From nobody Thu Sep 3 07:03:34 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass(p=quarantine dis=none) header.from=epam.com ARC-Seal: i=2; a=rsa-sha256; t=1787823512; cv=pass; d=zohomail.com; s=zohoarc; b=knmsU2xOdCp4cr7pB79wQnShefcDKYIdtp9xS3LkwYgW/Oz2eMtnXCImx+UMJMDLOdjbTHrtDPsKwc2yA4oPxkWDbhNlXHqHs5DNRHJHmt9mcZetzSHy0V7U29fxJP2ipdy9u0BJRcWJLcL3kSJ8LlvwdI3ItcH72WKqZrwB0+s= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787823512; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gwmCA8Q9O7G1J/I8ZQMK0FpJAXxpRT2z/dIkKHMIEdY=; b=mmnSYUV3SSwHM36FXfUJRy4dRxib8UAbZSTnEjNxVVpgZ/xrwd0veNHZslU7oSy+20KScckIiryHc6l5ClNqSiNH5yWINGUTNJrLNA86kZwywtWmgkXTGBCV/bM+8xkYEq+Sv7dc/A6jR6QSQ9fXhY7LRQLaabS1gPGPGjbyLIE= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1787823512380276.88879765285947; Thu, 27 Aug 2026 02:38:32 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1400448.1636110 (Exim 4.92) (envelope-from ) id 1wzWYj-0002gw-OE; Thu, 27 Aug 2026 09:38:09 +0000 Received: by outflank-mailman (output) from mailman id 1400448.1636110; Thu, 27 Aug 2026 09:38:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wzWYj-0002gg-Hl; Thu, 27 Aug 2026 09:38:09 +0000 Received: by outflank-mailman (input) for mailman id 1400448; Thu, 27 Aug 2026 09:38:08 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wzWYi-0002dJ-09 for xen-devel@lists.xenproject.org; Thu, 27 Aug 2026 09:38:08 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wzWYh-002LkA-D4 for xen-devel@lists.xenproject.org; Thu, 27 Aug 2026 11:38:07 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a90057f-bab6-0a2a0a5309dd-0a2a450ca456-2 for ; Thu, 27 Aug 2026 11:38:07 +0200 Received: from [40.107.130.73] (helo=MRWPR03CU001.outbound.protection.outlook.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a90057c-f479-0a2a450c0019-286b82493340-4 for ; Thu, 27 Aug 2026 11:38:07 +0200 Received: from AS8PR03MB9192.eurprd03.prod.outlook.com (2603:10a6:20b:5c0::11) by AS2PR03MB9562.eurprd03.prod.outlook.com (2603:10a6:20b:599::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.8; Thu, 27 Aug 2026 09:38:01 +0000 Received: from AS8PR03MB9192.eurprd03.prod.outlook.com ([fe80::61a0:97f5:ac5f:e292]) by AS8PR03MB9192.eurprd03.prod.outlook.com ([fe80::61a0:97f5:ac5f:e292%7]) with mapi id 15.21.0360.006; Thu, 27 Aug 2026 09:38:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=th+imLn7P8Q4jh7KHsShJh9bDfhhF4qcaVWVKV/Mmyum/waR3DlgS/OTMSi5ki5WWt4UXO6tRSP4TgWP+xqdLV1jo6wISULkmQA2MnWr0YvxsFK0di8lL9tG883+LCJCYxvvvwQpJaMsywGEQsly+JhqztR6K4uag0+2a6tjaWB8pR9i2qB7RU2ikVvOyA8Hc0ikRH8TBYfk57nwRl0ZDHBOz0LJaIhgTcplJkR283tIvD8yvZlJkpSs+ylSNKVs012B//giFi7CpunKSja/3vx43C5T/twuhJKZ9BmV60TZ79kQ/cvilHWMGd1lXetPjekAHjbPrbGsgZlyT2LNcA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=gwmCA8Q9O7G1J/I8ZQMK0FpJAXxpRT2z/dIkKHMIEdY=; b=csHwo+VSS0KUxEI9e2YVMRZZPLSd386074dr+e3pm5JRhGnysqOU1ik9zzYgt0zys6FShPPd1Im2qm/IuA3yE/qbhQJsTxW0otFrTGH2ghnXx1AL2915bb/XVxEOKBcs769GpFTyoy3C4rzlwtneIAu/QzAuqk3LFVEAHCNfwLXU6hI8wPJu0YjuO1+fY1wAeIe2igd72hPanUNUHZxRn06aJm/GeSGbWG7rMIn9gsM7KrG+sB2RRcM4CUxGpXaLf6XHWvuXRzGR3Nyv+kPnk6PfQrcih4HT92CA9yzmYgt8AvqyRV+qAH3PO8aODujfYSrVtK65BUccvjmCIBkkVg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gwmCA8Q9O7G1J/I8ZQMK0FpJAXxpRT2z/dIkKHMIEdY=; b=QPNUg2qIdNp0TrIQxSR8fqMuo+qmvdVhPAhKQLNmp90Sdq50oV/VAqguEWKrauZN3fk+q8xUn0+0Day7zRGLIJHzdHIW8D8SDqvDG7VCtCKqwfHtg+SWO9qXQqPJlj6yoAJFEfaA+bUqcbOeC4QumCQEVCaNdYRv5P8JiJjF3BdFOyrSHMjllYlLUExzox9yItZyqz1SDcMG1xWr2Q2TZNdfOk++WMzRSkfOapExHLG3P0yGXAKqYRoRJSxRj4rhXrQWycuI17jkc0UGShMuiEnrU6VTKDDOgsTnWRS4AYfkpHX5o1mm0ZbCXRO86FtrVbEVHbAsrBlDnX01tDm9EA== From: Sergiy Kibrik To: "xen-devel@lists.xenproject.org" CC: Sergiy Kibrik , "Daniel P. Smith" Subject: [PATCH v1 1/2] flask: add const qualifier to security_context_to_sid() Thread-Topic: [PATCH v1 1/2] flask: add const qualifier to security_context_to_sid() Thread-Index: AQHdNgfAVxs877kedUqP8J7OTWLOvA== Date: Thu, 27 Aug 2026 09:38:01 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: AS8PR03MB9192:EE_|AS2PR03MB9562:EE_ x-ms-office365-filtering-correlation-id: 89c5b2b4-b60f-493a-e12a-08df041ee2e8 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|38070700021|11063799006|10067099003|56012099006|22082099003|18002099003; x-microsoft-antispam-message-info: kF/7e+e53lgACPHSAqZLCSHvDG60PMc1n7SPk/DRysCE4OHJ527bAAafhlsur/hIXUnRn87EMjn7ihZhRHryOwTeOHkT4cSctVR3+7X4zWUDKs27Uvquk1dFBwSDYnCV51ZH8NSY4hP7pkhIvHNE9cWHWmBFWuqMnEHJPrNdFuMcNHpFfUTxMMmwGCxhZCXmo41/Ez7VEAufqgZgtBTAJ0kEFjzj/HaMoF1YqmWKRONr63vNQczD3BDe01E0WV610q6jkmyHkcouItERTlVoizYZaz+b2Ay5PH1LR8TzxB6UZ9wXKubpI9kDeseHbEgRMbrUnKYQvhgk/pzDcV9qG43+CD4k4m0LRm+CwQiMpW4dtotpqZ7I9iE46nQA7+LNYztaJbzSLPXjdvtnf9H0R291vGbNeiH8737YGAuvasq9V5e8T9O+n2nwhKLvjDrG41RyJPHe0pSuT4KcZkiRm6QX5SllmEX0cqmmK6UsEQnEBr08JhKOepgTzWM2/eLUD+E713fTthWWQtUsMPndHUZwhvXb9SGkwegpN9SBBCZsaMjiAxrZf9iDWdKjN+/332xPo6eFMI05Gu9/oGe2Im78XeZQ3TQB4V1LQji6x8K1g/36sZDwv5NmRD0MY8bXJKnFmaURmnkkltHrea69rpEQYEo2J4XqqO+LYngLWO5AHIZeeKRmy0MkJdxHwnvHs/qYkoIKJTF67L+fspB2l1liACus4pXgkaJbIEnpbu4= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8PR03MB9192.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(38070700021)(11063799006)(10067099003)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?OXVrYXNqb1Ric3lBQjBzNU1kalFTM2JqTWJuc3FsS29rVTJ5eHF2UUFWcVYx?= =?utf-8?B?TlFPdnZFMmJEK2doT2IwRXg2Z1BaRENBblBOc3pQMmNpdWM3MEFmVTh5Wkk2?= =?utf-8?B?R0t3dDd0ZGdXVmdQckdxZ0YzbFZhMUJtSU9WNlQxYWdmeWRETXhid2RZZ3Mx?= =?utf-8?B?bkpLRFVUWjJsUG9MU1MvRDB1OWdlSkdoTEZzNS9zemVvd2QwM1F1SGpHVGZh?