mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 18:21:39 +01:00
kaf24@firebug.cl.cam.ac.uk
7e9596058b
* adds a get_ssid ACM command that allows privileged domains to retrieve types for either a given ssid reference or a given domain id (of a running domain); this command can be used to extend access control into device domains, e.g., to control network traffic currently moving through Domain 0 uncontrolled by the ACM policy * adds a script getlabel.sh that allows users inside Dom0 to retrieve the label for a given ssid reference or a given domain id (multiple labels might map onto a single ssid reference) * cleans up label-related code in tools/security by merging common functions into labelfuncs.sh * cleans up ACM code related to above changes (eventually approximating a common coding style) Signed-off-by Reiner Sailer <sailer@us.ibm.com> Signed-off by Stefan Berger <stefanb@us.ibm.com>
82 lines
2.0 KiB
Makefile
82 lines
2.0 KiB
Makefile
XEN_ROOT = ../..
|
|
include $(XEN_ROOT)/tools/Rules.mk
|
|
|
|
SRCS = secpol_tool.c
|
|
CFLAGS += -Wall
|
|
CFLAGS += -Werror
|
|
CFLAGS += -O3
|
|
CFLAGS += -fno-strict-aliasing
|
|
CFLAGS += -I. -I/usr/include/libxml2
|
|
CFLAGS_XML2BIN += $(shell xml2-config --cflags --libs )
|
|
#if above does not work, try -L/usr/lib -lxml2 -lz -lpthread -lm
|
|
XML2VERSION = $(shell xml2-config --version )
|
|
VALIDATE_SCHEMA=$(shell if [[ $(XML2VERSION) < 2.6.20 ]]; then echo ""; else echo "-DVALIDATE_SCHEMA"; fi; )
|
|
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_NULL_POLICY)
|
|
POLICY=null
|
|
endif
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_CHINESE_WALL_POLICY)
|
|
POLICY=chwall
|
|
endif
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY)
|
|
POLICY=ste
|
|
endif
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_CHINESE_WALL_AND_SIMPLE_TYPE_ENFORCEMENT_POLICY)
|
|
POLICY=chwall_ste
|
|
endif
|
|
POLICYFILE=./policies/$(POLICY)/$(POLICY).bin
|
|
|
|
ifneq ($(ACM_USE_SECURITY_POLICY), ACM_NULL_POLICY)
|
|
all: build
|
|
|
|
install:all
|
|
|
|
default:all
|
|
else
|
|
all:
|
|
|
|
install:
|
|
|
|
default:
|
|
endif
|
|
|
|
build: mk-symlinks
|
|
$(MAKE) secpol_tool
|
|
$(MAKE) secpol_xml2bin
|
|
chmod 700 ./setlabel.sh
|
|
chmod 700 ./updategrub.sh
|
|
chmod 700 ./getlabel.sh
|
|
|
|
secpol_tool : secpol_tool.c secpol_compat.h
|
|
$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ $<
|
|
|
|
secpol_xml2bin : secpol_xml2bin.c secpol_xml2bin.h secpol_compat.h
|
|
$(CC) $(CPPFLAGS) $(CFLAGS) $(CFLAGS_XML2BIN) $(VALIDATE_SCHEMA) -o $@ $<
|
|
|
|
clean:
|
|
rm -rf secpol_tool secpol_xml2bin xen
|
|
|
|
policy_clean:
|
|
rm -rf policies/*/*.bin policies/*/*.map
|
|
|
|
mrproper: clean policy_clean
|
|
|
|
|
|
$(POLICYFILE) : build
|
|
@./secpol_xml2bin $(POLICY) > /dev/null
|
|
|
|
boot_install: $(POLICYFILE)
|
|
@cp $(POLICYFILE) /boot
|
|
@./updategrub.sh $(POLICY) $(PWD)/$(XEN_ROOT)
|
|
|
|
LINUX_ROOT := $(XEN_ROOT)/linux-2.6-xen-sparse
|
|
mk-symlinks:
|
|
[ -e xen/linux ] || mkdir -p xen/linux
|
|
[ -e xen/io ] || mkdir -p xen/io
|
|
( cd xen >/dev/null ; \
|
|
ln -sf ../$(XEN_ROOT)/xen/include/public/*.h . )
|
|
( cd xen/io >/dev/null ; \
|
|
ln -sf ../../$(XEN_ROOT)/xen/include/public/io/*.h . )
|
|
( cd xen/linux >/dev/null ; \
|
|
ln -sf ../../$(LINUX_ROOT)/include/asm-xen/linux-public/*.h . )
|