From nobody Fri Oct 23 15:34:28 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass(p=quarantine dis=none) header.from=epam.com ARC-Seal: i=2; a=rsa-sha256; t=1790936751; cv=pass; d=zohomail.com; s=zohoarc; b=hdjSHdciC667qwCknyQK/pqYOOm/CmZ3ongdymQMzcbj+izVNvUipcus2f2hw2RhbHlNPQwPtCKTCxWWkKGbaqz76aa2MFHdviPfaSAdYgsbcR+KUR2Y06HQd3quz8VZTwzIwgQ+P7kxzmY1mReyQC1d+J8ztOul/vwp8Q82Ink= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790936751; h=Content-ID:Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=91sCiVVbEEgxdXzk1w+Mjs8LUZDR9Ye82bW536CrQmU=; b=M05axRDd3YyGI0jzSeONymYXIpff5MaV+owUU85y855ufg4a0X5naoRoA2xVsZmY6a6oo4dRpWLSk7VorgWqplgRToRQqOX9N1GUCcfanudTj4zMk3aV7Xno4f/pqR1vM04wuYVpmkXo3ib0de3664sdssp9ZZD5lYZyrZz3fNg= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1790936751223854.9843801274142; Fri, 2 Oct 2026 03:25:51 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1439019.1657536 (Exim 4.92) (envelope-from ) id 1xCaSH-0003hS-Qg; Fri, 02 Oct 2026 10:25:29 +0000 Received: by outflank-mailman (output) from mailman id 1439019.1657536; Fri, 02 Oct 2026 10:25:29 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xCaSH-0003hL-Nx; Fri, 02 Oct 2026 10:25:29 +0000 Received: by outflank-mailman (input) for mailman id 1439019; Fri, 02 Oct 2026 10:25:28 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) id 1xCaSG-0003hF-3y for xen-devel@lists.xenproject.org; Fri, 02 Oct 2026 10:25:28 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xCaSF-00HG7f-H1 for xen-devel@lists.xenproject.org; Fri, 02 Oct 2026 12:25:27 +0200 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6abf8697-e002-0a2a0a5209dd-0a2a4506ad9c-2 for ; Fri, 02 Oct 2026 12:25:27 +0200 Received: from [52.101.65.138] (helo=DU2PR03CU002.outbound.protection.outlook.com) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6abf8696-195a-0a2a45060019-3465418afdff-3 for ; Fri, 02 Oct 2026 12:25:27 +0200 Received: from AS8PR03MB9192.eurprd03.prod.outlook.com (2603:10a6:20b:5c0::11) by AS2PR03MB9670.eurprd03.prod.outlook.com (2603:10a6:20b:5e9::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.15; Fri, 2 Oct 2026 10:25:22 +0000 Received: from AS8PR03MB9192.eurprd03.prod.outlook.com ([fe80::61a0:97f5:ac5f:e292]) by AS8PR03MB9192.eurprd03.prod.outlook.com ([fe80::61a0:97f5:ac5f:e292%6]) with mapi id 15.21.0451.022; Fri, 2 Oct 2026 