From mboxrd@z Thu Jan 1 00:00:00 1970 From: Doug Goldstein Subject: Re: [PATCH 10/17] flask: remove xen_flask_userlist operation Date: Mon, 20 Jun 2016 10:16:00 -0500 Message-ID: References: <1466431466-28055-1-git-send-email-dgdegra@tycho.nsa.gov> <1466431466-28055-11-git-send-email-dgdegra@tycho.nsa.gov> <345fecfb-d112-d8df-aed5-142f3ca4b14a@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3865870591978353733==" Return-path: In-Reply-To: <345fecfb-d112-d8df-aed5-142f3ca4b14a@tycho.nsa.gov> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: Daniel De Graaf , xen-devel@lists.xen.org List-Id: xen-devel@lists.xenproject.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============3865870591978353733== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="TfCVRqgm7TcMw6MQasLFjeIBaknWswlxR" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --TfCVRqgm7TcMw6MQasLFjeIBaknWswlxR Content-Type: multipart/mixed; boundary="2HOwEP47PukR9Kqn6O9M3393CNOs4bU8N" From: Doug Goldstein To: Daniel De Graaf , xen-devel@lists.xen.org Message-ID: Subject: Re: [Xen-devel] [PATCH 10/17] flask: remove xen_flask_userlist operation References: <1466431466-28055-1-git-send-email-dgdegra@tycho.nsa.gov> <1466431466-28055-11-git-send-email-dgdegra@tycho.nsa.gov> <345fecfb-d112-d8df-aed5-142f3ca4b14a@tycho.nsa.gov> In-Reply-To: <345fecfb-d112-d8df-aed5-142f3ca4b14a@tycho.nsa.gov> --2HOwEP47PukR9Kqn6O9M3393CNOs4bU8N Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 6/20/16 10:07 AM, Daniel De Graaf wrote: > On 06/20/2016 10:35 AM, Doug Goldstein wrote: >> On 6/20/16 9:04 AM, Daniel De Graaf wrote: >>> This operation has no known users, and is primarily useful when an ML= S >>> policy is in use (which has never been shipped with Xen). In additio= n, >>> the information it provides does not actually depend on hypervisor >>> state (only on the XSM policy), so an application that needs it could= >>> compute the results without needing to involve the hypervisor. >>> >> >> So if I read this language correctly. Removing this does not affect >> someone being able to build a MLS policy at a later date right? >=20 > Correct; that support is still there. This hypercall was used to > compute a list of reachable security contexts for a given user, which > is trivial in a non-MLS policy but more complex when one is being > used. This computation makes more sense on Linux (where creating > new contexts via "exec" is common) than on Xen (where normally a > domain cannot create another). >=20 Makes sense. Thanks for clarifying. Reviewed-by: Doug Goldstein --=20 Doug Goldstein --2HOwEP47PukR9Kqn6O9M3393CNOs4bU8N-- --TfCVRqgm7TcMw6MQasLFjeIBaknWswlxR Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0 iQJ8BAEBCgBmBQJXaAizXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBNTM5MEQ2RTNFMTkyNzlCNzVDMzIwOTVB MkJDMDNEQzg3RUQxQkQ0AAoJEKK8A9yH7RvUNLMP/1D+2olIBKCf1FmvLahZMpO/ e5MdVywdh/R9/HPOKKmTHOyRHaCRld4dpVn/fSFfGtgAKaEo4M7O4CIYI2EC4SbG yz7zjOY3jJjb7NGtILksG4NRsSnoKBCVzyMg/6Yl/TdzMMGBQQ8bgnl2xNPSHbOT OhUgmyJv1HtfsBce4luirQx43JoxYaOhbUATTGLuENRQnUUjiKD6XXjt78xWKArr nnwn+wFj2Nz25lY2kMKR7VXvXx82WyzXKdF70U0QuGiimaXm8S0XFo18JSMcDMY8 5klcaZt++zdF9HiAsCzGcGFMmxCOwDhdA3gXuHAaOuZltqrWjjpyYL3E4nRcVNxc V3Er6/5ABV1nfSAmQpzD70L6cVQtdwvb0WINYxXTCBQJzmCXE9+gcbzkmvkUPW7I AdrTrCGEMbRKBfZxr8NiFobMHbBAwJrr78vfDdnMPXbdTijZokjV6sKbaUJAlWGl kURo3JHuglGYOlVlcwhlE6fM/CfP16CaIM7xLgqhVTgmyrqt250KT1ESAYY0mnKV suZmzHqMftOIO63sRyWW0f6uHWbnos2z0uLUgSuwk6oFCo11coSw3DXvPUKND5qu 3NALPI6j6cRlsxFQaDLEu0yz5DraJIQ1vFjbUPRPEDuTwZRNacKldPJwve3LiH4U 8Uhqd0omkbLtCaycOFaK =WvHB -----END PGP SIGNATURE----- --TfCVRqgm7TcMw6MQasLFjeIBaknWswlxR-- --===============3865870591978353733== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KWGVuLWRldmVs IG1haWxpbmcgbGlzdApYZW4tZGV2ZWxAbGlzdHMueGVuLm9yZwpodHRwOi8vbGlzdHMueGVuLm9y Zy94ZW4tZGV2ZWwK --===============3865870591978353733==--