diff options
| author | Keir Fraser <keir.fraser@citrix.com> | 2009-10-27 12:52:57 +0000 |
|---|---|---|
| committer | Keir Fraser <keir.fraser@citrix.com> | 2009-10-27 12:52:57 +0000 |
| commit | 78942912c8a3ff303b910d4a179ff6be7e9b0477 (patch) | |
| tree | 10468e48843fbc769f0298b5bc52df3dfb63aa73 /tools/flask/policy/policy/modules/xen/xen.te | |
| parent | 16d8dcbfb346174e67a61134a45d40870d112cad (diff) | |
| download | xen-78942912c8a3ff303b910d4a179ff6be7e9b0477.tar.gz xen-78942912c8a3ff303b910d4a179ff6be7e9b0477.tar.bz2 xen-78942912c8a3ff303b910d4a179ff6be7e9b0477.zip | |
xsm: Add support for Xen device policies
Add support for Xen ocontext records to enable device polices. The
default policy will not be changed and instructions have been added to
enable the new functionality. Examples on how to use the new policy
language have been added but commented out. The newest version of
checkpolicy (>= 2.0.20) and libsepol (>= 2.0.39) is needed in order to
compile it. Devices can be labeled and enforced using the following
new commands; pirqcon, iomemcon, ioportcon and pcidevicecon.
Signed-off-by : George Coker <gscoker@alpha.ncsc.mil>
Signed-off-by : Paul Nuzzi <pjnuzzi@tycho.ncsc.mil>
Diffstat (limited to 'tools/flask/policy/policy/modules/xen/xen.te')
| -rw-r--r-- | tools/flask/policy/policy/modules/xen/xen.te | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index e72e4e6e57..851b0d6bd3 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -76,6 +76,41 @@ allow dom0_t dom0_t:event {send}; allow dom0_t domU_t:grant {copy}; allow domU_t domU_t:grant {copy}; +############################################################################### +# +# Create device labels +# +############################################################################### + +# create device resources +#create_passthrough_resource(dom0_t, domU_t, nicP_t) +#create_hvm_resource(dom0_t, domHU_t, nicP_t) + +# label e1000e nic +#pirqcon 33 system_u:object_r:nicP_t +#pirqcon 55 system_u:object_r:nicP_t +#iomemcon 0xfebe0-0xfebff system_u:object_r:nicP_t +#iomemcon 0xfebd9 system_u:object_r:nicP_t +#ioportcon 0xecc0-0xecdf system_u:object_r:nicP_t +#pcidevicecon 0xc800 system_u:object_r:nicP_t + +# label e100 nic +#pirqcon 16 system_u:object_r:nicP_t +#iomemcon 0xfe5df system_u:object_r:nicP_t +#iomemcon 0xfe5e0-0xfe5ff system_u:object_r:nicP_t +#iomemcon 0xc2000-0xc200f system_u:object_r:nicP_t +#ioportcon 0xccc0-0xcd00 system_u:object_r:nicP_t + +# label usb 1d.0-2 1d.7 +#pirqcon 23 system_u:object_r:nicP_t +#pirqcon 17 system_u:object_r:nicP_t +#pirqcon 18 system_u:object_r:nicP_t +#ioportcon 0xff80-0xFF9F system_u:object_r:nicP_t +#ioportcon 0xff60-0xff7f system_u:object_r:nicP_t +#ioportcon 0xff40-0xff5f system_u:object_r:nicP_t +#iomemcon 0xff980 system_u:object_r:nicP_t +#ioportcon 0xff00-0xff1f system_u:object_r:nicP_t + manage_domain(dom0_t, domU_t) ################################################################################ |