Add "seclabel" property to be able to specify security label for a domain
when XSM Flask is enabled, similar to xl configuration files.

Currently guest domain can't be created by Xen in dom0less configuration when
Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
by default, which Flask denies to create according to current policy.

Because code from outside of flask can't directly execute its internal API
a new XSM hook lookup_sid() introduced as part of XSM API exposed
to rest of Xen.

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Reviewed-by: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
---
CC: Daniel P. Smith <dpsmith@apertussolutions.com>
CC: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Jan Beulich <jbeulich@suse.com>
---
changes in v5:
 - print error code in panic message
 - return -EOPNOTSUPP instead of -EPERM in xsm_lookup_sid() stub function
 - address other review comments & add tags
changes in v4:
 - introduce XSM hook `lookup_sid`
 - at SID lookup return error if security server not initialized
 - document panic if DTS property is used and FLASK disabled
 - per Michal's request panic if FLASK disabled is left unchanged
---
 docs/misc/arm/device-tree/booting.txt      |  8 ++++++++
 xen/common/device-tree/dom0less-bindings.c | 12 ++++++++++++
 xen/include/xsm/dummy.h                    |  8 ++++++++
 xen/include/xsm/hooks.h                    |  2 ++
 xen/xsm/flask/hooks.c                      |  8 ++++++++
 5 files changed, 38 insertions(+)

diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
index 1dfdff0e4f..7edce9642e 100644
--- a/docs/misc/arm/device-tree/booting.txt
+++ b/docs/misc/arm/device-tree/booting.txt
@@ -348,6 +348,12 @@ with the following properties:
     not passed. This configuration requires static allocation (xen,static-mem)
     and direct mapping (direct-map).
 
+- seclabel
+
+    A string property specifying an XSM security label to this domain. Domains
+    will be classified "unlabeled" if this property is not specified.
+    Note: boot will fail if this property is present but FLASK is disabled.
+
 Under the "xen,domain" compatible node, one or more sub-nodes are present
 for the DomU kernel and ramdisk.
 
@@ -425,6 +431,7 @@ chosen {
         memory = <0 131072>;
         cpus = <2>;
         vpl011;
+        seclabel = "system_u:system_r:domU_t";
 
         vcpu0 {
             compatible = "xen,vcpu";
@@ -456,6 +463,7 @@ chosen {
         #size-cells = <0x1>;
         memory = <0 65536>;
         cpus = <1>;
+        seclabel = "system_u:system_r:domU_t";
 
         module@0x4c000000 {
             compatible = "multiboot,kernel", "multiboot,module";
diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
index 41d72d0d58..2d061e5ba6 100644
--- a/xen/common/device-tree/dom0less-bindings.c
+++ b/xen/common/device-tree/dom0less-bindings.c
@@ -11,6 +11,8 @@
 #include <public/bootfdt.h>
 #include <public/domctl.h>
 
+#include <xsm/xsm.h>
+
 int __init parse_dom0less_node(struct dt_device_node *node,
                                struct boot_domain *bd)
 {
@@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
     bool has_dtb = false;
     bool iommu = false;
     const char *dom0less_iommu = NULL;
+    const char *xsmlabel;
 
     if ( !dt_device_is_compatible(node, "xen,domain") )
         return -ENOENT;
@@ -141,5 +144,14 @@ int __init parse_dom0less_node(struct dt_device_node *node,
         panic("'llc-colors' found, but LLC coloring is disabled\n");
 #endif
 
+    if ( !dt_property_read_string(node, "seclabel", &xsmlabel) )
+    {
+        int rc = xsm_lookup_sid(XSM_HOOK, xsmlabel, strlen(xsmlabel),
+                                &d_cfg->ssidref);
+        if ( rc )
+            panic("Invalid security context for domain: %s (%d)\n",
+                  xsmlabel, rc);
+    }
+
     return arch_parse_dom0less_node(node, bd);
 }
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 6331859afa..7a05d2078c 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -823,4 +823,12 @@ static XSM_INLINE int xsm_domain_resource_map(
     return xsm_default_action(action, current->domain, d);
 }
 
+static XSM_INLINE int xsm_lookup_sid(
+    XSM_DEFAULT_ARG const char *ctx, uint32_t len, uint32_t *sid)
+{
+    XSM_ASSERT_ACTION(XSM_HOOK);
+    /* dummy policy has no security contexts */
+    return -EOPNOTSUPP;
+}
+
 #endif /* __XEN_XSM_DUMMY_H__ */
diff --git a/xen/include/xsm/hooks.h b/xen/include/xsm/hooks.h
index a331f5f0e5..3c1bef3053 100644
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -169,6 +169,8 @@ XSM_HOOK(int, argo_register_any_source, const struct domain *)
 XSM_HOOK(int, argo_send, const struct domain *, const struct domain *)
 #endif
 
+XSM_HOOK(int, lookup_sid, const char *, uint32_t, uint32_t *)
+
 #undef XSM_HOOK0
 #undef XSM_HOOK1
 #undef XSM_HOOK2
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index d65ba0aeae..741969c064 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1949,6 +1949,14 @@ static int cf_check flask_get_domain_state(struct domain *d)
     return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__GET_DOMAIN_STATE);
 }
 
+static int flask_lookup_sid(const char *ctx, uint32_t ctx_len, uint32_t *sid)
+{
+    if ( !ss_initialized )
+        return -EAGAIN;
+
+    return security_context_to_sid(ctx, ctx_len, sid);
+}
+
 static const struct xsm_ops __initconst_cf_clobber flask_ops = {
     .set_system_active = flask_set_system_active,
     .security_domaininfo = flask_security_domaininfo,
-- 
2.43.0