attribute xen_type;
attribute domain_type;
attribute resource_type;
attribute event_type;
attribute mls_priv;

type xen_t, xen_type, domain_type, mls_priv;

type dom0_t, domain_type, mls_priv;

type domio_t, domain_type;

type domxen_t, domain_type;

type unlabeled_t, domain_type;

type security_t, domain_type;

type pirq_t, resource_type;
type ioport_t, resource_type;
type iomem_t, resource_type;
type device_t, resource_type;

################################################################################
#
# Boot the hypervisor and dom0
#
################################################################################
allow dom0_t xen_t:xen {kexec readapic writeapic mtrr_read mtrr_add mtrr_del 
scheduler physinfo heap quirk readconsole writeconsole settime microcode};

allow dom0_t domio_t:mmu {map_read map_write};
allow dom0_t iomem_t:mmu {map_read map_write};
allow dom0_t pirq_t:event {vector};
allow dom0_t xen_t:mmu {memorymap};

allow dom0_t dom0_t:mmu {pinpage map_read map_write adjust updatemp};
allow dom0_t dom0_t:grant {query setup};
allow dom0_t dom0_t:domain {scheduler getdomaininfo getvcpuinfo getvcpuaffinity};

allow xen_t dom0_t:domain {create};
allow xen_t dom0_t:resource {add remove};
allow xen_t ioport_t:resource {add_ioport remove_ioport};
allow dom0_t ioport_t:resource {use};
allow xen_t iomem_t:resource {add_iomem remove_iomem};
allow dom0_t iomem_t:resource {use};
allow xen_t pirq_t:resource {add_irq remove_irq};
allow dom0_t pirq_t:resource { add_irq remove_irq use};
allow dom0_t dom0_t:resource { add remove };
allow dom0_t xen_t:xen firmware;

allow dom0_t security_t:security {compute_av compute_create compute_member 
check_context load_policy compute_relabel compute_user setenforce setbool
setsecparam add_ocontext del_ocontext};

create_channel(dom0_t, dom0_t, evchn0-0_t)
allow dom0_t evchn0-0_t:event {send};

################################################################################
#
# Create and manage a domU w/ dom0 IO
#
################################################################################
create_pv_dom(dom0_t, domU_t, evchnU-0_t, domio_t)

create_channel(domU_t, domU_t, evchnU-U_t)
allow domU_t evchnU-U_t:event {send};

create_channel(dom0_t, domU_t, evchn0-U_t)
allow dom0_t evchn0-U_t:event {send};

create_channel(domU_t, dom0_t, evchnU-0_t)
allow domU_t evchnU-0_t:event {send};

allow dom0_t dom0_t:event {send};
allow dom0_t domU_t:grant {copy};
allow domU_t domU_t:grant {copy};

###############################################################################
#
# Create device labels
#
###############################################################################

# create device resources
#create_passthrough_resource(dom0_t, domU_t, nicP_t)
#create_hvm_resource(dom0_t, domHU_t, nicP_t)

# label e1000e nic
#pirqcon 33 system_u:object_r:nicP_t
#pirqcon 55 system_u:object_r:nicP_t
#iomemcon 0xfebe0-0xfebff system_u:object_r:nicP_t
#iomemcon 0xfebd9 system_u:object_r:nicP_t
#ioportcon 0xecc0-0xecdf system_u:object_r:nicP_t
#pcidevicecon 0xc800 system_u:object_r:nicP_t

# label e100 nic
#pirqcon 16 system_u:object_r:nicP_t
#iomemcon 0xfe5df system_u:object_r:nicP_t
#iomemcon 0xfe5e0-0xfe5ff system_u:object_r:nicP_t
#iomemcon 0xc2000-0xc200f system_u:object_r:nicP_t
#ioportcon 0xccc0-0xcd00 system_u:object_r:nicP_t

# label usb 1d.0-2 1d.7
#pirqcon 23 system_u:object_r:nicP_t
#pirqcon 17 system_u:object_r:nicP_t
#pirqcon 18 system_u:object_r:nicP_t
#ioportcon 0xff80-0xFF9F system_u:object_r:nicP_t
#ioportcon 0xff60-0xff7f system_u:object_r:nicP_t
#ioportcon 0xff40-0xff5f system_u:object_r:nicP_t
#iomemcon 0xff980 system_u:object_r:nicP_t
#ioportcon 0xff00-0xff1f system_u:object_r:nicP_t

manage_domain(dom0_t, domU_t)

################################################################################
#
# Create and manage an HVM domU w/ dom0 IO
#
################################################################################
create_hvm_dom(dom0_t, domHU_t, evchnHU-0_t)
allow dom0_t evchn0-HU_t:event {send};

create_channel(domHU_t, domHU_t, evchnHU-HU_t)
allow domHU_t evchnU-U_t:event {send};

create_channel(dom0_t, domHU_t, evchn0-HU_t)
allow dom0_t evchn0-U_t:event {send};

create_channel(domHU_t, dom0_t, evchnHU-0_t)
allow domHU_t evchnU-0_t:event {send};

allow dom0_t dom0_t:event {send};

manage_domain(dom0_t, domHU_t)

################################################################################
#
#
#
################################################################################
sid xen gen_context(system_u:system_r:xen_t,s0)
sid dom0 gen_context(system_u:system_r:dom0_t,s0)
sid domU gen_context(system_u:system_r:domU_t,s0)
sid domxen gen_context(system_u:system_r:domxen_t,s0)
sid domio gen_context(system_u:system_r:domio_t,s0)
sid unlabeled gen_context(system_u:system_r:unlabeled_t,s0)
sid security gen_context(system_u:system_r:security_t,s0)
sid pirq gen_context(system_u:object_r:pirq_t,s0)
sid iomem gen_context(system_u:object_r:iomem_t,s0)
sid ioport gen_context(system_u:object_r:ioport_t,s0)
sid device gen_context(system_u:object_r:device_t,s0)

role system_r types { xen_type domain_type };
