WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

[Xen-devel] Re: [Xense-devel] [PATCH] ACM: adding C-support for policy t

To: David Palmer <dwpalmer.xense@xxxxxxxxx>
Subject: [Xen-devel] Re: [Xense-devel] [PATCH] ACM: adding C-support for policy translation and labeling support for domains
From: Reiner Sailer <sailer@xxxxxxxxxx>
Date: Wed, 31 Aug 2005 21:10:51 -0400
Cc: Ray Valdez <rvaldez@xxxxxxxxxx>, Stefan Berger <stefanb@xxxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxx, xense-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Thu, 01 Sep 2005 01:08:56 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <7d415b2805083116114dd152@xxxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx

Hi Dave,

we are introducing the get_ssid ACM command to allow  ACM policy-specific decisions
and enforcement in  policy-aware domains.

One can call back into the hypervisor for policy decisions having the benefit you are
naming (transparency). However doing this for every IP packet, for example, seems not efficient.
Consequently, you'll end up establishing decision cashes in the domains. Then you have the same
problem as before (change in policy) without the performance benefit. If transparency
(policy hiding) is the most important factor, then such a solution has merit. Another benefit of
getting the whole ssid is that you can re-use this information for other decisions since you get
all the types of a domain, not just a yes/no decision.

Nothing speaks against having an optional "acm_decision" call that can be used
by domains that don't  want to make informed decisions but blindly call the ACM
(hypervisor call++ overhead) each time they make a decisions. Such a call might prove useful
where decisions are made very infrequently. For example, a virtual block device domain owning a
hard drive and allowing other domains to mount certain logical partitions might just ask the ACM for
a decision  when deciding about accepting a mount-request from a domain to a logical partition
(right now, the virtual block device domain is dom0 but this could be refined in the future when other
domains can 'own' peripherals).

Regards
Reiner

xense-devel-bounces@xxxxxxxxxxxxxxxxxxx wrote on 08/31/2005 07:11:44 PM:

> I'm not clear why the getssid() needs to be introduced.  Isn't the
> problem better solved by introducing new object managers?  With the
> getssid(), the code must know about the specific policy, making the
> policy less amenable to adjustment as problems are discovered.  
> Wouldn't it be better for the domains to provide object managers?  
> This would allow the STE policy to make statements about those new
> objects.  The code can be policy neutral by strictly following the
> decisions of the security server.  Wouldn't this make it easier to
> revoke policies and update them without having to change the code and patch?
>
> Dave
>

> On 8/18/05, Reiner Sailer <sailer@xxxxxxxxxx> wrote:
>
> This patch:
>
> * adds a C-based security policy translation tool to Xen
> (secpol_xml2bin) and removes the current Java
> security policy translator (Java dependencies).  The C-based tool
> integrates into the Xen source tree build
> and install (using gnome libxml2 for XML parsing). See install.txt.
>
> * introduces security labels and related tools. Users can now use
> semantic-rich label names to put security-tags
> on domains. See example.txt, policy.txt.
>
> * moves the security configuration (currently
> ACM_USE_SECURITY_POLICY) from xen/Rules.mk
> into a separate top-level Security.mk file  (it is needed by the
> tools/security and xen/acm).
>
> Both xen/acm and tools/security are built during the Xen build
> process only if ACM_USE_SECURITY_POLICY
> is not ACM_NULL_POLICY (which is the default setting).
>
> Comments welcome!
>
> Note: We are currently preparing a patch that introduces a new ACM
> command (getssid) to retrieve the security types
> of a running domain. This command is enables domain-internal
> enforcement functions based on the ACM security policy.
>
> Thanks
> Reiner
>
> Signed-off-by Reiner Sailer <sailer@xxxxxxxxxx>
> Signed-off by Stefan Berger <stefanb@xxxxxxxxxx>
> Signed-off by Ray Valdez <rvaldez@xxxxxxxxxx>
>
>
> _______________________________________________
> Xense-devel mailing list
> Xense-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xense-devel
>
>

> _______________________________________________
> Xense-devel mailing list
> Xense-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xense-devel
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
<Prev in Thread] Current Thread [Next in Thread>