kernel line in grub.conf. The format is
ssidref=<ssidref>:sHype:<policy name>:<vm label>. The name of the
policy specified here must be the same name as the in the policy
provided as a module during boot, otherwise the policy will not be
accepted and the system then starts without a policy. The user tool
for 'xm dumppolicy' has been adapted to show which entry in the binary
policy is used by domain-0.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
the ACM policy. The translation tool has been adapted to parse the
version found in the XML representation and put it into the binary
policy. Xen has been adapted to remember the version information and
report it when asked for the current policy.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
- convert raw "install" command to use $(INSTALL)
- convert some $(INSTALL) to $(INSTALL_DATA) as appropriate
- modify the specific $(INSTALL) definitions to use -p.
Original patch by Ben Thomas <ben@virtualiron.com>
Signed-off-by: Keir Fraser <keir@xensource.com>
Having both the Xen tree and the tools tree recurse into the foreign
headers directory causes headaches in parallel builds and when
building 32-bit tools + 64 bit Xen in the same tree.
Therefore we cause mk-symlinks to symlink in the foreign headers build
bits and generate a local version of the headers and checker tool.
Only libxc needs to do this since the other tools were actually
picking up the libxc version of the headers anyway so the mk-symlinks
calls can be removed from these components.
Signed-off-by: Ian Campbell <ian.campbell@xensource.com>
This patch eliminates redundant security tools information that was
integrated into the Xen user guide and the xm man page.
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
be under /var/log/xen instead of under /var/log directly. This has
the advantage of cleaning things up a little and also can make it
easier to restrict the permissions needed by xend.
Signed-off-by: Jeremy Katz <katzj@redhat.com>
and described in the user guide to demonstrate how to quickly create,
enforce, and test workload protection policies in Xen. The tool is aimed
to improve usability of sHype/ACM for Xen.It is included in a single
file to make it easy to try it out on different platforms (it inherits
the look and feel of the base platform). It is tested on Linux and
Windows. Please read the new user guide section about how to start and
use the tool (section 10.2).
Requirements: python (www.python.org), wxPython (www.wxpython.org or
try 'yum install wxPython').
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
of void pointers. It also fixes a recently slipped in acm bug that hangs
Xen when a domain is destroyed.
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
Subsequent patches will follow in the coming weeks that will enable
Xen ACM to control assignment of resources (e.g., block devices and
networking) to virtual machines based on resource labels and the
active security policy.
Signed-off-by: Bryan D. Payne <bdpayne@us.ibm.com>
Signed-off-by: Reiner Sailer <sailer@us.ibm.com>
with command-specific request structures. It aligns the ACM
hypercalls with the way parameters are passed in the event channel
hypercalls.
Advantages include backward-compatibility regarding old guests when
new calls are added and clarity of the code.
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
Make header path for kernel's privcmd/evtchn headers generic.
Remove pointless xi_*() interface that was using private libxc
interfaces.
Signed-off-by: John Levon <john.levon@sun.com>
the integrated access control management commands. The man page is a
good place to start exploring these commands.
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
integrate into Xen Management and which support the new access control
labels (labels replace the ssidref numbers at the management user
interface).
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
introduced into security policies. It also fixes a minor problem related
to handling unsupported boot policies.
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
must be unique and must change if the content of the file changes. The
policy name is used to ensure that the XM tools and the hypervisor work
on the same policy, i.e., interpret the security information on domains
consistently. This patch also simplifies the policy management by moving
policy and labels into a single file.
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
* Move .PHONY directives next to targets,
this makes them a lot harder to miss
* Add missing .PHONY directives
* Remove nonexistent .PHONY directives
* Hopefully I didn'T miss anything...
Signed-Off-By: Horms <horms@verge.net.au>
creation/generation of the XML security policy files for the Xen ACM
security architecture. It is a python- based, web-based tool named
xensec_gen that allows users to create or modify XML policy files
through a browser. The resulting XML policy files can then be copied
or moved to the appropriate location in the /etc/xen/acm-security
directory structure in order to be translated into binary and used
within the Xen system.