= =?utf-8?B?Zm1LRjFxREZxYmFnVHBHbXYvSFNGdUdHa0ZZUUF4VHdwQi9CV1Fwdyt1SXE3?= =?utf-8?B?YjdIRitpNUtFeDhwcFZDSHFQTmh2TnFncGtRdGlOanV2SktyV0dQdVRxQ1FD?= =?utf-8?B?UWtwUThOTUtjNWRBbDRsRWpTS2NmWTZMTkRLNnEvbEFObkw2eWxycjVjcDJ2?= =?utf-8?B?cHJuV3RGMFFFa2plaG5YZnphdWw5WXl1K1VpbXQyTkNLcFVFeDJJbEVpRlNu?= =?utf-8?B?bkwxNUpHNUFDRGMvczNlZW5YRXVFdmROY08va05XR00rbUdWeEFpYVFlUzV3?= =?utf-8?B?RjNHcXVmS3dPY1dOVFFnb1hXbHNqajVhZDlvak92Yy9GZHhXeUZaSlEvUlVE?= =?utf-8?B?eE40b291VFJSRlpaaFBoWGV4ZmR0RmJ1R08xOUtJWnQreklMam9UZkViNnlC?= =?utf-8?B?dys5REVIa1IxcndVTUgrMXFzOWVsWXU3TkZLZnh4MlExNGs4ZzRmck1MVmVk?= =?utf-8?B?ekxHdkNUVzlvMjNsVW9ORDlsbm96ZE5uV0tLcWxPUWN2UEkwaWtxVVZNYS8r?= =?utf-8?B?RHNhSjZBaXA3MlY0UjhEekhnbjFXdUlyTnY2VklrZ29JdVFiMkUyaGxlSUE2?= =?utf-8?B?ZTVvak0xN2dEc29aR21WMDNvaWsyQWNIVU44dEFyMStUeHA2TytReGhvUyt6?= =?utf-8?B?V2s5TFZxZmZTYUY2REhZMmdlVFRwTlNvdDVWSDJlUThWb2FmQ1lxVTlOMmIw?= =?utf-8?B?eHVzMjc4dXVXZzdhYVlkak5XT0x6VkdlOGRRRGJJd2N1SzlISDV1OHlFc3lz?= =?utf-8?B?SEUzZWtReUhLUUovRW5UNW9LNmtSTzdsbFVyeXNuam5reFdxenlvczVOdWRD?= =?utf-8?B?Q2FlMStVRWRKa1JrVEtndUZpcUE5eTRPeHRBY3k5WDFWQkJhWGRhRFovMnUx?= =?utf-8?B?QXcyU0ttTndXVit5dVFUaGNNaWMrVVdqNEhBdUFiczcrWWlZWGJSRXZ4ajQx?= =?utf-8?B?NEgxQUZ3czQ1WklFVzJKNWs0N2liVnFQNTdaMUVEcW0zYkliSUlDVjZKM3R4?= =?utf-8?B?Y1ZFV0lSKzRYS0p6ajFiQWRzUnFybHNjWnFKZG8yVklKOWVNdktWeFhzbnA2?= =?utf-8?B?MnRaejNWY243UDZJdHhGckpJeEo2UWhIaEkrcWZEcFNiMG5zUnFOTElNVlor?= =?utf-8?B?bG5kQXUxdm9iUHNKVUxpSmlkM2dGd0MydEtuMVZnY2xhQjRzUlY4THhRVkVy?= =?utf-8?B?UWVocGE2cGpkZTRpYXpZclNnek9IR05aR0xLYU5RSER3R2R5VTZTTDNIbysv?= =?utf-8?B?ajJCNGVlVmlBWDBkc09ibUFTRUlSMDdPaWpwc3I0eHJKSVpEak5WMHN1aC9t?= =?utf-8?B?UVhMT3VHRGVURHFzaHQzQ3lKVWszM0UvQ3o5bURZUUw5WUNmNmJIR2dOdm5P?= =?utf-8?B?ajBsWk81Yitjb1d5MUpZNXZRNGZ3K2VJanRySVpGSXAyUTVjbTcrSU5LS0xm?= =?utf-8?B?aDViQ21RaTlVUlVpMFVlMU55YWdnYWZRSjlHQ0ZYV3pQTXY1SS9sSlJSSnU5?= =?utf-8?B?bVA0dHY2MXRhTmRLMjZuWk95cXZuZm8rcDV4ZTdqSllXMjJaaXQrZGFpSFJh?= =?utf-8?B?b2tob0MzSUhOSEhwQUdKK1dkZ3ZqNG5wMVpjeDFSWTN5eDZob2tDSjZ4QUVE?= =?utf-8?B?Z0JQMms1MDZ3a0EycHBLV3BaLzdiZjhqc1hVMnhYakZDRWxpTTl3dmJKemgv?= =?utf-8?B?dlIyaExKT3JKUjRVYUpFQzVaQTdKM21OdnZHN01LUnJpT2l4Y1pZM2dDejJz?= =?utf-8?B?aXoyUjBGc09aQVcwN1BvM1BPWDdGZkdKQUpIWUlHQ2VVdnZMRlNESXlQb3Fm?= =?utf-8?B?czhnY1k0eGxkQmp6MmN4WHY2UUxnaWJ2V0tMN2srUFpPOHhzUURNUjg2OExL?= =?utf-8?B?ckJqU2VLc1dadUNPU0o2NytzdWczMXVuZ0c4alNMUWJaQjljODMxNW5FOUt4?= =?utf-8?B?bUlSTDJQcUZvZUZLNEVqdS9QMnR5amU5VlY2QzdGQWp5OThzQTVVbzY3cmV1?= =?utf-8?B?SisrOGE0WU5pSm5NWjgwanFOd28zbk1STEFvUEc5dWhoL255SmYrN1pKYmUv?= =?utf-8?B?c2ovMWZ3UzdwLzlUdG84Rm85RWZaZnFHckpRYnUveUY1YXhQOW1TQT09?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AS8PR03MB9192.