[PATCH] XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.

* [PATCH] XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.
@ 2016-07-07 13:45 Anshul
  2016-07-07 14:49 ` Daniel De Graaf
  0 siblings, 1 reply; 3+ messages in thread
From: Anshul @ 2016-07-07 13:45 UTC (permalink / raw)
  To: xen-devel; +Cc: ian.jackson, dgdegra, wei.liu2, Anshul Makkar

From: Anshul Makkar <anshul.makkar@citrix.com>

This patch resolves the following permission denied scenarios while creating
new domU :
avc:  denied  { setdomainhandle } for domid=0 target=1
scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t tclass=domain

avc:  denied  { settime } for domid=0 target=1 scontext=system_u:system_r:dom0_t
tcontext=system_u:system_r:domU_t tclass=domain

Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
---
 tools/flask/policy/modules/xen.if | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index fd96303..8c43c28 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -48,7 +48,8 @@ define(`declare_build_label', `
 define(`create_domain_common', `
 	allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
 			getdomaininfo hypercall setvcpucontext getscheduler
-			getvcpuinfo getaddrsize getaffinity setaffinity };
+			getvcpuinfo getaddrsize getaffinity setaffinity
+			settime setdomainhandle };
 	allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
 			set_max_evtchn set_vnumainfo get_vnumainfo cacheflush
 			psr_cmt_op psr_cat_op soft_reset };
-- 
1.9.1


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

^ permalink raw reply related	[flat|nested] 3+ messages in thread