ACM源分析.ppt

小田 @ ACM实践与分析 ACM策略(/etc/xen/acm-security/policy) ACM策略-Types SimpleTypeEnforcement SimpleTypeEnforcementTypes Type ChineseWall ChineseWallTypes Type ConflictSets Conflict Type ACM策略-Labels SecurityLabelTemplate SubjectLabels VirtualMachineLabel Name SimpleTypeEnforcementTypes Type ChineseWallTypes Type ObjectLabels ResourceLabel Name SimpleTypeEnforcementTypes Type 源码结构 Xen/include/xsm Xen/include/xsm/acm /xen/include/public/xsm Xen/xsm Xen/xsm/acm XSM钩子 dom0_ops.c｜domain.c｜grant_table.c event_channel.c|setup.c｜mm.c ACM实现钩子 struct xsm_operations acm_xsm_ops = { .domain_create = acm_domain_create, .free_security_domain = acm_domain_destroy, .grant_mapref = acm_grant_mapref, .evtchn_unbound = acm_evtchn_unbound, .evtchn_interdomain = acm_evtchn_interdomain, .security_domaininfo = acm_security_domaininfo, .__do_xsm_op = do_acm_op, }; ACM钩子 policy management functions domain management control hooks event channel control hooks grant table control hooks generic domain-requested decision hooks determine whether the default policy is installed acm_operations acm_null_ops acm_chinesewall_ops acm_simple_type_enforcement_ops XSM初始化 _start_xen() xsm_init() xsm_policy_init() do_xsm_initcalls __xsm_initcall_start __xsm_initcall_start ....... ACM初始化 acm_init do_acm_set_policy acm_setup acm_init_binary_policy register_xsm acm_init_binary_policy dom0_ste_ssidref dom0_chwall_ssidref _acm_update_policy ChineseWall冲突判别算法 type1 type2 ... typem ssidref1 x x ssidref2 x x .... ssidrefn x x type1 type2 ... typem conflict1 x x conflict2 x x conflictl x x type1 type2 .... typem conflict_aggregate_set type1 type2 .... typem running_types x x x ssidrefs conflict_sets 感谢您的关注 小田 @