Re: [PATCH v1 2/2] common: dom0less-bindings: introduce XSM labels
Andrew Cooper <[email protected]>
| Newsgroups | gmane.comp.emulators.xen.devel |
|---|---|
| Message-ID | <[email protected]> |
On 27/08/2026 10:38 am, Sergiy Kibrik wrote: > diff --git a/xen/common/device-tree/Makefile b/xen/common/device-tree/Makefile > index 9036e455d6..e4de292533 100644 > --- a/xen/common/device-tree/Makefile > +++ b/xen/common/device-tree/Makefile > @@ -11,3 +11,5 @@ obj-$(CONFIG_DOMAIN_BUILD_HELPERS) += kernel.o > obj-$(CONFIG_STATIC_EVTCHN) += static-evtchn.init.o > obj-$(CONFIG_STATIC_MEMORY) += static-memory.init.o > obj-$(CONFIG_STATIC_SHM) += static-shmem.init.o > + > +CFLAGS-y += -I$(srctree)/xsm/flask/include > diff --git a/xen/common/device-tree/dom0less-bindings.c b/xen/common/device-tree/dom0less-bindings.c > index 41d72d0d58..bffd2ec65d 100644 > --- a/xen/common/device-tree/dom0less-bindings.c > +++ b/xen/common/device-tree/dom0less-bindings.c > @@ -11,6 +11,8 @@ > #include <public/bootfdt.h> > #include <public/domctl.h> > > +#include <security.h> > + security.h is a private header for internals of flask. Requiring the CFLAGS += -I should have been a hint. If a suitable public function doesn't exist, then make one rather than inserting a layering violation. To this specifically, I'm not sure security_context_to_sid() handing out SECINITSID_XEN if you happen to call it too early is the wisest behaviour. It's current call-chain has an earlier check which I think excludes this from occurring. ~Andrew