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 89c5b2b4-b60f-493a-e12a-08df041ee2e8 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Aug 2026 09:38:01.1679 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: bZBK9Ka6hD4VPvsoRUC7btbmwLsU1f8OlBOG4LKDXSZyNrIxEbSfqkSy2LSLoV1x4t0yaaRgcJsJF327TljKyg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR03MB9562 X-purgate-ID: tlsNG-d25034/1787823487-006CEA5B-C45B0A7B/0/0 X-purgate-type: clean X-purgate-size: 2042 X-ZohoMail-DKIM: pass (identity @epam.com) X-ZM-MESSAGEID: 1787823512908158500 The function does not modify context argument. Also it gives more flexibility to this API usage, because some context stri= ngs in Xen are also const char*. Signed-off-by: Sergiy Kibrik Acked-by: Daniel P. Smith --- xen/xsm/flask/include/security.h | 2 +- xen/xsm/flask/ss/services.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/xsm/flask/include/security.h b/xen/xsm/flask/include/secur= ity.h index ec8b442a8f..a2c5f423f8 100644 --- a/xen/xsm/flask/include/security.h +++ b/xen/xsm/flask/include/security.h @@ -76,7 +76,7 @@ int security_change_sid(u32 ssid, u32 tsid, u16 tclass, u= 32 *out_sid); =20 int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len); =20 -int security_context_to_sid(char *scontext, u32 scontext_len, u32 *out_sid= ); +int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *o= ut_sid); =20 int security_get_allow_unknown(void); =20 diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c index 35ad1034ca..764ac7d1d8 100644 --- a/xen/xsm/flask/ss/services.c +++ b/xen/xsm/flask/ss/services.c @@ -813,7 +813,7 @@ out: * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient * memory is available, or 0 on success. */ -int security_context_to_sid(char *scontext, u32 scontext_len, u32 *sid) +int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *s= id) { char *scontext2; struct context context; --=20 2.43.0 From nobody Thu Sep 3 07:03:34 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass(p=quarantine dis=none) header.from=epam.com ARC-Seal: i=2; a=rsa-sha256; t=1787823507; cv=pass; d=zohomail.com; s=zohoarc; b=P9SOLQunKvjehzAC/pA1LTlFiPBKIlzTYBhHNhumLsHPh6Gr/VKi/WDD3YKyE64OIwhFbK97dDMaeGmdzGx0beOwcAqMiyw9KyFdvI7hsW1OcwbZKDimvbtuhREhgxQzAFIkyGKyPpCMU5cMtqmOVzo1iZY7g9INjRYy81zF4U8= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1787823507; h=Content-ID:Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6hUzwFJQA/zIrKfA9M7At2QegoMA77ggOg6gny1kC54=; b=M+/zpPS6neZTiM62OIwTV5P1NA2okswjgrDSlf//qPi5RVCf0yZGGprpjiJfLKZLaTYIduWMDtEm0CwhEVYsquusR0CsWU+67HDJhxBOB/ym82z8Pvo3KVNh99s9nrWKtPUk0aY3GCz+x8f9PuH/sU7CNh4uayQZpHcGCqDYyJc= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=epam.