Re: [PATCH v1 2/2] common: dom0less-bindings: introduce XSM labels

On 8/27/26 5:38 AM, Sergiy Kibrik wrote:
> Add "seclabel" property to be able to specify security label for a domain
> when XSM Flask is enabled, similar to xl configuration files.
> 
> Currently guest domain can't be created by Xen in dom0less configuration when
> Flask is enabled, as domain is assigned "system_u:system_r:unlabeled_t" label
> by default, which Flask denies to create according to current policy.
> 
> Signed-off-by: Sergiy Kibrik <[email protected]>
> ---
>   docs/misc/arm/device-tree/booting.txt      |  8 ++++++++
>   xen/common/device-tree/Makefile            |  2 ++
>   xen/common/device-tree/dom0less-bindings.c | 11 +++++++++++
>   3 files changed, 21 insertions(+)
> 
> diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt
> index bcb06bc796..fcc7be0ffb 100644
> --- a/docs/misc/arm/device-tree/booting.txt
> +++ b/docs/misc/arm/device-tree/booting.txt
> @@ -345,6 +345,12 @@ with the following properties:
>       not passed. This configuration requires static allocation (xen,static-mem)
>       and direct mapping (direct-map).
>   
> +- seclabel
> +
> +    A string property specifying an XSM security label to this domain. Effective
> +    only when FLASK is enabled. Domains will be classified “unlabeled” if
> +    this property not specified.
> +
>   Under the "xen,domain" compatible node, one or more sub-nodes are present
>   for the DomU kernel and ramdisk.
>   
> @@ -422,6 +428,7 @@ chosen {
>           memory = <0 131072>;
>           cpus = <2>;
>           vpl011;
> +        seclabel = "system_u:system_r:domU_t";
>   
>           vcpu0 {
>               compatible = "xen,vcpu";
> @@ -453,6 +460,7 @@ chosen {
>           #size-cells = <0x1>;
>           memory = <0 65536>;
>           cpus = <1>;
> +        seclabel = "system_u:system_r:domU_t";
>   
>           module@0x4c000000 {
>               compatible = "multiboot,kernel", "multiboot,module";
> diff --git a/xen/common/device-tree/Makefile b/xen/common/device-tree/Makefile
> index 9036e455d6..e4de292533 100644
> --- a/xen/common/device-tree/Makefile
> +++ b/xen/common/device-tree/Makefile
> @@ -11,3 +11,5 @@ obj-$(CONFIG_DOMAIN_BUILD_HELPERS) += kernel.o
>   obj-$(CONFIG_STATIC_EVTCHN) += static-evtchn.init.o
>   obj-$(CONFIG_STATIC_MEMORY) += static-memory.init.o
>   obj-$(CONFIG_STATIC_SHM) += static-shmem.init.o
> +
> +CFLAGS-y += -I$(srctree)/xsm/flask/include
> diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c
> index 41d72d0d58..bffd2ec65d 100644
> --- a/xen/common/device-tree/dom0less-bindings.c
> +++ b/xen/common/device-tree/dom0less-bindings.c
> @@ -11,6 +11,8 @@
>   #include <public/bootfdt.h>
>   #include <public/domctl.h>
>   
> +#include <security.h>
> +
>   int __init parse_dom0less_node(struct dt_device_node *node,
>                                  struct boot_domain *bd)
>   {
> @@ -21,6 +23,7 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>       bool has_dtb = false;
>       bool iommu = false;
>       const char *dom0less_iommu = NULL;
> +    const char *xsm_seclabel = NULL;
>   
>       if ( !dt_device_is_compatible(node, "xen,domain") )
>           return -ENOENT;
> @@ -141,5 +144,13 @@ int __init parse_dom0less_node(struct dt_device_node *node,
>           panic("'llc-colors' found, but LLC coloring is disabled\n");
>   #endif
>   
> +    if ( IS_ENABLED(CONFIG_XSM_FLASK) &&
> +         !dt_property_read_string(node, "seclabel", &xsm_seclabel) )
> +    {
> +        if ( security_context_to_sid(xsm_seclabel, strlen(xsm_seclabel),
> +                                     &d_cfg->ssidref) )
> +            panic("Invalid security context for domain: %s\n", xsm_seclabel);
> +    }
> +
>       return arch_parse_dom0less_node(node, bd);
>   }

Acked-by: Daniel P. Smith <[email protected]>