diff options
author | Keir Fraser <keir.fraser@citrix.com> | 2009-11-13 22:00:19 +0000 |
---|---|---|
committer | Keir Fraser <keir.fraser@citrix.com> | 2009-11-13 22:00:19 +0000 |
commit | 3695303ba1539e57e5d8bdf4ee7ba1bc6e3edc81 (patch) | |
tree | 44cd05b2caf235afa0fd9bbaf71d1897d53efb13 /tools/flask/policy/policy/modules/xen/xen.te | |
parent | 4def0d9ca1ab8a1fdf4300f87118068e46e6491f (diff) | |
download | xen-3695303ba1539e57e5d8bdf4ee7ba1bc6e3edc81.tar.gz xen-3695303ba1539e57e5d8bdf4ee7ba1bc6e3edc81.tar.bz2 xen-3695303ba1539e57e5d8bdf4ee7ba1bc6e3edc81.zip |
xsm: Dynamic update to device ocontexts
Added the ability to add and delete ocontexts dynamically on a running
system. Two new commands have been added to the xsm hypercall, add
and delete ocontext. Twelve new library functions have been
implemented that use the hypercall commands to label and unlabel
pirqs, PCI devices, I/O ports and memory. The base policy has been
updated so dom0 has the ability to use the hypercall commands by
default. Items added to the list will not be present next time the
system reloads. They will need to be added to the static policy.
Signed-off-by : George Coker <gscoker@alpha.ncsc.mil>
Signed-off-by : Paul Nuzzi <pjnuzzi@tycho.ncsc.mil>
Diffstat (limited to 'tools/flask/policy/policy/modules/xen/xen.te')
-rw-r--r-- | tools/flask/policy/policy/modules/xen/xen.te | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index 851b0d6bd3..0977939146 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -51,7 +51,7 @@ allow dom0_t xen_t:xen firmware; allow dom0_t security_t:security {compute_av compute_create compute_member check_context load_policy compute_relabel compute_user setenforce setbool -setsecparam}; +setsecparam add_ocontext del_ocontext}; create_channel(dom0_t, dom0_t, evchn0-0_t) allow dom0_t evchn0-0_t:event {send}; |