mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Daniel De Graaf
b5f90278f5
This unifies the flask_enforcing and flask_enabled boot parameters into a single parameter with additional states. Defined options are: enforcing - require policy to be loaded at boot time and enforce it permissive - a missing or broken policy does not panic disabled - revert to dummy (no XSM) policy. Was flask_enabled=0 late - bootloader policy is not used; later loadpolicy is enforcing The default mode remains "permissive" and the flask_enforcing boot parameter is retained for compatibility. If flask_enforcing=1 is specified and flask= is not, the bootloader policy will be loaded in enforcing mode if present, but errors will disable access controls until a successful loadpolicy instead of causing a panic at boot. Suggested-by: Julien Grall <julien.grall@linaro.org> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>