mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 02:30:03 +01:00
kaf24@firebug.cl.cam.ac.uk
cc677c9d4e
1. adapts ACM hooks to the slightly changed event channel structure 2. introduces an ACM_GETDECISION command, which enables authorized domains to retrieve policy decisions regarding the sharing of resources (STE policy) from the Xen hypervisor 3. includes cleanup (warnings I found when applying analysis tools such as beam or flawfinder to the ACM code) The get_decision function is useful to enforce: * the security policy on network traffic in the network backends in domain 0; currently there is no enforcement in Dom0 and all packets flow freely * the security policy in block device backends to control which domains can access which vdisk resources I have added a small test program that shows how to use the get_decision ACM interface call, it is in tools/security/get_decision.c and will be compiled together with the policy tools. As usual, the ACM is unconfigured until you switch on a security policy on in Config.mk. Signed-off: Reiner Sailer <sailer@us.ibm.com>
## # readme.txt <description to the xen access control architecture> # # Author: # Reiner Sailer 08/15/2005 <sailer@watson.ibm.com> # # # This file is a toc for information regarding # the access control policy and tools in Xen. ## 1. policy.txt: describes the general reasoning and examples for access control policies in Xen 2. install.txt describes the activation of the access control framework in Xen 3. example.txt describes the available tools for managing security policies in Xen and the tools to label domains