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1787823507579405.4275884555759; Thu, 27 Aug 2026 02:38:27 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1400449.1636114 (Exim 4.92) (envelope-from ) id 1wzWYk-0002mk-39; Thu, 27 Aug 2026 09:38:10 +0000 Received: by outflank-mailman (output) from mailman id 1400449.1636114; Thu, 27 Aug 2026 09:38:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wzWYj-0002lZ-S0; Thu, 27 Aug 2026 09:38:09 +0000 Received: by outflank-mailman (input) for mailman id 1400449; Thu, 27 Aug 2026 09:38:09 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wzWYj-0002di-0V for xen-devel@lists.xenproject.org; Thu, 27 Aug 2026 09:38:09 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wzWYi-002LkA-DH for xen-devel@lists.xenproject.org; Thu, 27 Aug 2026 11:38:08 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a90057f-bab6-0a2a0a5309dd-0a2a450ca456-10 for ; Thu, 27 Aug 2026 11:38:08 +0200 Received: from [40.107.130.73] (helo=MRWPR03CU001.outbound.protection.outlook.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a90057c-f479-0a2a450c0019-286b82493340-5 for ; Thu, 27 Aug 2026 11:38:07 +0200 Received: from AS8PR03MB9192.eurprd03.prod.outlook.com (2603:10a6:20b:5c0::11) by AS2PR03MB9562.eurprd03.prod.outlook.com (2603:10a6:20b:599::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.8; Thu, 27 Aug 2026 09:38:01 +0000 Received: from AS8PR03MB9192.eurprd03.prod.outlook.com ([fe80::61a0:97f5:ac5f:e292]) by AS8PR03MB9192.eurprd03.prod.outlook.com ([fe80::61a0:97f5:ac5f:e292%7]) with mapi id 15.21.0360.006; Thu, 27 Aug 2026 09:38:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=epam.com header.i="@epam.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Y5B62HZCXOcSnbOIpvrch9/Mrar3dohzhh2j8iAC4Qei5E3QK+tKALpf1KhP8oa7VDbBAL+F+hCGQF7wxLlMkeqeW7N1vwsNUQLI9vXWHJLPjabVc9JKHXufQBizZXmXbZAhf0QC4cimLvjp3kElB+ChVrysEYDCm2HKpDtksAS/BMMjz74Y0GCcJINC2I5POe/puHOv22LNZlnl0Cq9YUR1X2bDCpe25aAssJX+I2oQ8UacmeBpfTvWaiHVcJLlXug0nXndiqa1e6zbdGUxz8YGJHK2Bg4PdPRTJikRJmMN3OZQ61Bg4FiJL+/AT2lVR14BgOtc+AI1DeOVlA6G9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6hUzwFJQA/zIrKfA9M7At2QegoMA77ggOg6gny1kC54=; b=cGYt4HighruKOFXFBpoQe3M7y4X8M/TVhL+cbXFhpEoADP0e/y92qVZdoN68oGUrey05J6T+YikwiNGsLiHcCrb310z94z/doFIFfFA7zzol1bgwgfeI7mUbN/aKUAhYJF1xXZeeFUuhdFg/XC2ZWs38aCfZW+4htqeuBoIgnOKtp1LP1bQIOZGAJOilJfgGLhLlR2N4seNpbsufBEePDgJXEc/vt8Yu6qAwMtm77wyoFrqoPcPV01QxVjoT4hSZ5a0wj4BGO2C56i9VfaTq9BRF2+P/VLSUBqRYTlnrLpSH6bDAOSemCTZDuJSe6S1RQfuXPcadlKEM6BR3qSwu+g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6hUzwFJQA/zIrKfA9M7At2QegoMA77ggOg6gny1kC54=; b=B7oCOVwhvhcIHvxcslTeC7EJXzenuapiq+tcsWGzw3QrSqKBz5S6hD6vo2DsWCk+IghE2ExobBc2OJ4J5eKtyfx/V7nV1iIRW0aX+rq4NQCIv6Kv4Jz0diZphVu8zOjBa9s/wdDuuGME0u2/80pU/fCnIJlpJENVU+z0KMRpWGsph92rTkapta/RsXdtkgbB87Rc3itv4ObiJ78gmULKstKq12mSqPF9lO5dBxPxwnT8drViwPLC7y7MZZX2CnrWOhmftKVx4IqqhRSXj5zeG/9ZAvH+RA5EoSukjOIUwnfrA8zy5myrLEmqJIE27OVQuFWDpYnvE0MfZkr4d5czOQ== From: Sergiy Kibrik To: "xen-devel@lists.xenproject.org" CC: Sergiy Kibrik , Stefano Stabellini , Julien Grall , Bertrand Marquis , Michal Orzel , Volodymyr Babchuk , "Daniel P. Smith" Subject: [PATCH v1 2/2] common: dom0less-bindings: introduce XSM labels Thread-Topic: [PATCH v1 2/2] common: dom0less-bindings: introduce XSM labels Thread-Index: AQHdNgfAHPmcI5IBhUGZU0o2oDVW1A== Date: Thu, 27 Aug 2026 09:38:01 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: AS8PR03MB9192:EE_|AS2PR03MB9562:EE_ x-ms-office365-filtering-correlation-id: bae71e0c-836a-4483-57bf-08df041ee33b x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|38070700021|11063799006|6133799003|10067099003|56012099006|22082099003|18002099003; x-microsoft-antispam-message-info: rV3KnQpwSkGWtrQjLmjioGsc3+UoqreuFxbG/Zw5vPAoBYtJSbVwAoP3saiHNVop9mLC3UiepEpSyuBiWqbl03VqguvB/ExPd+E++fhTF+L/VqhQvOyUSBQPWOPMyeWsqoFT85o6pEp6ui4GgWfPC2rwguqyEzqJG+IHjdKp18MkBzsHRljNI8xtIeI14hlues2/uthRZ6u/qMmEvtWkLUsCa1CxqfakQoqofU9WY156hfpBkZ8t4VDzw4okhRXhY4qgdnUcs+gMJOhMYhL1DnwKfk3pOjW4mATUlUl28iYSZpkeZZtQdR/VC+mZ5TDsyKNTW1smPoEOp3ZOvwhzDdnWlR5XaH1rHMS2zs09t8F8iSTO12tVGKU4j8nMguewfVZHwA1ULAOx7rshe3SsWV8qRYL8ZW4f0F9rpApyUIbeCJz4MM+CvneCwcXn3Q0Yg1lVe2VUpeyku7niMB9c8W5HsfhbSGPLe42lmvhV3BayLo1G1c0Q0xzretvYI8G7ywbaV51Qcz11glFJWEHdSwH5qe7/WHAXrqo9w0gb33PKZjxCKmok+LZncyvoySXDy1iwxuqa0C1YZGuKOq9iLMep+8lbNDDXoi3HJ92CjXg4JmJRV9P9cVCdtg1/avEVy4uarNrS6nO9Kob5f9XoYoN0PFvgUmRRg91a42+96w9ubbOjzvz0amB/0ggXiKvtW+YYc4bv2TW9Y3nsX4P9wxs4MIm4sh1Z04Ew2d1/unY= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8PR03MB9192.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(38070700021)(11063799006)(6133799003)(10067099003)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?OHJ4ZENsZ2ZrMXJldXBPV3NETkc1cUdydGI2TDkxY0Z3VHJyNk12Y1lLOHhM?= =?utf-8?B?Z1dydWxuMWkxZm9LMXVxY1VTblVPM1Ryd3NybzNScnNHcFNEOEFaRlpDN2tQ?= =?utf-8?B?ZHZTb2tZZkVPSkw2cEFTb1AvOUdkZnArNWxCNzkrQjFRVVNaM3Z0ZEVlNThB?= =?utf-8?B?Y1NZUjdVa2JNdVVkVndZYmozbHdNejBuVTNhdjQybS9ZL0hGb2NWN0QvcGZl?= =?utf-8?B?aSt2Um84ZUVQNE91SWJjcTgyeE5TSGFGZzNRcWMrSDRtR094dmpIczNDTVpw?= =?utf-8?B?MCtJN0Z6d0NYdmMxSEh5cEpBZUY3bnpKMXhoRE96TlZkaWxiTlY3d2tOV2tw?= =?utf-8?B?RHZjY3Zid0RXTysxbSsrYmdSWWxVWFZIOTVyL2ZTdTNLU1IzTFZ6eE9OOU1m?= =?utf-8?B?LzNzY1pYaFhQS1ZSZjlrR0RHQ3IvL01UbFpweWtMVmQ2YmJRMlRDb1J5M3hZ?= =?utf-8?B?T1dISzVReTJRQVhCdmNWRjF3OWx4L0J4MXJBMkFwSmlqQ005eXpwQlpObkV1?= =?utf-8?B?N2FtckZNQmRtbE5EcE96VE56RXY4Z2ZreTNRYkV4L3RtWWdyektqUFpxRmNx?= =?utf-8?B?clUzblFCb1VCSUI1VEJhd2ZKRngwa2djWWFuU0dmTGVoVkNiTkN0MkpPTkJy?= =?utf-8?B?QkN6U0Z0QVl1QlVQTWNVM29JbEd0NkRFUWp1QmMzczdaYWhPTlpFRHdtQzZT?= =?utf-8?B?NWlJZWoyNzhaaWViTW0rQlArWGVnVnV5N0dMWnZxWkZQYWxmZXhaTGtHWFhr?= =?utf-8?B?c01yTzBqMDRHRFNpRHdST2FqQ1RQNzBudUVmbkJ1N0dTcytXU2lYS1IrVmo0?= =?utf-8?B?QkF0WDFHTms3T2pZZHliY2JTcWE3S0hhUStlMkNJU1Y0eHkwdkxST3lPZGpH?= =?utf-8?B?R09aczNkWHROdkF1bE1HYjlhQTg3bUpJV2ovMWpGTmsrcmZCSHNzSU5ybnBy?