mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 10:40:03 +01:00
kaf24@firebug.cl.cam.ac.uk
cc677c9d4e
1. adapts ACM hooks to the slightly changed event channel structure 2. introduces an ACM_GETDECISION command, which enables authorized domains to retrieve policy decisions regarding the sharing of resources (STE policy) from the Xen hypervisor 3. includes cleanup (warnings I found when applying analysis tools such as beam or flawfinder to the ACM code) The get_decision function is useful to enforce: * the security policy on network traffic in the network backends in domain 0; currently there is no enforcement in Dom0 and all packets flow freely * the security policy in block device backends to control which domains can access which vdisk resources I have added a small test program that shows how to use the get_decision ACM interface call, it is in tools/security/get_decision.c and will be compiled together with the policy tools. As usual, the ACM is unconfigured until you switch on a security policy on in Config.mk. Signed-off: Reiner Sailer <sailer@us.ibm.com>
83 lines
2.0 KiB
Makefile
83 lines
2.0 KiB
Makefile
XEN_ROOT = ../..
|
|
include $(XEN_ROOT)/tools/Rules.mk
|
|
|
|
SRCS = secpol_tool.c
|
|
CFLAGS += -Wall
|
|
CFLAGS += -Werror
|
|
CFLAGS += -O3
|
|
CFLAGS += -fno-strict-aliasing
|
|
CFLAGS += -I. -I/usr/include/libxml2
|
|
CFLAGS_XML2BIN += $(shell xml2-config --cflags --libs )
|
|
#if above does not work, try -L/usr/lib -lxml2 -lz -lpthread -lm
|
|
XML2VERSION = $(shell xml2-config --version )
|
|
VALIDATE_SCHEMA=$(shell if [[ $(XML2VERSION) < 2.6.20 ]]; then echo ""; else echo "-DVALIDATE_SCHEMA"; fi; )
|
|
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_NULL_POLICY)
|
|
POLICY=null
|
|
endif
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_CHINESE_WALL_POLICY)
|
|
POLICY=chwall
|
|
endif
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY)
|
|
POLICY=ste
|
|
endif
|
|
ifeq ($(ACM_USE_SECURITY_POLICY),ACM_CHINESE_WALL_AND_SIMPLE_TYPE_ENFORCEMENT_POLICY)
|
|
POLICY=chwall_ste
|
|
endif
|
|
POLICYFILE=./policies/$(POLICY)/$(POLICY).bin
|
|
|
|
ifneq ($(ACM_USE_SECURITY_POLICY), ACM_NULL_POLICY)
|
|
all: build
|
|
|
|
install:all
|
|
|
|
default:all
|
|
else
|
|
all:
|
|
|
|
install:
|
|
|
|
default:
|
|
endif
|
|
|
|
build: mk-symlinks
|
|
$(MAKE) secpol_tool
|
|
$(MAKE) secpol_xml2bin
|
|
$(MAKE) get_decision
|
|
chmod 700 ./setlabel.sh
|
|
chmod 700 ./updategrub.sh
|
|
chmod 700 ./getlabel.sh
|
|
|
|
secpol_tool : secpol_tool.c
|
|
$(CC) $(CPPFLAGS) $(CFLAGS) -o $@ $<
|
|
|
|
secpol_xml2bin : secpol_xml2bin.c secpol_xml2bin.h
|
|
$(CC) $(CPPFLAGS) $(CFLAGS) $(CFLAGS_XML2BIN) $(VALIDATE_SCHEMA) -o $@ $<
|
|
|
|
clean:
|
|
rm -rf secpol_tool secpol_xml2bin xen
|
|
|
|
policy_clean:
|
|
rm -rf policies/*/*.bin policies/*/*.map
|
|
|
|
mrproper: clean policy_clean
|
|
|
|
|
|
$(POLICYFILE) : build
|
|
@./secpol_xml2bin $(POLICY) > /dev/null
|
|
|
|
boot_install: $(POLICYFILE)
|
|
@cp $(POLICYFILE) /boot
|
|
@./updategrub.sh $(POLICY) $(PWD)/$(XEN_ROOT)
|
|
|
|
LINUX_ROOT := $(XEN_ROOT)/linux-2.6-xen-sparse
|
|
mk-symlinks:
|
|
[ -e xen/linux ] || mkdir -p xen/linux
|
|
[ -e xen/io ] || mkdir -p xen/io
|
|
( cd xen >/dev/null ; \
|
|
ln -sf ../$(XEN_ROOT)/xen/include/public/*.h . )
|
|
( cd xen/io >/dev/null ; \
|
|
ln -sf ../../$(XEN_ROOT)/xen/include/public/io/*.h . )
|
|
( cd xen/linux >/dev/null ; \
|
|
ln -sf ../../$(LINUX_ROOT)/include/asm-xen/linux-public/*.h . )
|