Re: [Xen-devel] [PATCH][ACM] kernel enforcement of vbd policies via blkback driver

[Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>]

On 24 Jul 2006, at 17:23, Bryan D. Payne wrote:

> This patch modifies the blkback driver to perform a security check 
> (via an ACM get_decision hypercall) before connecting a vbd to a 
> domain.  While the security checks performed in the xm tools are 
> convenient for the users, the check added here is intended to 
> strengthen the security guarantees.
> Note that the security check in blkback is only enabled when 
> ACM_SECURITY=y in Config.mk.
> Signed-off-by: Bryan D. Payne <bdpayne@xxxxxxxxxx>
> Signed-off-by: Reiner Sailer <sailer@xxxxxxxxxx>
Wouldn't this be better checked in the tool stack, rather than the 
particular block device driver (which is as likely to be blktap as 
blkback in future -- control tools would provide a point of common 
infrastructure to make this check, regardless of choice of actual 
backend driver)?
 -- Keir


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel