[PATCH v4] common: dom0less-bindings: introduce XSM labels

[PATCH v4] common: dom0less-bindings: introduce XSM labels

[Sergiy Kibrik]

Add "seclabel" property to be able to specify security label for a domain
when XSM Flask is enabled, similar to xl configuration files.

Currently guest domain can't be created by Xen in dom0less configuration when
Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
by default, which Flask denies to create according to current policy.

Because code from outside of flask can't directly execute its internal API
a new XSM hook lookup_sid() introduced as part of XSM API exposed
to rest of Xen.

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
CC: Daniel P. Smith <dpsmith@apertussolutions.com>
CC: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Michal Orzel <michal.orzel@amd.com>
CC: Jan Beulich <jbeulich@suse.com>
CC: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
---
changes in v4:
 - introduce XSM hook `lookup_sid`
 - at SID lookup return error if security server not initialized
 - document panic if DTS property is used and FLASK disabled
 - per Michal's request panic if FLASK disabled is left unchanged
changes in v3:
 - panic if `seclabel` property found but FLASK is disabled
changes in v2:
 - add & use flask_context_to_sid() wrapper
---
 docs/misc/arm/device-tree/booting.txt      | 8 ++++++++
 xen/common/device-tree/dom0less-bindings.c | 7 +++++++
 xen/include/xsm/dummy.h                    | 7 +++++++
 xen/include/xsm/hooks.h                    | 2 ++
 xen/xsm/flask/hooks.c                      | 7 +++++++
 5 files changed, 31 insertions(+)

diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
index bcb06bc796..2a69d2537d 100644
--- a/docs/misc/arm/device-tree/booting.txt
+++ b/docs/misc/arm/device-tree/booting.txt
@@ -345,6 +345,12 @@ with the following properties:
     not passed. This configuration requires static allocation (xen,static-mem)
     and direct mapping (direct-map).
 
+- seclabel
+
+    A string property specifying an XSM security label to this domain. Domains
+    will be classified “unlabeled” if this property not specified.
+    Note: boot will fail if this property is present but FLASK is disabled.
+
 Under the "xen,domain" compatible node, one or more sub-nodes are present
 for the DomU kernel and ramdisk.
 
@@ -422,6 +428,7 @@ chosen {
         memory = <0 131072>;
         cpus = <2>;
         vpl011;
+        seclabel = "system_u:system_r:domU_t";
 
         vcpu0 {
             compatible = "xen,vcpu";
@@ -453,6 +460,7 @@ chosen {
         #size-cells = <0x1>;
         memory = <0 65536>;
         cpus = <1>;
+        seclabel = "system_u:system_r:domU_t";
 
         module@0x4c000000 {
             compatible = "multiboot,kernel", "multiboot,module";
diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
index 41d72d0d58..b03cee0e8c 100644
--- a/xen/common/device-tree/dom0less-bindings.c
+++ b/xen/common/device-tree/dom0less-bindings.c
@@ -11,6 +11,8 @@
 #include <public/bootfdt.h>
 #include <public/domctl.h>
 
+#include <xsm/xsm.h>
+
 int __init parse_dom0less_node(struct dt_device_node *node,
                                struct boot_domain *bd)
 {
@@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
     bool has_dtb = false;
     bool iommu = false;
     const char *dom0less_iommu = NULL;
+    const char *xsmlabel = NULL;
 
     if ( !dt_device_is_compatible(node, "xen,domain") )
         return -ENOENT;
@@ -141,5 +144,9 @@ int __init parse_dom0less_node(struct dt_device_node *node,
         panic("'llc-colors' found, but LLC coloring is disabled\n");
 #endif
 
+    if ( !dt_property_read_string(node, "seclabel", &xsmlabel) &&
+         xsm_lookup_sid(XSM_HOOK, xsmlabel, strlen(xsmlabel), &d_cfg->ssidref) )
+        panic("Invalid security context for domain: %s\n", xsmlabel);
+
     return arch_parse_dom0less_node(node, bd);
 }
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 6331859afa..029cddd5cd 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -823,4 +823,11 @@ static XSM_INLINE int xsm_domain_resource_map(
     return xsm_default_action(action, current->domain, d);
 }
 
+static XSM_INLINE int xsm_lookup_sid(
+    XSM_DEFAULT_ARG const char *ctx, uint32_t len, uint32_t *sid)
+{
+    /* dummy policy has no security contexts */
+    return -EPERM;
+}
+
 #endif /* __XEN_XSM_DUMMY_H__ */
diff --git a/xen/include/xsm/hooks.h b/xen/include/xsm/hooks.h
index a331f5f0e5..3c1bef3053 100644
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -169,6 +169,8 @@ XSM_HOOK(int, argo_register_any_source, const struct domain *)
 XSM_HOOK(int, argo_send, const struct domain *, const struct domain *)
 #endif
 
+XSM_HOOK(int, lookup_sid, const char *, uint32_t, uint32_t *)
+
 #undef XSM_HOOK0
 #undef XSM_HOOK1
 #undef XSM_HOOK2
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index d65ba0aeae..b130ff5e26 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1949,6 +1949,13 @@ static int cf_check flask_get_domain_state(struct domain *d)
     return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__GET_DOMAIN_STATE);
 }
 
+static int flask_lookup_sid(const char *ctx, uint32_t ctx_len, uint32_t *sid)
+{
+    if ( !ss_initialized )
+        return -EAGAIN;
+    return security_context_to_sid(ctx, ctx_len, sid);
+}
+
 static const struct xsm_ops __initconst_cf_clobber flask_ops = {
     .set_system_active = flask_set_system_active,
     .security_domaininfo = flask_security_domaininfo,
-- 
2.43.0

Re: [PATCH v4] common: dom0less-bindings: introduce XSM labels

[Alejandro Vallejo]

On Mon Oct 12, 2026 at 12:15 PM CEST, Sergiy Kibrik wrote:
> Add "seclabel" property to be able to specify security label for a domain
> when XSM Flask is enabled, similar to xl configuration files.
>
> Currently guest domain can't be created by Xen in dom0less configuration when
> Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
> by default, which Flask denies to create according to current policy.
>
> Because code from outside of flask can't directly execute its internal API
> a new XSM hook lookup_sid() introduced as part of XSM API exposed
> to rest of Xen.
>
> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>

  Reviewed-by: "Alejandro Vallejo" <alejandro.garciavallejo@amd.com>

A couple of inconsequential nits below, but otherwise LGTM:

> CC: Daniel P. Smith <dpsmith@apertussolutions.com>
> CC: Andrew Cooper <andrew.cooper3@citrix.com>
> CC: Michal Orzel <michal.orzel@amd.com>
> CC: Jan Beulich <jbeulich@suse.com>
> CC: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
> ---
> changes in v4:
>  - introduce XSM hook `lookup_sid`
>  - at SID lookup return error if security server not initialized
>  - document panic if DTS property is used and FLASK disabled
>  - per Michal's request panic if FLASK disabled is left unchanged
> changes in v3:
>  - panic if `seclabel` property found but FLASK is disabled
> changes in v2:
>  - add & use flask_context_to_sid() wrapper
> ---
>  docs/misc/arm/device-tree/booting.txt      | 8 ++++++++
>  xen/common/device-tree/dom0less-bindings.c | 7 +++++++
>  xen/include/xsm/dummy.h                    | 7 +++++++
>  xen/include/xsm/hooks.h                    | 2 ++
>  xen/xsm/flask/hooks.c                      | 7 +++++++
>  5 files changed, 31 insertions(+)
>
> diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
> index bcb06bc796..2a69d2537d 100644
> --- a/docs/misc/arm/device-tree/booting.txt
> +++ b/docs/misc/arm/device-tree/booting.txt
> @@ -345,6 +345,12 @@ with the following properties:
>      not passed. This configuration requires static allocation (xen,static-mem)
>      and direct mapping (direct-map).
>  
> +- seclabel
> +
> +    A string property specifying an XSM security label to this domain. Domains
> +    will be classified “unlabeled” if this property not specified.
> +    Note: boot will fail if this property is present but FLASK is disabled.
> +
>  Under the "xen,domain" compatible node, one or more sub-nodes are present
>  for the DomU kernel and ramdisk.
>  
> @@ -422,6 +428,7 @@ chosen {
>          memory = <0 131072>;
>          cpus = <2>;
>          vpl011;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          vcpu0 {
>              compatible = "xen,vcpu";
> @@ -453,6 +460,7 @@ chosen {
>          #size-cells = <0x1>;
>          memory = <0 65536>;
>          cpus = <1>;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          module@0x4c000000 {
>              compatible = "multiboot,kernel", "multiboot,module";
> diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
> index 41d72d0d58..b03cee0e8c 100644
> --- a/xen/common/device-tree/dom0less-bindings.c
> +++ b/xen/common/device-tree/dom0less-bindings.c
> @@ -11,6 +11,8 @@
>  #include <public/bootfdt.h>
>  #include <public/domctl.h>
>  
> +#include <xsm/xsm.h>
> +
>  int __init parse_dom0less_node(struct dt_device_node *node,
>                                 struct boot_domain *bd)
>  {
> @@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>      bool has_dtb = false;
>      bool iommu = false;
>      const char *dom0less_iommu = NULL;
> +    const char *xsmlabel = NULL;
>  
>      if ( !dt_device_is_compatible(node, "xen,domain") )
>          return -ENOENT;
> @@ -141,5 +144,9 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>          panic("'llc-colors' found, but LLC coloring is disabled\n");
>  #endif
>  
> +    if ( !dt_property_read_string(node, "seclabel", &xsmlabel) &&
> +         xsm_lookup_sid(XSM_HOOK, xsmlabel, strlen(xsmlabel), &d_cfg->ssidref) )
> +        panic("Invalid security context for domain: %s\n", xsmlabel);
> +
>      return arch_parse_dom0less_node(node, bd);
>  }
> diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
> index 6331859afa..029cddd5cd 100644
> --- a/xen/include/xsm/dummy.h
> +++ b/xen/include/xsm/dummy.h
> @@ -823,4 +823,11 @@ static XSM_INLINE int xsm_domain_resource_map(
>      return xsm_default_action(action, current->domain, d);
>  }
>  
> +static XSM_INLINE int xsm_lookup_sid(
> +    XSM_DEFAULT_ARG const char *ctx, uint32_t len, uint32_t *sid)
> +{
> +    /* dummy policy has no security contexts */
> +    return -EPERM;

nit: Perhaps -ENOSYS? or something like that. It's not that any
permission was violated, it's that the real version of this function is
absent.

> +}
> +
>  #endif /* __XEN_XSM_DUMMY_H__ */
> diff --git a/xen/include/xsm/hooks.h b/xen/include/xsm/hooks.h
> index a331f5f0e5..3c1bef3053 100644
> --- a/xen/include/xsm/hooks.h
> +++ b/xen/include/xsm/hooks.h
> @@ -169,6 +169,8 @@ XSM_HOOK(int, argo_register_any_source, const struct domain *)
>  XSM_HOOK(int, argo_send, const struct domain *, const struct domain *)
>  #endif
>  
> +XSM_HOOK(int, lookup_sid, const char *, uint32_t, uint32_t *)
> +
>  #undef XSM_HOOK0
>  #undef XSM_HOOK1
>  #undef XSM_HOOK2
> diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
> index d65ba0aeae..b130ff5e26 100644
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -1949,6 +1949,13 @@ static int cf_check flask_get_domain_state(struct domain *d)
>      return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__GET_DOMAIN_STATE);
>  }
>  
> +static int flask_lookup_sid(const char *ctx, uint32_t ctx_len, uint32_t *sid)
> +{
> +    if ( !ss_initialized )
> +        return -EAGAIN;

nit: missing newline

> +    return security_context_to_sid(ctx, ctx_len, sid);
> +}
> +
>  static const struct xsm_ops __initconst_cf_clobber flask_ops = {
>      .set_system_active = flask_set_system_active,
>      .security_domaininfo = flask_security_domaininfo,

