From: Daniel De Graaf <dgdegra@tycho.nsa.gov>
To: Doug Goldstein <cardoe@cardoe.com>, Jan Beulich <JBeulich@suse.com>
Cc: xen-devel@lists.xen.org
Subject: Re: [PATCH 15/15] xsm: add a default policy to .init.data
Date: Fri, 10 Jun 2016 10:50:54 -0400 [thread overview]
Message-ID: <d5314846-0071-574c-9321-c0869be67771@tycho.nsa.gov> (raw)
In-Reply-To: <ce8936a2-027e-b156-1522-63c78d0f1e86@cardoe.com>
On 06/09/2016 05:54 PM, Doug Goldstein wrote:
> On 6/9/16 11:53 AM, Daniel De Graaf wrote:
>> On 06/09/2016 12:15 PM, Jan Beulich wrote:
>>>>>> On 09.06.16 at 16:47, <dgdegra@tycho.nsa.gov> wrote:
>>>> --- a/xen/common/Kconfig
>>>> +++ b/xen/common/Kconfig
>>>> @@ -132,6 +132,23 @@ config FLASK
>>>>
>>>> If unsure, say Y.
>>>>
>>>> +config XSM_POLICY
>>>> + bool "Compile Xen with a built-in security policy"
>>>> + default y
>>>> + depends on XSM
>>>> + ---help---
>>>> + This includes a default XSM policy in the hypervisor so that the
>>>> + bootloader does not need to load a policy to get sane behavior
>>>> from an
>>>> + XSM-enabled hypervisor. If this is disabled, a policy must be
>>>> + provided by the bootloader or by Domain 0. Even if this is
>>>> enabled, a
>>>> + policy provided by the bootloader will override it.
>>>> +
>>>> + This requires that the SELinux policy compiler (checkpolicy) be
>>>> + available when compiling the hypervisor; if this tool is not
>>>> found, no
>>>> + policy will be added.
>>>> +
>>>> + If unsure, say Y.
>>>> +
>>>> config FLASK_AVC_STATS
>>>> def_bool y
>>>> depends on FLASK
>>>
>>> Placing this between FLASK and FLASK_AVC_STATS will break proper
>>> menuconfig representation of the latter afaict.
>>>
>>> Jan
>>
>> This option isn't visible in menuconfig. Should I make it visible?
>>
>
> I believe I actually had that as an outstanding question to you on the
> series that introduced that flag.
At the time I didn't see the need for it to be visible. Since it's come
up again, I think it should either be made visible (in a distinct patch),
but maybe limited to EXPERT=y. Otherwise, it seems like the option and
its #ifdefs should be removed: there's no point in having the option if
it's not possible to adjust it.
--
Daniel De Graaf
National Security Agency
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next prev parent reply other threads:[~2016-06-10 14:50 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-09 14:47 [PATCH 00/15] XSM/FLASK updates for 4.8 Daniel De Graaf
2016-06-09 14:47 ` [PATCH 01/15] flask/policy: split into modules Daniel De Graaf
2016-06-14 18:55 ` Konrad Rzeszutek Wilk
2016-06-20 5:15 ` Doug Goldstein
2016-06-09 14:47 ` [PATCH 02/15] flask/policy: split out rules for system_r Daniel De Graaf
2016-06-14 19:08 ` Konrad Rzeszutek Wilk
2016-06-20 5:21 ` Doug Goldstein
2016-06-09 14:47 ` [PATCH 03/15] flask/policy: move user definitions and constraints into modules Daniel De Graaf
2016-06-17 15:28 ` Konrad Rzeszutek Wilk
2016-06-17 16:49 ` Daniel De Graaf
2016-06-20 5:22 ` Doug Goldstein
2016-06-09 14:47 ` [PATCH 04/15] flask/policy: remove unused support for binary modules Daniel De Graaf
2016-06-20 5:22 ` Doug Goldstein
2016-06-09 14:47 ` [PATCH 05/15] flask/policy: xenstore stubdom policy Daniel De Graaf
2016-06-17 15:34 ` Konrad Rzeszutek Wilk
2016-06-20 5:22 ` Doug Goldstein
2016-06-09 14:47 ` [PATCH 06/15] flask/policy: remove unused example Daniel De Graaf
2016-06-17 15:34 ` Konrad Rzeszutek Wilk
2016-06-20 5:23 ` Doug Goldstein
2016-06-09 14:47 ` [PATCH 07/15] flask: unify {get, set}vcpucontext permissions Daniel De Graaf
2016-06-17 15:37 ` Konrad Rzeszutek Wilk
2016-06-09 14:47 ` [PATCH 08/15] flask: remove unused secondary context in ocontext Daniel De Graaf
2016-06-09 16:01 ` Jan Beulich
2016-06-09 16:38 ` Daniel De Graaf
2016-06-09 14:47 ` [PATCH 09/15] flask: remove unused AVC callback functions Daniel De Graaf
2016-06-09 14:47 ` [PATCH 10/15] flask: remove xen_flask_userlist operation Daniel De Graaf
2016-06-09 16:07 ` Jan Beulich
2016-06-09 16:43 ` Daniel De Graaf
2016-06-10 6:51 ` Jan Beulich
2016-06-10 13:08 ` Daniel De Graaf
2016-06-10 14:28 ` Jan Beulich
2016-06-09 14:47 ` [PATCH 11/15] flask: improve unknown permission handling Daniel De Graaf
2016-06-17 15:45 ` Konrad Rzeszutek Wilk
2016-06-17 17:02 ` Daniel De Graaf
2016-06-17 17:13 ` Konrad Rzeszutek Wilk
2016-06-17 17:20 ` Daniel De Graaf
2016-06-09 14:47 ` [PATCH 12/15] xen/xsm: remove .xsm_initcall.init section Daniel De Graaf
2016-06-09 15:14 ` Andrew Cooper
2016-06-09 16:11 ` Jan Beulich
2016-06-09 16:42 ` Daniel De Graaf
2016-06-17 15:50 ` Konrad Rzeszutek Wilk
2016-06-17 17:04 ` Daniel De Graaf
2016-06-17 17:14 ` Konrad Rzeszutek Wilk
2016-06-17 17:18 ` Daniel De Graaf
2016-06-17 17:21 ` Konrad Rzeszutek Wilk
2016-06-17 23:17 ` Daniel De Graaf
2016-06-09 14:47 ` [PATCH 13/15] xsm: annotate setup functions with __init Daniel De Graaf
2016-06-09 15:15 ` Andrew Cooper
2016-06-09 14:47 ` [PATCH 14/15] xsm: clean up unregistration Daniel De Graaf
2016-06-09 15:16 ` Andrew Cooper
2016-06-17 15:51 ` Konrad Rzeszutek Wilk
2016-06-09 14:47 ` [PATCH 15/15] xsm: add a default policy to .init.data Daniel De Graaf
2016-06-09 15:30 ` Andrew Cooper
2016-06-09 16:58 ` Daniel De Graaf
2016-06-10 7:15 ` Jan Beulich
2016-06-09 16:15 ` Jan Beulich
2016-06-09 16:53 ` Daniel De Graaf
2016-06-09 21:54 ` Doug Goldstein
2016-06-10 14:50 ` Daniel De Graaf [this message]
2016-06-10 6:53 ` Jan Beulich
2016-06-17 15:54 ` Konrad Rzeszutek Wilk
2016-06-17 16:00 ` [PATCH 00/15] XSM/FLASK updates for 4.8 Konrad Rzeszutek Wilk
2016-06-20 5:40 ` Doug Goldstein
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d5314846-0071-574c-9321-c0869be67771@tycho.nsa.gov \
--to=dgdegra@tycho.nsa.gov \
--cc=JBeulich@suse.com \
--cc=cardoe@cardoe.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).