On 10/09/2017 11:53 AM, Konrad Rzeszutek Wilk via refpolicy wrote:
From: Konrad Rzeszutek Wilk <kon...@kernel.org>
type=AVC msg=audit(1504637347.487:280): avc: denied { map } for pid=857 comm="xenconsoled"
path="/dev/xen/privcmd" dev="devtmpfs" ino=16289
scontext=system_u:system_r:xenconsoled_t:s0
Without this we can't use xenconsole (client) to
talk to xenconsoled (server).
Signed-off-by: Konrad Rzeszutek Wilk <kon...@kernel.org>
---
policy/modules/kernel/devices.if | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 4c47709ff..c9071df8f 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',`
')
rw_chr_files_pattern($1, device_t, xen_device_t)
+ allow $1 xen_device_t:chr_file map;
')
########################################
Merged.
--
Chris PeBenito
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
