mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
smh22@firebug.cl.cam.ac.uk
655ead6573
the integrated access control management commands. The man page is a good place to start exploring these commands. Signed-off by: Reiner Sailer <sailer@us.ibm.com>
88 lines
3.0 KiB
Plaintext
88 lines
3.0 KiB
Plaintext
##
|
|
# install.txt <description to the xen access control architecture>
|
|
#
|
|
# Author:
|
|
# Reiner Sailer 08/15/2005 <sailer@watson.ibm.com>
|
|
# 03/18/2006 update: new labeling
|
|
#
|
|
#
|
|
# This file shows how to activate and install the access control
|
|
# framework for Xen.
|
|
##
|
|
|
|
|
|
INSTALLING A SECURITY POLICY IN XEN
|
|
===================================
|
|
|
|
By default, the access control architecture is disabled in Xen. To
|
|
enable the access control architecture in Xen follow the steps below.
|
|
This description assumes that you want to install the Chinese Wall and
|
|
Simple Type Enforcement policy. Some file names need to be replaced
|
|
below to activate the Chinese Wall OR the Type Enforcement policy
|
|
exclusively (chwall_ste --> {chwall, ste}).
|
|
|
|
0. build and install the xm man page. It includes the description of
|
|
available management commands for the security policy for Xen and
|
|
the labeling of domains. If not installed by default, you can make
|
|
and install the xm man page as follows:
|
|
# cd "xen_root"/doc
|
|
# make install
|
|
Then, use man xm to read it:
|
|
# man xm
|
|
|
|
1. enable access control in Xen
|
|
# cd "xen_root"
|
|
# edit/xemacs/vi Config.mk
|
|
|
|
change the lines:
|
|
ACM_SECURITY ?= n
|
|
to:
|
|
ACM_SECURITY ?= y
|
|
|
|
Now the hypervisor will boot into the policy that is specified
|
|
in the grub configuration. If you would like to boot into a
|
|
specific policy (even if you can't specify a boot policy but
|
|
need to set the policy later using the 'xensec_tool
|
|
loadpolicy'), then use the other config parameter to change
|
|
from NULL to any other default policy, e.g.:
|
|
ACM_DEFAULT_SECURITY_POLICY ?= ACM_CHINESE_WALL_AND_SIMPLE_TYPE_ENFORCEMENT_POLICY
|
|
|
|
# make dist
|
|
# ./install.sh
|
|
|
|
2. Build acm and policy tools and create boot-able policy:
|
|
# cd tools/security
|
|
# make install
|
|
|
|
For description of the following commands, please see the xm
|
|
man page (docs/man1/xm.1). If it is not built, then you can
|
|
create it manually: cd "xen_root"/docs; make; man man1/xm.1
|
|
|
|
Step1: Building binary version of an example policy:
|
|
# xm makepolicy example.chwall_ste.client_v1
|
|
# xm cfgbootpolicy example.chwall_ste.client_v1
|
|
|
|
Please verify boot entry in /boot/grub/grub.conf (or menu.lst):
|
|
title Xen (2.6.16)
|
|
root (hd0,0)
|
|
kernel /xen.gz dom0_mem=2000000 console=vga
|
|
module /vmlinuz-2.6.16-xen ro root=/dev/VolGroup00/LogVol00 rhgb
|
|
module /initrd-2.6.165-xen-U.img
|
|
module /example.chwall_ste.client_v1.bin
|
|
|
|
3. reboot into the newly compiled hypervisor
|
|
|
|
after boot
|
|
# xm dmesg should show an entry about the policy being loaded
|
|
during the boot process
|
|
|
|
# xm dumppolicy
|
|
should print the new binary policy representation
|
|
including the policy name example.chwall_ste.client_v1
|
|
|
|
# xm list --label
|
|
should show security label names behind the running domains
|
|
|
|
For more information about how to use the security-enabled Xen, see
|
|
the examples.txt file in this directory.
|