On Wed, Nov 24, 2004 at 11:48:15AM -0000, Neugebauer, Rolf wrote:
> Yes, in principle you should be able to do that (and we have been
> thinking along similar lines). However, at the moment the linux kernel
> in the exporting VM (BE) does not know anything about other VMs so as
> far as my understanding goes you can't apply SELinux policies to it as
> you don't have a subject.
 

 okay.

 that can be dealt with by... (this is speculation, here!)

 by writing an selinux policy in advance that defines how many  virtual machines you have, and creating xen_vm0_t, xen_vm1_t  etc. to represent them.

 you then define what operations can be carried out, and then  grant a program the right to perform that operation on SPECIFIC  machines. [yes there is a short-hand which allows you to specify an  operation be allowed by a program on all machines].

 then it would be necessary to modify the linux kernel to call the  avc_has_perm() function at the appropriate point to check, at the time  that an operation was being done (e.g. read from block device), as to  whether that process had the right to perform that operation on that  xen virtual machine.

 in order for this to work, it would be necessary to have a translation  mechanism between the numbering xen_vm_0_t etc. and the actual xen  virtual machines.

 looking at avc_has_perm(), you'd need a SID per virtual machine,  as the second argument...

 xen_communication_has_perm(struct task_struct *tsk,

                            struct xen_info *xen,
							u32 perms)
 {
	 return avc_has_perm(tsec->sid,
	                     xen->sid, SECCLASS_XEN, perms, NULL, NULL);

 where xen->sid contains "xen_vm_0_t", "xen_vm_1_t" etc.  and tsec->sid contains "xen_xm_bin_t" - representing the xen control  binary /usr/bin/xm.

 the question i can't answer (the bit that i don't quite grok) is  how do you get hold of the right xen_info struct and how do you blat  the sid into it?

 l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.