Cheers,
Alejandro

Re: [PATCH v4] common: dom0less-bindings: introduce XSM labels

[Jan Beulich]

On 13.10.2026 11:09, Alejandro Vallejo wrote:
> On Mon Oct 12, 2026 at 12:15 PM CEST, Sergiy Kibrik wrote:
>> --- a/xen/include/xsm/dummy.h
>> +++ b/xen/include/xsm/dummy.h
>> @@ -823,4 +823,11 @@ static XSM_INLINE int xsm_domain_resource_map(
>>      return xsm_default_action(action, current->domain, d);
>>  }
>>  
>> +static XSM_INLINE int xsm_lookup_sid(
>> +    XSM_DEFAULT_ARG const char *ctx, uint32_t len, uint32_t *sid)
>> +{
>> +    /* dummy policy has no security contexts */
>> +    return -EPERM;
> 
> nit: Perhaps -ENOSYS? or something like that. It's not that any
> permission was violated, it's that the real version of this function is
> absent.

Yet then still e.g. -EOPNOTSUPP, but certainly not -ENOSYS.

Jan

Re: [PATCH v4] common: dom0less-bindings: introduce XSM labels

[Alejandro Vallejo]

On Tue Oct 13, 2026 at 11:17 AM CEST, Jan Beulich wrote:
> On 13.10.2026 11:09, Alejandro Vallejo wrote:
> > On Mon Oct 12, 2026 at 12:15 PM CEST, Sergiy Kibrik wrote:
> >> --- a/xen/include/xsm/dummy.h
> >> +++ b/xen/include/xsm/dummy.h
> >> @@ -823,4 +823,11 @@ static XSM_INLINE int xsm_domain_resource_map(
> >>      return xsm_default_action(action, current->domain, d);
> >>  }
> >>  
> >> +static XSM_INLINE int xsm_lookup_sid(
> >> +    XSM_DEFAULT_ARG const char *ctx, uint32_t len, uint32_t *sid)
> >> +{
> >> +    /* dummy policy has no security contexts */
> >> +    return -EPERM;
> > 
> > nit: Perhaps -ENOSYS? or something like that. It's not that any
> > permission was violated, it's that the real version of this function is
> > absent.
>
> Yet then still e.g. -EOPNOTSUPP, but certainly not -ENOSYS.

That'd also be ok.

It would be helpful if there was a guide under docs/ in which we state
what each of our errnos are meant to be in Xen terms. ENOSYS/EOPNOTSUPP
are great examples of such mixed usage that it's disheartening trying to
reverse engineer the policy from their use.

Cheers,
Alejandro

Re: [PATCH v4] common: dom0less-bindings: introduce XSM labels

[Orzel, Michal]

On 12-Oct-26 12:15, Sergiy Kibrik wrote:
> Add "seclabel" property to be able to specify security label for a domain
> when XSM Flask is enabled, similar to xl configuration files.
> 
> Currently guest domain can't be created by Xen in dom0less configuration when
> Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
> by default, which Flask denies to create according to current policy.
> 
> Because code from outside of flask can't directly execute its internal API
> a new XSM hook lookup_sid() introduced as part of XSM API exposed
> to rest of Xen.
> 
> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
> CC: Daniel P. Smith <dpsmith@apertussolutions.com>
> CC: Andrew Cooper <andrew.cooper3@citrix.com>
> CC: Michal Orzel <michal.orzel@amd.com>
> CC: Jan Beulich <jbeulich@suse.com>
> CC: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
Please move the CC: lines below the --- so that they don't end up in the
commit message.

