[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v1 2/2] common: dom0less-bindings: introduce XSM labels
- To: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Sergiy Kibrik <Sergiy_Kibrik@xxxxxxxx>
- Date: Fri, 4 Sep 2026 10:01:58 +0000
- Accept-language: en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=gWH369CGsQvS0nR81kZ/CVOnsZJb88aK0T8wC501PWA=; b=kxuXJ6Y/sad5a5hkBA0k24qCHaEtjDdwvyb6whZ4r8Dnw/NtKsuv9ugy0RZAO2fJlG3fIZ7pm8qL9OAJDPQgdYT/L4X7/PCFqnwYa9HjWKOs/7NrbWRYqC8LIXRQBv888aJxWrm3u03h/+ZpspinjcAEvRK/ZCPrY+TkPGCtM7lH+B0Gj4kWs9eE51HO+L5zPAhX2SNnKwjD56/RAH9TUgo0mGLToB8fIm/W6jhCMiIvB5F3k9y4Yb6UwItQ7cDrZCz+jFyTgWDihXHzD4aiUuITHLCFmwfLXtrKuHl2ytrenZ0dwqyYdbKEXqBPuRc6fC2fKTIXBM945rTcLMBo/g==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BDFFr5AYkEVn5UZY4BCRZ/oUEdAPWByXtDmlIA0y1jo3hzr0SjDS+D2ZIIVYdtAHTZkNklTBIL6+x6O307VXslOVhFFKAXfRVtYUbU8Ob0Sw0baQ5b3k09etmv07p5kGzOkBQTiLMFQBqWwj4rkS9UiR7sgB4JKvv9OBi+BYOs/8CjKN0uOoIbRyxwBpwnUDPqZ489QSRc5LfachVomfss9sqMkX/GtF9dGzH5TS/gDDEwOfi4bE/AO/TGuhGfiu4fZeFLFgMPSErpxNwdu/pVpghwY/g/Zp9Bk0bHx1+np8e587Sref1JoFSGnuwslTUikSPp5PubZ3HhnLOUyr6A==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck"
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com;
- Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>, Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>, "Daniel P. Smith" <dpsmith@xxxxxxxxxxxxxxxxxxxx>
- Delivery-date: Fri, 04 Sep 2026 10:02:28 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Thread-index: AQHdNgfAHPmcI5IBhUGZU0o2oDVW1La3+D2AgAZEiwA=
- Thread-topic: [PATCH v1 2/2] common: dom0less-bindings: introduce XSM labels
On 8/31/26 13:19, Andrew Cooper wrote:
> To this specifically, I'm not sure security_context_to_sid() handing out
> SECINITSID_XEN if you happen to call it too early is the wisest
> behaviour. It's current call-chain has an earlier check which I think
> excludes this from occurring.
It's only call-chain is in FLASK_CONTEXT_TO_SID xsm_op handling, and it
does return SECINITSID_XEN to toolstack if called before policy is
loaded (I've tried booting with flask=late).
But what's the point of falling back to SECINITSID_XEN anyway?
-Sergiy
|
