Re: [Xen-devel] [PATCH 1/3] flask/policy: updates from osstest runs

2015-06-03 Thread Ian Campbell
On Wed, 2015-05-27 at 09:13 +0100, Ian Campbell wrote: > On Tue, 2015-05-26 at 14:13 -0400, Daniel De Graaf wrote: > > Migration and HVM domain creation both trigger AVC denials that should > > be allowed in the default policy; add these rules. > > > > Guest console writes need to be either allowe

Re: [Xen-devel] [PATCH 1/3] flask/policy: updates from osstest runs

2015-05-27 Thread Ian Campbell
On Tue, 2015-05-26 at 14:13 -0400, Daniel De Graaf wrote: > Migration and HVM domain creation both trigger AVC denials that should > be allowed in the default policy; add these rules. > > Guest console writes need to be either allowed or denied without audit > depending on the decision of the loca

[Xen-devel] [PATCH 1/3] flask/policy: updates from osstest runs

2015-05-26 Thread Daniel De Graaf
Migration and HVM domain creation both trigger AVC denials that should be allowed in the default policy; add these rules. Guest console writes need to be either allowed or denied without audit depending on the decision of the local administrator; introduce a policy boolean to switch between these