> ---
> changes in v4:
>  - introduce XSM hook `lookup_sid`
>  - at SID lookup return error if security server not initialized
>  - document panic if DTS property is used and FLASK disabled
>  - per Michal's request panic if FLASK disabled is left unchanged
> changes in v3:
>  - panic if `seclabel` property found but FLASK is disabled
> changes in v2:
>  - add & use flask_context_to_sid() wrapper
> ---
>  docs/misc/arm/device-tree/booting.txt      | 8 ++++++++
>  xen/common/device-tree/dom0less-bindings.c | 7 +++++++
>  xen/include/xsm/dummy.h                    | 7 +++++++
>  xen/include/xsm/hooks.h                    | 2 ++
>  xen/xsm/flask/hooks.c                      | 7 +++++++
>  5 files changed, 31 insertions(+)
> 
> diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
> index bcb06bc796..2a69d2537d 100644
> --- a/docs/misc/arm/device-tree/booting.txt
> +++ b/docs/misc/arm/device-tree/booting.txt
> @@ -345,6 +345,12 @@ with the following properties:
>      not passed. This configuration requires static allocation (xen,static-mem)
>      and direct mapping (direct-map).
>  
> +- seclabel
> +
> +    A string property specifying an XSM security label to this domain. Domains
> +    will be classified “unlabeled” if this property not specified.
NIT: Use regular ASCII quotes.
Also, s/property not/property is not/

> +    Note: boot will fail if this property is present but FLASK is disabled.
> +
>  Under the "xen,domain" compatible node, one or more sub-nodes are present
>  for the DomU kernel and ramdisk.
>  
> @@ -422,6 +428,7 @@ chosen {
>          memory = <0 131072>;
>          cpus = <2>;
>          vpl011;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          vcpu0 {
>              compatible = "xen,vcpu";
> @@ -453,6 +460,7 @@ chosen {
>          #size-cells = <0x1>;
>          memory = <0 65536>;
>          cpus = <1>;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          module@0x4c000000 {
>              compatible = "multiboot,kernel", "multiboot,module";
> diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
> index 41d72d0d58..b03cee0e8c 100644
> --- a/xen/common/device-tree/dom0less-bindings.c
> +++ b/xen/common/device-tree/dom0less-bindings.c
> @@ -11,6 +11,8 @@
>  #include <public/bootfdt.h>
>  #include <public/domctl.h>
>  
> +#include <xsm/xsm.h>
> +
>  int __init parse_dom0less_node(struct dt_device_node *node,
>                                 struct boot_domain *bd)
>  {
> @@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>      bool has_dtb = false;
>      bool iommu = false;
>      const char *dom0less_iommu = NULL;
> +    const char *xsmlabel = NULL;
Please drop a dead assignment.

>  
>      if ( !dt_device_is_compatible(node, "xen,domain") )
>          return -ENOENT;
> @@ -141,5 +144,9 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>          panic("'llc-colors' found, but LLC coloring is disabled\n");
>  #endif
>  
> +    if ( !dt_property_read_string(node, "seclabel", &xsmlabel) &&
> +         xsm_lookup_sid(XSM_HOOK, xsmlabel, strlen(xsmlabel), &d_cfg->ssidref) )
xsm_lookup_sid returns an error code that we could print on panic message.
Please do so.

> +        panic("Invalid security context for domain: %s\n", xsmlabel);
> +
>      return arch_parse_dom0less_node(node, bd);
>  }
> diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
> index 6331859afa..029cddd5cd 100644
> --- a/xen/include/xsm/dummy.h
> +++ b/xen/include/xsm/dummy.h
> @@ -823,4 +823,11 @@ static XSM_INLINE int xsm_domain_resource_map(
>      return xsm_default_action(action, current->domain, d);
>  }
>  
> +static XSM_INLINE int xsm_lookup_sid(
> +    XSM_DEFAULT_ARG const char *ctx, uint32_t len, uint32_t *sid)
> +{
We need XSM_ASSERT_ACTION as the top level comment requires.

With the changes above:
Reviewed-by: Michal Orzel <michal.orzel@amd.com>

~Michal