Re: [PATCH v3 2/2] flask: implement xsm_set_system_active

[Jason Andryuk <jandryuk@xxxxxxxxx>]

On Fri, Apr 22, 2022 at 12:35 PM Daniel P. Smith
<dpsmith@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> This commit implements full support for starting the idle domain privileged by
> introducing a new flask label xenboot_t which the idle domain is labeled with
> at creation.  It then provides the implementation for the XSM hook
> xsm_set_system_active to relabel the idle domain to the existing xen_t flask
> label.
>
> In the reference flask policy a new macro, xen_build_domain(target), is
> introduced for creating policies for dom0less/hyperlaunch allowing the
> hypervisor to create and assign the necessary resources for domain
> construction.
>
> Signed-off-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
> ---

> @@ -188,8 +188,12 @@ static int cf_check flask_domain_alloc_security(struct 
> domain *d)
>
>  static int cf_check flask_set_system_active(void)
>  {
> +    struct domain_security_struct *dsec;
>      struct domain *d = current->domain;
>
> +    dsec = d->ssid;
> +    ASSERT( dsec->sid == SECINITSID_XENBOOT);

Extra space before dsec.

With that fixed,
Reviewed-by: Jason Andryuk <jandryuk@xxxxxxxxx>