Protect Xen Virtualization via SElinux.

Protect Xen Virtualization via SElinux.

[Jason Long]

Hello.
How can I protect my Xen VM via SElinux? Can you show me some useful examples?

Thnak you.

Re: Protect Xen Virtualization via SElinux.

[Stephen Smalley]

On 06/19/2016 09:15 AM, Jason Long wrote:
> Hello.
> How can I protect my Xen VM via SElinux? Can you show me some useful examples?

I'm not entirely sure what you are asking, but possible answers:

1. If you want to apply SELinux-like controls over Xen virtual machines
(domains), then you can use Xen Security Modules and the Flask security
module (commonly abbreviated XSM/Flask) to define and enforce a policy
over the hypervisor objects and operations.

2. If you want to use SELinux to harden the Xen domain-0 or specific
domUs, you can just enable it in those domains and configure your policy
accordingly.

If you want a worked example of applying both XSM/Flask and SELinux,
have a look at OpenXT,
http://openxt.org/

Re: Protect Xen Virtualization via SElinux.

[Jason Long]

Can you show me some examples for both ?



On Monday, June 20, 2016 5:13 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
On 06/19/2016 09:15 AM, Jason Long wrote:

> Hello.
> How can I protect my Xen VM via SElinux? Can you show me some useful examples?

I'm not entirely sure what you are asking, but possible answers:

1. If you want to apply SELinux-like controls over Xen virtual machines
(domains), then you can use Xen Security Modules and the Flask security
module (commonly abbreviated XSM/Flask) to define and enforce a policy
over the hypervisor objects and operations.

2. If you want to use SELinux to harden the Xen domain-0 or specific
domUs, you can just enable it in those domains and configure your policy
accordingly.

If you want a worked example of applying both XSM/Flask and SELinux,
have a look at OpenXT,
http://openxt.org/

Re: Protect Xen Virtualization via SElinux.

[Stephen Smalley]

On 06/20/2016 11:06 AM, Jason Long wrote:
> Can you show me some examples for both ?

I already pointed you to OpenXT; it is a worked example of both.

> On Monday, June 20, 2016 5:13 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 06/19/2016 09:15 AM, Jason Long wrote:
> 
>> Hello.
>> How can I protect my Xen VM via SElinux? Can you show me some useful examples?
> 
> I'm not entirely sure what you are asking, but possible answers:
> 
> 1. If you want to apply SELinux-like controls over Xen virtual machines
> (domains), then you can use Xen Security Modules and the Flask security
> module (commonly abbreviated XSM/Flask) to define and enforce a policy
> over the hypervisor objects and operations.
> 
> 2. If you want to use SELinux to harden the Xen domain-0 or specific
> domUs, you can just enable it in those domains and configure your policy
> accordingly.
> 
> If you want a worked example of applying both XSM/Flask and SELinux,
> have a look at OpenXT,
> http://openxt.org/
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
> 

Re: Protect Xen Virtualization via SElinux.

[Jason Long]

I can't find any example :( Can you show me some urls?



On Monday, June 20, 2016 7:45 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
On 06/20/2016 11:06 AM, Jason Long wrote:
> Can you show me some examples for both ?

I already pointed you to OpenXT; it is a worked example of both.


> On Monday, June 20, 2016 5:13 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 06/19/2016 09:15 AM, Jason Long wrote:
> 
>> Hello.
>> How can I protect my Xen VM via SElinux? Can you show me some useful examples?
> 
> I'm not entirely sure what you are asking, but possible answers:
> 
> 1. If you want to apply SELinux-like controls over Xen virtual machines
> (domains), then you can use Xen Security Modules and the Flask security
> module (commonly abbreviated XSM/Flask) to define and enforce a policy
> over the hypervisor objects and operations.
> 
> 2. If you want to use SELinux to harden the Xen domain-0 or specific
> domUs, you can just enable it in those domains and configure your policy
> accordingly.
> 
> If you want a worked example of applying both XSM/Flask and SELinux,
> have a look at OpenXT,
> http://openxt.org/
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.

> 

Re: Protect Xen Virtualization via SElinux.

[Patrick K., ITF]

[-- Attachment #1: Type: text/plain, Size: 1826 bytes --]

Jason,


The files are on Github here:  https://github.com/OpenXT/openxt

and here: *https://github.com/OpenXT/*

Best Regards,

-- 
  Patrick
--

On 6/21/2016 5:26 AM, Jason Long wrote:
> I can't find any example :( Can you show me some urls?
>
>
>
> On Monday, June 20, 2016 7:45 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 06/20/2016 11:06 AM, Jason Long wrote:
>> Can you show me some examples for both ?
> I already pointed you to OpenXT; it is a worked example of both.
>
>
>> On Monday, June 20, 2016 5:13 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
>> On 06/19/2016 09:15 AM, Jason Long wrote:
>>
>>> Hello.
>>> How can I protect my Xen VM via SElinux? Can you show me some useful examples?
>> I'm not entirely sure what you are asking, but possible answers:
>>
>> 1. If you want to apply SELinux-like controls over Xen virtual machines
>> (domains), then you can use Xen Security Modules and the Flask security
>> module (commonly abbreviated XSM/Flask) to define and enforce a policy
>> over the hypervisor objects and operations.
>>
>> 2. If you want to use SELinux to harden the Xen domain-0 or specific
>> domUs, you can just enable it in those domains and configure your policy
>> accordingly.
>>
>> If you want a worked example of applying both XSM/Flask and SELinux,
>> have a look at OpenXT,
>> http://openxt.org/
>> _______________________________________________
>> Selinux mailing list
>> Selinux@tycho.nsa.gov
>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
>> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.


