[Xen-changelog] [xen-unstable] [ACM] Allow the loadpolicy operation once

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1185180323 -3600
# Node ID 4a8dbbc16d48b5efbe7b4361a026c5959b35c5bf
# Parent  66db6b98f0720c08524754fc2364b126ef5cd2ab
[ACM] Allow the loadpolicy operation once

This patch allows the loadpolicy operation to only happen once, then
require an update until the default policy has been installed (again).

Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>
---
 xen/acm/acm_chinesewall_hooks.c             |    9 +++++++++
 xen/acm/acm_policy.c                        |   13 +++++++++++++
 xen/acm/acm_simple_type_enforcement_hooks.c |   10 ++++++++++
 xen/include/acm/acm_hooks.h                 |    2 ++
 4 files changed, 34 insertions(+)

diff -r 66db6b98f072 -r 4a8dbbc16d48 xen/acm/acm_chinesewall_hooks.c
--- a/xen/acm/acm_chinesewall_hooks.c   Fri Jul 20 14:10:40 2007 +0100
+++ b/xen/acm/acm_chinesewall_hooks.c   Mon Jul 23 09:45:23 2007 +0100
@@ -650,6 +650,13 @@ static void chwall_domain_destroy(void *
     return;
 }
 
+
+static int chwall_is_default_policy(void)
+{
+    return ( (chwall_bin_pol.max_types    == 1 ) &&
+             (chwall_bin_pol.max_ssidrefs == 2 ) );
+}
+
 struct acm_operations acm_chinesewall_ops = {
     /* policy management services */
     .init_domain_ssid = chwall_init_domain_ssid,
@@ -674,6 +681,8 @@ struct acm_operations acm_chinesewall_op
     .fail_grant_setup = NULL,
     /* generic domain-requested decision hooks */
     .sharing = NULL,
+
+    .is_default_policy = chwall_is_default_policy,
 };
 
 /*
diff -r 66db6b98f072 -r 4a8dbbc16d48 xen/acm/acm_policy.c
--- a/xen/acm/acm_policy.c      Fri Jul 20 14:10:40 2007 +0100
+++ b/xen/acm/acm_policy.c      Mon Jul 23 09:45:23 2007 +0100
@@ -87,9 +87,16 @@ _acm_update_policy(void *buf, u32 buf_si
                    struct acm_sized_buffer *errors)
 {
     uint32_t offset, length;
+    static int require_update = 0;
 
     write_lock(&acm_bin_pol_rwlock);
 
+    if (  require_update != 0 &&
+        ( deletions == NULL || ssidchanges == NULL ) )
+    {
+        goto error_lock_free;
+    }
+    require_update = 1;
     /*
        first some tests to check compatibility of new policy with
        current state of system/domains
@@ -153,7 +160,13 @@ _acm_update_policy(void *buf, u32 buf_si
            &pol->xml_pol_version,
            sizeof(acm_bin_pol.xml_pol_version));
 
+    if ( acm_primary_ops->is_default_policy() &&
+         acm_secondary_ops->is_default_policy() ) {
+        require_update = 0;
+    }
+
     write_unlock(&acm_bin_pol_rwlock);
+
     return ACM_OK;
 
 error_lock_free:
diff -r 66db6b98f072 -r 4a8dbbc16d48 xen/acm/acm_simple_type_enforcement_hooks.c
--- a/xen/acm/acm_simple_type_enforcement_hooks.c       Fri Jul 20 14:10:40 
2007 +0100
+++ b/xen/acm/acm_simple_type_enforcement_hooks.c       Mon Jul 23 09:45:23 
2007 +0100
@@ -739,6 +739,14 @@ ste_sharing(ssidref_t ssidref1, ssidref_
         return ACM_ACCESS_DENIED;
 }
 
+/* */
+
+static int
+ste_is_default_policy(void)
+{
+    return ( (ste_bin_pol.max_types    == 1) &&
+             (ste_bin_pol.max_ssidrefs == 2) );
+}
 
 /* now define the hook structure similarly to LSM */
 struct acm_operations acm_simple_type_enforcement_ops = {
@@ -768,6 +776,8 @@ struct acm_operations acm_simple_type_en
     .pre_grant_setup        = ste_pre_grant_setup,
     .fail_grant_setup       = NULL,
     .sharing                = ste_sharing,
+
+    .is_default_policy      = ste_is_default_policy,
 };
 
 /*
diff -r 66db6b98f072 -r 4a8dbbc16d48 xen/include/acm/acm_hooks.h
--- a/xen/include/acm/acm_hooks.h       Fri Jul 20 14:10:40 2007 +0100
+++ b/xen/include/acm/acm_hooks.h       Mon Jul 23 09:45:23 2007 +0100
@@ -113,6 +113,8 @@ struct acm_operations {
     void (*fail_grant_setup)           (domid_t id);
     /* generic domain-requested decision hooks (can be NULL) */
     int (*sharing)                     (ssidref_t ssidref1, ssidref_t 
ssidref2);
+    /* determine whether the default policy is installed */
+    int (*is_default_policy)           (void);
 };
 
 /* global variables */

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog