kernel line in grub.conf. The format is
ssidref=<ssidref>:sHype:<policy name>:<vm label>. The name of the
policy specified here must be the same name as the in the policy
provided as a module during boot, otherwise the policy will not be
accepted and the system then starts without a policy. The user tool
for 'xm dumppolicy' has been adapted to show which entry in the binary
policy is used by domain-0.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
the ACM policy. The translation tool has been adapted to parse the
version found in the XML representation and put it into the binary
policy. Xen has been adapted to remember the version information and
report it when asked for the current policy.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Subsequent patches will follow in the coming weeks that will enable
Xen ACM to control assignment of resources (e.g., block devices and
networking) to virtual machines based on resource labels and the
active security policy.
Signed-off-by: Bryan D. Payne <bdpayne@us.ibm.com>
Signed-off-by: Reiner Sailer <sailer@us.ibm.com>
introduced into security policies. It also fixes a minor problem related
to handling unsupported boot policies.
Signed-off by: Reiner Sailer <sailer@us.ibm.com>
and installation. Particularly it does the following:
- the Makefile installs the ACM security-related tools
into /etc/xen/acm-security
- improves and cleans up some of the tools
- updates the documentation
Signed-off-by: Tom Lendacky <toml@us.ibm.com>
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
* adds a C-based security policy translation tool to Xen (secpol_xml2bin)
and removes the current Java
security policy translator (Java dependencies). The C-based tool
integrates into the Xen source tree build
and install (using gnome libxml2 for XML parsing). See install.txt.
* introduces security labels and related tools. Users can now use
semantic-rich label names to put security-tags
on domains. See example.txt, policy.txt.
* moves the security configuration (currently ACM_USE_SECURITY_POLICY)
from xen/Rules.mk
into a separate top-level Security.mk file (it is needed by the
tools/security and xen/acm).
Both xen/acm and tools/security are built during the Xen build process
only if ACM_USE_SECURITY_POLICY
is not ACM_NULL_POLICY (which is the default setting).
Signed-off-by Reiner Sailer <sailer@us.ibm.com>
Signed-off by Stefan Berger <stefanb@us.ibm.com>
Signed-off by Ray Valdez <rvaldez@us.ibm.com>
kfraser@localhost.localdomain
Keir Fraser
kaf24@firebug.cl.cam.ac.uk
smh22@firebug.cl.cam.ac.uk
emellor@leeni.uk.xensource.com