Understanding Xen Security Policies: Structure, Implementation, and Improvement Strategies
This document explores the core ideas and implementation strategies behind Xen Security Policies (XSP). It describes the fundamental constructs, including subjects, objects, and access control rules. We dive into policy management services, domain creation, and specific implementations of access control hooks. Furthermore, we discuss potential improvements such as time-limited rules and dynamic change capabilities. By encapsulating types and establishing common labels, we highlight enhancements for effective policy management. This guide aims to facilitate a better understanding of security policy frameworks within the Xen environment.
Understanding Xen Security Policies: Structure, Implementation, and Improvement Strategies
E N D
Presentation Transcript
XEN STE POLICY • Basic Idea • Implementation • Improvement
Basic Idea • Subject • domain • Object • file, dir, device, domain • Rules • access control array
Basic Idea • Type • Basic type, can not be used directly • Label • Encapsulate types • Subject Label • Object Label • Rule • Only two labels share at least one common type that access can be permit
Implementation • policy management services(7) • domain management control hooks(2) • event channel control hooks(2) • grant table control hooks(2) • generic domain-requested decision hooks(2) • other(1)
Implementation • domain_create(...,ssidref) • xsm_domain_create(d,ssidref) • xsm_ops->domain_create(d,ssidref) • acm_domain_create(d,ssidref) • acm_primary_ops->domain_create() acm_primary_ops->acm_init_domain_ssid • ste_domain_create() • ste_pre_domain_create()
Implementation • acm_primary_ops->acm_init_domain_ssid • ste_init_domain_ssid
Domain ssid struct acm_binary_policy{ …. u16 primary_policy_code; …. }; struct acm_ssid_domain { struct list_head node; int datatype; ssidref_t ssidref; ssidref_t old_ssidref; void *primary_ssid; void *secondary_ssid; struct domain *subject; domid_t domainid; }; struct ste_ssid { ssidref_t ste_ssidref; struct acm_ste_cache_line \ ste_cache[ACM_TE_CACHE_SIZE]; }; struct domain { ….. void *ssid ….. };
Implementation-another example • __gnttab_map_grant_ref • xsm_grant_mapref(ld,rd,op->flags) • acm_grant_mapref(ld,rd,op->flags) • acm_pre_grant_map_ref(id) • acm_primary_ops->pre_grant_map_ref(id) • ste_pre_grant_map_ref • share_common_type(subj,obj)
Implementation-another example • GET_SSIDP() • have_common_type(ref_s,ref_o); dom1 dom2 domx
Improvement • Add Time Limit • Dynamic change rules • To be continue......