10:25:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=q/obR++SAI1xc5NlNsLB2VfzH2CEVbQIao07mNT2X+byhF7TTOnNrBiqTajJHgrOYt1MpZaF6r6PX/axUmPEmFZZLq/6bzjRG4a0VQOa5UVxfUTLO5pDytc3wRYQ9QKumY3r39xNnlFsWjR0gHQcAa00NUTr6S3d9diY+4NHJZ5beOXbtQMu6yRqT+6SiE8v++ikFpOzOMP8QaQAx0lsp2jdWlISzr4rz3OS+hEPZtJWLqOOjXoEDKA8gKYrV8On10EGFTN/1MkqaX/LnXcbW5yxEb1qmBCtT0r8MhutAdZ9o5BQMh7hVj4a186FujlVVRbAUFePe+wFdY4pAUclUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=91sCiVVbEEgxdXzk1w+Mjs8LUZDR9Ye82bW536CrQmU=; b=xgURX4r7QbQolIlv9sM8jS/KvGwvGa7jtHQ85uFfLeLAvKPOHaZgIAa426ORO9znQ+oDrMycja8KoEljpORDQDoBVsKLPLcoMUYJ9z3CebO4nFxpm2TjybwKyHy0sX3pGS2emdbstCXVhACLqol4DefepeMrge7EXe+R8k1pz8jnSzgkhvFaFxmvtm+Z19VGV0DYs8aCGJv044pCwV1Kyr47K3wb/sAn20XVZckIgGuz7KUuOPdmhG5E96/em9tQiwSc3bryMsZwbZSjJItFgmR8UfGtnmvzJFwqSBYBSJG9rvrldHpkJm6cqwNf4jxYgdrQD2bJzNmn4vTNArlMVA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=91sCiVVbEEgxdXzk1w+Mjs8LUZDR9Ye82bW536CrQmU=; b=Kf4z/KnrGfNk9YId1cgxJdSkSBkeQF/UbjVb9qHeBWTLiPs2qOMq6pHTJ0kl8ZbVGG04Z0WsXfi9s4A3ZiZhAZ63He6WlL6T7JJoketa6n/4EaEeRJTG/2aM7N7FALRVASOT9XkHS/sirCdJpwqlZl59X7VepGImBN3FzknHuyjecbytePzcXdT24R5GeDil2z1fgT2fQVgMYVoFoDOEDz2fFJDqAb+vs76kg77Ua6JYu5erVFsiJfqXFp2JY0JPc9lSvxLyRzMgBcXrQBfRVtbnUJATlUYAOGNSZb1KI8JOLP9uB0xVX9BLRayF/4v2VbyFzZIJ5aPwTI9E3Phteg== From: Sergiy Kibrik To: "xen-devel@lists.xenproject.org" CC: Sergiy Kibrik , Stefano Stabellini , Julien Grall , Bertrand Marquis , Volodymyr Babchuk , "Daniel P. Smith" , Andrew Cooper , Michal Orzel , Jan Beulich Subject: [PATCH v3] common: dom0less-bindings: introduce XSM labels Thread-Topic: [PATCH v3] common: dom0less-bindings: introduce XSM labels Thread-Index: AQHdUlhUefJfBgwqL0GtZVNifM+Gfg== Date: Fri, 2 Oct 2026 10:25:21 +0000 Message-ID: <20261002102521.565675-1-Sergiy_Kibrik@epam.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: AS8PR03MB9192:EE_|AS2PR03MB9670:EE_ x-ms-office365-filtering-correlation-id: 7a2bf557-9668-4bce-be5a-08df206f7705 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|10067099003|11063799006|6133799003|56012099006|18002099003|38070700021; x-microsoft-antispam-message-info: V62oylpxvflCdYhXuDg/gJVhWoFekR4bFNuLGXgJWb/AupmHC1qYXzSqpVi5/Tc3eCTcagTN979AFh0muCxUknAAdL7KfklyUC9IS5teCmdScShn4J21Tk4ZLvAwoZ3A0lpUIbkFiAZaE6sZuIAm/9pNjmE910riyE4okQeztB6TmUXSD28mas1tSUYHCl2TR8MtZgQcF7u3MMCFon+4FKnhQ42jQEta0R3HeSEPtn5QxTzfPZSAHRBYB4JknNUpsCxV1WMhTV5rWBJuCgV1ns9ybbs4K8nAygYxpvgPDDEPTGorvzuhencKwPP7vVV292q0TmE6PJrEAUsof7aza6LHlw0zxsrcJsBEWhHfYjLPgjUYtv3lxzDeMxKsUiR74zBYBXltcvvq9C6hNRpSTr/4hY2mTyDA/h8Es71349TTfbFaeKBa5vudoCxeSoy5MI3R4+MQMhAuWw5CDOgiwBe/e7nn/VLbrWKJeg/JJImGBABbkzTSqxbvXdAvjb/FkfgvGEv/KitDQ0ALY8Kfb7TA42+HEdD8mE0h+1C38BmuyzhYB4MXHGWQ0F4Pk0amKch2KjOWjc0Nw8dPP7QeR8Av1PaUn7t5A0v8zLvNIs4LpknDqOhl3X0fnUKgogxu06RABjYVxuTb3nA+ZHy5RmZetlwYCgXfIpeU8KfW67HkdgCRiwpyxlLEVF/eENyYremoKVgSY6nau7VNibisUCQmh43vzzZsVb2y1GXuz60= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8PR03MB9192.