diff options
| author | Keir Fraser <keir@xen.org> | 2011-02-06 17:10:31 +0000 |
|---|---|---|
| committer | Keir Fraser <keir@xen.org> | 2011-02-06 17:10:31 +0000 |
| commit | 95eddf1e8725a52b319a6d53ced93c30315fe1ff (patch) | |
| tree | 5ccd94d74905b5e30b0a93d42876f755010c41c1 /xen/xsm | |
| parent | 75f04e45d08c5c5f8088f72782b0c3dec823721b (diff) | |
| download | xen-95eddf1e8725a52b319a6d53ced93c30315fe1ff.tar.gz xen-95eddf1e8725a52b319a6d53ced93c30315fe1ff.tar.bz2 xen-95eddf1e8725a52b319a6d53ced93c30315fe1ff.zip | |
xsm/flask: Fix permission tables
At some point, it seems that someone manually added Flask permission
definitions to one header file without updating the corresponding
policy configuration or the other related table. The end result is
that we can get uninterpretable AVC messages like this:
# xl dmesg | grep avc
(XEN) avc: denied { 0x4000000 } for domid=0
scontext=system_u:system_r:dom0_t tcontext=system_u:system_r:domU_t
tclass=domain
Fix this by updating the flask config and regenerating the headers
from it. In the future, this can be further improved by integrating
the automatic generation of the headers into the build process as is
presently done in SELinux.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'xen/xsm')
| -rw-r--r-- | xen/xsm/flask/include/av_perm_to_string.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/xen/xsm/flask/include/av_perm_to_string.h b/xen/xsm/flask/include/av_perm_to_string.h index da56d563c9..b10a252589 100644 --- a/xen/xsm/flask/include/av_perm_to_string.h +++ b/xen/xsm/flask/include/av_perm_to_string.h @@ -50,6 +50,8 @@ S_(SECCLASS_DOMAIN, DOMAIN__TRIGGER, "trigger") S_(SECCLASS_DOMAIN, DOMAIN__GETEXTVCPUCONTEXT, "getextvcpucontext") S_(SECCLASS_DOMAIN, DOMAIN__SETEXTVCPUCONTEXT, "setextvcpucontext") + S_(SECCLASS_DOMAIN, DOMAIN__GETVCPUEXTSTATE, "getvcpuextstate") + S_(SECCLASS_DOMAIN, DOMAIN__SETVCPUEXTSTATE, "setvcpuextstate") S_(SECCLASS_HVM, HVM__SETHVMC, "sethvmc") S_(SECCLASS_HVM, HVM__GETHVMC, "gethvmc") S_(SECCLASS_HVM, HVM__SETPARAM, "setparam") |