[Xen-changelog] [xen master] XSM/policy: Allow the source domain access to settime and setdomainhandle domctls while creating domain.

[patchbot@xxxxxxx]

commit f755485cbd2a17c4e0069271ee930ad0972c1b9c
Author:     Anshul Makkar <anshul.makkar@xxxxxxxxxx>
AuthorDate: Thu Jul 7 14:45:47 2016 +0100
Commit:     Wei Liu <wei.liu2@xxxxxxxxxx>
CommitDate: Fri Jul 8 14:36:00 2016 +0100

    XSM/policy: Allow the source domain access to settime and setdomainhandle 
domctls while creating domain.
    
    This patch resolves the following permission denied scenarios while creating
    new domU :
    avc:  denied  { setdomainhandle } for domid=0 target=1
    scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t 
tclass=domain
    
    avc:  denied  { settime } for domid=0 target=1 
scontext=system_u:system_r:dom0_t
    tcontext=system_u:system_r:domU_t tclass=domain
    
    Signed-off-by: Anshul Makkar <anshul.makkar@xxxxxxxxxx>
    Acked-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
---
 tools/flask/policy/modules/xen.if | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/flask/policy/modules/xen.if 
b/tools/flask/policy/modules/xen.if
index fd96303..8c43c28 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -48,7 +48,8 @@ define(`declare_build_label', `
 define(`create_domain_common', `
        allow $1 $2:domain { create max_vcpus setdomainmaxmem setaddrsize
                        getdomaininfo hypercall setvcpucontext getscheduler
-                       getvcpuinfo getaddrsize getaffinity setaffinity };
+                       getvcpuinfo getaddrsize getaffinity setaffinity
+                       settime setdomainhandle };
        allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim
                        set_max_evtchn set_vnumainfo get_vnumainfo cacheflush
                        psr_cmt_op psr_cat_op soft_reset };
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog