[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen-unstable] [ACM] Support for removing / replacing a policy



# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1186391485 -3600
# Node ID 92e43b36d211606435587420d08b6b949911ce18
# Parent  6384e168f12268ce38ac1e805c8b99790d6a012d
[ACM] Support for removing / replacing a policy

Add support for removing/replacing a policy from the running
system. This operation is only successful if currently running VMs
would also be allowed to run under the new policy. Removing the
current policy means that the default policy is installed, which then
only has support for a single VM label and STE type (SystemManagement)
and is the same policy that the system starts up with when no policy
is chosen.

Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>
---
 tools/python/xen/util/acmpolicy.py    |   64 ++++++++++++++++++++++++----------
 tools/python/xen/util/security.py     |   32 ++++++++++++++---
 tools/python/xen/xm/activatepolicy.py |   27 +++++++++++++-
 tools/python/xen/xm/resources.py      |    1 
 tools/python/xen/xm/setpolicy.py      |   40 ++++++++++++++++++++-
 tools/security/Makefile               |   11 ++---
 6 files changed, 142 insertions(+), 33 deletions(-)

diff -r 6384e168f122 -r 92e43b36d211 tools/python/xen/util/acmpolicy.py
--- a/tools/python/xen/util/acmpolicy.py        Mon Aug 06 10:10:34 2007 +0100
+++ b/tools/python/xen/util/acmpolicy.py        Mon Aug 06 10:11:25 2007 +0100
@@ -142,6 +142,21 @@ class ACMPolicy(XSPolicy):
         return xsconstants.XSERR_SUCCESS
 
 
+    def is_default_policy(self):
+        """
+           Determine whether this is the default policy
+        """
+        default = ['SystemManagement']
+        if self.policy_get_virtualmachinelabel_names() == default and \
+           self.policy_get_bootstrap_vmlabel() == default[0] and \
+           self.policy_get_stetypes_types() == default and \
+           self.policy_get_stes_of_vmlabel(default[0]) == default and \
+           self.policy_get_resourcelabel_names() == [] and \
+           self.policy_get_chwall_types() == default and \
+           self.get_name() == "DEFAULT":
+            return True
+        return False
+
     def update(self, xml_new):
         """
             Update the policy with the new XML. The hypervisor decides
@@ -156,27 +171,18 @@ class ACMPolicy(XSPolicy):
             return -xsconstants.XSERR_XML_PROCESSING, errors
 
         vmlabel_map = acmpol_new.policy_get_vmlabel_translation_map()
+
         # An update requires version information in the current
         # and new policy. The version number of the current policy
         # must be the same as what is in the FromPolicy/Version node
         # in the new one and the current policy's name must be the
         # same as in FromPolicy/PolicyName
-
-        now_vers    = acmpol_old.policy_dom_get_hdr_item("Version")
-        now_name    = acmpol_old.policy_dom_get_hdr_item("PolicyName")
-        req_oldvers = acmpol_new.policy_dom_get_frompol_item("Version")
-        req_oldname = acmpol_new.policy_dom_get_frompol_item("PolicyName")
-
-        if now_vers == "" or \
-           now_vers != req_oldvers or \
-           now_name != req_oldname:
-            log.info("Policy rejected: %s != %s or %s != %s" % \
-                     (now_vers,req_oldvers,now_name,req_oldname))
-            return -xsconstants.XSERR_VERSION_PREVENTS_UPDATE, errors
-
-        if not self.isVersionUpdate(acmpol_new):
-            log.info("Policy rejected since new version is not an update.")
-            return -xsconstants.XSERR_VERSION_PREVENTS_UPDATE, errors
+        # The default policy when it is set skips this step.
+        if not acmpol_new.is_default_policy() and \
+           not acmpol_old.is_default_policy():
+            irc = self.__do_update_version_check(acmpol_new)
+            if irc != xsconstants.XSERR_SUCCESS:
+                return irc, errors
 
         if self.isloaded():
             newvmnames = \
@@ -258,6 +264,29 @@ class ACMPolicy(XSPolicy):
             self.compile()
         return rc, errors
 
