ia64/xen-unstable

view docs/man/xm.pod.1 @ 15783:c93e2a822d6f

[xen, xencomm] xencomm multiple page support
Current implementation doesn't allow struct xencomm_desc::address
array to be more than single page. On IA64 it causes 64GB+ domain
creation failure. This patch generalizes xencomm to allow multipage

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
author kfraser@localhost.localdomain
date Tue Aug 28 15:32:27 2007 +0100 (2007-08-28)
parents 9c3a8ca0bf34
children 6df47366830c
line source
1 =head1 NAME
3 xm - Xen management user interface
5 =head1 SYNOPSIS
7 B<xm> I<subcommand> [I<args>]
9 =head1 DESCRIPTION
11 The B<xm> program is the main interface for managing Xen guest
12 domains. The program can be used to create, pause, and shutdown
13 domains. It can also be used to list current domains, enable or pin
14 VCPUs, and attach or detach virtual block devices.
16 The basic structure of every B<xm> command is almost always:
18 =over 2
20 B<xm> I<subcommand> I<domain-id> [I<OPTIONS>]
22 =back
24 Where I<subcommand> is one of the subcommands listed below, I<domain-id>
25 is the numeric domain id, or the domain name (which will be internally
26 translated to domain id), and I<OPTIONS> are subcommand specific
27 options. There are a few exceptions to this rule in the cases where
28 the subcommand in question acts on all domains, the entire machine,
29 or directly on the Xen hypervisor. Those exceptions will be clear for
30 each of those subcommands.
32 =head1 NOTES
34 All B<xm> operations rely upon the Xen control daemon, aka B<xend>.
35 For any B<xm> commands to run, xend must also be running. For this
36 reason you should start xend as a service when your system first boots
37 using Xen.
39 Most B<xm> commands require root privileges to run due to the
40 communications channels used to talk to the hypervisor. Running as
41 non root will return an error.
43 Most B<xm> commands act asynchronously, so just because the B<xm>
44 command returned doesn't mean the action is complete. This is
45 important, as many operations on domains, like create and shutdown,
46 can take considerable time (30 seconds or more) to bring the machine
47 into a fully compliant state. If you want to know when one of these
48 actions has finished you must poll through B<xm list> periodically.
50 =head1 DOMAIN SUBCOMMANDS
52 The following subcommands manipulate domains directly. As stated
53 previously, most commands take I<domain-id> as the first parameter.
55 =over 4
57 =item B<console> I<domain-id>
59 Attach to domain I<domain-id>'s console. If you've set up your domains to
60 have a traditional log in console this will look much like a normal
61 text log in screen.
63 This uses the back end xenconsole service which currently only
64 works for para-virtual domains.
66 The attached console will perform much like a standard serial console,
67 so running curses based interfaces over the console B<is not
68 advised>. Vi tends to get very odd when using it over this interface.
70 =item B<create> [B<-c>] I<configfile> [I<name>=I<value>]..
72 The create sub command requires a config file and can optionally take a
73 series of name value pairs that add to or override variables defined
74 in the config file. See L<xmdomain.cfg> for full details of that file
75 format, and possible options used in either the configfile or
76 I<name>=I<value> combinations.
78 I<configfile> can either be an absolute path to a file, or a relative
79 path to a file located in /etc/xen.
81 Create will return B<as soon> as the domain is started. This B<does
82 not> mean the guest OS in the domain has actually booted, or is
83 available for input.
85 B<OPTIONS>
87 =over 4
89 =item B<-c>
91 Attache console to the domain as soon as it has started. This is
92 useful for determining issues with crashing domains.
94 =back
96 B<EXAMPLES>
98 =over 4
100 =item I<with config file>
102 xm create Fedora4
104 This creates a domain with the file /etc/xen/Fedora4, and returns as
105 soon as it is run.
107 =item I<without config file>
109 xm create /dev/null ramdisk=initrd.img \
110 kernel=/boot/vmlinuz-2.6.12.6-xenU \
111 name=ramdisk nics=0 vcpus=1 \
112 memory=64 root=/dev/ram0
114 This creates the domain without using a config file (more specifically
115 using /dev/null as an empty config file), kernel and ramdisk as
116 specified, setting the name of the domain to "ramdisk", also disabling
117 virtual networking. (This example comes from the xm-test test suite.)
119 =back
121 =item B<destroy> I<domain-id>
123 Immediately terminate the domain I<domain-id>. This doesn't give the
124 domain OS any chance to react, and is the equivalent of ripping the
125 power cord out on a physical machine. In most cases you will want to
126 use the B<shutdown> command instead.
128 =item B<domid> I<domain-name>
130 Converts a domain name to a domain id using xend's internal mapping.
132 =item B<domname> I<domain-id>
134 Converts a domain id to a domain name using xend's internal mapping.
136 =item B<help> [B<--long>]
138 Displays the short help message (i.e. common commands).
140 The B<--long> option prints out the complete set of B<xm> subcommands,
141 grouped by function.
143 =item B<list> [B<--long> | B<--label>] [I<domain-id> ...]
145 Prints information about one or more domains. If no domains are
146 specified it prints out information about all domains.
148 An example format for the list is as follows:
150 Name ID Mem(MiB) VCPUs State Time(s)
151 Domain-0 0 98 1 r----- 5068.6
152 Fedora3 164 128 1 r----- 7.6
153 Fedora4 165 128 1 ------ 0.6
154 Mandrake2006 166 128 1 -b---- 3.6
155 Mandrake10.2 167 128 1 ------ 2.5
156 Suse9.2 168 100 1 ------ 1.8
158 Name is the name of the domain. ID the numeric domain id. Mem is the
159 desired amount of memory to allocate to the domain (although it may
160 not be the currently allocated amount). VCPUs is the number of
161 virtual CPUs allocated to the domain. State is the run state (see
162 below). Time is the total run time of the domain as accounted for by
163 Xen.
165 B<STATES>
167 =over 4
169 The State field lists 6 states for a Xen domain, and which ones the
170 current domain is in.
172 =item B<r - running>
174 The domain is currently running on a CPU.
176 =item B<b - blocked>
178 The domain is blocked, and not running or runnable. This can be caused
179 because the domain is waiting on IO (a traditional wait state) or has
180 gone to sleep because there was nothing else for it to do.
182 =item B<p - paused>
184 The domain has been paused, usually occurring through the administrator
185 running B<xm pause>. When in a paused state the domain will still
186 consume allocated resources like memory, but will not be eligible for
187 scheduling by the Xen hypervisor.
189 =item B<s - shutdown>
191 FIXME: Why would you ever see this state?
193 =item B<c - crashed>
195 The domain has crashed, which is always a violent ending. Usually
196 this state can only occur if the domain has been configured not to
197 restart on crash. See L<xmdomain.cfg> for more info.
199 =item B<d - dying>
201 The domain is in process of dying, but hasn't completely shutdown or
202 crashed.
204 FIXME: Is this right?
206 =back
208 B<LONG OUTPUT>
210 =over 4
212 If B<--long> is specified, the output for B<xm list> is not the table
213 view shown above, but instead is an S-Expression representing all
214 information known about all domains asked for. This is mostly only
215 useful for external programs to parse the data.
217 B<Note:> There is no stable guarantees on the format of this data.
218 Use at your own risk.
220 =back
222 B<LABEL OUTPUT>
224 =over 4
226 If B<--label> is specified, the security labels are added to the
227 output of B<xm list> and the lines are sorted by the labels (ignoring
228 case). The B<--long> option prints the labels by default and cannot be
229 combined with B<--label>. See the ACCESS CONTROL SUBCOMMAND section of
230 this man page for more information about labels.
232 ==back
234 B<NOTES>
236 =over 4
238 The Time column is deceptive. Virtual IO (network and block devices)
239 used by domains requires coordination by Domain0, which means that
240 Domain0 is actually charged for much of the time that a DomainU is
241 doing IO. Use of this time value to determine relative utilizations
242 by domains is thus very suspect, as a high IO workload may show as
243 less utilized than a high CPU workload. Consider yourself warned.
245 =back
247 =item B<mem-max> I<domain-id> I<mem>
249 Specify the maximum amount of memory the domain is able to use. I<mem>
250 is specified in megabytes.
252 The mem-max value may not correspond to the actual memory used in the
253 domain, as it may balloon down its memory to give more back to the OS.
255 =item B<mem-set> I<domain-id> I<mem>
257 Set the domain's used memory using the balloon driver. Because this
258 operation requires cooperation from the domain operating system, there
259 is no guarantee that it will succeed.
261 B<Warning:> There is no good way to know in advance how small of a
262 mem-set will make a domain unstable and cause it to crash. Be very
263 careful when using this command on running domains.
265 =item B<migrate> I<domain-id> I<host> [I<OPTIONS>]
267 Migrate a domain to another host machine. Xend must be running on
268 other host machine, it must be running the same version of Xen, it
269 must have the migration TCP port open and accepting connections from
270 the source host, and there must be sufficient resources for the domain
271 to run (memory, disk, etc).
273 Migration is pretty complicated, and has many security implications.
274 Please read the Xen User's Guide to ensure you understand the
275 ramifications and limitations on migration before attempting it in
276 production.
278 B<OPTIONS>
280 =over 4
282 =item B<-l>, B<--live>
284 Use live migration. This will migrate the domain between hosts
285 without shutting down the domain. See the Xen User's Guide for more
286 information.
288 =item B<-r>, B<--resource> I<Mbs>
290 Set maximum Mbs allowed for migrating the domain. This ensures that
291 the network link is not saturated with migration traffic while
292 attempting to do other useful work.
294 =back
296 =item B<pause> I<domain-id>
298 Pause a domain. When in a paused state the domain will still consume
299 allocated resources such as memory, but will not be eligible for
300 scheduling by the Xen hypervisor.
302 =item B<reboot> [I<OPTIONS>] I<domain-id>
304 Reboot a domain. This acts just as if the domain had the B<reboot>
305 command run from the console. The command returns as soon as it has
306 executed the reboot action, which may be significantly before the
307 domain actually reboots.
309 The behavior of what happens to a domain when it reboots is set by the
310 B<on_reboot> parameter of the xmdomain.cfg file when the domain was
311 created.
313 B<OPTIONS>
315 =over 4
317 =item B<-a>, B<--all>
319 Reboot all domains.
321 =item B<-w>, B<--wait>
323 Wait for reboot to complete before returning. This may take a while,
324 as all services in the domain will have to be shut down cleanly.
326 =back
328 =item B<restore> I<state-file>
330 Build a domain from an B<xm save> state file. See B<save> for more info.
332 =item B<save> I<domain-id> I<state-file>
334 Saves a running domain to a state file so that it can be restored
335 later. Once saved, the domain will no longer be running on the
336 system, thus the memory allocated for the domain will be free for
337 other domains to use. B<xm restore> restores from this state file.
339 This is roughly equivalent to doing a hibernate on a running computer,
340 with all the same limitations. Open network connections may be
341 severed upon restore, as TCP timeouts may have expired.
343 =item B<shutdown> [I<OPTIONS>] I<domain-id>
345 Gracefully shuts down a domain. This coordinates with the domain OS
346 to perform graceful shutdown, so there is no guarantee that it will
347 succeed, and may take a variable length of time depending on what
348 services must be shutdown in the domain. The command returns
349 immediately after signally the domain unless that B<-w> flag is used.
351 The behavior of what happens to a domain when it reboots is set by the
352 B<on_shutdown> parameter of the xmdomain.cfg file when the domain was
353 created.
355 B<OPTIONS>
357 =over 4
359 =item B<-a>
361 Shutdown B<all> domains. Often used when doing a complete shutdown of
362 a Xen system.
364 =item B<-w>
366 Wait for the domain to complete shutdown before returning.
368 =back
370 =item B<sysrq> I<domain-id> I<letter>
372 Send a I<Magic System Request> signal to the domain. For more
373 information on available magic sys req operations, see sysrq.txt in
374 your Linux Kernel sources.
376 =item B<unpause> I<domain-id>
378 Moves a domain out of the paused state. This will allow a previously
379 paused domain to now be eligible for scheduling by the Xen hypervisor.
381 =item B<vcpu-set> I<domain-id> I<vcpu-count>
383 Enables the I<vcpu-count> virtual CPUs for the domain in question.
384 Like mem-set, this command can only allocate up to the maximum virtual
385 CPU count configured at boot for the domain.
387 If the I<vcpu-count> is smaller than the current number of active
388 VCPUs, the highest number VCPUs will be hotplug removed. This may be
389 important for pinning purposes.
391 Attempting to set the VCPUs to a number larger than the initially
392 configured VCPU count is an error. Trying to set VCPUs to < 1 will be
393 quietly ignored.
395 =item B<vcpu-list> [I<domain-id>]
397 Lists VCPU information for a specific domain. If no domain is
398 specified, VCPU information for all domains will be provided.
400 =item B<vcpu-pin> I<domain-id> I<vcpu> I<cpus>
402 Pins the the VCPU to only run on the specific CPUs. The keyword
403 B<all> can be used to apply the I<cpus> list to all VCPUs in the
404 domain.
406 Normally VCPUs can float between available CPUs whenever Xen deems a
407 different run state is appropriate. Pinning can be used to restrict
408 this, by ensuring certain VCPUs can only run on certain physical
409 CPUs.
411 =back
413 =head1 XEN HOST SUBCOMMANDS
415 =over 4
417 =item B<dmesg> [B<-c>]
419 Reads the Xen message buffer, similar to dmesg on a Linux system. The
420 buffer contains informational, warning, and error messages created
421 during Xen's boot process. If you are having problems with Xen, this
422 is one of the first places to look as part of problem determination.
424 B<OPTIONS>
426 =over 4
428 =item B<-c>, B<--clear>
430 Clears Xen's message buffer.
432 =back
434 =item B<info>
436 Print information about the Xen host in I<name : value> format. When
437 reporting a Xen bug, please provide this information as part of the
438 bug report.
440 Sample output looks as follows (lines wrapped manually to make the man
441 page more readable):
443 host : talon
444 release : 2.6.12.6-xen0
445 version : #1 Mon Nov 14 14:26:26 EST 2005
446 machine : i686
447 nr_cpus : 2
448 nr_nodes : 1
449 sockets_per_node : 2
450 cores_per_socket : 1
451 threads_per_core : 1
452 cpu_mhz : 696
453 hw_caps : 0383fbff:00000000:00000000:00000040
454 total_memory : 767
455 free_memory : 37
456 xen_major : 3
457 xen_minor : 0
458 xen_extra : -devel
459 xen_caps : xen-3.0-x86_32
460 xen_scheduler : credit
461 xen_pagesize : 4096
462 platform_params : virt_start=0xfc000000
463 xen_changeset : Mon Nov 14 18:13:38 2005 +0100
464 7793:090e44133d40
465 cc_compiler : gcc version 3.4.3 (Mandrakelinux
466 10.2 3.4.3-7mdk)
467 cc_compile_by : sdague
468 cc_compile_domain : (none)
469 cc_compile_date : Mon Nov 14 14:16:48 EST 2005
470 xend_config_format : 3
472 B<FIELDS>
474 =over 4
476 Not all fields will be explained here, but some of the less obvious
477 ones deserve explanation:
479 =item B<hw_caps>
481 A vector showing what hardware capabilities are supported by your
482 processor. This is equivalent to, though more cryptic, the flags
483 field in /proc/cpuinfo on a normal Linux machine.
485 =item B<free_memory>
487 Available memory (in MB) not allocated to Xen, or any other domains.
489 =item B<xen_caps>
491 The Xen version and architecture. Architecture values can be one of:
492 x86_32, x86_32p (i.e. PAE enabled), x86_64, ia64.
494 =item B<xen_changeset>
496 The Xen mercurial changeset id. Very useful for determining exactly
497 what version of code your Xen system was built from.
499 =back
501 =item B<log>
503 Print out the xend log. This log file can be found in
504 /var/log/xend.log.
506 =item B<top>
508 Executes the B<xentop> command, which provides real time monitoring of
509 domains. Xentop is a curses interface, and reasonably self
510 explanatory.
512 =back
514 =head1 SCHEDULER SUBCOMMANDS
516 Xen ships with a number of domain schedulers, which can be set at boot
517 time with the B<sched=> parameter on the Xen command line. By
518 default B<credit> is used for scheduling.
520 FIXME: we really need a scheduler expert to write up this section.
522 =over 4
524 =item B<sched-credit> [ B<-d> I<domain-id> [ B<-w>[B<=>I<WEIGHT>] | B<-c>[B<=>I<CAP>] ] ]
526 Set credit scheduler parameters. The credit scheduler is a
527 proportional fair share CPU scheduler built from the ground up to be
528 work conserving on SMP hosts.
530 Each domain (including Domain0) is assigned a weight and a cap.
532 B<PARAMETERS>
534 =over 4
536 =item I<WEIGHT>
538 A domain with a weight of 512 will get twice as much CPU as a domain
539 with a weight of 256 on a contended host. Legal weights range from 1
540 to 65535 and the default is 256.
542 =item I<CAP>
544 The cap optionally fixes the maximum amount of CPU a domain will be
545 able to consume, even if the host system has idle CPU cycles. The cap
546 is expressed in percentage of one physical CPU: 100 is 1 physical CPU,
547 50 is half a CPU, 400 is 4 CPUs, etc. The default, 0, means there is
548 no upper cap.
550 =back
552 =item B<sched-sedf> I<period> I<slice> I<latency-hint> I<extratime> I<weight>
554 Set Simple EDF (Earliest Deadline First) scheduler parameters. This
555 scheduler provides weighted CPU sharing in an intuitive way and uses
556 realtime-algorithms to ensure time guarantees. For more information
557 see docs/misc/sedf_scheduler_mini-HOWTO.txt in the Xen distribution.
559 B<PARAMETERS>
561 =over 4
563 =item I<period>
565 The normal EDF scheduling usage in nanoseconds
567 =item I<slice>
569 The normal EDF scheduling usage in nanoseconds
571 FIXME: these are lame, should explain more.
573 =item I<latency-hint>
575 Scaled period if domain is doing heavy I/O.
577 =item I<extratime>
579 Flag for allowing domain to run in extra time.
581 =item I<weight>
583 Another way of setting CPU slice.
585 =back
587 B<EXAMPLES>
589 I<normal EDF (20ms/5ms):>
591 xm sched-sedf <dom-id> 20000000 5000000 0 0 0
593 I<best-effort domains (i.e. non-realtime):>
595 xm sched-sedf <dom-id> 20000000 0 0 1 0
597 I<normal EDF (20ms/5ms) + share of extra-time:>
599 xm sched-sedf <dom-id> 20000000 5000000 0 1 0
601 I<4 domains with weights 2:3:4:2>
603 xm sched-sedf <d1> 0 0 0 0 2
604 xm sched-sedf <d2> 0 0 0 0 3
605 xm sched-sedf <d3> 0 0 0 0 4
606 xm sched-sedf <d4> 0 0 0 0 2
608 I<1 fully-specified (10ms/3ms) domain, 3 other domains share available
609 rest in 2:7:3 ratio:>
611 xm sched-sedf <d1> 10000000 3000000 0 0 0
612 xm sched-sedf <d2> 0 0 0 0 2
613 xm sched-sedf <d3> 0 0 0 0 7
614 xm sched-sedf <d4> 0 0 0 0 3
616 =back
618 =head1 VIRTUAL DEVICE COMMANDS
620 Most virtual devices can be added and removed while guests are
621 running. The effect to the guest OS is much the same as any hotplug
622 event.
624 =head2 BLOCK DEVICES
626 =over 4
628 =item B<block-attach> I<domain-id> I<be-dev> I<fe-dev> I<mode> [I<bedomain-id>]
630 Create a new virtual block device. This will trigger a hotplug event
631 for the guest.
633 B<OPTIONS>
635 =over 4
637 =item I<domain-id>
639 The domain id of the guest domain that the device will be attached to.
641 =item I<be-dev>
643 The device in the backend domain (usually domain 0) to be exported.
644 This can be specified as a physical partition (phy:sda7) or as a file
645 mounted as loopback (file://path/to/loop.iso).
647 =item I<fe-dev>
649 How the device should be presented to the guest domain. It can be
650 specified as either a symbolic name, such as /dev/hdc, for common
651 devices, or by device id, such as 0x1400 (/dev/hdc device id in hex).
653 =item I<mode>
655 The access mode for the device from the guest domain. Supported modes
656 are B<w> (read/write) or B<r> (read-only).
658 =item I<bedomain-id>
660 The back end domain hosting the device. This defaults to domain 0.
662 =back
664 B<EXAMPLES>
666 =over 4
668 =item I<Mount an ISO as a Disk>
670 xm block-attach guestdomain file://path/to/dsl-2.0RC2.iso /dev/hdc ro
672 This will mount the dsl ISO as /dev/hdc in the guestdomain as a read
673 only device. This will probably not be detected as a CD-ROM by the
674 guest, but mounting /dev/hdc manually will work.
676 =back
678 =item B<block-detach> I<domain-id> I<devid> [B<--force>]
680 Detach a domain's virtual block device. I<devid> may be the symbolic
681 name or the numeric device id given to the device by domain 0. You
682 will need to run B<xm block-list> to determine that number.
684 Detaching the device requires the cooperation of the domain. If the
685 domain fails to release the device (perhaps because the domain is hung
686 or is still using the device), the detach will fail. The B<--force>
687 parameter will forcefully detach the device, but may cause IO errors
688 in the domain.
690 =item B<block-list> [B<-l>|B<--long>] I<domain-id>
692 List virtual block devices for a domain. The returned output is
693 formatted as a list or as an S-Expression if the B<--long> option was given.
695 =head2 NETWORK DEVICES
697 =item B<network-attach> I<domain-id> [B<script=>I<scriptname>] [B<ip=>I<ipaddr>]
698 [B<mac=>I<macaddr>] [B<bridge=>I<bridge-name>] [B<backend=>I<bedomain-id>]
700 Creates a new network device in the domain specified by I<domain-id>. It
701 takes the following optional options:
703 B<OPTIONS>
705 =over 4
707 =item B<script=>I<scriptname>
709 Use the specified script name to bring up the network. Defaults to
710 the default setting in xend-config.sxp for B<vif-script>.
712 =item B<ip=>I<ipaddr>
714 Passes the specified IP Address to the adapter on creation.
716 FIXME: this currently appears to be B<broken>. I'm not sure under what
717 circumstances this should actually work.
719 =item B<mac=>I<macaddr>
721 The MAC address that the domain will see on its Ethernet device. If
722 the device is not specified it will be randomly generated with the
723 00:16:3e vendor id prefix.
725 =item B<bridge=>I<bridge-name>
727 The name of the bridge to attach the vif to, in case you have more
728 than one. This defaults to xenbr0.
730 =item B<backend=>I<bedomain-id>
732 The backend domain id. By default this is domain 0.
734 =back
736 =item B<network-detach> I<domain-id> I<devid>
738 Removes the network device from the domain specified by I<domain-id>.
739 I<devid> is the virtual interface device number within the domain
740 (i.e. the 3 in vif22.3).
742 FIXME: this is currently B<broken>. Network devices aren't completely
743 removed from domain 0.
745 =item B<network-list> [B<-l>|B<--long>]> I<domain-id>
747 List virtual network interfaces for a domain. The returned output is
748 formatted as a list or as an S-Expression if the B<--long> option was given.
750 =head2 VIRTUAL TPM DEVICES
752 =item B<vtpm-list> [B<-l>|B<--long>] I<domain-id>
754 Show the virtual TPM device for a domain. The returned output is
755 formatted as a list or as an S-Expression if the B<--long> option was given.
757 =back
759 =head1 VNET COMMANDS
761 The Virtual Network interfaces for Xen.
763 FIXME: This needs a lot more explanation, or it needs to be ripped
764 out entirely.
766 =over 4
768 =item B<vnet-list> [B<-l>|B<--long>]
770 List vnets.
772 =item B<vnet-create> I<config>
774 Create a vnet from a config file.
776 =item B<vnet-delete> I<vnetid>
778 Delete a vnet.
780 =back
782 =head1 ACCESS CONTROL SUBCOMMANDS
784 Access Control in Xen consists of two components: (i) The Access
785 Control Policy (ACP) defines security labels and access rules based on
786 these labels. (ii) The Access Control Module (ACM) makes access control
787 decisions by interpreting the policy when domains require to
788 communicate or to access resources. The Xen access control has
789 sufficient mechanisms in place to enforce the access decisions even
790 against maliciously acting user domains (mandatory access control).
792 Access rights for domains in Xen are determined by the domain security
793 label only and not based on the domain Name or ID. The ACP specifies
794 security labels that can then be assigned to domains and
795 resources. Every domain must be assigned exactly one security label,
796 otherwise access control decisions could become indeterministic. ACPs
797 are distinguished by their name, which is a parameter to most of the
798 subcommands described below. Currently, the ACP specifies two ways to
799 interpret labels:
801 (1) Simple Type Enforcement: Labels are interpreted to decide access
802 of domains to communication means and virtual or physical
803 resources. Communication between domains as well as access to
804 resources are forbidden by default and can only take place if they are
805 explicitly allowed by the security policy. The proper assignment of
806 labels to domains controls the sharing of information (directly
807 through communication or indirectly through shared resources) between
808 domains. This interpretation allows to control the overt (intended)
809 communication channels in Xen.
811 (2) Chinese Wall: Labels are interpreted to decide which domains can
812 co-exist (be run simultaneously) on the same system. This
813 interpretation allows to prevent direct covert (unintended) channels
814 and mitigates risks caused by imperfect core domain isolation
815 (trade-off between security and other system requirements). For a
816 short introduction to covert channels, please refer to
817 http://www.multicians.org/timing-chn.html.
819 The following subcommands help you to manage security policies in Xen
820 and to assign security labels to domains. To enable access control
821 security in Xen, you must compile Xen with ACM support enabled as
822 described under "Configuring Security" below. There, you will find
823 also examples of each subcommand described here.
825 =item B<setpolicy> ACM I<policy> I<[--load|--boot]>
827 Makes the given ACM policy available to xend as a I<xend-managed policy>.
828 The policy is compiled and a mapping (.map) as well as a binary (.bin)
829 version of the policy is created. If the option I<--load> is provided
830 the policy is loaded into Xen. If the option I<--boot> is provided the
831 system is configure to be loaded with the policy at boot time. If these
832 options are not provided with the B<setpolicy> subcommand, the
833 B<activatepolicy> subcommand provides this functionality.
835 =over 4
837 I<policy> is a dot-separated list of names. The last part is the file
838 name pre-fix for the policy XML file. The preceding name parts are
839 translated into the local path pointing to the policy XML file
840 relative to the global policy root directory
841 (/etc/xen/acm-security/policies). For example,
842 example.chwall_ste.client_v1 denotes the policy file
843 example/chwall_ste/client_v1-security_policy.xml relative to the
844 global policy root directory.
846 =back
848 =item B<activatepolicy> I<[--load|--boot]>
850 Activates the xend-managed policy by loading it into Xen using the
851 I<--load> option or configures the system to boot with the
852 xend-managed policy during the next reboot as a result of the
853 I<--boot> option. The latter is only supported if the system is booted
854 with the grub boot loader and the default boot title is modified.
855 It copies the binary policy representation into the /boot directory and
856 adds a module line specifying the binary policy to the /boot/grub/menu.lst
857 or /boot/grub/grub.conf file.
859 =item B<getpolicy> [--dumpxml]
861 Displays information about the current xend-managed policy, such as
862 name and type of the policy, the uuid xend has assigned to it on the
863 local system, the version of the XML representation and the status
864 of the policy, such as whether it is currently loaded into Xen or
865 whether the policy is automatically loaded during system boot. With
866 the I<--dumpxml> option, the XML representation of the policy is
867 displayed.
869 =item B<dumppolicy>
871 Prints the current security policy state information of Xen.
873 =item B<labels> [I<policy>] [B<type=dom>|B<res>|B<any>]
875 Lists all labels of a I<type> (domain, resource, or both) that are
876 defined in the I<policy>. Unless specified, the default I<policy> is
877 the currently enforced access control policy. The default for I<type>
878 is 'dom'. The labels are arranged in alphabetical order.
