mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 18:21:39 +01:00
kaf24@firebug.cl.cam.ac.uk
e39ba51523
active at startup; this works by adding a module line into the grub configuration file and placing the binary policy generated by the policy tool into the boot directory; This assumes that a maximum of one module line is used for the initrd in the grub configuration file - Question: do users pass more than one module to the kernel? - enables the policy hypervisor call on x86/64 - some function prototypes moved to include files - moves the version number in the java tool up to the current version (a better way of doing this will be submitted soon) Signed-off-by: Stefan Berger <stefanb@us.ibm.com> Signed-off-by: Reiner Sailer <sailer@us.ibm.com>
# Author: Ray Valdez, rvaldez@us.ibm.com
# Version: 1.0
#
# This readme describes the policy processor tool for sHype.
#
Java program:
java XmlToBin -i [file.xml] -o <file.bin> -xssid <SsidFile> -xssidconf <SsidConf>
Command line options:
-i inputFile: name of policyfile (.xml)
-o outputFile: name of binary policy file (Big Endian)
-xssid SsidFile: xen ssids to named types text file
-xssidconf SsidConf: xen conflict ssids to types text file
-debug turn on debug messages
-help help. This printout
Where:
file.xml is the (input) xml policy file to be parsed and validated.
The syntax for file.xml is defined in the SecurityPolicySpec.xsd file.
file.bin is the (output) binary policy file generated by XmlToBin.
This binary policy can be activated in sHype. The binary policy file
is laid out in network byte order (i.e., big endian). The SsidFile
file contains the mapping of type enforcement (TE) ssids to the "named
types". Similarly, the SsidConf file contains the mapping of Chinese
Wall (ChWall) ssids to conflict named types. The ssidFile and SsidConf
files are used by Xen.
Xml Schema and policy:
The SecurityPolicySpec.xsd defines the syntax of a policy file. It
declares the tags that are used by XmlToBin to generate the binary
policy file. The tags that XmlToBin keys on are TE, ChWall, id, vid,
etc. The xml files that describe a policy are simple. Semantic
checking of a policy is performed mostly by XmlToBin. A type, for
example, is a string. No fixed values are defined for types in Xml.
A policy consists of two Xml files: definition and policy. The
definition Xml declares the types that are permitted in the policy
Xml. The policy Xml contains the assignment of labels to
subject/object (e.g., vm). This Xml file contains an explicit
reference to the definition Xml (e.g., <url>xen_sample_def.xml</url>).
The policy Xml is the one provided as a command line argument.
Files:
*.java - policy processor source
xen_sample_policy.xml - sample xml policy file
xen_sample_def.xml - sample user defined types
SecurityPolicySpec.xsd - schema definition file
To generate the sample binary policy:
export CLASSPATH=$XERCES_HOME/xercesImpl.jar:$XERCES_HOME/xmlParserAPIs.jar:.
java XmlToBin -i xen_sample_policy.xml -o xen_sample_policy.bin
where $XERCES_HOME is the installation directory of the Apache Xerces-J