= =?utf-8?B?WXJkS2FJWUxPNTVXOVBsR2l5ZTZvNzQ1dUJvaWorMkF3Kzh3M1RQVFFwVWkx?= =?utf-8?B?cTZhTjlPRVA5VWVDMzF6a1RVZ3FpRXZBYVVMY3laZUVhaWt6RkQ1c3dtMisw?= =?utf-8?B?S0YyNkovTWpEY2tHcmdPeEZ0VEZwUXRFU1pmV2wwN0IxOXZWK1JubWZpQ0Mv?= =?utf-8?B?bkRXVGpkWStXM00yblkwd2VoY0p1Tk9Nc1RKQTgrTDkxS1JpQjY3NzJuUmNW?= =?utf-8?B?VHM3UDJnQWg5TE4wWE1BMzRzWHRYQmhWS2hZanhRcVAxMlEyTERXTXBla3JT?= =?utf-8?B?eXNaWitvNDN0bUFodHJ5aXVyNEs0ZkowZm8vd3JEeWE1dGRSL1QrYnFKeXpZ?= =?utf-8?B?RXFIakJpdlA0UHpXWVhwTTdvanBuanVPd3VaVGNuSjdKQ0NoeUNrWjF4TTRH?= =?utf-8?B?UWhMbjF1VDYydnFGSHRTaURkdG1EK2UzNlpxT1FtaWwyeEU4T1lpVEtocmRU?= =?utf-8?B?a3JNa0J0a3dKR1dQZVhjN0M0ZjRwcUpIazhncmxYd1B3TEwvK00wWCtETFU3?= =?utf-8?B?aFhtMzZWR0NTTDU2OVN4S0xOSVNnekIwL3RteER2a3paWkljSEttSFF0QnpX?= =?utf-8?B?djlEbUJaZW55TzdHa3pPcDJaa0ZPdGE4eUNUSkVtOWM5Y2tITmNYQ21aVGJz?= =?utf-8?B?WkgzSHBvci9XTnhhYnFMdGFFaDJHSXBpK3o5dlpOcUkxUlMwNDN1a0M1UWc4?= =?utf-8?B?eENTUmNhQmlTSmZlcmxjRjVNTmY1SDErSHZqc1d3Y3htRmR2YzZvajdWVmhX?= =?utf-8?B?NHYyQzFlRDh5c2FoYjcvRXkxY21EYWplM1NvL1pIVEZzbEVPVE9Oa2FQbkRu?= =?utf-8?B?eXYwejhqc2ZCVGY0SXRlMFMzRXNWSGhxY0FFUjQydC9oMGVpL2lST2VRWGZJ?= =?utf-8?B?MUNPdFVNQXJJaVFpMjdrZkJ3RGJqUnAvbmhHY3RKMVkyeWI2ZTFLaTNXbkVO?= =?utf-8?B?YS8xMXJ0eUsxRkFEVGRqbW1LR1kvRFJtQ2NvQ3FTNTBwYmdUQWlnbVRUbHc3?= =?utf-8?B?MmlpVWszM2RCKzFsTldIRkdsTFhHN3gwRndGajlsaGx2UUNNL0ZickNrbkl1?= =?utf-8?B?M2xpdHZ4aE9VQU9GN3dkcVJTRzVCTFI4aC9wMmpFT0tmbFdUdFVsRWp5eGJZ?= =?utf-8?B?MmZudVFMbWNocGRyVXFxQ1dHeGdYNUl2WWNUVmVQdWozWVhTdGQ3Yy8yRy9x?= =?utf-8?B?ZU9YZXlHUVVGU2ZjM2JaOWFuWUFvN2h3ZEE3RmpCUSttQ29FZjBCeGtQUkJ0?= =?utf-8?B?cnVEdWlYNjRVclNMOGRPeC81WkhJOEVXN1VBUXg0OWJpeHMyZzd5SDEzUzVQ?= =?utf-8?B?ZUQ1V2Z6R3IzbjlvdWd0b1hVdEQvdytPay9PWEtnRTdNRmpIaTJZUT09?= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AS8PR03MB9192.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: bae71e0c-836a-4483-57bf-08df041ee33b X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Aug 2026 09:38:01.6047 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tGmSB3PGwY4KGn0Cl4v69oVXC+5n47Q9nd3V2vgW3bK0hs/syCLtJVTKJOmapzt/RNDajitMqwN/+31dPJJV4w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR03MB9562 X-purgate-ID: tlsNG-d25034/1787823487-024DFA5B-16147642/0/0 X-purgate-type: clean X-purgate-size: 5006 X-ZohoMail-DKIM: pass (identity @epam.com) X-ZM-MESSAGEID: 1787823508839158500 Add "seclabel" property to be able to specify security label for a domain when XSM Flask is enabled, similar to xl configuration files. Currently guest domain can't be created by Xen in dom0less configuration wh= en Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" lab= el by default, which Flask denies to create according to current policy. Signed-off-by: Sergiy Kibrik Acked-by: Daniel P. Smith --- docs/misc/arm/device-tree/booting.txt | 8 ++++++++ xen/common/device-tree/Makefile | 2 ++ xen/common/device-tree/dom0less-bindings.c | 11 +++++++++++ 3 files changed, 21 insertions(+) diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-t= ree/booting.txt index bcb06bc796..fcc7be0ffb 100644 --- a/docs/misc/arm/device-tree/booting.txt +++ b/docs/misc/arm/device-tree/booting.txt @@ -345,6 +345,12 @@ with the following properties: not passed. This configuration requires static allocation (xen,static-= mem) and direct mapping (direct-map). =20 +- seclabel + + A string property specifying an XSM security label to this domain. Eff= ective + only when FLASK is enabled. Domains will be classified =E2=80=9Cunlabe= led=E2=80=9D if + this property not specified. + Under the "xen,domain" compatible node, one or more sub-nodes are present for the DomU kernel and ramdisk. =20 @@ -422,6 +428,7 @@ chosen { memory =3D <0 131072>; cpus =3D <2>; vpl011; + seclabel =3D "system_u:system_r:domU_t"; =20 vcpu0 { compatible =3D "xen,vcpu"; @@ -453,6 +460,7 @@ chosen { #size-cells =3D <0x1>; memory =3D <0 65536>; cpus =3D <1>; + seclabel =3D "system_u:system_r:domU_t"; =20 module@0x4c000000 { compatible =3D "multiboot,kernel", "multiboot,module"; diff --git a/xen/common/device-tree/Makefile b/xen/common/device-tree/Makef= ile index 9036e455d6..e4de292533 100644 --- a/xen/common/device-tree/Makefile +++ b/xen/common/device-tree/Makefile @@ -11,3 +11,5 @@ obj-$(CONFIG_DOMAIN_BUILD_HELPERS) +=3D kernel.o obj-$(CONFIG_STATIC_EVTCHN) +=3D static-evtchn.init.o obj-$(CONFIG_STATIC_MEMORY) +=3D static-memory.init.o obj-$(CONFIG_STATIC_SHM) +=3D static-shmem.init.o + +CFLAGS-y +=3D -I$(srctree)/xsm/flask/include diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device= -tree/dom0less-bindings.c index 41d72d0d58..bffd2ec65d 100644 --- a/xen/common/device-tree/dom0less-bindings.c +++ b/xen/common/device-tree/dom0less-bindings.c @@ -11,6 +11,8 @@ #include #include =20 +#include + int __init parse_dom0less_node(struct dt_device_node *node, struct boot_domain *bd) { @@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *nod= e, bool has_dtb =3D false; bool iommu =3D false; const char *dom0less_iommu =3D NULL; + const char *xsm_seclabel =3D NULL; =20 if ( !dt_device_is_compatible(node, "xen,domain") ) return -ENOENT; @@ -141,5 +144,13 @@ int __init parse_dom0less_node(struct dt_device_node *= node, panic("'llc-colors' found, but LLC coloring is disabled\n"); #endif =20 + if ( IS_ENABLED(CONFIG_XSM_FLASK) && + !dt_property_read_string(node, "seclabel", &xsm_seclabel) ) + { + if ( security_context_to_sid(xsm_seclabel, strlen(xsm_seclabel), + &d_cfg->ssidref) ) + panic("Invalid security context for domain: %s\n", xsm_seclabe= l); + } + return arch_parse_dom0less_node(node, bd); } --=20 2.43.0