From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70F8CC4338F for ; Tue, 27 Jul 2021 12:19:42 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 31F1561A3C for ; Tue, 27 Jul 2021 12:19:42 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 31F1561A3C Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=invisiblethingslab.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.xenproject.org Received: from list by lists.xenproject.org with outflank-mailman.161142.295875 (Exim 4.92) (envelope-from ) id 1m8M3P-0005IO-Dh; Tue, 27 Jul 2021 12:19:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 161142.295875; Tue, 27 Jul 2021 12:19:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1m8M3P-0005IH-AV; Tue, 27 Jul 2021 12:19:23 +0000 Received: by outflank-mailman (input) for mailman id 161142; Tue, 27 Jul 2021 12:19:22 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1m8M3O-0005IB-LM for xen-devel@lists.xenproject.org; Tue, 27 Jul 2021 12:19:22 +0000 Received: from new3-smtp.messagingengine.com (unknown [66.111.4.229]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 313ea7cb-7f44-489d-9105-92225c954cd9; Tue, 27 Jul 2021 12:19:19 +0000 (UTC) Received: from compute2.internal (compute2.nyi.internal [10.202.2.42]) by mailnew.nyi.internal (Postfix) with ESMTP id 831C95809B9; Tue, 27 Jul 2021 08:19:19 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute2.internal (MEProxy); Tue, 27 Jul 2021 08:19:19 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 27 Jul 2021 08:19:16 -0400 (EDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 313ea7cb-7f44-489d-9105-92225c954cd9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=HFQS1c g750Dc7AJsr+GwXrprkSp+hJpy1jfr8zXR32I=; b=qwAEjRSWURXEugHBg++/t8 +ShsWu6P/hLgSMVIObKy1E31CDKwh7E+tAD2mmMsL3M6EAyJqS4Uzrc/mZpF8/x9 bp0J6Nvca505UdEdsDh6SIjqq6ztECRMUmLs97YG85WXFdBy5TSXDOv2tpCdhKBk wtMEIPyinJdbOWHWo9gA/Xwhvk8Q54XJJrPt4vBZaK+E4ad8/xwQ/1NbxUKsusbp sdriAzq5eeR+ssztsQqzprRzg8YRX5/XXy2aXUdCiyHdP00crCWJFFHVNHSE7aDG gtK4JGmo239HYW0X+NLvgGdV9CBoB5GnHCapDmyh96uCVqwFi8lC4TvCvaN7XyKA == X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvtddrgeejgdeggecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpeffhffvuffkfhggtggujgesghdtreertddtjeenucfhrhhomhepofgrrhgvkhcu ofgrrhgtiiihkhhofihskhhiqdfikphrvggtkhhiuceomhgrrhhmrghrvghksehinhhvih hsihgslhgvthhhihhnghhslhgrsgdrtghomheqnecuggftrfgrthhtvghrnhepteevffei gffhkefhgfegfeffhfegveeikeettdfhheevieehieeitddugeefteffnecuvehluhhsth gvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepmhgrrhhmrghrvghksehi nhhvihhsihgslhgvthhhihhnghhslhgrsgdrtghomh X-ME-Proxy: Date: Tue, 27 Jul 2021 14:19:11 +0200 From: Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= To: Jason Andryuk Cc: Scott Davis , xen-devel , Scott Davis , Ian Jackson , Wei Liu , George Dunlap , Nick Rosbrook , Anthony PERARD , Juergen Gross , Daniel De Graaf , "Daniel P . Smith" Subject: Re: [XEN PATCH] tools/xl: Add device_model_stubdomain_init_seclabel option to xl.cfg Message-ID: References: <8ee22fab0731347dd7f998c5f336eac804785c28.1627014699.git.scott.davis@starlab.io> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="6nTE+UInqay0ySTB" Content-Disposition: inline In-Reply-To: --6nTE+UInqay0ySTB Content-Type: text/plain; protected-headers=v1; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Date: Tue, 27 Jul 2021 14:19:11 +0200 From: Marek =?utf-8?Q?Marczykowski-G=C3=B3recki?= To: Jason Andryuk Cc: Scott Davis , xen-devel , Scott Davis , Ian Jackson , Wei Liu , George Dunlap , Nick Rosbrook , Anthony PERARD , Juergen Gross , Daniel De Graaf , "Daniel P . Smith" Subject: Re: [XEN PATCH] tools/xl: Add device_model_stubdomain_init_seclabel option to xl.cfg On Mon, Jul 26, 2021 at 09:07:03AM -0400, Jason Andryuk wrote: > Sort of relatedly, is stubdom unpaused before the guest gets > relabeled? Quickly looking, I think stubdom is unpaused. I would > think you want them both relabeled before either is unpaused. If the > stubdom starts with the exec_label, but it sees the guest with the > init_label, it may get an unexpected denial? On the other hand, > delayed unpausing of stubdom would slow down booting. Some parts of the stubdomain setup are done after it's unpaused (but before the guest is unpaused). Especially, PCI devices are hot-plugged only when QEMU is already running (not sure why). > With the stubdom getting unpaused before relabel, do you have to give > the stubdom some extra flask policy permissions to handle that case? --=20 Best Regards, Marek Marczykowski-G=C3=B3recki Invisible Things Lab --6nTE+UInqay0ySTB Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmD/+cAACgkQ24/THMrX 1yz93gf7BFztLtdJnY9lVdHluWOjOq7Aa82KGdBoAy7+WpNGmlsdwxANpoyw5NEt p5pFCXkio5RboFNxozlbqwnHpjlBc+t7VrO7P2eyFParhb3W16aKotbXusVRduct 461NFIYnBsnCdxn2ElAifda/Tgn4ty8b1WwLSftkAlUQrvwuf0qfKuaCEdbbr4q3 H1MAtXEqB1MZKNb2ft1QnQUH8hqZGvW6EbSC3F8ouh6wWxJe8Vm1UtDLepvbJenk X9WGx/bz16p69zjKPRk6iLFAgjE2UDjFhnzYSuSgkxQkaSX7CoDuNiI8NHrC758b 2JARSqtYe7MBsqohDkjVnplydFTWcA== =f6GZ -----END PGP SIGNATURE----- --6nTE+UInqay0ySTB--