This adds the xenstore_t type to the example policy for use by a xenstore stub domain.
Signed-off-by: Daniel De Graaf <dgde...@tycho.nsa.gov> --- tools/flask/policy/modules/modules.conf | 3 +++ tools/flask/policy/modules/xenstore.te | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 tools/flask/policy/modules/xenstore.te diff --git a/tools/flask/policy/modules/modules.conf b/tools/flask/policy/modules/modules.conf index 2dfc011..8ffd00e 100644 --- a/tools/flask/policy/modules/modules.conf +++ b/tools/flask/policy/modules/modules.conf @@ -33,6 +33,9 @@ nomigrate = on # Example device policy. Also see policy/device_contexts. nic_dev = on +# Xenstore stub domain. +xenstore = on + # Allow all domains to use system_u:system_r: instead of requiring explicit # roles. This is not required for dom0_t, domU_t, and dm_dom_t. default_role = on diff --git a/tools/flask/policy/modules/xenstore.te b/tools/flask/policy/modules/xenstore.te new file mode 100644 index 0000000..2ae7a1d --- /dev/null +++ b/tools/flask/policy/modules/xenstore.te @@ -0,0 +1,21 @@ +################################################################################ +# +# Xenstore stubdomain +# +################################################################################ +declare_singleton_domain(xenstore_t) +create_domain(dom0_t, xenstore_t) +manage_domain(dom0_t, xenstore_t) + +# Xenstore requires the global VIRQ for domain destroy operations +allow dom0_t xenstore_t:domain set_virq_handler; +# Current xenstore stubdom uses the hypervisor console, not "xl console" +allow xenstore_t xen_t:xen writeconsole; +# Xenstore queries domaininfo on all domains +allow xenstore_t domain_type:domain getdomaininfo; + +# As a shortcut, the following 3 rules are used instead of adding a domain_comms +# rule between xenstore_t and every domain type that talks to xenstore +create_channel(xenstore_t, domain_type, xenstore_t_channel) +allow event_type xenstore_t: event bind; +allow xenstore_t domain_type:grant { map_read map_write unmap }; -- 2.5.5 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel