[Xen-devel] [PATCH] flask: Allow initial domain to use XENPF_get_symbol

[Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>]

It looks to be missing in the policy file for the initial
domain. Eventually we may want to extend this access to
non-dom0 domains but for now it certainly dom0-only.

Reviewed-by: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
---
 tools/flask/policy/policy/modules/xen/xen.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/flask/policy/policy/modules/xen/xen.te 
b/tools/flask/policy/policy/modules/xen/xen.te
index 5e94ee3..d35ae22 100644
--- a/tools/flask/policy/policy/modules/xen/xen.te
+++ b/tools/flask/policy/policy/modules/xen/xen.te
@@ -71,6 +71,7 @@ allow dom0_t xen_t:xen2 {
 };
 allow dom0_t xen_t:xen2 {
     pmu_ctrl
+    get_symbol
 };
 allow dom0_t xen_t:mmu memorymap;
 
-- 
2.1.0


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel