flask/policy: device model stubdom fixes

This fixes framebuffer support for device model stubdoms after 3f28d007
which added the target_hack permission but did not allow the permission
to the stubdom it was created for.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if
index c86a6189c67aca08f16cfc4e704fac1e03086184..97af0a8623b53c23d70b70dae5e5c22a549e37c0 100644 (file)
--- a/tools/flask/policy/policy/modules/xen/xen.if
+++ b/tools/flask/policy/policy/modules/xen/xen.if
@@ -143,7 +143,7 @@ define(`device_model', `
        allow $1 $2_channel:event create;
 
        allow $1 $2_target:domain shutdown;
-       allow $1 $2_target:mmu { map_read map_write adjust physmap };
+       allow $1 $2_target:mmu { map_read map_write adjust physmap target_hack };
        allow $1 $2_target:hvm { getparam setparam trackdirtyvram hvmctl irqlevel pciroute cacheattr send_irq };
 ')