mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 02:30:03 +01:00
kaf24@firebug.cl.cam.ac.uk
ac5d4d868f
time (instead of at compile time). Allows a single xen.gz binary to run under different security policy types, which simplifies distributions considerably. To this end, we replace the current single compile switch in Config.mk with the following two: 1. ACM_SECURITY (y/n) if "n", then the ACM is not compiled and no security policies can be configured at boot time. If "y", then the ACM is compiled and can be configured into any of the available policy types (null, chwall, ste, chwall_ste) by specifying a valid boot policy .bin file in the grub boot configuration. 2. ACM_DEFAULT_SECURITY_POLICY (null / chwall / ste / chwall_ste) specifies the policy into which Xen defaults in the case that security is enabled but no boot policy file is specified, or the specified policy file is invalid (wrong version, magic, corrupted, ...) While the type of the enabled policy (null, ste, ...) is decided once during boot for the whole boot cycle, the policy instantiation can be changed during operation as usual with the security tools. Signed-off by: Tomas Lendacky <toml@us.ibm.com> Signed-off by: Reiner Sailer <sailer@us.ibm.com>
70 lines
2.1 KiB
Plaintext
70 lines
2.1 KiB
Plaintext
##
|
|
# install.txt <description to the xen access control architecture>
|
|
#
|
|
# Author:
|
|
# Reiner Sailer 08/15/2005 <sailer@watson.ibm.com>
|
|
#
|
|
#
|
|
# This file shows how to activate and install the access control
|
|
# framework.
|
|
##
|
|
|
|
|
|
INSTALLING A SECURITY POLICY IN XEN
|
|
===================================
|
|
|
|
By default, the access control architecture is disabled in Xen. To
|
|
enable the access control architecture in Xen follow the steps below.
|
|
This description assumes that you want to install the Chinese Wall and
|
|
Simple Type Enforcement policy. Some file names need to be replaced
|
|
below to activate the Chinese Wall OR the Type Enforcement policy
|
|
exclusively (chwall_ste --> {chwall, ste}).
|
|
|
|
1. enable access control in Xen
|
|
# cd "xen_root"
|
|
# edit/xemacs/vi Config.mk
|
|
|
|
change the lines:
|
|
ACM_SECURITY ?= n
|
|
ACM_DEFAULT_SECURITY_POLICY ?= ACM_NULL_POLICY
|
|
|
|
to:
|
|
ACM_SECURITY ?= y
|
|
ACM_DEFAULT_SECURITY_POLICY ?= ACM_CHINESE_WALL_AND_SIMPLE_TYPE_ENFORCEMENT_POLICY
|
|
|
|
# make all
|
|
# ./install.sh
|
|
|
|
2. compile the policy from xml to a binary format that can be loaded
|
|
into the hypervisor for enforcement
|
|
# cd tools/security
|
|
# make
|
|
|
|
manual steps (alternative to make boot_install):
|
|
#./secpol_xml2bin chwall_ste
|
|
#cp policies/chwall_ste/chwall_ste.bin /boot
|
|
#edit /boot/grub/grub.conf
|
|
add the follwoing line to your xen boot entry:
|
|
"module chwall_ste.bin"
|
|
|
|
alternatively, you can try our automatic translation and
|
|
installation of the policy:
|
|
# make boot_install
|
|
|
|
[we try hard to do the right thing to the right boot entry but
|
|
please verify boot entry in /boot/grub/grub.conf afterwards;
|
|
your xen boot entry should have an additional module line
|
|
specifying a chwall_ste.bin file with the correct directory
|
|
(e.g. "/" or "/boot").]
|
|
|
|
|
|
3. reboot into the newly compiled hypervisor
|
|
|
|
after boot
|
|
#xm dmesg should show an entry about the policy being loaded
|
|
during the boot process
|
|
|
|
#tools/security/secpol_tool getpolicy
|
|
should print the new chwall_ste binary policy representation
|
|
|