Fedora xen - Nov 2006 - Howto enable sHype/ACM security for Xen with FC6 Xen sources and FC6 kernels

I have been approached for help in enabling sHype/ACM for Xen on an FC6 
system using Fedora sources only.  Since sHype/ACM is still disabled by 
default in Xen, you need to recompile and re-install Xen to enable it. I 
have attached a short howto, since this procedure might not be 
straight-forward for the general user.

sHype/ACM is part of the core Xen distribution and includes mandatory 
access control in the Xen hypervisor. sHype controls sharing between user 
domains (controls which domains can communicate with each other and which 
domains can access which resources) and enforces anti-collocation rules 
(controls which domains can run simultaneously on the same platform) with 
simple formal security policies. Please refer to the Xen user guide 
section about sHype/ACM for more details and for usage/test examples and 
current limitations.

You do not  need to follow this howto if you choose to install the 
original Xensource.com Xen version and the 2.6.16.29 Xen kernel. In this 
case, the Xen user guide for sHype/ACM includes all information needed for 
configuration,  installation, and usage examples.

Feedback / corrections / improvements are welcome (I am not an FC6 
specialist!).

Regards
Reiner

=======================================HOWTO

BUILD AND INSTALL SHYPE/ACM XEN FROM FEDORA CORE 6 SOURCES
***********************************************************

Foreword: You can use the official Xen source install from Xensource.com 
and configure ACM (see Xen user guide). However, Xen comes with a 
2.6.16.29 kernel by default. If you depend on a FC6 2.6.18 kernel running 
on Xen and you want the sHype ACM security extension, then the following 
document describes how to get there from a clean non-virtualized FC6 
install.

The following step-wise description shows how to get sources, configure 
them, and install them so that sHype/ACM security is enabled in Xen on FC6 
for the latest FC6 kernel.

Once you run sHype/ACM Xen, you can refer to the Xen user guide manual 
chapter (found in: ) 10 to walk through usage examples.


A) Get source Xen/Kernel for FC6 (from any FC6 mirror)
=====================================================ftp://ftp.linux.ncsu.edu/pub/fedora/linux/core/updates/6/SRPMS
download:
kernel-2.6.18-1.2849.fc6.src.rpm
ftp://ftp.linux.ncsu.edu/pub/fedora/linux/core/6/source/SRPMS
download:
xen-3.0.3-0.1.rc3.src.rpm


B) Unpack source rpm
===================rpm -ihv kernel-2.6.18-1.2849.fc6.src.rpm
rpm -ihv xen-3.0.3-0.1.rc3.src.rpm


C) Create sources and configure sHype Access Control Module for Xen
==================================================================(this step
creates the sources into /usr/src/redhat/BUILD)
cd /usr/src/redhat/SPECS
rpmbuild -bp xen.spec
rpmbuild -bp kernel-2.6.spec


D) Build/Install Xen
===================Note: it appears that most problems in this stage stem from
inconsistent
PAE settings in Xen and Kernel (must be the same).

i) Configure + install security enabled Xen and tools: 
cd /usr/src/redhat/BUILD/xen-3.0.3-rc3
edit Config.mk and set following variables for PAE/no PAE:

i.a) if you DON''T want PAE support (<4GB on x386):
XEN_TARGET_X86_PAE  ?= n
ACM_SECURITY ?= y

i.b) if you DO want PAE support:
XEN_TARGET_X86_PAE  ?= y
ACM_SECURITY ?= y

ii) Now save Config.mk and exit editor.

iii) in the current xen-3.0.3-rc3 directory:
root# (cd LibVNCServer-0.8.2; make install)
root# make xen tools

Note: do not just ''make'' because it will take a long time to
build the
kernel and you are not going to use it (see below)

iv) 
root# make install-xen; make install-tools

v) Install wxPython for ez-Security Policy tool
root# yum install wxPython

Test: /usr/sbin/xensec_ezpolicy should bring up a GUI (close it)


E) BUILD/INSTALL FC6 Kernel for Xen
==================================We only use the 2.6.18.i386 kernel from this
install. Not xen.

i) Configure + install FC6 Kernel for Xen: 
root# cd /usr/src/redhat/BUILD/kernel-2.6.18/linux-2.6.18.i386
root# cp configs/kernel-2.6.18.i686-xen.config .config

use ''make menuconfig'' or ''make gconfig'' to
configure the following
variables for PAE/no PAE:

i.a) if you DON''T want PAE support (<4GB on x386):
In submenu: Processor_type_and_features->High_Memory_Support
set HIMEM to 4GB

i.b) if you DO want PAE support:
In submenu: Processor_type_and_features->High_Memory_Support
set HIMEM to 64GB

ii) Compile + Install kernel (currently, the kernel is not ACM specific)
Note: If you already have a proprietary kernel installed, you might want 
to name the kernel by setting the LOCALVERSION config parameter.

root# make all
root# make modules_install
root# make install


F) CREATE BOOT ENTRY
===================Mine looks as follows (using xen/kernel that were
built/installed above):

title XEN sHype/ACM (2.6.18-1.2849-xen)
        root (hd0,0)
        kernel /xen-3.0.3-rc3.gz
        module /vmlinuz-2.6.18-prep ro root=/dev/hda3 rhgb
        module /initrd-2.6.18-prep.img

Make sure you have the initrd and that you have the proper file prefix for 
the files. This example assumes that you mount /boot. You might need to 
build the initrd manually if it does not show up in the /boot directory 
after the kernel make install:

root #cd /boot
root #mkinitrd initrd-2.6.18-prep.img 2.6.18-prep


G) WHERE DO I GO FROM HERE
=========================If you boot into sHype/ACM XEN, then you need to label
resources and
domains. For this, you need a policy. Without it, you can start domain 0 
but no other domains. Please refer to the Xen User Guide (currently 
chapter 10) for further information.

=======================================END
__________________________________________________________
Reiner Sailer, Research Staff Member, Secure Systems Department
IBM T J Watson Research Ctr, 19 Skyline Drive, Hawthorne NY 10532
Phone: 914 784 6280  (t/l 863)  Fax: 914 784 6205, sailer@us.ibm.com 
http://www.research.ibm.com/people/s/sailer/