Re: [PATCH 17/24] XSM: make Argo hooks well-formed ones

On 06.08.2026 01:02, Daniel P. Smith wrote:
> On 7/28/26 9:22 AM, Jan Beulich wrote:
>> @@ -2307,7 +2308,7 @@ argo_init(struct domain *d)
>>   {
>>       struct argo_domain *argo;
>>   
>> -    if ( !opt_argo || xsm_argo_enable(d) )
>> +    if ( !opt_argo || xsm_argo_enable(XSM_HOOK, d) )
> 
> This question came up on another thread, so thought I might point it out 
> that when FLASK is in use this can return a nubmer of error codes beyond 
> an access deny. While I know it's the existing behavior, but if the 
> error code is anything other than -EPERM, then it's not that the policy 
> denied the access but something cause a fault in the security server. In 
> that case the domain is still being allowed to construct with the 
> assumption that it was a policy deny. At a minimum should the error code 
> at least get reported, and perhaps it should be passed up to domain 
> construction to allowing it to make an informed decision on construction?

Sounds plausible, but definitely wants doing in a separate patch.

Jan