Entity descriptions
The WebServer entity does not provide functionality to other entities.
WebServer.edl
entity server.WebServer
The AuthService entity is a trusted component that authenticates users, and contains implementations of the ILoginForm interface (to receive the user name and password input form) and the ILoginResultForm interface (to receive the authentication results).
AuthService.edl
entity auth_service.AuthService
interfaces
{
login : auth_service.ILoginForm
result : auth_service.ILoginResultForm
}
ILoginForm.idl
package auth_service.ILoginForm
const UInt32 MaxHtmlSize = 5120;
typedef sequence<UInt8, MaxHtmlSize> HtmlLine;
typedef UInt8 Bool;
interface
{
Open(out Bool result);
Read(out HtmlLine line);
Dispose();
}
ILoginResultForm.idl
package auth_service.ILoginResultForm
const UInt32 MaxHtmlSize = 5120;
typedef sequence<UInt8, MaxHtmlSize> HtmlLine;
typedef sequence<UInt8, MaxHtmlSize> String;
typedef UInt8 Bool;
struct UserRequest
{
String userName;
String password;
String cryptoB;
}
interface
{
Open(in UserRequest login, out Bool result);
Read(out HtmlLine line);
Dispose();
}
Init description
init.yaml
entities:
- name: server.WebServer
connections:
- target: auth_service.AuthService
id: authservice
- target: kl.VfsEntity
id: {var: _VFS_CONNECTION_ID, include: vfs/defs.h}
- name: auth_service.AuthService
connections:
- target: kl.VfsEntity
id: {var: _VFS_CONNECTION_ID, include: vfs/defs.h}
- name: kl.VfsEntity
path: VFS
connections:
- target: kl.drivers.ATA
id: kl.drivers.ATA
- target: kl.drivers.PCIE
id: kl.drivers.PCIE
- name: kl.rump.Dhcpcd
path: dhcpcd_entity
connections:
- target: kl.VfsEntity
id: {var: _VFS_CONNECTION_ID, include: vfs/defs.h}
- name: kl.drivers.ATA
path: ata
connections:
- target: kl.drivers.PCIE
id: kl.drivers.PCIE
- name: kl.drivers.PCIE
path: pcie_hw
Solution security policy
security_x86.psl
/* Includes internal and external security policies. */
use internal._
use external._
/* Only for the x86 platform. */
use EDL kl.drivers.ATA
use EDL kl.drivers.PCIE
request src=kl.drivers.ATA, dst=kl.drivers.PCIE
{
grant()
}
response src=kl.drivers.PCIE, dst=kl.drivers.ATA
{
grant()
}
request src=kl.VfsEntity, dst=kl.drivers.PCIE
{
grant()
}
response src=kl.drivers.PCIE, dst=kl.VfsEntity
{
grant()
}
request src=kl.drivers.ATA, dst=kl.core.Core
{
grant()
}
response src=kl.core.Core, dst=kl.drivers.ATA
{
grant()
}
request src=kl.drivers.PCIE, dst=kl.core.Core
{
grant()
}
response src=kl.core.Core, dst=kl.drivers.PCIE
{
grant()
}
external.psl
use nk.base._
/**
* This code includes EDL descriptions of corresponding external
* entities.
*/
use EDL server.WebServer
use EDL auth_service.AuthService
/**
* The following code lets external entities send requests to the KasperskyOS kernel
* and receive responses. It makes it possible for external entities to use system calls.
* Caution! This rule is strictly for early-stage development because it
* exposes a variety of system services that could be invoked by an attacker.
* An audit must be performed to determine the minimal set of methods to allow.
*/
request src=server.WebServer, dst=kl.core.Core
{
grant()
}
response src=kl.core.Core, dst=server.WebServer
{
grant()
}
request src=server.WebServer, dst=kl.VfsEntity
{
grant()
}
response src=kl.VfsEntity, dst=server.WebServer
{
grant()
}
request src=auth_service.AuthService, dst=kl.core.Core
{
grant()
}
response src=kl.core.Core, dst=auth_service.AuthService
{
grant()
}
request src=auth_service.AuthService, dst=kl.VfsEntity
{
grant()
}
response src=kl.VfsEntity, dst=auth_service.AuthService
{
grant()
}
request src=server.WebServer, dst=auth_service.AuthService
{
grant()
}
response src=auth_service.AuthService, dst=server.WebServer
{
grant()
}
internal.psl
/**
* This file describes internal entities and their connections.
*/
use nk.base._
/**
* This code includes EDL descriptions of corresponding internal entities.
*/
use EDL Einit
use EDL kl.core.Core
use EDL kl.VfsEntity
use EDL kl.rump.Dhcpcd
/**
* This policy lets the KasperskyOS kernel start system entities.
*/
execute src=kl.core.Core, dst=kl.core.Core
{
grant()
}
execute src=kl.core.Core, dst=Einit
{
grant()
}
/**
* This statement enables startup and initialization of entities specified in the file init.yaml.in.
*/
execute src=Einit
{
grant()
}
/**
* This code lets you send requests from the Einit entity to the KasperskyOS kernel and receive
* responses. It makes it possible for Einit to use system calls.
*/
request src=Einit, dst=kl.core.Core
{
grant()
}
response src=kl.core.Core, dst=Einit
{
grant()
}
request src=kl.VfsEntity, dst=kl.core.Core
{
grant()
}
response src=kl.core.Core, dst=kl.VfsEntity
{
grant()
}
request src=kl.rump.Dhcpcd, dst=kl.core.Core
{
grant()
}
response src=kl.core.Core, dst=kl.rump.Dhcpcd
{
grant()
}
request src=kl.rump.Dhcpcd, dst=kl.VfsEntity
{
grant()
}
response src=kl.VfsEntity, dst=kl.rump.Dhcpcd
{
grant()
}
Page top