libxl: Add device_model_stubdomain_seclabel

This allows the security label of stub domains to be specified.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>

diff --git a/docs/man/xl.cfg.pod.5 b/docs/man/xl.cfg.pod.5
index 9d90290cc104477cde9822993663834c86e16aca..8f171b4e3c426e1ccf497565dfe4b47aaa57bf20 100644 (file)
--- a/docs/man/xl.cfg.pod.5
+++ b/docs/man/xl.cfg.pod.5
@@ -789,6 +789,10 @@ Override the use of stubdomain based device-model.  Normally this will
 be automatically selected based upon the other features and options
 you have selected.
 
+=item B<device_model_stubdomain_seclabel="LABEL">
+
+Assign an XSM security label to the device-model stubdomain.
+
 =item B<device_model_args=[ "ARG", "ARG", ...]>
 
 Pass additional arbitrary options on the devide-model command

diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
index 5fec137afccd5a40f02c97e3bfa952e6d47c99b5..e99d173ef0932522ae1236770827eeb53d5bc9fc 100644 (file)
--- a/tools/libxl/libxl_dm.c
+++ b/tools/libxl/libxl_dm.c
@@ -703,6 +703,7 @@ static int libxl__create_stubdom(libxl__gc *gc,
     dm_config.c_info.type = LIBXL_DOMAIN_TYPE_PV;
     dm_config.c_info.name = libxl__sprintf(gc, "%s-dm",
                                     libxl__domid_to_name(gc, guest_domid));
+    dm_config.c_info.ssidref = guest_config->b_info.device_model_ssidref;
 
     libxl_uuid_generate(&dm_config.c_info.uuid);
 

diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl
index 3c24626d8e67295b678eebf28f5a606df6eec0ba..b77bc651d8ab1bce53c70ddf56b63c94ea0c1e8f 100644 (file)
--- a/tools/libxl/libxl_types.idl
+++ b/tools/libxl/libxl_types.idl
@@ -217,6 +217,7 @@ libxl_domain_build_info = Struct("domain_build_info",[
     ("device_model_stubdomain", bool),
     # you set device_model you must set device_model_version too
     ("device_model",     string),
+    ("device_model_ssidref", uint32),
 
     # extra parameters pass directly to qemu, NULL terminated
     ("extra",            libxl_string_list),

diff --git a/tools/libxl/xl_cmdimpl.c b/tools/libxl/xl_cmdimpl.c
index f10c20c6b4c5e00b65c21ef7b59fd7a6d8cbfe90..df0980e36133f31cce12cc7ec2b1259a546541ed 100644 (file)
--- a/tools/libxl/xl_cmdimpl.c
+++ b/tools/libxl/xl_cmdimpl.c
@@ -1134,6 +1134,21 @@ skip_vfb:
     if (!xlu_cfg_get_long (config, "device_model_stubdomain_override", &l, 0))
         b_info->device_model_stubdomain = l;
 
+    if (!xlu_cfg_get_string (config, "device_model_stubdomain_seclabel",
+                             &buf, 0)) {
+        e = libxl_flask_context_to_sid(ctx, (char *)buf, strlen(buf),
+                                    &b_info->device_model_ssidref);
+        if (e) {
+            if (errno == ENOSYS) {
+                fprintf(stderr, "XSM Disabled:"
+                        " device_model_stubdomain_seclabel not supported\n");
+            } else {
+                fprintf(stderr, "Invalid device_model_stubdomain_seclabel:"
+                        " %s\n", buf);
+                exit(1);
+            }
+        }
+    }
 #define parse_extra_args(type)                                            \
     e = xlu_cfg_get_list_as_string_list(config, "device_model_args"#type, \
                                     &b_info->extra##type, 0);            \