[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH] xl.pod.1: introduction to FLASK

Add a simple introduction to FLASK to the xl man page, at the beginning
of the FLASK chapter. Link to the xsm-flask.txt document.
Currently FLASK, TMEM and PCI PASS-THROUGH are defined as =head2 so they
look like sub-chapters of VIRTUAL DEVICE COMMANDS. Make them =head1.

Based on a text written by Daniel De Graaf.

Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>

diff --git a/docs/man/xl.pod.1 b/docs/man/xl.pod.1
index 17789b4..18fd411 100644
--- a/docs/man/xl.pod.1
+++ b/docs/man/xl.pod.1
@@ -906,7 +906,7 @@ List virtual network interfaces for a domain.
 =over 4
@@ -929,7 +929,7 @@ List pass-through pci devices for a domain.
-=head2 TMEM
+=head1 TMEM
 =over 4
@@ -995,7 +995,20 @@ Get information about how much freeable memory (MB) is 
in-use by tmem.
-=head2 FLASK
+=head1 FLASK
+B<FLASK> is a security framework that defines a mandatory access control policy
+providing fine-grained controls over Xen domains, allowing the policy writer
+to define what interactions between domains, devices, and the hypervisor are
+permitted. Some example of what you can do using XSM/FLASK:
+ - Prevent two domains from communicating via event channels or grants
+ - Control which domains can use device passthrough (and which devices)
+ - Restrict or audit operations performed by privileged domains
+ - Prevent a privileged domain from arbitrarily mapping pages from other
+   domains.
+You can find more details on how to use FLASK and an example security
+policy here: L<http://xenbits.xen.org/docs/unstable/misc/xsm-flask.txt>
 =over 4
@@ -1039,6 +1052,7 @@ And the following documents on the xen.org website:
 =head1 BUGS

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.