From mboxrd@z Thu Jan 1 00:00:00 1970 From: Keir Fraser Subject: Re: [Xense-devel][PATCH][XSM][1/4] Xen Security Modules Patch Date: Fri, 09 Mar 2007 09:43:28 +0000 Message-ID: References: <1173383888.11144.119.camel@moss-walleye.epoch.ncsc.mil> Mime-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1173383888.11144.119.camel@moss-walleye.epoch.ncsc.mil> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: "George S. Coker, II" , Keir Fraser Cc: xen-devel@lists.xensource.com, xense-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org On 8/3/07 19:58, "George S. Coker, II" wrote: > purpose of the security field is not only to facilitate information > flows to resources, virtual or physical, in the hypervisor, but also to > facilitate guests in the ability to identify channels based on these > security properties and support information flows mediated by these > guests. This is really an important property for creating secure > channels between domains as well as other resources (virtual or > physical) resources. E.g., the information flow from timer events to a guest? I can't envisage what kinds of policies you might have in mind. I'm probably missing some bigger picture. > To achieve a very light-weight > domain, one would like to remove as much functionality from that domain > as possible, to include the interrupt handler. Instead, there would > exist a light-weight domain interrupt handler domain that is responsible > for this functionality. These interrupts would manifest as interdomain > channels; however, the ipi mechanism remains unless a hook exists to > block this code path. Likewise, the light-weight domains wouldn't be > able to close their channels arbitrarily, and require a check on close > as well. I think this sounds like a microkernel-style 'interrupt server'? Why would you want that? And if you did have it, why would you care about the clients of this server closing their ends of interdomain event channels? -- Keir