From 3fd29b158f8ad8e43dd10a2d76d8ac793e3c77f8 Mon Sep 17 00:00:00 2001 From: Keir Fraser Date: Fri, 4 Apr 2008 12:59:28 +0100 Subject: [PATCH] acm: Modify the default ACM boot policy so that unlabeled domains can always start I am modifying the xen- and xend-internal default policy so that unlabeled domains can always start. A more restrictive security policy can then be set on top of that policy. Signed-off-by: Stefan Beger --- tools/python/xen/util/acmpolicy.py | 26 ++++++++++++++++--- tools/security/Makefile | 2 +- xen/xsm/acm/acm_chinesewall_hooks.c | 8 ++++-- .../acm/acm_simple_type_enforcement_hooks.c | 12 ++++++--- 4 files changed, 39 insertions(+), 9 deletions(-) diff --git a/tools/python/xen/util/acmpolicy.py b/tools/python/xen/util/acmpolicy.py index ef31734ad3..89ee983600 100644 --- a/tools/python/xen/util/acmpolicy.py +++ b/tools/python/xen/util/acmpolicy.py @@ -76,6 +76,7 @@ DEFAULT_policy = \ " \n" +\ " \n" +\ " SystemManagement\n" +\ +" __UNLABELED__\n" +\ " \n" +\ " \n" +\ " \n" +\ @@ -89,12 +90,30 @@ DEFAULT_policy = \ " SystemManagement\n" +\ " \n" +\ " SystemManagement\n" +\ +" __UNLABELED__\n" +\ +" \n" +\ +" \n" +\ +" \n" +\ +" \n" +\ +" \n" +\ +" \n" +\ +" __UNLABELED__\n" +\ +" \n" +\ +" __UNLABELED__\n" +\ " \n" +\ " \n" +\ " \n" +\ " \n" +\ " \n" +\ " \n" +\ +" \n" +\ +" \n" +\ +" __UNLABELED__\n" +\ +" \n" +\ +" __UNLABELED__\n" +\ +" \n" +\ +" \n" +\ +" \n" +\ " \n" +\ "\n" @@ -231,13 +250,14 @@ class ACMPolicy(XSPolicy): """ Determine whether this is the default policy """ - default = ['SystemManagement'] + default = ['SystemManagement', ACM_LABEL_UNLABELED ] if self.policy_get_virtualmachinelabel_names() == default and \ self.policy_get_bootstrap_vmlabel() == default[0] and \ self.policy_get_stetypes_types() == default and \ self.policy_get_stes_of_vmlabel(default[0]) == default and \ - self.policy_get_resourcelabel_names() == [] and \ - self.policy_get_chwall_types() == default and \ + self.policy_get_stes_of_vmlabel(default[1]) == [default[1]] and \ + self.policy_get_resourcelabel_names() == [default[1]] and \ + self.policy_get_chwall_types() == [ default[0] ] and \ self.get_name() == "DEFAULT": return True return False diff --git a/tools/security/Makefile b/tools/security/Makefile index 81da019485..61062715a2 100644 --- a/tools/security/Makefile +++ b/tools/security/Makefile @@ -32,7 +32,7 @@ ACM_SECGEN_CGIDIR = $(ACM_SECGEN_HTMLDIR)/cgi-bin ACM_SCHEMA = security_policy.xsd ACM_EXAMPLES = client_v1 test -ACM_DEF_POLICIES = DEFAULT-UL +ACM_DEF_POLICIES = ACM_POLICY_SUFFIX = security_policy.xml ifeq ($(ACM_SECURITY),y) diff --git a/xen/xsm/acm/acm_chinesewall_hooks.c b/xen/xsm/acm/acm_chinesewall_hooks.c index 65e60e7cb4..977c45ff2a 100644 --- a/xen/xsm/acm/acm_chinesewall_hooks.c +++ b/xen/xsm/acm/acm_chinesewall_hooks.c @@ -637,8 +637,12 @@ static void chwall_domain_destroy(void *object_ssid, struct domain *d) static int chwall_is_default_policy(void) { - return ( (chwall_bin_pol.max_types == 1 ) && - (chwall_bin_pol.max_ssidrefs == 2 ) ); + static const domaintype_t def_policy[2] = { 0x0, 0x0 }; + return ( ( chwall_bin_pol.max_types == 1 ) && + ( chwall_bin_pol.max_ssidrefs == 2 ) && + ( memcmp(chwall_bin_pol.ssidrefs, + def_policy, + sizeof(def_policy)) == 0 ) ); } diff --git a/xen/xsm/acm/acm_simple_type_enforcement_hooks.c b/xen/xsm/acm/acm_simple_type_enforcement_hooks.c index 01eae51bb2..2810597c39 100644 --- a/xen/xsm/acm/acm_simple_type_enforcement_hooks.c +++ b/xen/xsm/acm/acm_simple_type_enforcement_hooks.c @@ -108,7 +108,7 @@ static int share_common_type(struct domain *subj, struct domain *obj) int acm_init_ste_policy(void) { /* minimal startup policy; policy write-locked already */ - ste_bin_pol.max_types = 1; + ste_bin_pol.max_types = 2; ste_bin_pol.max_ssidrefs = 1 + dom0_ste_ssidref; ste_bin_pol.ssidrefs = (domaintype_t *)xmalloc_array(domaintype_t, @@ -123,7 +123,9 @@ int acm_init_ste_policy(void) ste_bin_pol.max_ssidrefs); /* initialize state so that dom0 can start up and communicate with itself */ + ste_bin_pol.ssidrefs[ste_bin_pol.max_types - 1 ] = 1; ste_bin_pol.ssidrefs[ste_bin_pol.max_types * dom0_ste_ssidref] = 1; + ste_bin_pol.ssidrefs[ste_bin_pol.max_types * dom0_ste_ssidref + 1] = 1; /* init stats */ atomic_set(&(ste_bin_pol.ec_eval_count), 0); @@ -868,8 +870,12 @@ ste_authorization(ssidref_t ssidref1, ssidref_t ssidref2) static int ste_is_default_policy(void) { - return ((ste_bin_pol.max_types == 1) && - (ste_bin_pol.max_ssidrefs == 2)); + const static domaintype_t def_policy[4] = { 0x0, 0x1, 0x1, 0x1}; + return ((ste_bin_pol.max_types == 2) && + (ste_bin_pol.max_ssidrefs == 2) && + (memcmp(ste_bin_pol.ssidrefs, + def_policy, + sizeof(def_policy)) == 0)); } /* now define the hook structure similarly to LSM */ -- 2.30.2