xsm: Permit dom0 to use dmops

c/s 524a98c2ac5 "public / x86: introduce __HYPERCALL_dm_op" gave flask
permisisons for a stubdomain to use dmops, but omitted the case of a device
model running in dom0.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Tested-by: Paul Durrant <paul.durrant@citrix.com>

diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index f5d254f053e07d65dbc0bea34dbd3acbf9269cac..ed0df4f01068f6aded617e0dddde41832edecfe3 100644 (file)
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -58,7 +58,7 @@ define(`create_domain_common', `
        allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp };
        allow $1 $2:grant setup;
        allow $1 $2:hvm { cacheattr getparam hvmctl sethvmc
-                       setparam nested altp2mhvm altp2mhvm_op };
+                       setparam nested altp2mhvm altp2mhvm_op dm };
 ')
 
 # create_domain(priv, target)