From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: Re: [PATCH] libxl: assigned a default ssid_label (XSM label) to guests Date: Tue, 19 May 2015 11:43:51 +0100 Message-ID: <1432032231.12989.68.camel@citrix.com> References: <1431599625-9572-1-git-send-email-ian.campbell@citrix.com> <55548553.7060700@citrix.com> <1431604483.13579.60.camel@citrix.com> <55552B0E.8050807@tycho.nsa.gov> <1431682741.8943.45.camel@citrix.com> <1431952728.4944.51.camel@citrix.com> <555A69AC.6080603@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <555A69AC.6080603@tycho.nsa.gov> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Daniel De Graaf Cc: Julien Grall , ian.jackson@eu.citrix.com, wei.liu2@citrix.com, xen-devel@lists.xen.org List-Id: xen-devel@lists.xenproject.org On Mon, 2015-05-18 at 18:37 -0400, Daniel De Graaf wrote: > On 05/18/2015 08:38 AM, Ian Campbell wrote: > > On Fri, 2015-05-15 at 10:39 +0100, Ian Campbell wrote: > >>> The header file defining these SIDs is buried in the hypervisor source > >>> tree (xen/xsm/flask/include/flask.h) and is only generated during a build > >>> with XSM enabled. It may be simpler to define the value in a shared header > >>> and add a BUILD_BUG_ON somewhere in the flask code to check for mismatches. > >> > >> I was about to ask about this. Short of a pretty serious change to the > >> build a BUILD_BUG_ON seems like a reasonable approach. > > > > To what extent is a user's customized (e.g. potentially clean room > > implemented) policy required to match what goes on here? I suspect the > > answer is "fully" and that any custom policy must therefore use exactly > > the policy/security_classes and policy/initial_sids as was used when Xen > > was built. > > When rewriting the security policy, xen/xsm/flask/policy/initial_sids is > expected to remain unchanged, while tools/flask/policy/policy/initial_sids > can be modified to suit the types defined in the rewritten policy. This > applies to all the files split between the two directories. Makes sense. >>From the PoV of this series I think I just need to expose xen/xsm/flask/policy/initial_sids (via mkflask.sh to generate a header) to the tools. I'll arrange for that to happen in v2. Thanks, Ian.