Re: [Xen-devel] [PATCH] XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.
On Thu, Jul 07, 2016 at 10:49:01AM -0400, Daniel De Graaf wrote: > On 07/07/2016 09:45 AM, anshul.makkar.anshul.mak...@citrix.com wrote: > >From: Anshul Makkar> > > >This patch resolves the following permission denied scenarios while creating > >new domU : > >avc: denied { setdomainhandle } for domid=0 target=1 > >scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t > >tclass=domain > > > >avc: denied { settime } for domid=0 target=1 > >scontext=system_u:system_r:dom0_t > >tcontext=system_u:system_r:domU_t tclass=domain > > > >Signed-off-by: Anshul Makkar > > Acked-by: Daniel De Graaf Queued. Thank you both. ___ Xen-devel mailing list Xen-devel@lists.xen.org https://lists.xen.org/xen-devel
Re: [Xen-devel] [PATCH] XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.
On 07/07/2016 09:45 AM, anshul.makkar.anshul.mak...@citrix.com wrote: From: Anshul MakkarThis patch resolves the following permission denied scenarios while creating new domU : avc: denied { setdomainhandle } for domid=0 target=1 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain avc: denied { settime } for domid=0 target=1 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain Signed-off-by: Anshul Makkar Acked-by: Daniel De Graaf ___ Xen-devel mailing list Xen-devel@lists.xen.org https://lists.xen.org/xen-devel
[Xen-devel] [PATCH] XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.
From: Anshul MakkarThis patch resolves the following permission denied scenarios while creating new domU : avc: denied { setdomainhandle } for domid=0 target=1 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain avc: denied { settime } for domid=0 target=1 scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain Signed-off-by: Anshul Makkar --- tools/flask/policy/modules/xen.if | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index fd96303..8c43c28 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -48,7 +48,8 @@ define(`declare_build_label', ` define(`create_domain_common', ` allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize getdomaininfo hypercall setvcpucontext getscheduler - getvcpuinfo getaddrsize getaffinity setaffinity }; + getvcpuinfo getaddrsize getaffinity setaffinity + settime setdomainhandle }; allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo cacheflush psr_cmt_op psr_cat_op soft_reset }; -- 1.9.1 ___ Xen-devel mailing list Xen-devel@lists.xen.org https://lists.xen.org/xen-devel