Re: [RFC PATCH] xen/flask: estimate max sidtable size

2025-07-07 Thread Daniel P. Smith
On 7/4/25 06:48, Jan Beulich wrote: On 04.07.2025 12:10, Sergiy Kibrik wrote: 01.07.25 13:42, Jan Beulich: On 30.06.2025 10:55, Sergiy Kibrik wrote: @@ -54,4 +54,7 @@ $(obj)/policy.bin: FORCE FLASK_BUILD_DIR=$(FLASK_BUILD_DIR) POLICY_FILENAME=$(POLICY_SRC) cmp -s $(POLI

Re: [RFC PATCH] xen/flask: estimate max sidtable size

2025-07-07 Thread Stefano Stabellini
On Fri, 4 Jul 2025, Jan Beulich wrote: > On 04.07.2025 12:10, Sergiy Kibrik wrote: > > 01.07.25 13:42, Jan Beulich: > >> On 30.06.2025 10:55, Sergiy Kibrik wrote: > >>> @@ -54,4 +54,7 @@ $(obj)/policy.bin: FORCE > >>> FLASK_BUILD_DIR=$(FLASK_BUILD_DIR) > >>> POLICY_FILENAME=$(POL

Re: [RFC PATCH] xen/flask: estimate max sidtable size

2025-07-04 Thread Jan Beulich
On 04.07.2025 12:10, Sergiy Kibrik wrote: > 01.07.25 13:42, Jan Beulich: >> On 30.06.2025 10:55, Sergiy Kibrik wrote: >>> @@ -54,4 +54,7 @@ $(obj)/policy.bin: FORCE >>> FLASK_BUILD_DIR=$(FLASK_BUILD_DIR) POLICY_FILENAME=$(POLICY_SRC) >>> cmp -s $(POLICY_SRC) $@ || cp $(POLICY_SRC) $

Re: [RFC PATCH] xen/flask: estimate max sidtable size

2025-07-04 Thread Sergiy Kibrik
01.07.25 13:42, Jan Beulich: On 30.06.2025 10:55, Sergiy Kibrik wrote: Currently Xen lacks a defined largest number of security IDs it can potentially use. The number of SIDs are naturally limited by number of security contexts provided by a given security policy, i.e. how many combination of us

Re: [RFC PATCH] xen/flask: estimate max sidtable size

2025-07-01 Thread Jan Beulich
On 30.06.2025 10:55, Sergiy Kibrik wrote: > Currently Xen lacks a defined largest number of security IDs it can > potentially > use. The number of SIDs are naturally limited by number of security contexts > provided by a given security policy, i.e. how many combination of user, role > and type the

[RFC PATCH] xen/flask: estimate max sidtable size

2025-06-30 Thread Sergiy Kibrik
Currently Xen lacks a defined largest number of security IDs it can potentially use. The number of SIDs are naturally limited by number of security contexts provided by a given security policy, i.e. how many combination of user, role and type there can be, and is dependant on the policy being used.