Setting up XSM/Flask for XEN

make -C xen menuconfig

Common Features --> XSM

Then at boot time,

#4.9.1 flask_enforcing=1 // 0
#4.10.0 flask=enforcing // disabled

Note. XEN 4.9.1 compiled from the drakvuf git submodules does not warn about flask_enforcing being unknown. So either it is enabled in the micro-kernel configuration (?) or it just does not warn about it. XEN 4.10.0 warns when you try enabling it while it is not compiled in.

Then review the issues,

xl dmesg | grep avc
#?? xl dmesg | audit2allow

Review the active policies per guest,

xl list -Z