Signed-off-by: Tom Lendacky <toml@us.ibm.com>
and installation. Particularly it does the following:
- the Makefile installs the ACM security-related tools
into /etc/xen/acm-security
- improves and cleans up some of the tools
- updates the documentation
Signed-off-by: Tom Lendacky <toml@us.ibm.com>
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
time (instead of at compile time). Allows a single xen.gz binary to
run under different security policy types, which simplifies
distributions considerably. To this end, we replace the current single
compile switch in Config.mk with the following two:
1. ACM_SECURITY (y/n) if "n", then the ACM is not compiled and no security
policies can be configured at boot time. If "y", then the ACM is compiled
and can be configured into any of the available policy types (null,
chwall, ste, chwall_ste) by specifying a valid boot policy .bin file in
the grub boot configuration.
2. ACM_DEFAULT_SECURITY_POLICY (null / chwall / ste / chwall_ste)
specifies the policy into which Xen defaults in the case that security is
enabled but no boot policy file is specified, or the specified policy file
is invalid (wrong version, magic, corrupted, ...)
While the type of the enabled policy (null, ste, ...) is decided once
during boot for the whole boot cycle, the policy instantiation can be
changed during operation as usual with the security tools.
Signed-off by: Tomas Lendacky <toml@us.ibm.com>
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
1. adapts ACM hooks to the slightly changed event channel structure
2. introduces an ACM_GETDECISION command, which enables authorized
domains to retrieve policy decisions regarding the sharing of resources
(STE policy) from the Xen hypervisor
3. includes cleanup (warnings I found when applying analysis tools such
as beam or flawfinder to the ACM code)
The get_decision function is useful to enforce:
* the security policy on network traffic in the network backends in
domain 0; currently there is no enforcement in Dom0 and all packets flow
freely
* the security policy in block device backends to control which
domains can access which vdisk resources
I have added a small test program that shows how to use the get_decision
ACM interface call, it is in tools/security/get_decision.c and will be
compiled together with the policy tools. As usual, the ACM is unconfigured
until you switch on a security policy on in Config.mk.
Signed-off: Reiner Sailer <sailer@us.ibm.com>
* adds a get_ssid ACM command that allows privileged domains to retrieve
types for either a given ssid reference or a given domain id (of a running
domain); this command can be used to extend access control into device
domains, e.g., to control network traffic currently moving through Domain
0 uncontrolled by the ACM policy
* adds a script getlabel.sh that allows users inside Dom0 to retrieve the
label for a given ssid reference or a given domain id (multiple labels
might map onto a single ssid reference)
* cleans up label-related code in tools/security by merging common
functions into labelfuncs.sh
* cleans up ACM code related to above changes (eventually approximating a
common coding style)
Signed-off-by Reiner Sailer <sailer@us.ibm.com>
Signed-off by Stefan Berger <stefanb@us.ibm.com>
* adds a C-based security policy translation tool to Xen (secpol_xml2bin)
and removes the current Java
security policy translator (Java dependencies). The C-based tool
integrates into the Xen source tree build
and install (using gnome libxml2 for XML parsing). See install.txt.
* introduces security labels and related tools. Users can now use
semantic-rich label names to put security-tags
on domains. See example.txt, policy.txt.
* moves the security configuration (currently ACM_USE_SECURITY_POLICY)
from xen/Rules.mk
into a separate top-level Security.mk file (it is needed by the
tools/security and xen/acm).
Both xen/acm and tools/security are built during the Xen build process
only if ACM_USE_SECURITY_POLICY
is not ACM_NULL_POLICY (which is the default setting).
Signed-off-by Reiner Sailer <sailer@us.ibm.com>
Signed-off by Stefan Berger <stefanb@us.ibm.com>
Signed-off by Ray Valdez <rvaldez@us.ibm.com>