880 =item B<addlabel> I<label> B<dom> I<configfile> [I<policy>]
882 =item B<addlabel> I<label> B<mgt> I<domain name> [I<policy type>:I<policy>]
884 =item B<addlabel> I<label> B<res> I<resource> [I<policy>]
886 =item B<addlabel> I<label> B<vif-idx> I<domain name> [I<policy type>:I<policy>]
889 Adds the security label with name I<label> to a domain
890 I<configfile> (dom), a Xend-managed domain (mgt), to the global resource label
891 file for the given I<resource> (res), or to a managed domain's virtual network
892 interface (vif) that is specified by its index. Unless specified,
893 the default I<policy> is the currently enforced access control policy.
894 This subcommand also verifies that the I<policy> definition supports the
895 specified I<label> name.
897 The only I<policy type> that is currently supported is I<ACM>.
899 =item B<rmlabel> B<dom> I<configfile>
901 =item B<rmlabel> B<mgt> I<domain name>
903 =item B<rmlabel> B<res> I<resource>
905 =item B<rmlabel> B<vif-idx> I<domain name>
907 Works the same as the B<addlabel> command (above), except that this
908 command will remove the label from the domain I<configfile> (dom),
909 a Xend-managed domain (mgt), the global resource label file (res),
910 or a managed domain's network interface (vif).
912 =item B<getlabel> B<dom> I<configfile>
914 =item B<getlabel> B<mgt> I<domain name>
916 =item B<getlabel> B<res> I<resource>
918 =item B<getlabel> B<vif-idx> I<domain name>
920 Shows the label for a domain's configuration in the given I<configfile>,
921 a xend-managed domain (mgt), a resource, or a managed domain's network
922 interface (vif).
924 =item B<resources>
926 Lists all resources in the global resource label file. Each resource
927 is listed with its associated label and policy name.
929 =item B<dry-run> I<configfile>
931 Determines if the specified I<configfile> describes a domain with a valid
932 security configuration for type enforcement. The test shows the policy
933 decision made for each resource label against the domain label as well as
934 the overall decision.
936 B<CONFIGURING SECURITY>
938 =over 4
940 In xen_source_dir/Config.mk set the following parameter:
942 ACM_SECURITY ?= y
943 Then recompile and install xen and the security tools and then reboot:
945 cd xen_source_dir/xen; make clean; make; cp xen.gz /boot;
946 cd xen_source_dir/tools/security; make install;
947 reboot into Xen
949 =back
951 B<SETTING A SECURITY POLICY>
953 =over 4
955 This step makes the policy available to xend and creates the client_v1.map and
956 client_v1.bin files in /etc/xen/acm-security/policies/example/chwall_ste.
958 xm setpolicy ACM example.client_v1
960 =back
962 B<ACTIVATING THE XEND-MANAGED SECURITY POLICY>
964 =over 4
966 This step activates the xend-manged policy as new security policy in Xen.
967 You can use the dumppolicy subcommand before and afterwards to see the
968 change in the Xen policy state.
970 xm activatpolicy --load
972 =back
974 B<CONFIGURING A BOOT SECURITY POLICY>
976 =over 4
978 This configures the boot loader to load the current xend-managed policy at
979 boot time. During system start, the ACM configures Xen with this policy and
980 Xen enforces this policy from then on.
982 xm activatepolicy --boot
984 =back
986 B<LISTING SECURITY LABELS>
988 =over 4
990 This subcommand shows all labels that are defined and which can be
991 attached to domains.
993 xm labels example.client_v1 type=dom
995 will print for our example policy:
997 dom_BoincClient
998 dom_Fun
999 dom_HomeBanking
1000 dom_NetworkDomain
1001 dom_StorageDomain
1002 dom_SystemManagement
1004 =back
1006 B<ATTACHING A SECURITY LABEL TO A DOMAIN>
1008 =over 4
1010 The B<addlabel> subcommand can attach a security label to a domain
1011 configuration file, here a HomeBanking label. The example policy
1012 ensures that this domain does not share information with other
1013 non-homebanking user domains (i.e., domains labeled as dom_Fun or
1014 dom_Boinc) and that it will not run simultaneously with domains
1015 labeled as dom_Fun.
1017 We assume that the specified myconfig.xm configuration file actually
1018 instantiates a domain that runs workloads related to home-banking,
1019 probably just a browser environment for online-banking.
1021 xm addlabel dom_HomeBanking dom myconfig.xm
1023 The very simple configuration file might now look as printed
1024 below. The B<addlabel> subcommand added the B<access_control> entry at
1025 the end of the file, consisting of a label name and the policy that
1026 specifies this label name:
1028 kernel = "/boot/vmlinuz-2.6.16-xen"
1029 ramdisk="/boot/U1_home_banking_ramdisk.img"
1030 memory = 164
1031 name = "homebanking"
1032 vif = [ '' ]
1033 dhcp = "dhcp"
1034 access_control = ['policy=example.chwall_ste.client_v1,
1035 label=dom_HomeBanking']
1037 Security labels must be assigned to domain configurations because
1038 these labels are essential for making access control decisions as
1039 early as during the configuration phase of a newly instantiated
1040 domain. Consequently, a security-enabled Xen hypervisor will only
1041 start domains that have a security label configured and whose security
1042 label is consistent with the currently enforced policy. Otherwise,
1043 starting the domain will fail with the error condition "operation not
1044 permitted".
