Re: [Xen-devel] [PATCH for-4.11 1/2] XSM: adjust Kconfig names

[Julien Grall <julien.grall@xxxxxxx>]

Hi Jan,

On 18/06/2019 15:04, Jan Beulich wrote:
> Since the Kconfig option renaming was not backported, the new uses of
> involved CONFIG_* settings should have been adopted to the existing
> names in the XSA-295 series. Do this now, also changing XSM_SILO to just
> SILO to better match its FLASK counterpart.
>
> To avoid breaking the Kconfig menu structure also adjust XSM_POLICY's
> dependency (as was also silently done on master during the renaming).
>
> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
Sorry for the breakage. To avoid such blunder during XSAs, would it be possible 
to test them on osstest before they are published?
Also, do we need to update the advisory?

Acked-by: Julien Grall <julien.grall@xxxxxxx>

> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -130,7 +130,7 @@ config FLASK_AVC_STATS
>   config XSM_POLICY
>         bool "Compile Xen with a built-in security policy"
>         default y if HAS_CHECKPOLICY = "y"
> -       depends on XSM
> +       depends on FLASK
>         ---help---
>           This includes a default XSM policy in the hypervisor so that the
>           bootloader does not need to load a policy to get sane behavior from an
> @@ -143,7 +143,7 @@ config XSM_POLICY
>   
>   	  If unsure, say Y.
>   
> -config XSM_SILO
> +config SILO
>         def_bool y
>         prompt "SILO support"
>         depends on XSM
> @@ -158,16 +158,16 @@ config XSM_SILO
>   choice
>         prompt "Default XSM implementation"
>         depends on XSM
> -       default XSM_SILO_DEFAULT if XSM_SILO && ARM
> -       default XSM_FLASK_DEFAULT if XSM_FLASK
> -       default XSM_SILO_DEFAULT if XSM_SILO
> +       default XSM_SILO_DEFAULT if SILO && ARM
> +       default XSM_FLASK_DEFAULT if FLASK
> +       default XSM_SILO_DEFAULT if SILO
>         default XSM_DUMMY_DEFAULT
>         config XSM_DUMMY_DEFAULT
>                 bool "Match non-XSM behavior"
>         config XSM_FLASK_DEFAULT
> -               bool "FLux Advanced Security Kernel" if XSM_FLASK
> +               bool "FLux Advanced Security Kernel" if FLASK
>         config XSM_SILO_DEFAULT
> -               bool "SILO" if XSM_SILO
> +               bool "SILO" if SILO
>   endchoice
>   
>   config LATE_HWDOM
> --- a/xen/include/xsm/xsm.h
> +++ b/xen/include/xsm/xsm.h
> @@ -738,7 +738,7 @@ extern const unsigned char xsm_init_poli
>   extern const unsigned int xsm_init_policy_size;
>   #endif
>   
> -#ifdef CONFIG_XSM_SILO
> +#ifdef CONFIG_SILO
>   extern void silo_init(void);
>   #else
>   static inline void silo_init(void) {}
> --- a/xen/xsm/Makefile
> +++ b/xen/xsm/Makefile
> @@ -1,6 +1,6 @@
>   obj-y += xsm_core.o
>   obj-$(CONFIG_XSM) += xsm_policy.o
>   obj-$(CONFIG_XSM) += dummy.o
> -obj-$(CONFIG_XSM_SILO) += silo.o
> +obj-$(CONFIG_SILO) += silo.o
>   
>   subdir-$(CONFIG_FLASK) += flask
> --- a/xen/xsm/xsm_core.c
> +++ b/xen/xsm/xsm_core.c
> @@ -38,9 +38,9 @@ enum xsm_bootparam {
>   };
>   
>   static enum xsm_bootparam __initdata xsm_bootparam =
> -#ifdef CONFIG_XSM_FLASK_DEFAULT
> +#if defined(CONFIG_XSM_FLASK_DEFAULT)
>       XSM_BOOTPARAM_FLASK;
> -#elif CONFIG_XSM_SILO_DEFAULT
> +#elif defined(CONFIG_XSM_SILO_DEFAULT)
>       XSM_BOOTPARAM_SILO;
>   #else
>       XSM_BOOTPARAM_DUMMY;
> @@ -52,11 +52,11 @@ static int __init parse_xsm_param(const
>   
>       if ( !strcmp(s, "dummy") )
>           xsm_bootparam = XSM_BOOTPARAM_DUMMY;
> -#ifdef CONFIG_XSM_FLASK
> +#ifdef CONFIG_FLASK
>       else if ( !strcmp(s, "flask") )
>           xsm_bootparam = XSM_BOOTPARAM_FLASK;
>   #endif
> -#ifdef CONFIG_XSM_SILO
> +#ifdef CONFIG_SILO
>       else if ( !strcmp(s, "silo") )
>           xsm_bootparam = XSM_BOOTPARAM_SILO;
>   #endif
--
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel