[Xen-changelog] [xen-unstable] xsm: clean up initial SIDs

[Xen patchbot-unstable <patchbot@xxxxxxx>]

# HG changeset patch
# User Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
# Date 1322862511 28800
# Node ID 1288a553f924705b9ad513d04cb82d8804b7dbf0
# Parent  346da8c033f6af083439cda268db8c23136297e5
xsm: clean up initial SIDs

The domU SID is never used before a policy load, and so does not
belong in the initial_sids list.

The PIRQ SID is now incorrectly named; it should simply be called IRQ.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
Committed-by: Keir Fraser <keir@xxxxxxx>
---


diff -r 346da8c033f6 -r 1288a553f924 
tools/flask/policy/policy/flask/initial_sids
--- a/tools/flask/policy/policy/flask/initial_sids      Fri Dec 02 13:47:50 
2011 -0800
+++ b/tools/flask/policy/policy/flask/initial_sids      Fri Dec 02 13:48:31 
2011 -0800
@@ -5,13 +5,12 @@
 #
 sid xen
 sid dom0
-sid domU
 sid domio
 sid domxen
 sid unlabeled
 sid security
 sid ioport
 sid iomem
-sid pirq
+sid irq
 sid device
 # FLASK
diff -r 346da8c033f6 -r 1288a553f924 
tools/flask/policy/policy/modules/xen/xen.if
--- a/tools/flask/policy/policy/modules/xen/xen.if      Fri Dec 02 13:47:50 
2011 -0800
+++ b/tools/flask/policy/policy/modules/xen/xen.if      Fri Dec 02 13:48:31 
2011 -0800
@@ -70,10 +70,10 @@
         allow $1 $2:resource {add remove};
         allow $1 ioport_t:resource {add_ioport use};
         allow $1 iomem_t:resource {add_iomem use};
-        allow $1 pirq_t:resource  {add_irq use};
+        allow $1 irq_t:resource  {add_irq use};
         allow $1 domio_t:mmu {map_read map_write};
         allow $2 domio_t:mmu {map_write};
-        allow $2 pirq_t:resource {use};
+        allow $2 irq_t:resource {use};
         allow $1 $3:resource {add_irq add_iomem add_ioport remove_irq 
remove_iomem remove_ioport use add_device remove_device};
         allow $2 $3:resource {use add_ioport add_iomem remove_ioport 
remove_iomem};
         allow $2 $3:mmu {map_read map_write};
diff -r 346da8c033f6 -r 1288a553f924 
tools/flask/policy/policy/modules/xen/xen.te
--- a/tools/flask/policy/policy/modules/xen/xen.te      Fri Dec 02 13:47:50 
2011 -0800
+++ b/tools/flask/policy/policy/modules/xen/xen.te      Fri Dec 02 13:48:31 
2011 -0800
@@ -16,7 +16,7 @@
 
 type security_t, domain_type;
 
-type pirq_t, resource_type;
+type irq_t, resource_type;
 type ioport_t, resource_type;
 type iomem_t, resource_type;
 type device_t, resource_type;
@@ -43,8 +43,8 @@
 allow dom0_t ioport_t:resource {use};
 allow xen_t iomem_t:resource {add_iomem remove_iomem};
 allow dom0_t iomem_t:resource {use};
-allow xen_t pirq_t:resource {add_irq remove_irq};
-allow dom0_t pirq_t:resource { add_irq remove_irq use};
+allow xen_t irq_t:resource {add_irq remove_irq};
+allow dom0_t irq_t:resource { add_irq remove_irq use};
 allow dom0_t dom0_t:resource { add remove };
 allow dom0_t xen_t:xen firmware;
 
@@ -140,12 +140,11 @@
 
################################################################################
 sid xen gen_context(system_u:system_r:xen_t,s0)
 sid dom0 gen_context(system_u:system_r:dom0_t,s0)
-sid domU gen_context(system_u:system_r:domU_t,s0)
 sid domxen gen_context(system_u:system_r:domxen_t,s0)
 sid domio gen_context(system_u:system_r:domio_t,s0)
 sid unlabeled gen_context(system_u:system_r:unlabeled_t,s0)
 sid security gen_context(system_u:system_r:security_t,s0)
-sid pirq gen_context(system_u:object_r:pirq_t,s0)
+sid irq gen_context(system_u:object_r:irq_t,s0)
 sid iomem gen_context(system_u:object_r:iomem_t,s0)
 sid ioport gen_context(system_u:object_r:ioport_t,s0)
 sid device gen_context(system_u:object_r:device_t,s0)
diff -r 346da8c033f6 -r 1288a553f924 xen/xsm/flask/include/flask.h
--- a/xen/xsm/flask/include/flask.h     Fri Dec 02 13:47:50 2011 -0800
+++ b/xen/xsm/flask/include/flask.h     Fri Dec 02 13:48:31 2011 -0800
@@ -20,16 +20,15 @@
  */
 #define SECINITSID_XEN                                  1
 #define SECINITSID_DOM0                                 2
-#define SECINITSID_DOMU                                 3
-#define SECINITSID_DOMIO                                4
-#define SECINITSID_DOMXEN                               5
-#define SECINITSID_UNLABELED                            6
-#define SECINITSID_SECURITY                             7
-#define SECINITSID_IOPORT                               8
-#define SECINITSID_IOMEM                                9
-#define SECINITSID_PIRQ                                 10
-#define SECINITSID_DEVICE                               11
+#define SECINITSID_DOMIO                                3
+#define SECINITSID_DOMXEN                               4
+#define SECINITSID_UNLABELED                            5
+#define SECINITSID_SECURITY                             6
+#define SECINITSID_IOPORT                               7
+#define SECINITSID_IOMEM                                8
+#define SECINITSID_IRQ                                  9
+#define SECINITSID_DEVICE                               10
 
-#define SECINITSID_NUM                                  11
+#define SECINITSID_NUM                                  10
 
 #endif
diff -r 346da8c033f6 -r 1288a553f924 
xen/xsm/flask/include/initial_sid_to_string.h
--- a/xen/xsm/flask/include/initial_sid_to_string.h     Fri Dec 02 13:47:50 
2011 -0800
+++ b/xen/xsm/flask/include/initial_sid_to_string.h     Fri Dec 02 13:48:31 
2011 -0800
@@ -4,14 +4,13 @@
     "null",
     "xen",
     "dom0",
-    "domU",
     "domio",
     "domxen",
     "unlabeled",
     "security",
     "ioport",
     "iomem",
-    "pirq",
+    "irq",
     "device",
 };
 
diff -r 346da8c033f6 -r 1288a553f924 xen/xsm/flask/ss/services.c
--- a/xen/xsm/flask/ss/services.c       Fri Dec 02 13:47:50 2011 -0800
+++ b/xen/xsm/flask/ss/services.c       Fri Dec 02 13:48:31 2011 -0800
@@ -1546,7 +1546,7 @@
     }
     else
     {
-        *out_sid = SECINITSID_PIRQ;
+        *out_sid = SECINITSID_IRQ;
     }
 
 out:

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog