ia64/xen-unstable

view tools/flask/policy/policy/modules/xen/xen.te @ 18723:b99ab7f88a82

Add 2 more permissions to the XSM/Flask default policy.

Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
author Keir Fraser <keir.fraser@citrix.com>
date Mon Oct 27 10:29:39 2008 +0000 (2008-10-27)
parents d5bd0567b458
children
line source
1 attribute xen_type;
2 attribute domain_type;
3 attribute resource_type;
4 attribute event_type;
6 type xen_t, xen_type, domain_type;
8 type dom0_t, domain_type;
10 type domio_t, domain_type;
12 type domxen_t, domain_type;
14 type unlabeled_t, domain_type;
16 type security_t, domain_type;
18 type pirq_t, resource_type;
19 type ioport_t, resource_type;
20 type iomem_t, resource_type;
21 type device_t, resource_type;
23 ################################################################################
24 #
25 # create_domain(priv_dom, domain, channel)
26 #
27 ################################################################################
28 define(`create_domain', `
29 type $2, domain_type;
30 allow $1 $2:domain {create max_vcpus setdomainmaxmem
31 setaddrsize getdomaininfo hypercall
32 setvcpucontext scheduler unpause
33 getvcpuinfo getaddrsize getvcpuaffinity};
34 allow $1 $2:shadow {enable};
35 allow $1 $2:mmu {map_read map_write memorymap adjust pinpage};
36 allow $2 $2:mmu {map_read map_write adjust pinpage};
37 allow $2 domio_t:mmu {map_read};
38 allow $2 $2:grant {query setup};
39 allow $1 $2:grant {map_read unmap};
40 allow $1 $3:event {create};
41 ')
43 ################################################################################
44 #
45 # manage_domain(priv_dom, domain)
46 #
47 ################################################################################
48 define(`manage_domain', `
49 allow $1 $2:domain {pause destroy};
50 ')
52 ################################################################################
53 #
54 # create_channel(caller, peer, channel)
55 #
56 ################################################################################
57 define(`create_channel', `
58 type $3, event_type;
59 type_transition $1 $2:event $3;
60 allow $1 $3:event {create};
61 allow $3 $2:event {bind};
62 ')
64 ################################################################################
65 #
66 # Boot the hypervisor and dom0
67 #
68 ################################################################################
69 allow dom0_t xen_t:xen {kexec readapic writeapic mtrr_read mtrr_add mtrr_del
70 scheduler physinfo heap quirk readconsole writeconsole settime microcode};
72 allow dom0_t domio_t:mmu {map_read map_write};
73 allow dom0_t iomem_t:mmu {map_read map_write};
74 allow dom0_t pirq_t:event {vector};
75 allow dom0_t xen_t:mmu {memorymap};
77 allow dom0_t dom0_t:mmu {pinpage map_read map_write adjust updatemp};
78 allow dom0_t dom0_t:grant {query setup};
79 allow dom0_t dom0_t:domain {scheduler getdomaininfo getvcpuinfo getvcpuaffinity};
81 allow xen_t dom0_t:domain {create};
82 allow xen_t dom0_t:resource {add remove};
83 allow xen_t ioport_t:resource {add_ioport remove_ioport};
84 allow dom0_t ioport_t:resource {use};
85 allow xen_t iomem_t:resource {add_iomem remove_iomem};
86 allow dom0_t iomem_t:resource {use};
87 allow xen_t pirq_t:resource {add_irq remove_irq};
88 allow dom0_t pirq_t:resource {use};
90 allow dom0_t security_t:security {compute_av compute_create compute_member
91 check_context load_policy compute_relabel compute_user setenforce setbool
92 setsecparam};
94 create_channel(dom0_t, dom0_t, evchn0-0_t)
95 allow dom0_t evchn0-0_t:event {send};
97 ################################################################################
98 #
99 # Create and manage a domU w/ dom0 IO
100 #
101 ################################################################################
102 create_domain(dom0_t, domU_t, evchnU-0_t)
104 create_channel(domU_t, domU_t, evchnU-U_t)
105 allow domU_t evchnU-U_t:event {send};
107 create_channel(dom0_t, domU_t, evchn0-U_t)
108 allow dom0_t evchn0-U_t:event {send};
110 create_channel(domU_t, dom0_t, evchnU-0_t)
111 allow domU_t evchnU-0_t:event {send};
113 allow dom0_t dom0_t:event {send};
114 allow dom0_t domU_t:grant {copy};
115 allow domU_t domU_t:grant {copy};
117 manage_domain(dom0_t, domU_t)
119 ################################################################################
120 #
121 #
122 #
123 ################################################################################
124 sid xen gen_context(system_u:system_r:xen_t,s0)
125 sid dom0 gen_context(system_u:system_r:dom0_t,s0)
126 sid domU gen_context(system_u:system_r:domU_t,s0)
127 sid domxen gen_context(system_u:system_r:domxen_t,s0)
128 sid domio gen_context(system_u:system_r:domio_t,s0)
129 sid unlabeled gen_context(system_u:system_r:unlabeled_t,s0)
130 sid security gen_context(system_u:system_r:security_t,s0)
131 sid pirq gen_context(system_u:object_r:pirq_t,s0)
132 sid iomem gen_context(system_u:object_r:iomem_t,s0)
133 sid ioport gen_context(system_u:object_r:ioport_t,s0)
134 sid device gen_context(system_u:object_r:device_t,s0)
136 role system_r types { xen_type domain_type };
137 role user_r types { xen_type domain_type };
138 role sysadm_r types { xen_type domain_type };
139 role staff_r types { xen_type domain_type };