nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
14d23ee979
selinux-refpolicy/policy/modules/kernel
History
Stephen Smalley 14d23ee979 Refine xen policy 
Various changes to the Xen userspace policy, including:
- Add gntdev and gntalloc device node labeling.
- Create separate domains for blktap and qemu-dm rather than leaving them in xend_t.
- No need to allow xen userspace to create its own device nodes anymore;
this is handled automatically by the kernel/udev.
- No need to allow xen userspace access to generic raw storage; even if
using dedicated partitions/LVs for disk images, you can just label them
with xen_image_t.

The blktap and qemu-dm domains are stubs and will likely need to be
further expanded, but they should definitely not be left in xend_t.  Not
sure if I should try to use qemu_domain_template() instead for qemu-dm,
but I don't see any current users of that template (qemu_t uses
virt_domain_template instead), and qemu-dm has specific interactions
with Xen.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
2011-02-15 12:59:13 -05:00
..
corecommands.fc Additional rearrangement in corecommands, along with module version bump. 2010-10-27 14:09:00 -04:00
corecommands.if Additional rearrangement in corecommands, along with module version bump. 2010-10-27 14:09:00 -04:00
corecommands.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
corenetwork.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
corenetwork.if.in Whitespace fixes in corenetwork and ipsec. 2011-01-13 13:37:04 -05:00
corenetwork.if.m4 trunk: Add support for network interfaces with access controlled by a Boolean from the CLIP project. 2009-01-15 20:31:06 +00:00
corenetwork.te.in Add TSS Core Services (TCS) daemon (tcsd) policy 2011-02-07 08:36:43 -05:00
corenetwork.te.m4 Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh. 2010-07-19 14:22:44 -04:00
devices.fc Refine xen policy 2011-02-15 12:59:13 -05:00
devices.if Add TSS Core Services (TCS) daemon (tcsd) policy 2011-02-07 08:36:43 -05:00
devices.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
domain.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
domain.if 1/1] Make the ability to mmap zero conditional where this is fapplicable. 2010-09-01 09:41:56 -04:00
domain.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
files.fc Files patch from Dan Walsh. 2010-06-09 09:09:34 -04:00
files.if Minor fixes for Chris Richards' mount patchset. 2010-11-11 09:47:37 -05:00
files.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
filesystem.fc Libcgroup moved the cgroup directory to /sys/fs/cgroup. 2010-09-03 11:03:10 -04:00
filesystem.if Minor fixes for Chris Richards' mount patchset. 2010-11-11 09:47:37 -05:00
filesystem.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
kernel.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
kernel.if Add syslog capability. 2011-01-19 14:11:00 -05:00
kernel.te Module version bump and changelog for KaiGai's database object classes patch. 2011-01-14 10:35:52 -05:00
mcs.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
mcs.if revise MCS constraints to use only MCS-specific attributes. 2009-10-07 11:48:14 -04:00
mcs.te Whitespace change: drop unnecessary blank line at the start of .te files. 2010-06-10 08:16:35 -04:00
metadata.xml remove extra level of directory 2006-07-12 20:32:27 +00:00
mls.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
mls.if trunk: whitespace fixes 2009-06-26 14:40:13 +00:00
mls.te Whitespace change: drop unnecessary blank line at the start of .te files. 2010-06-10 08:16:35 -04:00
selinux.fc remove extra level of directory 2006-07-12 20:32:27 +00:00
selinux.if Add mounting interfaces for selinuxfs. 2010-10-28 14:32:24 -04:00
selinux.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
storage.fc Take virtio disks into account. 2010-08-02 08:25:14 -04:00
storage.if Kernel layer xml fixes. 2010-08-05 09:08:07 -04:00
storage.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
terminal.fc Add terminal patch from Dan Walsh. 2009-11-19 14:57:49 -05:00
terminal.if Rename allow_console tunable to console_login. 2011-01-14 11:44:42 -05:00
terminal.te Module version bump and changelog for /dev/console login from Harry Ciao. 2011-01-14 14:41:15 -05:00
ubac.fc trunk: add missing ubac module. 2008-11-05 16:11:27 +00:00
ubac.if Improve the documentation of ubac_constrained(). 2010-03-02 11:28:44 -05:00
ubac.te Whitespace change: drop unnecessary blank line at the start of .te files. 2010-06-10 08:16:35 -04:00