Re: [Xen-devel] protecting xen startup

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Nov 24, 2004 at 11:48:15AM -0000, Neugebauer, Rolf wrote:
> Yes, in principle you should be able to do that (and we have been
> thinking along similar lines). However, at the moment the linux kernel
> in the exporting VM (BE) does not know anything about other VMs so as
> far as my understanding goes you can't apply SELinux policies to it as
> you don't have a subject.
 
 okay.

 that can be dealt with by... (this is speculation, here!)

 by writing an selinux policy in advance that defines how many
 virtual machines you have, and creating xen_vm0_t, xen_vm1_t
 etc. to represent them.

 you then define what operations can be carried out, and then
 grant a program the right to perform that operation on SPECIFIC
 machines.  [yes there is a short-hand which allows you to specify an
 operation be allowed by a program on all machines].

 then it would be necessary to modify the linux kernel to call the
 avc_has_perm() function at the appropriate point to check, at the time
 that an operation was being done (e.g. read from block device), as to
 whether that process had the right to perform that operation on that
 xen virtual machine.

 in order for this to work, it would be necessary to have a translation
 mechanism between the numbering xen_vm_0_t etc. and the actual xen
 virtual machines.

 looking at avc_has_perm(), you'd need a SID per virtual machine,
 as the second argument...

 xen_communication_has_perm(struct task_struct *tsk,
                            struct xen_info *xen,
							u32 perms)
 {
	 return avc_has_perm(tsec->sid,
	                     xen->sid, SECCLASS_XEN, perms, NULL, NULL);
 }

 where xen->sid contains "xen_vm_0_t", "xen_vm_1_t" etc.
 and tsec->sid contains "xen_xm_bin_t" - representing the xen control
 binary /usr/bin/xm.

 the question i can't answer (the bit that i don't quite grok) is
 how do you get hold of the right xen_info struct and how do you blat
 the sid into it?

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.