From: Ian Jackson <ian.jackson@eu.citrix.com>
To: grub-devel@gnu.org
Cc: xen-devel@lists.xenproject.org, Ian Jackson <ian.jackson@eu.citrix.com>
Subject: [GRUB PATCH 2/2] 20_linux_xen: Support Xen Security Modules (XSM/FLASK)
Date: Wed, 20 May 2020 13:14:20 +0100 [thread overview]
Message-ID: <20200520121420.7965-3-ian.jackson@eu.citrix.com> (raw)
In-Reply-To: <20200520121420.7965-1-ian.jackson@eu.citrix.com>
XSM is enabled by adding "flask=enforcing" as a Xen command line
argument, and providing the policy file as a grub module.
We make entries for both with and without XSM. If XSM is not compiled
into Xen, then there are no policy files, so no change to the boot
options.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
---
util/grub.d/20_linux_xen.in | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in
index 30da49d66..7a092b898 100644
--- a/util/grub.d/20_linux_xen.in
+++ b/util/grub.d/20_linux_xen.in
@@ -94,6 +94,11 @@ esac
title_correction_code=
linux_entry ()
+{
+ linux_entry_xsm "$@" false
+ linux_entry_xsm "$@" true
+}
+linux_entry_xsm ()
{
os="$1"
version="$2"
@@ -101,6 +106,18 @@ linux_entry ()
type="$4"
args="$5"
xen_args="$6"
+ xsm="$7"
+ # If user wants to enable XSM support, make sure there's
+ # corresponding policy file.
+ if ${xsm} ; then
+ xenpolicy="xenpolicy-$xen_version"
+ if test ! -e "${xen_dirname}/${xenpolicy}" ; then
+ return
+ fi
+ xen_args="$xen_args flask=enforcing"
+ xen_version="$(gettext_printf "%s (XSM enabled)" "$xen_version")"
+ # xen_version is used for messages only; actual file is xen_basename
+ fi
if [ -z "$boot_device_id" ]; then
boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")"
fi
@@ -154,6 +171,13 @@ EOF
sed "s/^/$submenu_indentation/" << EOF
echo '$(echo "$message" | grub_quote)'
${module_loader} --nounzip $(echo $initrd_path)
+EOF
+ fi
+ if test -n "${xenpolicy}" ; then
+ message="$(gettext_printf "Loading XSM policy ...")"
+ sed "s/^/$submenu_indentation/" << EOF
+ echo '$(echo "$message" | grub_quote)'
+ ${module_loader} ${rel_dirname}/${xenpolicy}
EOF
fi
sed "s/^/$submenu_indentation/" << EOF
--
2.20.1
next prev parent reply other threads:[~2020-05-20 12:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-20 12:14 [GRUB PATCH 0/2] Better Xen support Ian Jackson
2020-05-20 12:14 ` [GRUB PATCH 1/2] 20_linux_xen: Ignore xenpolicy and config files too Ian Jackson
2020-05-20 12:14 ` Ian Jackson [this message]
2020-05-20 13:40 ` [GRUB PATCH 0/2] Better Xen support Daniel Kiper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200520121420.7965-3-ian.jackson@eu.citrix.com \
--to=ian.jackson@eu.citrix.com \
--cc=grub-devel@gnu.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.