Re: [Xense-devel] [PATCH] ACM: adding get_ssid command and cleanup

David Palmer
Fri, 02 Sep 2005 18:41:28 -0000

Reiner,

I''ve looked over the code. As input, it takes either an SSID or a
DomainID.
If given a DomainID, it looks up the domain''s SSID. It then returns two
arrays of 0''s and 1''s. One array is a row from the STE-Type
matrix and the
other is a row from the ChWall-Type matrix corresponding to the given SSID.

My question then: What constitutes a legitimate use vs. a clear abuse of
this information?

For example, lets say I create a domain that manages a resource. When
another domain connects, the resource domain checks for a specific type
using get_ssid() on the subject''s DomainID and indexes one of the
arrays
with the type number. If the type is set, then it provides the
"Privileged"
interface with the other domain. If it is not set, then it provides the
"Unprivileged" interface with the domain. Is this legitimate or an
abuse of
the function? Why or why not?

Dave

On 9/1/05, Reiner Sailer <sailer@us.ibm.com>
wrote:
>
>
> This patch:
>
> * adds a get_ssid ACM command that allows privileged domains to retrieve
> types for either a given ssid reference or a given domain id (of a running
> domain); this command can be used to extend access control into device
> domains, e.g., to control network traffic currently moving through Domain
> 0 uncontrolled by the ACM policy
>
> * adds a script getlabel.sh that allows users inside Dom0 to retrieve the
> label for a given ssid reference or a given domain id (multiple labels
might
> map onto a single ssid reference)
>
> * cleans up label-related code in tools/security by merging common
> functions into labelfuncs.sh
>
> * cleans up ACM code related to above changes (eventually approximating a
> common coding style)
>
> Comments welcome.
>
> Thanks
> Reiner
>
> Signed-off-by Reiner Sailer <sailer@us.ibm.com>
> Signed-off by Stefan Berger <stefanb@us.ibm.com>
>
>
>
> _______________________________________________
> Xense-devel mailing list
> Xense-devel@lists.xensource.com
> http://lists.xensource.com/xense-devel
>
>
>
>


_______________________________________________
Xense-devel mailing list
Xense-devel@lists.xensource.com