From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel De Graaf Subject: [PATCH 10/10] flask/policy: use declare_domain for dom0_t Date: Tue, 31 Jan 2012 16:26:18 -0500 Message-ID: <1328045178-30665-11-git-send-email-dgdegra@tycho.nsa.gov> References: <1328045178-30665-1-git-send-email-dgdegra@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1328045178-30665-1-git-send-email-dgdegra@tycho.nsa.gov> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: xen-devel@lists.xensource.com Cc: Daniel De Graaf List-Id: xen-devel@lists.xenproject.org Signed-off-by: Daniel De Graaf --- tools/flask/policy/policy/modules/xen/xen.if | 4 ++-- tools/flask/policy/policy/modules/xen/xen.te | 4 +--- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index 3065718..dde7f90 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -5,10 +5,10 @@ # Domain creation and setup # ################################################################################ -# declare_domain(type) +# declare_domain(type, attrs...) # Declare a type as a domain type, and allow basic domain setup define(`declare_domain', ` - type $1, domain_type; + type $1, domain_type`'ifelse(`$#', `1', `', `,shift($@)'); allow $1 $1:grant { query setup }; allow $1 $1:mmu { adjust physmap map_read map_write stat pinpage }; allow $1 $1:hvm { getparam setparam }; diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index 67dd0df..fb71b75 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -25,7 +25,7 @@ attribute mls_priv; type xen_t, xen_type, mls_priv; # Domain 0 -type dom0_t, domain_type, mls_priv; +declare_domain(dom0_t, mls_priv); # Untracked I/O memory (pseudo-domain) type domio_t, xen_type; @@ -63,8 +63,6 @@ allow dom0_t security_t:security { check_context compute_av compute_create setbool setsecparam add_ocontext del_ocontext }; allow dom0_t dom0_t:domain { getdomaininfo getvcpuinfo getvcpuaffinity }; -allow dom0_t dom0_t:grant { query setup }; -allow dom0_t dom0_t:mmu { adjust physmap map_read map_write stat pinpage }; allow dom0_t dom0_t:resource { add remove }; admin_device(dom0_t, device_t) -- 1.7.7.6