From 5a77ccf609da289131bd1664ee20c17b1f9bb93c Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Fri, 27 Jan 2017 14:16:58 +0000 Subject: [PATCH] xsm: Permit dom0 to use dmops c/s 524a98c2ac5 "public / x86: introduce __HYPERCALL_dm_op" gave flask permisisons for a stubdomain to use dmops, but omitted the case of a device model running in dom0. Signed-off-by: Andrew Cooper Reviewed-by: Wei Liu Tested-by: Paul Durrant --- tools/flask/policy/modules/xen.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index f5d254f053..ed0df4f010 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -58,7 +58,7 @@ define(`create_domain_common', ` allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; allow $1 $2:grant setup; allow $1 $2:hvm { cacheattr getparam hvmctl sethvmc - setparam nested altp2mhvm altp2mhvm_op }; + setparam nested altp2mhvm altp2mhvm_op dm }; ') # create_domain(priv, target) -- 2.30.2