Re: [PATCH] XSM-docs: Flask operates on domain types and not on individual domain. Updated the documentation to reflect this.

[anshul makkar <anshul.makkar@citrix.com>]

On 19/07/16 14:30, Doug Goldstein wrote:
> On 7/19/16 4:05 AM, Anshul Makkar wrote:
>> Signed-off-by: Anshul Makkar <anshul.makkar@citrix.com>
>> ---
>>   * Resending the patch due to incomplete subject in the previous patch.
>>
>>   docs/misc/xsm-flask.txt | 8 ++++----
>>   1 file changed, 4 insertions(+), 4 deletions(-)
>> ---
>> diff --git a/docs/misc/xsm-flask.txt b/docs/misc/xsm-flask.txt
>> index 62f15dd..bf8bb6e 100644
>>   Some examples of what FLASK can do:
>> - - Prevent two domains from communicating via event channels or grants
>> - - Control which domains can use device passthrough (and which devices)
>> + - Prevent two domains types from communicating via event channels or grants
>> + - Control which type of domains can use device passthrough (and which devices)
>
> I disagree with this snippet. This is an example of what you can do with
> FLASK. You can use flask to do those two actions. Adding the word
> "types" in there takes it from being a concrete example to being more
> ambiguous.
"Prevent domains belonging to different types to communicate via event 
channels or grants". Does this sounds better.

I think that its important to use the word "type" so that user doesn't 
get a wrong impression that the policy is per domain, while in actual 
its per type.
>
>>    - Restrict or audit operations performed by privileged domains
>>    - Prevent a privileged domain from arbitrarily mapping pages from other domains
>>
>> @@ -160,10 +160,10 @@ the policy can be reloaded using "xl loadpolicy".
>>   The example policy included with Xen demonstrates most of the features of FLASK
>>   that can be used without dom0 disaggregation. The main types for domUs are:
>>
>> - - domU_t is a domain that can communicate with any other domU_t
>> + - domU_t is a domain type that can communicate with any other domU_t types.
>
> "A domain labeled with domU_t can communicate with any other domain
> labeled with type domU_t."
Rephrasing is fine.
>
>>    - isolated_domU_t can only communicate with dom0
>>    - prot_domU_t is a domain type whose creation can be disabled with a boolean
>> - - nomigrate_t is a domain that must be created via the nomigrate_t_building
>> + - nomigrate_t is a domain type that must be created via the nomigrate_t_building
>>      type, and whose memory cannot be read by dom0 once created
>
> "A domain labeled with nomigeate_t is a domain that"
Rephrasing is fine.
>
>>
>>   HVM domains with stubdomain device models also need a type for the stub domain.
>>
>
>


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel