[Xen-devel] [PATCH] libxl: assigned a default ssid_label (XSM label) to guests

[Ian Campbell <ian.campbell@xxxxxxxxxx>]

system_u:system_r:domU_t is defined in the default policy and makes as
much sense as anything for a default.

This change required moving the call to domain_create_info_setdefault
to be before the ssid_label is translated into ssidref, which also
moves it before some other stuff which consumes things from c_info,
which is correct since setdefault should always be called first. Apart
from the SSID handling there should be no functional change (since
setdefault doesn't actually act on anything which that other stuff
uses).

There is no need to set exec_ssid_label since the default is to leave
the domain using the ssid_label after build.

I haven't done anything with the device model ssid.

Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
Cc: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
Cc: Wei.Liu2@xxxxxxxxxx
---
 docs/man/xl.cfg.pod.5      |    4 +++-
 tools/libxl/libxl_create.c |   11 ++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/docs/man/xl.cfg.pod.5 b/docs/man/xl.cfg.pod.5
index 8e4154f..fcca1cc 100644
--- a/docs/man/xl.cfg.pod.5
+++ b/docs/man/xl.cfg.pod.5
@@ -437,7 +437,9 @@ UUID will be generated.
 
 =item B<seclabel="LABEL">
 
-Assign an XSM security label to this domain.
+Assign an XSM security label to this domain. By default a domain is
+assigned the label B<system_u:system_r:domU_t>, which is defined in
+the default policy.
 
 =item B<init_seclabel="LABEL">
 
diff --git a/tools/libxl/libxl_create.c b/tools/libxl/libxl_create.c
index f0da7dc..4dd2ec2 100644
--- a/tools/libxl/libxl_create.c
+++ b/tools/libxl/libxl_create.c
@@ -42,6 +42,11 @@ int libxl__domain_create_info_setdefault(libxl__gc *gc,
     libxl_defbool_setdefault(&c_info->run_hotplug_scripts, true);
     libxl_defbool_setdefault(&c_info->driver_domain, false);
 
+    if (!c_info->ssid_label) {
+        c_info->ssid_label = libxl__strdup(NOGC, "system_u:system_r:domU_t");
+        LOG(INFO, "Using default ssid_label: %s", c_info->ssid_label);
+    }
+
     return 0;
 }
 
@@ -802,6 +807,9 @@ static void initiate_domain_create(libxl__egc *egc,
 
     domid = 0;
 
+    ret = libxl__domain_create_info_setdefault(gc, &d_config->c_info);
+    if (ret) goto error_out;
+
     if (d_config->c_info.ssid_label) {
         char *s = d_config->c_info.ssid_label;
         ret = libxl_flask_context_to_sid(ctx, s, strlen(s),
@@ -887,9 +895,6 @@ static void initiate_domain_create(libxl__egc *egc,
         goto error_out;
     }
 
-    ret = libxl__domain_create_info_setdefault(gc, &d_config->c_info);
-    if (ret) goto error_out;
-
     ret = libxl__domain_make(gc, d_config, &domid, &state->config);
     if (ret) {
         LIBXL__LOG(ctx, LIBXL__LOG_ERROR, "cannot make domain: %d", ret);
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel