ subops that have checks.
|
|
# Note that dom0 is part of domain_type so this has duplicates.
|
|
allow dom0_t xen_t:version {
|
|
xen_extraversion xen_compile_info xen_capabilities
|
|
xen_changeset xen_pagesize xen_guest_handle xen_commandline
|
|
xen_build_id
|
|
};
|
|
|
|
allow dom0_t xen_t:mmu memorymap;
|
|
|
|
# Allow dom0 to use these domctls on itself. For domctls acting on other
|
|
# domains, see the definitions of create_domain and manage_domain.
|
|
allow dom0_t dom0_t:domain {
|
|
setvcpucontext max_vcpus setaffinity getaffinity getscheduler
|
|
getdomaininfo getvcpuinfo getvcpucontext setdomainmaxmem setdomainhandle
|
|
setdebugging hypercall settime setaddrsize getaddrsize trigger
|
|
getpodtarget setpodtarget getpagingmempool setpagingmempool set_misc_info
|
|
set_virq_handler
|
|
};
|
|
allow dom0_t dom0_t:domain2 {
|
|
set_cpu_policy gettsc settsc setscheduler set_vnumainfo
|
|
get_vnumainfo psr_cmt_op psr_alloc get_cpu_policy
|
|
};
|
|
allow dom0_t dom0_t:resource { add remove };
|
|
|
|
# These permissions allow using the FLASK security server to compute access
|
|
# checks locally, which could be used by a domain or service (such as xenstore)
|
|
# that does not have its own security server to make access decisions based on
|
|
# Xen's security policy.
|
|
allow dom0_t security_t:security {
|
|
compute_av compute_create compute_member compute_relabel
|
|
};
|
|
|
|
# Allow string/SID conversions (for "xl list -Z" and similar)
|
|
allow dom0_t security_t:security check_context;
|
|
|
|
# Allow flask-label-pci to add and change labels
|
|
allow dom0_t security_t:security { add_ocontext del_ocontext };
|
|
|
|
# Allow performance parameters of the security server to be tweaked
|
|
allow dom0_t security_t:security setsecparam;
|
|
|
|
# Allow changing the security policy
|
|
allow dom0_t security_t:security { load_policy setenforce setbool };
|
|
|
|
# Audit policy change events even when they are allowed
|
|
auditallow dom0_t security_t:security { load_policy setenforce setbool };
|
|
|
|
# Allow dom0 to report platform configuration changes back to the hypervisor
|
|
allow dom0_t xen_t:resource setup;
|
|
|
|
admin_device(dom0_t, device_t)
|
|
admin_device(dom0_t, irq_t)
|
|
admin_device(dom0_t, ioport_t)
|
|
admin_device(dom0_t, iomem_t)
|
|
|
|
domain_comms(dom0_t, dom0_t)
|
|
|
|
# Allow the hypervisor to build domains of type dom0_t
|
|
xen_build_domain(dom0_t)
|