[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v1 0/2] XSM labels support in dom0less
- To: "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>
- Date: Thu, 27 Aug 2026 09:38:00 +0000
- Accept-language: en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SgziTV3hVaV5ve/1Bw1hIfKe/GnHCsU5TuUVeBnQKfQ=; b=GQ3Yp6yRtDOqgKOvqCVI8JEFhAGf3qElRpzIpDi2ppaZjtQmZ8g4k5npm4nAzJ14vBJ3IqAc5FFS1fGAnYHlegUeunKuXREcnEZ6YgBw2Qr6TYttGOAlM17hCytKhR5K555QX6pZVoiKcE576JwpboJXzUjMbS6fTeQMKdphxuLBFB4vgFg8B5JMwbU3izBcViTsdBmQuE9zWO69vO6sWmie+Gz9fGckooijFzgHDX2L3T2WoQ4p6bQ2AcIACsZiG6UGdYw0/nqkfoeCdmV28FmbTyyamnXxRxpi7scuw+tOQl8IJ0mex1qRTWE6jtnMf8Umx7eFpLOzThNEKrk8yA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=f+t5lHy6xG6wsH2yuZzIWRr3r8a4KiPkFT4LUPIcWT0HcJrqNNbETq3vy+ZD+Prg0AkD3QrmY+/qZeoGcwBqlx0PBjBUR4zl0KmZXVrdBkra+rMVmEuPdbStG+dwqVxnP9YVff9MqRYNSnihPfNSqQHoQEieHOOV6zfe/6r8S9SQgmZb+dRe1mIPqphDt4RGwDNmu0onk0w6F3LtoRoVZEe+n+pcDy5A62fOwapvTi0xCSW8hxqDiju9cUYHPLpIpOgeaW2+UuMZwryvKDD1eqaqu0IAvkD9KbZe7oYXqZwXFpqmqxpMxg0+misEjFBliN5eAJp2V4c67ghWPLyVQA==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck"
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com;
- Cc: Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>, "Daniel P. Smith" <dpsmith@xxxxxxxxxxxxxxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>, Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
- Delivery-date: Thu, 27 Aug 2026 09:38:09 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Thread-index: AQHdNgfA1drElJutwEqAemyOuAaNVg==
- Thread-topic: [PATCH v1 0/2] XSM labels support in dom0less
Currently FLASK can't really be enforced for domains being brought up in
dom0less mode, as security contexts are not assigned for domains in this
configuration. Thus domains are left with default SECINITSID_UNLABELED SID
which policy forbids to create:
(XEN) [ 0.637379] avc: denied { create } for current=d[IDLE]
scontext=system_u:system_r:xenboot_t tcontext=system_u:system_r:unlabeled_t
tclass=domain
This series extends dom0less bindings with ability to provide human-readable
security context in domain's DTS configuration, replicating a toolstack
approach and naming.
-Sergiy
Sergiy Kibrik (2):
flask: add const qualifier to security_context_to_sid()
common: dom0less-bindings: introduce XSM labels
docs/misc/arm/device-tree/booting.txt | 8 ++++++++
xen/common/device-tree/Makefile | 2 ++
xen/common/device-tree/dom0less-bindings.c | 11 +++++++++++
xen/xsm/flask/include/security.h | 2 +-
xen/xsm/flask/ss/services.c | 2 +-
5 files changed, 23 insertions(+), 2 deletions(-)
--
2.43.0
|
