Currently FLASK can't really be enforced for domains being brought up in
dom0less mode, as security contexts are not assigned for domains in this
configuration. Thus domains are left with default SECINITSID_UNLABELED SID
which policy forbids to create:

    (XEN) [    0.637379] avc:  denied  { create } for current=d[IDLE] scontext=system_u:system_r:xenboot_t tcontext=system_u:system_r:unlabeled_t tclass=domain

This series extends dom0less bindings with ability to provide human-readable
security context in domain's DTS configuration, replicating a toolstack
approach and naming.

 -Sergiy

Sergiy Kibrik (2):
  flask: add const qualifier to security_context_to_sid()
  common: dom0less-bindings: introduce XSM labels

 docs/misc/arm/device-tree/booting.txt      |  8 ++++++++
 xen/common/device-tree/Makefile            |  2 ++
 xen/common/device-tree/dom0less-bindings.c | 11 +++++++++++
 xen/xsm/flask/include/security.h           |  2 +-
 xen/xsm/flask/ss/services.c                |  2 +-
 5 files changed, 23 insertions(+), 2 deletions(-)

-- 
2.43.0