<?xml version="1.0" encoding="UTF-8"?>
<!-- Author: Reiner Sailer, Ray Valdez {sailer,rvaldez}@us.ibm.com  -->
<!--             This file defines the security policies, which     -->
<!--             can be enforced by the Xen Access Control Module.  -->
<!--             Currently: Chinese Wall and Simple Type Enforcement-->
<SecurityPolicyDefinition xmlns="http://www.ibm.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.ibm.com ../../security_policy.xsd ">
	<PolicyHeader>
		<PolicyName>example.client_v1</PolicyName>
		<PolicyUrl>www.ibm.com/example/client_v1</PolicyUrl>
		<Date>2006-03-31</Date>
		<Version>1.0</Version>
	</PolicyHeader>
	<!--                                                        -->
	<!-- example of a simple type enforcement policy definition -->
	<!--                                                        -->
	<SimpleTypeEnforcement>
		<SimpleTypeEnforcementTypes>
			<Type>ste_SystemManagement</Type><!-- machine/security management -->
			<Type>ste_PersonalFinances</Type><!-- personal finances -->
			<Type>ste_InternetInsecure</Type><!-- games, active X, etc. -->
			<Type>ste_DonatedCycles</Type><!-- donation to BOINC/seti@home -->
			<Type>ste_PersistentStorageA</Type><!-- domain managing the harddrive A-->
			<Type>ste_NetworkAdapter0</Type><!-- type of the domain managing ethernet adapter 0-->
		</SimpleTypeEnforcementTypes>
	</SimpleTypeEnforcement>
	<!--                                             -->
	<!-- example of a chinese wall type definition   -->
	<!-- along with its conflict sets                -->
	<!-- (typse in a confict set are exclusive, i.e. -->
	<!--  once a Domain with one type of a set is    -->
	<!--  running, no other Domain with another type -->
	<!--  of the same conflict set can start.)       -->
	<ChineseWall priority="PrimaryPolicyComponent">
		<ChineseWallTypes>
			<Type>cw_SystemManagement</Type>
			<Type>cw_Sensitive</Type>
			<Type>cw_Isolated</Type>
			<Type>cw_Distrusted</Type>
		</ChineseWallTypes>

		<ConflictSets>
			<Conflict name="Protection1">
				<Type>cw_Sensitive</Type>
				<Type>cw_Distrusted</Type>
			</Conflict>
		</ConflictSets>
	</ChineseWall>
	<SecurityLabelTemplate>
		<SubjectLabels bootstrap="SystemManagement">
			<!-- single ste typed domains            -->
			<!-- ACM enforces that only domains with -->
			<!-- the same type can share information -->
			<!--                                     -->
			<!-- Bootstrap label is assigned to Dom0 -->
			<VirtualMachineLabel>
				<Name>dom_HomeBanking</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_PersonalFinances</Type>
				</SimpleTypeEnforcementTypes>

				<ChineseWallTypes>
					<Type>cw_Sensitive</Type>
				</ChineseWallTypes>
			</VirtualMachineLabel>

			<VirtualMachineLabel>
				<Name>dom_Fun</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_InternetInsecure</Type>
				</SimpleTypeEnforcementTypes>

				<ChineseWallTypes>
					<Type>cw_Distrusted</Type>
				</ChineseWallTypes>
			</VirtualMachineLabel>

			<VirtualMachineLabel>
				<!-- donating some cycles to seti@home -->
				<Name>dom_BoincClient</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_DonatedCycles</Type>
				</SimpleTypeEnforcementTypes>

				<ChineseWallTypes>
					<Type>cw_Isolated</Type>
				</ChineseWallTypes>
			</VirtualMachineLabel>

			<!-- Domains with multiple ste types services; such domains   -->
			<!-- must keep the types inside their domain safely confined. -->
			<VirtualMachineLabel>
				<Name>SystemManagement</Name>
				<SimpleTypeEnforcementTypes>
					<!-- since dom0 needs access to every domain and -->
					<!-- resource right now ... -->
					<Type>ste_SystemManagement</Type>
					<Type>ste_PersonalFinances</Type>
					<Type>ste_InternetInsecure</Type>
					<Type>ste_DonatedCycles</Type>
					<Type>ste_PersistentStorageA</Type>
					<Type>ste_NetworkAdapter0</Type>
				</SimpleTypeEnforcementTypes>

				<ChineseWallTypes>
					<Type>cw_SystemManagement</Type>
				</ChineseWallTypes>
			</VirtualMachineLabel>

			<VirtualMachineLabel>
				<!-- serves persistent storage to other domains -->
				<Name>dom_StorageDomain</Name>
				<SimpleTypeEnforcementTypes>
					<!-- access right to the resource (hard drive a) -->
					<Type>ste_PersistentStorageA</Type>
					<!-- can serve following types -->
					<Type>ste_PersonalFinances</Type>
					<Type>ste_InternetInsecure</Type>
				</SimpleTypeEnforcementTypes>

				<ChineseWallTypes>
					<Type>cw_SystemManagement</Type>
				</ChineseWallTypes>
			</VirtualMachineLabel>

			<VirtualMachineLabel>
				<!-- serves network access to other domains -->
				<Name>dom_NetworkDomain</Name>
				<SimpleTypeEnforcementTypes>
					<!-- access right to the resource (ethernet card) -->
					<Type>ste_NetworkAdapter0</Type>
					<!-- can serve following types -->
					<Type>ste_PersonalFinances</Type>
					<Type>ste_InternetInsecure</Type>
					<Type>ste_DonatedCycles</Type>
				</SimpleTypeEnforcementTypes>

				<ChineseWallTypes>
					<Type>cw_SystemManagement</Type>
				</ChineseWallTypes>
			</VirtualMachineLabel>
		</SubjectLabels>

		<ObjectLabels>
			<ResourceLabel>
				<Name>res_ManagementResource</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_SystemManagement</Type>
				</SimpleTypeEnforcementTypes>
			</ResourceLabel>

			<ResourceLabel>
				<Name>res_HardDrive(hda)</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_PersistentStorageA</Type>
				</SimpleTypeEnforcementTypes>
			</ResourceLabel>

			<ResourceLabel>
				<Name>res_LogicalDiskPartition1(hda1)</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_PersonalFinances</Type>
				</SimpleTypeEnforcementTypes>
			</ResourceLabel>

			<ResourceLabel>
				<Name>res_LogicalDiskPartition2(hda2)</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_InternetInsecure</Type>
				</SimpleTypeEnforcementTypes>
			</ResourceLabel>

			<ResourceLabel>
				<Name>res_EthernetCard</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_NetworkAdapter0</Type>
				</SimpleTypeEnforcementTypes>
			</ResourceLabel>

			<ResourceLabel>
				<Name>res_SecurityToken</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_PersonalFinances</Type>
				</SimpleTypeEnforcementTypes>
			</ResourceLabel>

			<ResourceLabel>
				<Name>res_GraphicsAdapter</Name>
				<SimpleTypeEnforcementTypes>
					<Type>ste_SystemManagement</Type>
				</SimpleTypeEnforcementTypes>
			</ResourceLabel>
		</ObjectLabels>
	</SecurityLabelTemplate>
</SecurityPolicyDefinition>