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(10067099003)(11063799006)(6133799003)(56012099006)(18002099003)(38070700021);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?SndzWFdtbDdCU3REL3NoTzdtbDZxaWczeEZLYjJVZTBvTit5dm1YTEVic0Mv?= =?utf-8?B?QU9ncE82TG9SLzV4eXYvc0hHNmZlZ0FtUnpnZWtBeGNsL1VYd0dVdDZjY2Nq?= =?utf-8?B?Q0NDZ1FVV0tWWk5BV2dDY3dOaFZKZ3ZqLzFCRGEyWU42dFRvclRsQ0FJdjlj?= =?utf-8?B?di9uWlJkbmE0d0pqaDVPZkxPNTlDY2E4Q2ZhUXlIUy84K1NHZWNFNmRnbjZF?= =?utf-8?B?RGFNR29VRmVxV2lGMm1Ldjk2a3Q0Y0NuSTBjL0NTQ3pOZld4RFkxUHRYSGRV?= =?utf-8?B?ckQ4RENFY3BjbzhTeUlNT2N5SkM3WnFldHVDdTJ6bGVGTGtZZ0Q2dTUrYXY2?= =?utf-8?B?SEVmdkpua2IyNEF6QnFjWEpjdy93REZ4bFFOanFkZ2lFVjAyRTdjVnJ4ak56?= =?utf-8?B?amc4ZDJuajNMNXhaTnBGSXJvOHpzRVdjQ016bDUwUXgwdWVqeXg0R3RTWmNB?= =?utf-8?B?QlAwbm1xNWMxZHVEZkZ1bU1ydXR1VTdFNmI4ZWs5d0gzRTdHQjl5clFIWDNB?= =?utf-8?B?UEpRU0I4bnVlRWlmWXpjR1g2U1Vua01SWEl6cnlGcGVUUjVNeVF0SjI0M0ts?= =?utf-8?B?dnRJbjBuRWp5RGJ4OHM0R0Q0c1hVNHlzTnBwdE5OcDF5OStqVElrdzRCRGta?= =?utf-8?B?NEs0UFRkRmsrMysyeUFkRnE1eUtHd1NuS3cxQVFNbS8zRzNMK2c1RE9pbE13?= =?utf-8?B?ZEZ2dHp2VG9MaTh5cFRuZ0dqNVpXeVpqMCtwa045YzlFeGhuVTU0bzVlWEkz?= =?utf-8?B?TWtmN2VST2lmUHVtUjFBVlB2MTkwR1BQL3FtVFJiQWVYRG04UVpXaXp2NW5G?= =?utf-8?B?QTduRVJ5QXJ4YUdzd0U3RytQZFRZR2F0RFNPQWxtMGowaFhjOXE3ZWJqZUJq?= =?utf-8?B?Y0xCQnJyVXRtV09EcmpFRlBYTW14Z1Y5T05aNW9XeGVZOWZSSEU1VktlTW1u?= =?utf-8?B?SU40M1NqUGFqYk5xcTVoQTVzNmo0NERZZEgyaEY3S3VIZFNPd000ZUJjMXpT?= =?utf-8?B?eGVWSXR3UUxHOEFuc0Z4MnpERHNSakEvL1NpVUFRc1ZOVjRjenA4T0ZnSTJa?= =?utf-8?B?QTJjZ1lkTjA1VlZZbzhXNlIrdkpwcHF6MTFiUVk0SGpGY0NyZkQrMTJVS0ZJ?= =?utf-8?B?NGdUNi9jU1ZIRmdlYnNhK2gxUXJWRm9sSEc3SnBpVFd2OVRhNWtmQStOYkQz?= =?utf-8?B?dVpnUDhURUFyU2hDKytYTnZKcmxub29IelJJMTBiMVMySGdURGZIRDd3Y2ZR?= =?utf-8?B?LzVoWGt3eDRTYTI1ZmFZVTdablpraDgyZGY4eTd3UVlrRVE0U2xFM2Ird1VO?= =?utf-8?B?clVkSjdQV0RTNlF3MDBueFBVNDhhYmM3Y255ZzlEaUQvcEY4QjVTbzlwNFll?= =?utf-8?B?M3JETG9DcUl4b1FjbHJGeGVKWWJmUjlmdC9EKzRxMHVLMWlMN214SFlmVW1a?= =?utf-8?B?Z0pxZEY0QmtmUTdsK0cvaDF2UUNlUzlKYWxBcE9aU0Q0WW5UMGVnbUE0NW9H?= =?utf-8?B?TDdUcWl2bzhNNTRkeUx5VHhraENFNUNkYkVDdjJEdXl6cDdxdm1nUFUySEUw?= =?utf-8?B?UzlVaDRVT2t0YUN5WkJNMUZuMmgwZ0lVSnRXYVZZYlFkRHhEK2U0aXJmSHVP?= =?utf-8?B?OWdxTnk4WldiR29lM1JDeW80cVNkcEVVYkwwVEhITGIwbTVqOWRqd0l3QjNB?= =?utf-8?B?UUE2bHN0ZThVK1lLR0x2QllsUVhGRjVWVWRSVVRxSUhZTmpjMDRZM0liZjJq?= =?utf-8?B?eWpTWXZtckNXTFdwVGI0TmFNS2pFRVdnWE04SU5hbi9rTnFmTjZoYnhIeGhH?= =?utf-8?B?eWl0c0JJaVVqZmlOTjJrTVB1QktYYm1nNE8rdDVQNGg0d0pac0F5SStTc1BT?