Re: [PATCH v3 2/2] flask: implement xsm_set_system_active

["Daniel P. Smith" <dpsmith@apertussolutions.com>]

On 4/22/22 12:58, Jason Andryuk wrote:
> On Fri, Apr 22, 2022 at 12:35 PM Daniel P. Smith
> <dpsmith@apertussolutions.com> wrote:
>>
>> This commit implements full support for starting the idle domain privileged by
>> introducing a new flask label xenboot_t which the idle domain is labeled with
>> at creation.  It then provides the implementation for the XSM hook
>> xsm_set_system_active to relabel the idle domain to the existing xen_t flask
>> label.
>>
>> In the reference flask policy a new macro, xen_build_domain(target), is
>> introduced for creating policies for dom0less/hyperlaunch allowing the
>> hypervisor to create and assign the necessary resources for domain
>> construction.
>>
>> Signed-off-by: Daniel P. Smith <dpsmith@apertussolutions.com>
>> ---
> 
>> @@ -188,8 +188,12 @@ static int cf_check flask_domain_alloc_security(struct domain *d)
>>
>>  static int cf_check flask_set_system_active(void)
>>  {
>> +    struct domain_security_struct *dsec;
>>      struct domain *d = current->domain;
>>
>> +    dsec = d->ssid;
>> +    ASSERT( dsec->sid == SECINITSID_XENBOOT);
> 
> Extra space before dsec.

Ack.

> With that fixed,
> Reviewed-by: Jason Andryuk <jandryuk@gmail.com>