1046 =back
1048 B<ATTACHING A SECURITY LABEL TO A XEND-MANAGED DOMAIN>
1050 =over 4
1052 The addlabel subcommand supports labeling of domains that are managed
1053 by xend. This includes domains that are currently running, such as for
1054 example Domain-0, or those that are in a dormant state.
1055 Depending on the state of the system, it is possible that the new label
1056 is rejected. An example for a reason for the rejection of the relabeling
1057 of a domain would be if a domain is currently allowed to
1058 access its labeled resources but due to the new label would be prevented
1059 from accessing one or more of them.
1061 xm addlabel dom_Fun mgt Domain-0
1063 This changes the label of Domain-0 to dom_Fun under the condition that
1064 this new label of Domain-0 would not prevent any other domain from
1065 accessing its resources that are provided through Domain-0, such as for
1066 example network or block device access.
1068 =back
1070 B<ATTACHING A SECURITY LABEL TO A RESOURCE>
1072 =over 4
1074 The B<addlabel> subcommand can also be used to attach a security
1075 label to a resource. Following the home banking example from above,
1076 we can label a disk resource (e.g., a physical partition or a file)
1077 to make it accessible to the home banking domain. The example policy
1078 provides a resource label, res_LogicalDiskPartition1(hda1), that is
1079 compatible with the HomeBanking domain label.
1081 xm addlabel "res_LogicalDiskPartition1(hda1)" res phy:hda6
1083 After labeling this disk resource, it can be attached to the domain
1084 by adding a line to the domain configuration file. The line below
1085 attaches this disk to the domain at boot time.
1087 disk = [ 'phy:hda6,sda2,w' ]
1089 Alternatively, the resource can be attached after booting the domain
1090 by using the B<block-attach> subcommand.
1092 xm block-attach homebanking phy:hda6 sda2 w
1094 Note that labeled resources cannot be used when security is turned
1095 off. Any attempt to use labeled resources with security turned off
1096 will result in a failure with a corresponding error message. The
1097 solution is to enable security or, if security is no longer desired,
1098 to remove the resource label using the B<rmlabel> subcommand.
1100 =back
1102 B<STARTING AND LISTING LABELED DOMAINS>
1104 =over 4
1106 xm create myconfig.xm
1108 xm list --label
1110 Name ID ... Time(s) Label
1111 homebanking 23 ... 4.4 dom_HomeBanking
1112 Domain-0 0 ... 2658.8 dom_SystemManagement
1114 =back
1116 B<LISTING LABELED RESOURCES>
1118 =over 4
1120 xm resources
1122 phy:hda6
1123 type: ACM
1124 policy: example.chwall_ste.client_v1
1125 label: res_LogicalDiskPartition1(hda1)
1126 file:/xen/disk_image/disk.img
1127 type: ACM
1128 policy: example.chwall_ste.client_v1
1129 label: res_LogicalDiskPartition2(hda2)
1131 =back
1133 B<POLICY REPRESENTATIONS>
1135 =over 4
1137 We distinguish three representations of the Xen access control policy:
1138 the source XML version, its binary counterpart, and a mapping
1139 representation that enables the tools to deterministically translate
1140 back and forth between label names of the XML policy and label
1141 identifiers of the binary policy. All three versions must be kept
1142 consistent to achieve predictable security guarantees.
1144 The XML version is the version that users are supposed to create or
1145 change, either by manually editing the XML file or by using the Xen
1146 policy generation tool (B<xensec_gen>). After changing the XML file,
1147 run the B<setpolicy> subcommand to ensure that the new policy is
1148 available to xend. Use, for example, the subcommand
1149 B<activatepolicy> to activate the changes during the next system
1150 reboot.
1152 The binary version of the policy is derived from the XML policy by
1153 tokenizing the specified labels and is used inside Xen only. It is
1154 created with the B<setpolicy> subcommand. Essentially, the binary
1155 version is much more compact than the XML version and is easier to
1156 evaluate during access control decisions.
1158 The mapping version of the policy is created during the XML-to-binary
1159 policy translation (B<setpolicy>) and is used by xend and the management
1160 tools to translate between label names used as input to the tools and
1161 their binary identifiers (ssidrefs) used inside Xen.
1163 =back
1165 =head1 SEE ALSO
1167 B<xmdomain.cfg>(5), B<xentop>(1)
1169 =head1 AUTHOR
1171 Sean Dague <sean at dague dot net>
1172 Daniel Stekloff <dsteklof at us dot ibm dot com>
1173 Reiner Sailer <sailer at us dot ibm dot com>
1174 Stefan Berger <stefanb at us dot ibm dot com>
1176 =head1 BUGS