Re: [PATCH] libxl: assigned a default ssid_label (XSM label) to guests

[Ian Campbell <ian.campbell@citrix.com>]

On Mon, 2015-05-18 at 18:37 -0400, Daniel De Graaf wrote:
> On 05/18/2015 08:38 AM, Ian Campbell wrote:
> > On Fri, 2015-05-15 at 10:39 +0100, Ian Campbell wrote:
> >>> The header file defining these SIDs is buried in the hypervisor source
> >>> tree (xen/xsm/flask/include/flask.h) and is only generated during a build
> >>> with XSM enabled.  It may be simpler to define the value in a shared header
> >>> and add a BUILD_BUG_ON somewhere in the flask code to check for mismatches.
> >>
> >> I was about to ask about this. Short of a pretty serious change to the
> >> build a BUILD_BUG_ON seems like a reasonable approach.
> >
> > To what extent is a user's customized (e.g. potentially clean room
> > implemented) policy required to match what goes on here? I suspect the
> > answer is "fully" and that any custom policy must therefore use exactly
> > the policy/security_classes and policy/initial_sids as was used when Xen
> > was built.
> 
> When rewriting the security policy, xen/xsm/flask/policy/initial_sids is
> expected to remain unchanged, while tools/flask/policy/policy/initial_sids
> can be modified to suit the types defined in the rewritten policy.  This
> applies to all the files split between the two directories.

Makes sense.

>From the PoV of this series I think I just need to expose
xen/xsm/flask/policy/initial_sids (via mkflask.sh to generate a header)
to the tools.

I'll arrange for that to happen in v2.

Thanks,

Ian.