Re: [PATCH v1 2/2] common: dom0less-bindings: introduce XSM labels

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 27/08/2026 10:38 am, Sergiy Kibrik wrote:
> diff --git a/xen/common/device-tree/Makefile b/xen/common/device-tree/Makefile
> index 9036e455d6..e4de292533 100644
> --- a/xen/common/device-tree/Makefile
> +++ b/xen/common/device-tree/Makefile
> @@ -11,3 +11,5 @@ obj-$(CONFIG_DOMAIN_BUILD_HELPERS) += kernel.o
>  obj-$(CONFIG_STATIC_EVTCHN) += static-evtchn.init.o
>  obj-$(CONFIG_STATIC_MEMORY) += static-memory.init.o
>  obj-$(CONFIG_STATIC_SHM) += static-shmem.init.o
> +
> +CFLAGS-y += -I$(srctree)/xsm/flask/include
> diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
> index 41d72d0d58..bffd2ec65d 100644
> --- a/xen/common/device-tree/dom0less-bindings.c
> +++ b/xen/common/device-tree/dom0less-bindings.c
> @@ -11,6 +11,8 @@
>  #include <public/bootfdt.h>
>  #include <public/domctl.h>
>  
> +#include <security.h>
> +

security.h is a private header for internals of flask.  Requiring the
CFLAGS += -I should have been a hint.

If a suitable public function doesn't exist, then make one rather than
inserting a layering violation.

To this specifically, I'm not sure security_context_to_sid() handing out
SECINITSID_XEN if you happen to call it too early is the wisest
behaviour.  It's current call-chain has an earlier check which I think
excludes this from occurring.

~Andrew