flask: Allow initial domain to use XENPF_get_symbol

It looks to be missing in the policy file for the initial
domain. Eventually we may want to extend this access to
non-dom0 domains but for now it certainly dom0-only.

Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te
index 5e94ee38b17e7958c992eeb625b97da0e6a88271..d35ae221f0fddd0339645961ee00ce675893aad7 100644 (file)
--- a/tools/flask/policy/policy/modules/xen/xen.te
+++ b/tools/flask/policy/policy/modules/xen/xen.te
@@ -71,6 +71,7 @@ allow dom0_t xen_t:xen2 {
 };
 allow dom0_t xen_t:xen2 {
     pmu_ctrl
+    get_symbol
 };
 allow dom0_t xen_t:mmu memorymap;