---
 xen-unstable.hg/xen/acm/acm_chinesewall_hooks.c             |    9 ++++++++
 xen-unstable.hg/xen/acm/acm_policy.c                        |   13 ++++++++++++
 xen-unstable.hg/xen/acm/acm_simple_type_enforcement_hooks.c |   10 +++++++++
 xen-unstable.hg/xen/include/acm/acm_hooks.h                 |    2 +
 4 files changed, 34 insertions(+)

Index: root/xen-unstable.hg/xen/acm/acm_policy.c
===================================================================
--- root.orig/xen-unstable.hg/xen/acm/acm_policy.c
+++ root/xen-unstable.hg/xen/acm/acm_policy.c
@@ -87,9 +87,16 @@ _acm_update_policy(void *buf, u32 buf_si
                    struct acm_sized_buffer *errors)
 {
     uint32_t offset, length;
+    static int require_update = 0;
 
     write_lock(&acm_bin_pol_rwlock);
 
+    if (  require_update != 0 &&
+        ( deletions == NULL || ssidchanges == NULL ) )
+    {
+        goto error_lock_free;
+    }
+    require_update = 1;
     /*
        first some tests to check compatibility of new policy with
        current state of system/domains
@@ -153,7 +160,13 @@ _acm_update_policy(void *buf, u32 buf_si
            &pol->xml_pol_version,
            sizeof(acm_bin_pol.xml_pol_version));
 
+    if ( acm_primary_ops->is_default_policy() &&
+         acm_secondary_ops->is_default_policy() ) {
+        require_update = 0;
+    }
+
     write_unlock(&acm_bin_pol_rwlock);
+
     return ACM_OK;
 
 error_lock_free:
Index: root/xen-unstable.hg/xen/acm/acm_chinesewall_hooks.c
===================================================================
--- root.orig/xen-unstable.hg/xen/acm/acm_chinesewall_hooks.c
+++ root/xen-unstable.hg/xen/acm/acm_chinesewall_hooks.c
@@ -650,6 +650,13 @@ static void chwall_domain_destroy(void *
     return;
 }
 
+
+static int chwall_is_default_policy(void)
+{
+    return ( (chwall_bin_pol.max_types    == 1 ) &&
+             (chwall_bin_pol.max_ssidrefs == 2 ) );
+}
+
 struct acm_operations acm_chinesewall_ops = {
     /* policy management services */
     .init_domain_ssid = chwall_init_domain_ssid,
@@ -674,6 +681,8 @@ struct acm_operations acm_chinesewall_op
     .fail_grant_setup = NULL,
     /* generic domain-requested decision hooks */
     .sharing = NULL,
+
+    .is_default_policy = chwall_is_default_policy,
 };
 
 /*
Index: root/xen-unstable.hg/xen/acm/acm_simple_type_enforcement_hooks.c
===================================================================
--- root.orig/xen-unstable.hg/xen/acm/acm_simple_type_enforcement_hooks.c
+++ root/xen-unstable.hg/xen/acm/acm_simple_type_enforcement_hooks.c
@@ -739,6 +739,14 @@ ste_sharing(ssidref_t ssidref1, ssidref_
         return ACM_ACCESS_DENIED;
 }
 
+/* */
+
+static int
+ste_is_default_policy(void)
+{
+    return ( (ste_bin_pol.max_types    == 1) &&
+             (ste_bin_pol.max_ssidrefs == 2) );
+}
 
 /* now define the hook structure similarly to LSM */
 struct acm_operations acm_simple_type_enforcement_ops = {
@@ -768,6 +776,8 @@ struct acm_operations acm_simple_type_en
     .pre_grant_setup        = ste_pre_grant_setup,
     .fail_grant_setup       = NULL,
     .sharing                = ste_sharing,
+
+    .is_default_policy      = ste_is_default_policy,
 };
 
 /*
Index: root/xen-unstable.hg/xen/include/acm/acm_hooks.h
===================================================================
--- root.orig/xen-unstable.hg/xen/include/acm/acm_hooks.h
+++ root/xen-unstable.hg/xen/include/acm/acm_hooks.h
@@ -113,6 +113,8 @@ struct acm_operations {
     void (*fail_grant_setup)           (domid_t id);
     /* generic domain-requested decision hooks (can be NULL) */
     int (*sharing)                     (ssidref_t ssidref1, ssidref_t ssidref2);
+    /* determine whether the default policy is installed */
+    int (*is_default_policy)           (void);
 };
 
 /* global variables */