[Xen-devel] [PATCH] ACM: hypervisor security policy as boot option

[Reiner Sailer <sailer@xxxxxxxxxx>]

This patch enables the Xen hypervisor
ACM security policy to be determined at boot time (instead of at compile
time). It enables a single xen.gz binary to run under different security
policy types, which simplifies distributions considerably. To this end,
this patch replaces the current single compile switch in Config.mk with
the following two:

1. ACM_SECURITY (y/n) if "n",
then the ACM is not compiled and no security policies can be configured
at boot time. If "y", then the ACM is compiled and can be configured
into any of the available policy types (null, chwall, ste, chwall_ste)
by specifying a valid boot policy .bin file in the grub boot configuration.

2. ACM_DEFAULT_SECURITY_POLICY (null
/ chwall / ste / chwall_ste) specifies the policy into which Xen defaults
in the case that security is enabled but no boot policy file is specified,
or the specified policy file is invalid (wrong version, magic, corrupted,
...)

While the type of the enabled policy
(null, ste, ...) is decided once during boot for the whole boot cycle,
the policy instantiation can be changed during operation as usual with
the security tools.

Regards
Reiner

Signed-off by: Tomas Lendacky <toml@xxxxxxxxxx>
Signed-off by: Reiner Sailer <sailer@xxxxxxxxxx>

File changes:
 Config.mk      
            |   14 ++-
 tools/security/Makefile  
  |   12 +--
 tools/security/install.txt  |
   8 +-
 xen/Makefile      
         |    6 -
 xen/Rules.mk      
         |    3 
 xen/acm/acm_core.c    
     |  164 +++++++++++++++++++++++++-------------------
 xen/acm/acm_policy.c    
   |   26 +++++-
 xen/common/acm_ops.c    
   |    2 
 xen/include/acm/acm_core.h  |
   5 -
 xen/include/acm/acm_hooks.h |
   2 
 xen/include/public/acm.h  
 |    1 
 11 files changed, 145 insertions(+),
98 deletions(-)

Patch:

acm_bootpolicy.diff
Description: Binary data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel