[PATCH v2] common: dom0less-bindings: introduce XSM labels

[PATCH v2] common: dom0less-bindings: introduce XSM labels

[Sergiy Kibrik]

Add "seclabel" property to be able to specify security label for a domain
when XSM Flask is enabled, similar to xl configuration files.

Currently guest domain can't be created by Xen in dom0less configuration when
Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
by default, which Flask denies to create according to current policy.

Because code from outside of flask can't directly execute its internal API
a new routine flask_context_to_sid() introduced as part of XSM API exposed
to rest of Xen, which is a direct wrapper for security_context_to_sid().

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
CC: Daniel P. Smith <dpsmith@apertussolutions.com>
CC: Andrew Cooper <andrew.cooper3@citrix.com>
---
changes in v2:
 - add & use flask_context_to_sid() wrapper
---
 docs/misc/arm/device-tree/booting.txt      |  8 ++++++++
 xen/common/device-tree/dom0less-bindings.c | 11 +++++++++++
 xen/include/xsm/xsm.h                      |  3 +++
 xen/xsm/flask/hooks.c                      |  5 +++++
 4 files changed, 27 insertions(+)

diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
index bcb06bc796..fcc7be0ffb 100644
--- a/docs/misc/arm/device-tree/booting.txt
+++ b/docs/misc/arm/device-tree/booting.txt
@@ -345,6 +345,12 @@ with the following properties:
     not passed. This configuration requires static allocation (xen,static-mem)
     and direct mapping (direct-map).
 
+- seclabel
+
+    A string property specifying an XSM security label to this domain. Effective
+    only when FLASK is enabled. Domains will be classified “unlabeled” if
+    this property not specified.
+
 Under the "xen,domain" compatible node, one or more sub-nodes are present
 for the DomU kernel and ramdisk.
 
@@ -422,6 +428,7 @@ chosen {
         memory = <0 131072>;
         cpus = <2>;
         vpl011;
+        seclabel = "system_u:system_r:domU_t";
 
         vcpu0 {
             compatible = "xen,vcpu";
@@ -453,6 +460,7 @@ chosen {
         #size-cells = <0x1>;
         memory = <0 65536>;
         cpus = <1>;
+        seclabel = "system_u:system_r:domU_t";
 
         module@0x4c000000 {
             compatible = "multiboot,kernel", "multiboot,module";
diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
index 41d72d0d58..0b0ed6e25d 100644
--- a/xen/common/device-tree/dom0less-bindings.c
+++ b/xen/common/device-tree/dom0less-bindings.c
@@ -11,6 +11,8 @@
 #include <public/bootfdt.h>
 #include <public/domctl.h>
 
+#include <xsm/xsm.h>
+
 int __init parse_dom0less_node(struct dt_device_node *node,
                                struct boot_domain *bd)
 {
@@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
     bool has_dtb = false;
     bool iommu = false;
     const char *dom0less_iommu = NULL;
+    const char *xsm_seclabel = NULL;
 
     if ( !dt_device_is_compatible(node, "xen,domain") )
         return -ENOENT;
@@ -141,5 +144,13 @@ int __init parse_dom0less_node(struct dt_device_node *node,
         panic("'llc-colors' found, but LLC coloring is disabled\n");
 #endif
 
+    if ( IS_ENABLED(CONFIG_XSM_FLASK) &&
+         !dt_property_read_string(node, "seclabel", &xsm_seclabel) )
+    {
+        if ( flask_context_to_sid(xsm_seclabel, strlen(xsm_seclabel),
+                                     &d_cfg->ssidref) )
+            panic("Invalid security context for domain: %s\n", xsm_seclabel);
+    }
+
     return arch_parse_dom0less_node(node, bd);
 }
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 9809e005e0..73d058a8b2 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -261,4 +261,7 @@ static inline bool has_xsm_magic(paddr_t start)
 
 #endif /* CONFIG_XSM */
 
+int flask_context_to_sid(const char *scontext,
+                         uint32_t scontext_len, uint32_t *sid);
+
 #endif /* __XSM_H */
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 902857415b..9b10784acb 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -2014,6 +2014,11 @@ const struct xsm_ops *__init flask_init(
     return &flask_ops;
 }
 
+int flask_context_to_sid(const char *scontext, uint32_t scontext_len, uint32_t *sid)
+{
+    return security_context_to_sid(scontext, scontext_len, sid);
+}
+
 /*
  * Local variables:
  * mode: C
-- 
2.43.0

Re: [PATCH v2] common: dom0less-bindings: introduce XSM labels

[Jan Beulich]

On 09.09.2026 10:57, Sergiy Kibrik wrote:
> @@ -141,5 +144,13 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>          panic("'llc-colors' found, but LLC coloring is disabled\n");
>  #endif
>  
> +    if ( IS_ENABLED(CONFIG_XSM_FLASK) &&
> +         !dt_property_read_string(node, "seclabel", &xsm_seclabel) )
> +    {
> +        if ( flask_context_to_sid(xsm_seclabel, strlen(xsm_seclabel),
> +                                     &d_cfg->ssidref) )
> +            panic("Invalid security context for domain: %s\n", xsm_seclabel);
> +    }

Is there a reason this isn't a single if()? Also (nit) the one wrapped line
is mis-indented.

Jan

Re: [PATCH v2] common: dom0less-bindings: introduce XSM labels

[Sergiy Kibrik]

On 9/9/26 12:07, Jan Beulich wrote:
> On 09.09.2026 10:57, Sergiy Kibrik wrote:
>> @@ -141,5 +144,13 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>>           panic("'llc-colors' found, but LLC coloring is disabled\n");
>>   #endif
>>   
>> +    if ( IS_ENABLED(CONFIG_XSM_FLASK) &&
>> +         !dt_property_read_string(node, "seclabel", &xsm_seclabel) )
>> +    {
>> +        if ( flask_context_to_sid(xsm_seclabel, strlen(xsm_seclabel),
>> +                                     &d_cfg->ssidref) )
>> +            panic("Invalid security context for domain: %s\n", xsm_seclabel);
>> +    }
> 
> Is there a reason this isn't a single if()? Also (nit) the one wrapped line
> is mis-indented.

no specific reason, can very well be three long expressions combined 
into single if() condition.

   -Sergiy

Re: [PATCH v2] common: dom0less-bindings: introduce XSM labels

[Orzel, Michal]

On 09-Sep-26 10:57, Sergiy Kibrik wrote:
> Add "seclabel" property to be able to specify security label for a domain
> when XSM Flask is enabled, similar to xl configuration files.
> 
> Currently guest domain can't be created by Xen in dom0less configuration when
> Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
> by default, which Flask denies to create according to current policy.
> 
> Because code from outside of flask can't directly execute its internal API
> a new routine flask_context_to_sid() introduced as part of XSM API exposed
> to rest of Xen, which is a direct wrapper for security_context_to_sid().
> 
> Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
> CC: Daniel P. Smith <dpsmith@apertussolutions.com>
> CC: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> changes in v2:
>  - add & use flask_context_to_sid() wrapper
> ---
>  docs/misc/arm/device-tree/booting.txt      |  8 ++++++++
>  xen/common/device-tree/dom0less-bindings.c | 11 +++++++++++
>  xen/include/xsm/xsm.h                      |  3 +++
>  xen/xsm/flask/hooks.c                      |  5 +++++
>  4 files changed, 27 insertions(+)
> 
> diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
> index bcb06bc796..fcc7be0ffb 100644
> --- a/docs/misc/arm/device-tree/booting.txt
> +++ b/docs/misc/arm/device-tree/booting.txt
> @@ -345,6 +345,12 @@ with the following properties:
>      not passed. This configuration requires static allocation (xen,static-mem)
>      and direct mapping (direct-map).
>  
> +- seclabel
> +
> +    A string property specifying an XSM security label to this domain. Effective
> +    only when FLASK is enabled. Domains will be classified “unlabeled” if
For "Effective only when FLASK is enabled" see below.

> +    this property not specified.
> +
>  Under the "xen,domain" compatible node, one or more sub-nodes are present
>  for the DomU kernel and ramdisk.
>  
> @@ -422,6 +428,7 @@ chosen {
>          memory = <0 131072>;
>          cpus = <2>;
>          vpl011;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          vcpu0 {
>              compatible = "xen,vcpu";
> @@ -453,6 +460,7 @@ chosen {
>          #size-cells = <0x1>;
>          memory = <0 65536>;
>          cpus = <1>;
> +        seclabel = "system_u:system_r:domU_t";
>  
>          module@0x4c000000 {
>              compatible = "multiboot,kernel", "multiboot,module";
> diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
> index 41d72d0d58..0b0ed6e25d 100644
> --- a/xen/common/device-tree/dom0less-bindings.c
> +++ b/xen/common/device-tree/dom0less-bindings.c
> @@ -11,6 +11,8 @@
>  #include <public/bootfdt.h>
>  #include <public/domctl.h>
>  
> +#include <xsm/xsm.h>
> +
>  int __init parse_dom0less_node(struct dt_device_node *node,
>                                 struct boot_domain *bd)
>  {
> @@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>      bool has_dtb = false;
>      bool iommu = false;
>      const char *dom0less_iommu = NULL;
> +    const char *xsm_seclabel = NULL;
>  
>      if ( !dt_device_is_compatible(node, "xen,domain") )
>          return -ENOENT;
> @@ -141,5 +144,13 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>          panic("'llc-colors' found, but LLC coloring is disabled\n");
>  #endif
>  
> +    if ( IS_ENABLED(CONFIG_XSM_FLASK) &&
> +         !dt_property_read_string(node, "seclabel", &xsm_seclabel) )
> +    {
> +        if ( flask_context_to_sid(xsm_seclabel, strlen(xsm_seclabel),
> +                                     &d_cfg->ssidref) )
> +            panic("Invalid security context for domain: %s\n", xsm_seclabel);
> +    }
The preferred way (you can look at e.g. SVE, SCI, LLC) is to stop Xen if a
property was found whose functionality cannot be satisfied.

~Michal