[PATCH RFC] flask/policy: use naming convention xenpolicy-$VERSION

[PATCH RFC] flask/policy: use naming convention xenpolicy-$VERSION

[Wei Liu]

The original scheme is to use xenpolicy.$VERSION. Change it to
xenpolicy-$VERSION This naming convention resembles the one used in
Linux.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov>
---
to Daniel:

We plan to add in a new test case for XSM in OSSTest, which uses Grub to
generate boot entry. The boot entry generation relies on a naming
convention to look up files. In short, we need to agree on one naming
convention, not necessary the one I propose here (though I think it's
quite sensible to follow the one Linux uses).

It's important for us to reach an agreement before I can write any patch
for upstream grub. Comments are welcome.
---
 .gitignore                  |    2 +-
 tools/flask/policy/Makefile |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 6d725aa..e5ad43d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -272,7 +272,7 @@ xen/xsm/flask/include/class_to_string.h
 xen/xsm/flask/include/flask.h
 xen/xsm/flask/include/initial_sid_to_string.h
 tools/flask/policy/policy.conf
-tools/flask/policy/xenpolicy.24
+tools/flask/policy/xenpolicy-*
 xen/xen
 xen/xen-syms
 xen/xen.*
diff --git a/tools/flask/policy/Makefile b/tools/flask/policy/Makefile
index a1c0f11..17c132a 100644
--- a/tools/flask/policy/Makefile
+++ b/tools/flask/policy/Makefile
@@ -32,7 +32,7 @@ M4 ?= m4
 # include the Xen policy type (needed for static device policy).
 OUTPUT_POLICY = 24
 
-POLICY_FILENAME = xenpolicy.$(OUTPUT_POLICY)
+POLICY_FILENAME = xenpolicy-$(OUTPUT_POLICY)
 POLICY_LOADPATH = /boot
 
 # policy source layout
-- 
1.7.10.4

Re: [PATCH RFC] flask/policy: use naming convention xenpolicy-$VERSION

[Daniel De Graaf]

On 09/15/2014 09:27 AM, Wei Liu wrote:
> The original scheme is to use xenpolicy.$VERSION. Change it to
> xenpolicy-$VERSION This naming convention resembles the one used in
> Linux.

I belive the Linux naming convention for SELinux binary policy is still
/etc/selinux/$NAME/policy/policy.$VERSION; however, this naming decision
is distribution-specific and not overly important to Xen.

Xen does not use the Linux kernel policy revision numbers to provide
backwards comparability - unlike Linux, the Xen policy is distributed with
the Xen kernel, and the hypervisor does not provide the ability to load
policies compiled for older or newer hypervisors (to be precise, it does not
allow policies with a different set of permissions).  The policy output
version number has stayed at 24 since the introduction of the FLASK security
server, and I would not expect this to change unless there is a reason to port
a new policy feature from SELinux.

> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
> Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov>
> ---
> to Daniel:
>
> We plan to add in a new test case for XSM in OSSTest, which uses Grub to
> generate boot entry. The boot entry generation relies on a naming
> convention to look up files. In short, we need to agree on one naming
> convention, not necessary the one I propose here (though I think it's
> quite sensible to follow the one Linux uses).
>
> It's important for us to reach an agreement before I can write any patch
> for upstream grub. Comments are welcome.

I agree this is a good idea.  I would propose using the Xen hypervisor version
number in order to support multiple hypervisor versions each paired with their
own security policy: xenpolicy-$(XEN_FULLVERSION); perhaps with symlinks as is
done with the hypervisor.  Wiring up the Makefile to produce this may be tricky,
since the Xen version is in xen/Makefile and not somewhere in tools/.

-- 
Daniel De Graaf
National Security Agency

Re: [PATCH RFC] flask/policy: use naming convention xenpolicy-$VERSION

[Wei Liu]

On Mon, Sep 15, 2014 at 10:55:15AM -0400, Daniel De Graaf wrote:
> On 09/15/2014 09:27 AM, Wei Liu wrote:
> >The original scheme is to use xenpolicy.$VERSION. Change it to
> >xenpolicy-$VERSION This naming convention resembles the one used in
> >Linux.
> 
> I belive the Linux naming convention for SELinux binary policy is still
> /etc/selinux/$NAME/policy/policy.$VERSION; however, this naming decision
> is distribution-specific and not overly important to Xen.
> 
> Xen does not use the Linux kernel policy revision numbers to provide
> backwards comparability - unlike Linux, the Xen policy is distributed with
> the Xen kernel, and the hypervisor does not provide the ability to load
> policies compiled for older or newer hypervisors (to be precise, it does not
> allow policies with a different set of permissions).  The policy output
> version number has stayed at 24 since the introduction of the FLASK security
> server, and I would not expect this to change unless there is a reason to port
> a new policy feature from SELinux.
> 

I see. Thanks for clarifying this.

> >Signed-off-by: Wei Liu <wei.liu2@citrix.com>
> >Cc: Daniel De Graaf <dgdegra@tycho.nsa.gov>
> >---
> >to Daniel:
> >
> >We plan to add in a new test case for XSM in OSSTest, which uses Grub to
> >generate boot entry. The boot entry generation relies on a naming
> >convention to look up files. In short, we need to agree on one naming
> >convention, not necessary the one I propose here (though I think it's
> >quite sensible to follow the one Linux uses).
> >
> >It's important for us to reach an agreement before I can write any patch
> >for upstream grub. Comments are welcome.
> 
> I agree this is a good idea.  I would propose using the Xen hypervisor version
> number in order to support multiple hypervisor versions each paired with their
> own security policy: xenpolicy-$(XEN_FULLVERSION); perhaps with symlinks as is
> done with the hypervisor.  Wiring up the Makefile to produce this may be tricky,
> since the Xen version is in xen/Makefile and not somewhere in tools/.
> 

xenpolicy-$(XEN_FULLVERSION) sounds plausible. I will look into this.

Wei.

> -- 
> Daniel De Graaf
> National Security Agency