Re: [XEN PATCH] xen: allow XSM_FLASK_POLICY only if checkpolicy binary is available

[Anthony PERARD <anthony.perard@citrix.com>]

On Thu, Jul 15, 2021 at 08:25:31AM +0200, Jan Beulich wrote:
> On 14.07.2021 18:17, Anthony PERARD wrote:
> > --- a/xen/common/Kconfig
> > +++ b/xen/common/Kconfig
> > @@ -25,6 +25,9 @@ config GRANT_TABLE
> >  config HAS_ALTERNATIVE
> >  	bool
> >  
> > +config HAS_CHECKPOLICY
> > +	def_bool $(success,$(CHECKPOLICY) -h 2>&1 | grep -q xen)
> > +
> 
> This is no different from other aspects of "Kconfig vs tool chain
> capabilities" sent out last August to start a discussion about
> whether we really want such. Besides Jürgen no-one cared to reply
> iirc, which to me means no-one really cares one way or the other.
> Which I didn't think was the case ... So here we are again, with
> all the same questions still open.

It's true, I don't really care either way. But with maybe a slight
preference for testing the environment every time `make` is run. But
there weren't really a precedent for testing in Makefile and using the
result in Kconfig (or I don't think there is).

> I'm not going to nack the patch, because there's an immediate
> purpose / need, but I also can't avoid commenting (and I won't
> put my name on it in any positive way, i.e. also not as a
> committer; if anything then to record my reservations).

I've prepared an update which test in Makefile, which I hope you'll like
better.

Thanks,

-- 
Anthony PERARD