[Xense-devel] How to get XSM/Flask working

To:	xense-devel@xxxxxxxxxxxxxxxxxxx
Subject:	[Xense-devel] How to get XSM/Flask working
From:	"Hayawardh V" <hayawardh@xxxxxxxxx>
Date:	Wed, 21 May 2008 18:46:46 -0400
Delivery-date:	Wed, 21 May 2008 15:47:03 -0700
Dkim-signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type; bh=XpPa/yQeOgWN5R01+pxEBStRtYJIpPvMR1cW+6Rz3d0=; b=UZ5JOcWc/9mmbOKj3ydu1QCudsfhFPNezLveGSAf4ZEezgmi18cSUHa5grHDvcVF52u8nOnnLaH93DLe6qffse1CLU4ITlEJV7Nnz9Hi5sXtvRNduCtVf+qiuRPlrFb7BDhplHBumHjbj5Cwvb+Uy2egd5NeU32TXvNCzNsBiAs=
Domainkey-signature:	a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=Jm5KryRBrRZ+SLVBQLFDMRDOPGJM1MrMtatsWLZLCgtUIH0CqltVpqG/OjnyaMICa9tgLzSyx7/f88ceUIMdhmywfYPAZzjilnvCGAOWnq7Wyt1I/DKwsRjRW7eqEinjKT5BaVfnu+BrWJ77o1ZnbxivgM9yuQiWVrewzB8d0Ms=
Envelope-to:	www-data@xxxxxxxxxxxxxxxxxx
List-help:	<mailto:xense-devel-request@lists.xensource.com?subject=help>
List-id:	"A discussion list for those developing security enhancements for Xen." <xense-devel.lists.xensource.com>
List-post:	<mailto:xense-devel@lists.xensource.com>
List-subscribe:	<http://lists.xensource.com/cgi-bin/mailman/listinfo/xense-devel>, <mailto:xense-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe:	<http://lists.xensource.com/cgi-bin/mailman/listinfo/xense-devel>, <mailto:xense-devel-request@lists.xensource.com?subject=unsubscribe>
Sender:	xense-devel-bounces@xxxxxxxxxxxxxxxxxxx

Hi all,

I compiled xen-3.2-testing with linux-2.6.18-xen after modifying Config.mk to enable XSM/Flask:

XSM_ENABLE ?= y
FLASK_ENABLE ?= y
ACM_SECURITY ?= n

I downloaded a test Flask policy from http://lists.xensource.com/archives/html/xense-devel/2007-03/msg00005.html
and ran 'make' on it.

I copied the policy.20 file to /boot and modified the grub entry as follows:

title Xen 3 with Fedora 8 2.6.18.8
       root (hd0,5)
       kernel /boot/xen-3.2.gz console=vga
       module /boot/vmlinuz-2.6.18.8-xen root=LABEL=/1 ro console=tty0
       module /boot/initrd-2.6.18.8-xen.img
       module /boot/policy.20

and booted into the same.

When I do an xm create of a domU, I get:

[root@XXX xenimg]# xm create -c fedora.fc8.xen3.cfg
Using config file "./fedora.fc8.xen3.cfg".
Error: 'module' object has no attribute 'get_active_policy_name'

(Note: The same domU boots as expected in a Xen without XSM/Flask enabled, on the same machine)

1. What causes the above problem? How do I get XSM/Flask to work?

2. Is the above policy the latest or is there a more recent version?

3. The above post says "This policy is incomplete and cannot be used with the Flask module in enforcing mode." How do I enable enforcing mode? Where are the equivalent SELinux tools like sestatus etc? Are they still under development?

Thanks,
Hayawardh

_______________________________________________
Xense-devel mailing list
Xense-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xense-devel