From: Daniel De Graaf <dgdegra@tycho.nsa.gov>
To: cooldharma06 <cooldharma06@gmail.com>
Cc: xen-devel@lists.xen.org
Subject: Re: xen (XSM policy) : Unload and analysis tool.
Date: Fri, 19 Jul 2013 10:45:00 -0400 [thread overview]
Message-ID: <51E950EC.3070704@tycho.nsa.gov> (raw)
In-Reply-To: <CAJ4UyV3h3zyb5CtH1bX2dDvP8z0C=2QcKPPgagQrpsH+g7ep1w@mail.gmail.com>
On 07/19/2013 02:33 AM, cooldharma06 wrote:
> Hi all,
>
> i want to know about the following things:
>
> 1.unloading XSM policy.
>
> -xl loadpolicy xenpolicy.24
>
> to load the policy. For unloading is there any command is available.?
No. Loading another policy will replace the existing one, so there is no
need to unload a policy. Disabling enforcing mode will prevent XSM from
denying any accesses, which has a similar effect to unloading the policy.
> 2. i want to know any analysis tool is available for XSM policy.
SELinux tools such as sesearch will work on XSM policy; you just need to
point them at the Xen policy explicitly. For some of the tools, you may
need to explicitly tell the tool that MLS is disabled.
> 3. Apart from wiki.org/XSM any other tutorial is available for developing
> own XSM policy.?
The xen source has docs/misc/xsm-flask.txt; otherwise, any tutorial on writing
SELinux policy should apply (although the specific macros and access vectors
will be different). I am not aware of a xen-specific tutorial.
> Thanks and regards,
> cooldharma06.
>
--
Daniel De Graaf
National Security Agency
prev parent reply other threads:[~2013-07-19 14:45 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-19 6:33 xen (XSM policy) : Unload and analysis tool cooldharma06
2013-07-19 14:45 ` Daniel De Graaf [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51E950EC.3070704@tycho.nsa.gov \
--to=dgdegra@tycho.nsa.gov \
--cc=cooldharma06@gmail.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).