[-- Attachment #2: Type: text/html, Size: 3597 bytes --]

Re: Protect Xen Virtualization via SElinux.

[Jason Long]

[-- Attachment #1: Type: text/plain, Size: 1954 bytes --]

No, I mean is how to drive it. 

    On Tuesday, June 21, 2016 2:28 PM, "Patrick K., ITF" <cto@itechfrontiers.com> wrote:
 

  Jason, 
  The files are on Github here:  https://github.com/OpenXT/openxt and here:  https://github.com/OpenXT/ Best Regards,
  -- 
 Patrick
-- On 6/21/2016 5:26 AM, Jason Long wrote:
  
 I can't find any example :( Can you show me some urls?



On Monday, June 20, 2016 7:45 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
On 06/20/2016 11:06 AM, Jason Long wrote:
 
 Can you show me some examples for both ?
 
 I already pointed you to OpenXT; it is a worked example of both.


 
 On Monday, June 20, 2016 5:13 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
On 06/19/2016 09:15 AM, Jason Long wrote:

 
 Hello.
How can I protect my Xen VM via SElinux? Can you show me some useful examples?
 
 I'm not entirely sure what you are asking, but possible answers:

1. If you want to apply SELinux-like controls over Xen virtual machines
(domains), then you can use Xen Security Modules and the Flask security
module (commonly abbreviated XSM/Flask) to define and enforce a policy
over the hypervisor objects and operations.

2. If you want to use SELinux to harden the Xen domain-0 or specific
domUs, you can just enable it in those domains and configure your policy
accordingly.

If you want a worked example of applying both XSM/Flask and SELinux,
have a look at OpenXT,
http://openxt.org/
_______________________________________________
Selinux mailing list
Selinux@tycho.nsa.gov
To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
 
  
  
 _______________________________________________
Selinux mailing list
Selinux@tycho.nsa.gov
To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
 
 
 

  

[-- Attachment #2: Type: text/html, Size: 5209 bytes --]

Re: Protect Xen Virtualization via SElinux.

[Patrick K., ITF]

[-- Attachment #1: Type: text/plain, Size: 2518 bytes --]

Jason,


Please read it here:

https://openxt.atlassian.net/wiki/pages/viewpage.action?pageId=10747915


https://openxt.atlassian.net/wiki/display/OD/Getting+Started


Best Regards,

-- 
  Patrick
--

On 6/21/2016 6:45 AM, Jason Long wrote:
> No, I mean is how to drive it.
>
>
> On Tuesday, June 21, 2016 2:28 PM, "Patrick K., ITF" 
> <cto@itechfrontiers.com> wrote:
>
>
> Jason,
>
> The files are on Github here: https://github.com/OpenXT/openxt
> and here: *https://github.com/OpenXT/*
> Best Regards,
> -- 
>   Patrick
> --
> On 6/21/2016 5:26 AM, Jason Long wrote:
>> I can't find any example :( Can you show me some urls?
>>
>>
>>
>> On Monday, June 20, 2016 7:45 PM, Stephen Smalley<sds@tycho.nsa.gov> <mailto:sds@tycho.nsa.gov>  wrote:
>> On 06/20/2016 11:06 AM, Jason Long wrote:
>>> Can you show me some examples for both ?
>> I already pointed you to OpenXT; it is a worked example of both.
>>
>>
>>> On Monday, June 20, 2016 5:13 PM, Stephen Smalley<sds@tycho.nsa.gov> <mailto:sds@tycho.nsa.gov>  wrote:
>>> On 06/19/2016 09:15 AM, Jason Long wrote:
>>>
>>>> Hello.
>>>> How can I protect my Xen VM via SElinux? Can you show me some useful examples?
>>> I'm not entirely sure what you are asking, but possible answers:
>>>
>>> 1. If you want to apply SELinux-like controls over Xen virtual machines
>>> (domains), then you can use Xen Security Modules and the Flask security
>>> module (commonly abbreviated XSM/Flask) to define and enforce a policy
>>> over the hypervisor objects and operations.
>>>
>>> 2. If you want to use SELinux to harden the Xen domain-0 or specific
>>> domUs, you can just enable it in those domains and configure your policy
>>> accordingly.
>>>
>>> If you want a worked example of applying both XSM/Flask and SELinux,
>>> have a look at OpenXT,
>>> http://openxt.org/
>>> _______________________________________________
>>> Selinux mailing list
>>> Selinux@tycho.nsa.gov <mailto:Selinux@tycho.nsa.gov>
>>> To unsubscribe, send email toSelinux-leave@tycho.nsa.gov <mailto:Selinux-leave@tycho.nsa.gov>.
>>> To get help, send an email containing "help" toSelinux-request@tycho.nsa.gov <mailto:Selinux-request@tycho.nsa.gov>.
>> _______________________________________________
>> Selinux mailing list
>> Selinux@tycho.nsa.gov <mailto:Selinux@tycho.nsa.gov>
>> To unsubscribe, send email toSelinux-leave@tycho.nsa.gov <mailto:Selinux-leave@tycho.nsa.gov>.
>> To get help, send an email containing "help" toSelinux-request@tycho.nsa.gov <mailto:Selinux-request@tycho.nsa.gov>.
>
>
>


[-- Attachment #2: Type: text/html, Size: 7789 bytes --]