From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julien Grall Subject: Re: [PATCH] libxl: assigned a default ssid_label (XSM label) to guests Date: Thu, 14 May 2015 15:18:26 +0100 Message-ID: <5554AEB2.3050806@citrix.com> References: <1431599625-9572-1-git-send-email-ian.campbell@citrix.com> <55548553.7060700@citrix.com> <1431604483.13579.60.camel@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1431604483.13579.60.camel@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Ian Campbell , Julien Grall Cc: ian.jackson@eu.citrix.com, Daniel De Graaf , wei.liu2@citrix.com, xen-devel@lists.xen.org List-Id: xen-devel@lists.xenproject.org On 14/05/15 12:54, Ian Campbell wrote: > On Thu, 2015-05-14 at 12:21 +0100, Julien Grall wrote: >> Hi Ian, >> >> On 14/05/15 11:33, Ian Campbell wrote: >>> system_u:system_r:domU_t is defined in the default policy and makes as >>> much sense as anything for a default. >> >> So you rule out the possibility to run an unlabelled domain? This is >> possible if the policy explicitly authorized it. That's a significant >> change in the libxl behavior. > > I didn't realise this was a possibility, wouldn't such a domain be > system_u:system_r:unlabeled_t> or something? I'm not sure how unlabeled works. I will let Daniel answer to this. > Note that this won't override a label which is just '' (i.e. an empty > string rather than NULL). I don't know if that results in the behaviour > you want. IIRC, NULL means unlabeled. '' would be translated as an invalid ssid and throw an error. Regards, -- Julien Grall