From mboxrd@z Thu Jan 1 00:00:00 1970 From: Doug Goldstein Subject: Re: [PATCH] tools: make flask utils build unconditional Date: Tue, 5 Jan 2016 10:34:37 -0600 Message-ID: <568BF09D.8060007@cardoe.com> References: <1450759603-24249-1-git-send-email-cardoe@cardoe.com> <20160104122805.GG9423@citrix.com> <568A7E3F.9020108@cardoe.com> <20160104142638.GA12639@citrix.com> <1452004651.13361.289.camel@citrix.com> <1452008181.13361.328.camel@citrix.com> <20160105161328.GD27789@citrix.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6452973612974115739==" Return-path: In-Reply-To: <20160105161328.GD27789@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Wei Liu , Ian Campbell Cc: Daniel De Graaf , xen-devel@lists.xen.org, Ian Jackson , Stefano Stabellini List-Id: xen-devel@lists.xenproject.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============6452973612974115739== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Q1TCDqWgFbEvIwmh83oExgNqP9B5AO6hk" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Q1TCDqWgFbEvIwmh83oExgNqP9B5AO6hk Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 1/5/16 10:13 AM, Wei Liu wrote: > On Tue, Jan 05, 2016 at 03:36:21PM +0000, Ian Campbell wrote: >> On Tue, 2016-01-05 at 14:37 +0000, Ian Campbell wrote: >>> >>> which on the basis of this discussion I wasn't expecting. I didn't se= e this >>> new file on i686 or ARM*. >>> >>> My baseline is from the last time I committed, which would be last ye= ar, so >>> maybe something other than my current batch of patches has caused thi= s. >>> >>> I'm going to drop this one for now and (hopefully) get the rest of th= e >>> batch squared away. Afterwards I'll take another look (with a new bas= eline >>> filelist), but if someone can explain it in the meantime that would b= e >>> super. >> >> So with a fresh basline I still see: >> >> --- ../FILE_LIST.BASE.staging.x86_64 2016-01-05 14:50:32.000000000 = +0000 >> +++ ../FILE_LIST.staging.x86_64 2016-01-05 15:11:15.000000000 +0000 >> @@ -6,6 +6,7 @@ >> dist/install/boot/xen-4.7-unstable.gz >> dist/install/boot/xen-4.gz >> dist/install/boot/xen.gz >> +dist/install/boot/xenpolicy-4.7-unstable >> dist/install/etc >> dist/install/etc/bash_completion.d >> dist/install/etc/bash_completion.d/xl.sh >> @@ -386,6 +387,12 @@ >> dist/install/usr/local/lib/xen/libexec >> dist/install/usr/local/lib/xen/libexec/qemu-bridge-helper >> dist/install/usr/local/sbin >> +dist/install/usr/local/sbin/flask-get-bool >> +dist/install/usr/local/sbin/flask-getenforce >> +dist/install/usr/local/sbin/flask-label-pci >> +dist/install/usr/local/sbin/flask-loadpolicy >> +dist/install/usr/local/sbin/flask-set-bool >> +dist/install/usr/local/sbin/flask-setenforce >> dist/install/usr/local/sbin/gdbsx >> dist/install/usr/local/sbin/gtracestat >> dist/install/usr/local/sbin/gtraceview >> *** FILES DIFFER *** >> >> On i686 and ARM* I only see the (expected) second hunk. >> >> I think the i686 case is explainable by the lack of a hypervisor build= >> there, but I'm unsure why ARM* and x86_64 should differ in this regard= =2E >> >> config/Tools.mk is y only on x86_64, not on the others, which obviousl= y >> explains things, but the question is why only on x86_64 (I presume thi= s has >> always been the case and it was previously masked, but I've not checke= d). >> >> Ah, OK, I misread >> >> AX_ARG_DEFAULT_ENABLE([xsmpolicy], [Disable XSM policy compilation]) >> >> as being default disable, actually the default is "enabled iff checkpo= licy >> is installed" and it happens to be that it is only installed in my x86= _64 >> build env. >> >> So, in the end I think Wei was correct and this change will now, in so= me >> circumstances, end up installing a /boot/xenpolicy-*. >> >=20 > I don't think it is related to this patch. I see an xenpoilcy file > without this patch applied. As you said it only depends on availability= > of checkpolicy (part of generic SELinux utils, not the ones we build). >=20 > That said, let me try to answer the following question. >=20 >> So the question is do we mind that? >> >=20 > We might or might not. See below. >=20 > I once submitted a patch to grub that look into /boot and generate XSM > entries if there is policy file. The patch is not yet merged though. >=20 > Since there is no way at the moment to tell if xen.gz has flask enabled= , > my not yet upstreamed patch only matches the version number of xen.gz a= nd > xenpolicy. Installing xenpolicy when xen.gz is not flaks-capable will > make grub generate an XSM entry nonetheless, which makes no sense. >=20 > Of course all the above is based on the theory that my grub patch is > going to be upstreamed. >=20 > Things have changed since I first submitted that patch. Doug's Kconfig > work is good. With .config installed in suitable location we can make > grub grep for flask information in config, hence avoiding generating > wrong entries. I think this is better solution as we don't need to use= > version number to match xen.gz and xenpolicy. If we go down this route > we don't mind having random xenpolicy lying around in /boot. So I submitted a patch to put the .config in /boot to have the ability to do this. I figured it needed to be in /boot because that's how the existing 20_linux_xen but there's some disagreement on the location. If we can resolve that I'll happily update the 20_linux_xen patch as well. http://lists.xenproject.org/archives/html/xen-devel/2015-12/msg02369.html= >=20 > We just need to reach an agreement on how to proceed. I would vote for > the second solution. >=20 > Wei. >=20 >=20 >> Ian. --=20 Doug Goldstein --Q1TCDqWgFbEvIwmh83oExgNqP9B5AO6hk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0 iQJ8BAEBCgBmBQJWi/ChXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBNTM5MEQ2RTNFMTkyNzlCNzVDMzIwOTVB MkJDMDNEQzg3RUQxQkQ0AAoJEKK8A9yH7RvUnpcQAJXgBuqVzwtfBduhs1TXrGV6 yobzmrGuX7igyJjU0XBShgrc4sEwkHX5Ci5SwA+exjTaZzgF+YCxWThGmOm7cCx5 h3aKw7qcepv3EncrIsqo1qATjs361EB9F/THh1Zw+D9HiC+jE4coU9m92LrZMcSK ThvPLJmZXngEYoCga5CfHUFkXu181euSz7+DlApd/KK5pD4/so5OD6Ot5Pt2H//P OHCApkDlMFcI4sWddQYvuOZOsbcIbfx80/BjtDb9YeWGwK97S9PJUjE8zomo8SPR lsOv5sOgQlt8250uJckAswsLAXbWBuCSWv+vDvLXyPhyjWL2n1heGrAmpsLeQGmM 9k8/QV7fegjRGhBadyYvhhC8ht862qdWinNPqB4oA/Rfj2yfUieGi5ivSWP9OWCl G92eBBc/EfLw7CLd8phQYI9LuVymjcVDbKPtttZxNoqOVtvuGMRqizS5ZoP92G9p cilvLYB+1AqJuX6m5hM8Ukzq1IevUeYyZRyPuXg5IvMUrat8pmdXcPcV08gU1Ze4 vhuAqyAgz9tPAR5qCb4p5AuTSl2LS3EefZtab/5WzR9uPAexjaWH17gYir0nbN/t Ro6QZhJvQUm1nGf81VUVCEXWIJ/+fpCfipykArNK4KSTnbztmfd/Fk4qKX032v/2 Rcuh1sqg8G+TVVdp/iWl =XQAp -----END PGP SIGNATURE----- --Q1TCDqWgFbEvIwmh83oExgNqP9B5AO6hk-- --===============6452973612974115739== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============6452973612974115739==--