## # example.txt # # Author: # Reiner Sailer 08/15/2005 # # # This file introduces into the tools to manage policies # and to label domains and resources. ## We will show how to install and use the chwall_ste policy. Other policies work similarly. Feedback welcome! 1. Using secpol_xml2bin to translate the chwall_ste policy: =========================================================== #tools/security/secpol_xml2bin chwall_ste Successful execution should print: [root@laptopxn security]# ./secpol_xml2bin chwall_ste Validating label file policies/chwall_ste/chwall_ste-security_label_template.xml... XML Schema policies/security_policy.xsd valid. Validating policy file policies/chwall_ste/chwall_ste-security_policy.xml... XML Schema policies/security_policy.xsd valid. Creating ssid mappings ... Creating label mappings ... Max chwall labels: 7 Max chwall-types: 4 Max chwall-ssids: 5 Max ste labels: 14 Max ste-types: 6 Max ste-ssids: 10 The tool looks in directory policies/chwall_ste for the label and policy files. The default policy directory structure under tools/security looks like: policies |-- security_policy.xsd |-- chwall | |-- chwall-security_label_template.xml | `-- chwall-security_policy.xml |-- chwall_ste | |-- chwall_ste-security_label_template.xml | `-- chwall_ste-security_policy.xml |-- null | |-- null-security_label_template.xml | `-- null-security_policy.xml `-- ste |-- ste-security_label_template.xml `-- ste-security_policy.xml policies/security_policy.xsd contains the schema against which both the label-template and the policy files must validate during translation. policies/chwall_ste/chwall_ste-security_policy.xml defines the policies and the types known to the policies. policies/chwall_ste/chwall_ste-security_label_template.xml contains label definitions that group chwall and ste types together and make them easier to use for users After executing the above secpol_xml2bin command, you will find 2 new files in the policies/chwall_ste sub-directory: policies/chwall_ste/chwall_ste.map ... this file includes the mapping of names from the xml files into their binary code representation. policies/chwall_ste/chwall_ste.bin ... this is the binary policy file, the result of parsing the xml files and using the mapping to extract a binary version that can be loaded into the hypervisor. 2. Loading and activating the policy: ===================================== We assume that xen is already configured to use the chwall_ste policy; please refer to install.txt for instructions. To activate the policy from the command line (assuming that the currently established policy is the minimal boot-policy that is hard-coded into the hypervisor: # ./secpol_tool loadpolicy policies/chwall_ste/chwall_ste.bin To activate the policy at next reboot: # cp policies/chwall_ste/chwall_ste.bin /boot Add a module line to your /boot/grub/grub.conf Xen entry. My boot entry with chwall_ste enabled looks like this: title Xen (2.6.12) root (hd0,5) kernel /boot/xen.gz dom0_mem=1200000 console=vga module /boot/vmlinuz-2.6.12-xen0 ro root=/dev/hda6 rhgb module /boot/initrd-2.6.12-xen0.img module /boot/chwall_ste.bin This tells the grub boot-loader to load the binary policy, which the hypervisor will recognize. The hypervisor will then establish this binary policy during boot instead of the minimal policy that is hardcoded as default. If you have any trouble here, maks sure you have the access control framework enabled (see: install.txt). 3. Labeling domains: ==================== a) Labeling Domain0: The chwall_ste-security_label_template.xml file includes an attribute "bootstrap", which is set to the label name that will be assigned to Dom0 (this label will be mapped to ssidref 1/1, the default for Dom0). b) Labeling User Domains: Use the script tools/security/setlabel.sh to choose a label and to assign labels to user domains. To show available labels for the chwall_ste policy: #tools/security/setlabel.sh -l lists all available labels. For the default chwall_ste it should print the following: [root@laptopxn security]# ./setlabel.sh -l chwall_ste The following labels are available: dom_SystemManagement dom_HomeBanking dom_Fun dom_BoincClient dom_StorageDomain dom_NetworkDomain You need to have compiled the policy beforehand so that a .map file exists. Setlabel.sh uses the mapping file created throughout the policy translation to translate a user-friendly label string into a ssidref-number that is eventually used by the Xen hypervisor. We distinguish two kinds of labels: a) VM labels (for domains) and RES Labels (for resources). We are currently working on support for resource labeling but will focus here on VM labels. Setlabel.sh only prints VM labels (which we have prefixed with "dom_") since only those are used at this time. If you would like to assign the dom_HomeBanking label to one of your user domains (which you hopefully keep clean), look at an example domain configuration homebanking.xm: #------HOMEBANKING--------- kernel = "/boot/vmlinuz-2.6.12-xenU" ramdisk="/boot/U1_ramdisk.img" memory = 65 name = "test34" cpu = -1 # leave to Xen to pick # Number of network interfaces. Default is 1. nics=1 dhcp="dhcp" #------------------------- Now we label this domain [root@laptopxn security]# ./setlabel.sh homebanking.xm dom_HomeBanking chwall_ste Mapped label 'dom_HomeBanking' to ssidref '0x00020002'. The domain configuration my look now like: [root@laptopxn security]# cat homebanking.xm #------HOMEBANKING--------- kernel = "/boot/vmlinuz-2.6.12-xenU" ramdisk="/boot/U1_ramdisk.img" memory = 65 name = "test34" cpu = -1 # leave to Xen to pick # Number of network interfaces. Default is 1. nics=1 dhcp="dhcp" #------------------------- #ACM_POLICY=chwall_ste-security_policy.xml #ACM_LABEL=dom_HomeBanking ssidref = 0x00020002 You can see 3 new entries, two of which are comments. The only value that the hypervisor cares about is the ssidref that will reference those types assigned to this label. You can look them up in the xml label-template file for the chwall_ste policy. This script will eventually move into the domain management and will be called when the domain is instantiated. For now, the setlabel script must be run on domains whenever the policy files change since the mapping between label names and ssidrefs can change in this case. 4. Starting a labeled domain ============================ Now, start the domain: #xm create -c homebanking.xm If you label another domain configuration as dom_Fun and try to start it afterwards, its start will fail. Why? Because the running homebanking domain has the chinese wall type "cw_Sensitive". The new domain dom_Fun has the chinese wall label "cw_Distrusted". This domain is not allowed to run simultaneously because of the defined conflict set cw_Sensitive cw_Distrusted (in policies/chwall_ste/chwall_ste-security_policy.xml), which says that only one of the types cw_sensitive and cw_Distrusted can run at a time. If you save or shutdown the HomeBanking domain, you will be able to start the "Fun" domain. You can look into the Xen log to see if a domain was denied to start because of the access control framework with the command 'xm dmesg'. It is important (and usually non-trivial) to define the labels in a way that the semantics of the labels are enforced and supported by the types and the conflict sets. Note: While the chinese wall policy enforcement is complete, the type enforcement is currently enforced in the Xen hypervisor only. Therefore, only point-to-point sharing with regard to the type enforcement is currently controlled. We are working on enhancements to Dom0 that enforce types also for network traffic that is routed through Dom0 and on the enforcement of resource labeling when binding resources to domains (e.g., enforcing types between domains and hardware resources, such as disk partitions). 4. Adding your own policies =========================== Writing your own policy (e.g. "mypolicy") requires the following: a) the policy definition (types etc.) file b) the label template definition (labels etc.) file If your policy name is "mypolicy", you need to create a subdirectory mypolicy in tools/security/policies. Then you create tools/security/policies/mypolicy/mypolicy-security_policy.xml and tools/security/policies/mypolicy/mypolicy-security_label_template.xml. You need to keep to the schema as defined in tools/security/security_policy.xsd since the translation tool secpol_xml2bin is written against this schema. If you keep to the security policy schema, then you can use all the tools described above. Refer to install.txt to install it.