= =?utf-8?B?b3BsWFpUdFpYMmtIMzdzMDJkVTBsMkNOVHRVTk5BR0RZcnFFOXY3UzB1VTNz?= =?utf-8?B?eG1sWW4zSkdrYkhGSmtBMm91bFBCOHhJNjVSQzRXSUJ3Yjd1WFl1bWpVaTk1?= =?utf-8?B?VnQ4UWdLRlRmdENJV2VnMk56a254WlZ5Nm9ZdjJWdDYvdGI1aGxmeXFRZytq?= =?utf-8?B?ZkFrcU16VEl5QVhpUUlHbEVWU3dnbi9Id2orVFZ4SU1yakxWQXNRalNzeHho?= =?utf-8?B?blZ5Qm9yT1VBRnphVEVFMzN2bzFNQ2U5cFBaMWp5VzQ5aE9oczJkVGVjbFdF?= =?utf-8?B?SDlLQlgyUXBrb1NtZmFwREgwWDBBZ2E5WGthcEhFMWdHYWxHNzNlL0lpc3lD?= =?utf-8?B?ZldFdjhKNFFrRGdPb2h5UFNCbHBKdXlMZGQrYkRxbmhnckpFQWxDVld3RmI5?= =?utf-8?B?U0RHWi9zd0QvdFFsUnpxZ1AxY1dmM0ZDcUttdHZqdEt6UzZuaWc4UT09?= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AS8PR03MB9192.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7a2bf557-9668-4bce-be5a-08df206f7705 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Oct 2026 10:25:21.9714 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: CMShoVkosyFLR1gJ9hVe0+pbZ7z3G4RUF7TnvYBSY8owN2a+57fHkHsoYxMGjXC0SsRRJsHFsLShVitXgSTR9A== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR03MB9670 X-purgate-ID: tlsNG-16d1c6/1790936727-1F8CB77B-264D8219/10/78276251493 X-purgate-type: spam X-purgate-size: 6438 X-ZohoMail-DKIM: pass (identity @epam.com) X-ZM-MESSAGEID: 1790936752257158500 Add "seclabel" property to be able to specify security label for a domain when XSM Flask is enabled, similar to xl configuration files. Currently guest domain can't be created by Xen in dom0less configuration wh= en Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" lab= el by default, which Flask denies to create according to current policy. Because code from outside of flask can't directly execute its internal API a new routine flask_context_to_sid() introduced as part of XSM API exposed to rest of Xen, which is a direct wrapper for security_context_to_sid(). Signed-off-by: Sergiy Kibrik CC: Daniel P. Smith CC: Andrew Cooper CC: Michal Orzel CC: Jan Beulich --- changes in v3: - panic if `seclabel` property found but FLASK is disabled changes in v2: - add & use flask_context_to_sid() wrapper --- docs/misc/arm/device-tree/booting.txt | 7 +++++++ xen/common/device-tree/dom0less-bindings.c | 13 +++++++++++++ xen/include/xsm/xsm.h | 3 +++ xen/xsm/flask/hooks.c | 5 +++++ 4 files changed, 28 insertions(+) diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-t= ree/booting.txt index bcb06bc796..d04455b744 100644 --- a/docs/misc/arm/device-tree/booting.txt +++ b/docs/misc/arm/device-tree/booting.txt @@ -345,6 +345,11 @@ with the following properties: not passed. This configuration requires static allocation (xen,static-= mem) and direct mapping (direct-map). =20 +- seclabel + + A string property specifying an XSM security label to this domain. Dom= ains + will be classified =E2=80=9Cunlabeled=E2=80=9D if this property not sp= ecified. + Under the "xen,domain" compatible node, one or more sub-nodes are present for the DomU kernel and ramdisk. =20 @@ -422,6 +427,7 @@ chosen { memory =3D <0 131072>; cpus =3D <2>; vpl011; + seclabel =3D "system_u:system_r:domU_t"; =20 vcpu0 { compatible =3D "xen,vcpu"; @@ -453,6 +459,7 @@ chosen { #size-cells =3D <0x1>; memory =3D <0 65536>; cpus =3D <1>; + seclabel =3D "system_u:system_r:domU_t"; =20 module@0x4c000000 { compatible =3D "multiboot,kernel", "multiboot,module"; diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device= -tree/dom0less-bindings.c index 41d72d0d58..01d5cc1bc9 100644 --- a/xen/common/device-tree/dom0less-bindings.c +++ b/xen/common/device-tree/dom0less-bindings.c @@ -11,6 +11,8 @@ #include #include =20 +#include + int __init parse_dom0less_node(struct dt_device_node *node, struct boot_domain *bd) { @@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *nod= e, bool has_dtb =3D false; bool iommu =3D false; const char *dom0less_iommu =3D NULL; + const char *xsm_seclabel =3D NULL; =20 if ( !dt_device_is_compatible(node, "xen,domain") ) return -ENOENT; @@ -141,5 +144,15 @@ int __init parse_dom0less_node(struct dt_device_node *= node, panic("'llc-colors' found, but LLC coloring is disabled\n"); #endif =20 + if ( !dt_property_read_string(node, "seclabel", &xsm_seclabel) ) + { + if ( !IS_ENABLED(CONFIG_XSM_FLASK) ) + panic("'seclabel' found, but FLASK is disabled\n"); + else if ( flask_context_to_sid(xsm_seclabel, strlen(xsm_seclabel), + &d_cfg->ssidref) ) + panic("Invalid security context for domain: %s\n", + xsm_seclabel); + } + return arch_parse_dom0less_node(node, bd); } diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 9809e005e0..73d058a8b2 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -261,4 +261,7 @@ static inline bool has_xsm_magic(paddr_t start) =20 #endif /* CONFIG_XSM */ =20 +int flask_context_to_sid(const char *scontext, + uint32_t scontext_len, uint32_t *sid); + #endif /* __XSM_H */ diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d65ba0aeae..0b44a2a3d9 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -2016,6 +2016,11 @@ const struct xsm_ops *__init flask_init( return &flask_ops; } =20 +int flask_context_to_sid(const char *scontext, uint32_t scontext_len, uint= 32_t *sid) +{ + return security_context_to_sid(scontext, scontext_len, sid); +} + /* * Local variables: * mode: C --=20 2.43.0