From 4bc22a50ebc1fb1695d59f69105797e208021edb Mon Sep 17 00:00:00 2001 From: Daniel De Graaf Date: Tue, 23 Apr 2013 11:54:01 +0200 Subject: x86/hvm: convert access check for nested HVM to XSM This adds an XSM hook for enabling nested HVM support, replacing an IS_PRIV check. This hook is a partial duplicate with the xsm_hvm_param hook, but using the existing hook would require adding the index to the hook and would require the use of a custom hook for the xsm-disabled case (using XSM_OTHER, which is less immediately readable) - whereas adding a new hook retains the clarity of the existing code. Signed-off-by: Daniel De Graaf Acked-by: George Dunlap (release perspective) --- tools/flask/policy/policy/modules/xen/xen.if | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'tools/flask') diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index 18647c9327..3a59f38567 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -54,7 +54,8 @@ define(`create_domain_common', ` allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op }; allow $1 $2:grant setup; - allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc setparam pcilevel trackdirtyvram }; + allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc + setparam pcilevel trackdirtyvram nested }; ') # create_domain(priv, target) -- cgit v1.2.3