diff options
| author | Daniel De Graaf <dgdegra@tycho.nsa.gov> | 2013-04-23 11:54:01 +0200 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-04-23 11:54:01 +0200 |
| commit | 4bc22a50ebc1fb1695d59f69105797e208021edb (patch) | |
| tree | 6f01eb36d8f62b7f1d203c4e6bbd8067338a540d /tools/flask | |
| parent | bb812101db5117e07de1b557b355c3855850cc95 (diff) | |
| download | xen-4bc22a50ebc1fb1695d59f69105797e208021edb.tar.gz xen-4bc22a50ebc1fb1695d59f69105797e208021edb.tar.bz2 xen-4bc22a50ebc1fb1695d59f69105797e208021edb.zip | |
x86/hvm: convert access check for nested HVM to XSM
This adds an XSM hook for enabling nested HVM support, replacing an
IS_PRIV check. This hook is a partial duplicate with the xsm_hvm_param
hook, but using the existing hook would require adding the index to the
hook and would require the use of a custom hook for the xsm-disabled
case (using XSM_OTHER, which is less immediately readable) - whereas
adding a new hook retains the clarity of the existing code.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)
Diffstat (limited to 'tools/flask')
| -rw-r--r-- | tools/flask/policy/policy/modules/xen/xen.if | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index 18647c9327..3a59f38567 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -54,7 +54,8 @@ define(`create_domain_common', ` allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op }; allow $1 $2:grant setup; - allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc setparam pcilevel trackdirtyvram }; + allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc + setparam pcilevel trackdirtyvram nested }; ') # create_domain(priv, target) |