Re: [PATCH v4] common: dom0less-bindings: introduce XSM labels

["Alejandro Vallejo" <alejandro.garciavallejo@amd.com>]

On Mon Oct 12, 2026 at 12:15 PM CEST, Sergiy Kibrik wrote:
> Add "seclabel" property to be able to specify security label for a domain
> when XSM Flask is enabled, similar to xl configuration files.
>
> Currently guest domain can't be created by Xen in dom0less configuration when
> Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
> by default, which Flask denies to create according to current policy.
>
> Because code from outside of flask can't directly execute its internal API
> a new XSM hook lookup_sid() introduced as part of XSM API exposed
> to rest of Xen.
>
> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>

  Reviewed-by: "Alejandro Vallejo" <alejandro.garciavallejo@amd.com>

A couple of inconsequential nits below, but otherwise LGTM:

> CC: Daniel P. Smith <dpsmith@apertussolutions.com>
> CC: Andrew Cooper <andrew.cooper3@citrix.com>
> CC: Michal Orzel <michal.orzel@amd.com>
> CC: Jan Beulich <jbeulich@suse.com>
> CC: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
> ---
> changes in v4:
>  - introduce XSM hook `lookup_sid`
>  - at SID lookup return error if security server not initialized
>  - document panic if DTS property is used and FLASK disabled
>  - per Michal's request panic if FLASK disabled is left unchanged
> changes in v3:
>  - panic if `seclabel` property found but FLASK is disabled
> changes in v2:
>  - add & use flask_context_to_sid() wrapper
> ---
>  docs/misc/arm/device-tree/booting.txt      | 8 ++++++++
>  xen/common/device-tree/dom0less-bindings.c | 7 +++++++
>  xen/include/xsm/dummy.h                    | 7 +++++++
>  xen/include/xsm/hooks.h                    | 2 ++
>  xen/xsm/flask/hooks.c                      | 7 +++++++
>  5 files changed, 31 insertions(+)
>
> diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
> index bcb06bc796..2a69d2537d 100644
> --- a/docs/misc/arm/device-tree/booting.txt
> +++ b/docs/misc/arm/device-tree/booting.txt
> @@ -345,6 +345,12 @@ with the following properties:
>      not passed. This configuration requires static allocation (xen,static-mem)
>      and direct mapping (direct-map).
>  
> +- seclabel
> +
> +    A string property specifying an XSM security label to this domain. Domains
> +    will be classified “unlabeled” if this property not specified.
> +    Note: boot will fail if this property is present but FLASK is disabled.
> +
>  Under the "xen,domain" compatible node, one or more sub-nodes are present
>  for the DomU kernel and ramdisk.
>  
> @@ -422,6 +428,7 @@ chosen {
>          memory = <0 131072>;
>          cpus = <2>;
>          vpl011;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          vcpu0 {
>              compatible = "xen,vcpu";
> @@ -453,6 +460,7 @@ chosen {
>          #size-cells = <0x1>;
>          memory = <0 65536>;
>          cpus = <1>;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          module@0x4c000000 {
>              compatible = "multiboot,kernel", "multiboot,module";
> diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
> index 41d72d0d58..b03cee0e8c 100644
> --- a/xen/common/device-tree/dom0less-bindings.c
> +++ b/xen/common/device-tree/dom0less-bindings.c
> @@ -11,6 +11,8 @@
>  #include <public/bootfdt.h>
>  #include <public/domctl.h>
>  
> +#include <xsm/xsm.h>
> +
>  int __init parse_dom0less_node(struct dt_device_node *node,
>                                 struct boot_domain *bd)
>  {
> @@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>      bool has_dtb = false;
>      bool iommu = false;
>      const char *dom0less_iommu = NULL;
> +    const char *xsmlabel = NULL;
>  
>      if ( !dt_device_is_compatible(node, "xen,domain") )
>          return -ENOENT;
> @@ -141,5 +144,9 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>          panic("'llc-colors' found, but LLC coloring is disabled\n");
>  #endif
>  
> +    if ( !dt_property_read_string(node, "seclabel", &xsmlabel) &&
> +         xsm_lookup_sid(XSM_HOOK, xsmlabel, strlen(xsmlabel), &d_cfg->ssidref) )
> +        panic("Invalid security context for domain: %s\n", xsmlabel);
> +
>      return arch_parse_dom0less_node(node, bd);
>  }
> diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
> index 6331859afa..029cddd5cd 100644
> --- a/xen/include/xsm/dummy.h
> +++ b/xen/include/xsm/dummy.h
> @@ -823,4 +823,11 @@ static XSM_INLINE int xsm_domain_resource_map(
>      return xsm_default_action(action, current->domain, d);
>  }
>  
> +static XSM_INLINE int xsm_lookup_sid(
> +    XSM_DEFAULT_ARG const char *ctx, uint32_t len, uint32_t *sid)
> +{
> +    /* dummy policy has no security contexts */
> +    return -EPERM;

nit: Perhaps -ENOSYS? or something like that. It's not that any
permission was violated, it's that the real version of this function is
absent.

> +}
> +
>  #endif /* __XEN_XSM_DUMMY_H__ */
> diff --git a/xen/include/xsm/hooks.h b/xen/include/xsm/hooks.h
> index a331f5f0e5..3c1bef3053 100644
> --- a/xen/include/xsm/hooks.h
> +++ b/xen/include/xsm/hooks.h
> @@ -169,6 +169,8 @@ XSM_HOOK(int, argo_register_any_source, const struct domain *)
>  XSM_HOOK(int, argo_send, const struct domain *, const struct domain *)
>  #endif
>  
> +XSM_HOOK(int, lookup_sid, const char *, uint32_t, uint32_t *)
> +
>  #undef XSM_HOOK0
>  #undef XSM_HOOK1
>  #undef XSM_HOOK2
> diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
> index d65ba0aeae..b130ff5e26 100644
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -1949,6 +1949,13 @@ static int cf_check flask_get_domain_state(struct domain *d)
>      return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__GET_DOMAIN_STATE);
>  }
>  
> +static int flask_lookup_sid(const char *ctx, uint32_t ctx_len, uint32_t *sid)
> +{
> +    if ( !ss_initialized )
> +        return -EAGAIN;

nit: missing newline

> +    return security_context_to_sid(ctx, ctx_len, sid);
> +}
> +
>  static const struct xsm_ops __initconst_cf_clobber flask_ops = {
>      .set_system_active = flask_set_system_active,
>      .security_domaininfo = flask_security_domaininfo,

Cheers,
Alejandro