+
+    def __do_update_version_check(self, acmpol_new):
+        acmpol_old = self
+
+        now_vers    = acmpol_old.policy_dom_get_hdr_item("Version")
+        now_name    = acmpol_old.policy_dom_get_hdr_item("PolicyName")
+        req_oldvers = acmpol_new.policy_dom_get_frompol_item("Version")
+        req_oldname = acmpol_new.policy_dom_get_frompol_item("PolicyName")
+
+        if now_vers == "" or \
+           now_vers != req_oldvers or \
+           now_name != req_oldname:
+            log.info("Policy rejected: %s != %s or %s != %s" % \
+                     (now_vers,req_oldvers,now_name,req_oldname))
+            return -xsconstants.XSERR_VERSION_PREVENTS_UPDATE
+
+        if not self.isVersionUpdate(acmpol_new):
+            log.info("Policy rejected since new version is not an update.")
+            return -xsconstants.XSERR_VERSION_PREVENTS_UPDATE
+
+        return xsconstants.XSERR_SUCCESS
+
+
     def compareVersions(self, v1, v2):
         """
             Compare two policy versions given their tuples of major and
@@ -848,8 +877,7 @@ class ACMPolicy(XSPolicy):
         if self.isloaded():
             return -xsconstants.XSERR_POLICY_LOADED
         files = [ self.get_filename(".map",""),
-                  self.get_filename(".bin",""),
-                  self.path_from_policy_name(self.get_name())]
+                  self.get_filename(".bin","") ]
         for f in files:
             try:
                 os.unlink(f)
diff -r 6384e168f122 -r 92e43b36d211 tools/python/xen/util/security.py
--- a/tools/python/xen/util/security.py Mon Aug 06 10:10:34 2007 +0100
+++ b/tools/python/xen/util/security.py Mon Aug 06 10:11:25 2007 +0100
@@ -146,7 +146,7 @@ def calc_dom_ssidref_from_info(info):
                 raise VmError("VM label '%s' in wrong format." % seclab)
             typ, policyname, vmlabel = seclab.split(":")
             if typ != xsconstants.ACM_POLICY_ID:
-                raise VmError("Policy type '%s' not supported." % typ)
+                raise VmError("Policy type '%s' must be changed." % typ)
             refresh_security_policy()
             if active_policy != policyname:
                 raise VmError("Active policy '%s' different than "
@@ -502,7 +502,7 @@ def hv_chg_policy(bin_pol, del_array, ch
         rc, errors = acm.chgpolicy(bin_pol, del_array, chg_array)
     except Exception, e:
         pass
-    if (len(errors) > 0):
+    if len(errors) > 0:
         rc = -xsconstants.XSERR_HV_OP_FAILED
     return rc, errors
 
@@ -785,6 +785,24 @@ def res_security_check_xapi(rlabel, rssi
     return rtnval
 
 
+def validate_label(label, policyref):
+    """
+       Make sure that this label is part of the currently enforced policy
+       and that it reference the current policy.
+    """
+    rc = xsconstants.XSERR_SUCCESS
+    from xen.xend.XendXSPolicyAdmin import XSPolicyAdminInstance
+    curpol = XSPolicyAdminInstance().get_loaded_policy()
+    if not curpol or curpol.get_name() != policyref:
+        rc = -xsconstants.XSERR_BAD_LABEL
+    else:
+        try:
+            label2ssidref(label, curpol.get_name() , 'res')
+        except:
+            rc = -xsconstants.XSERR_BAD_LABEL
+    return rc
+
+
 def set_resource_label_xapi(resource, reslabel_xapi, oldlabel_xapi):
     """Assign a resource label to a resource
     @param resource: The name of a resource, i.e., "phy:/dev/hda", or
@@ -809,9 +827,15 @@ def set_resource_label_xapi(resource, re
             return -xsconstants.XSERR_BAD_LABEL_FORMAT
         otyp, opolicyref, olabel = tmp
         # Only ACM is supported
-        if otyp != xsconstants.ACM_POLICY_ID:
+        if otyp != xsconstants.ACM_POLICY_ID  and \
+           otyp != xsconstants.INVALID_POLICY_PREFIX + \
+                   xsconstants.ACM_POLICY_ID:
             return -xsconstants.XSERR_WRONG_POLICY_TYPE
+    rc = validate_label(label, policyref)
+    if rc != xsconstants.XSERR_SUCCESS:
+        return rc
     return set_resource_label(resource, typ, policyref, label, olabel)
+
 
 def is_resource_in_use(resource):
     """ Investigate all running domains whether they use this device """
@@ -1228,7 +1252,7 @@ def change_acm_policy(bin_pol, del_array
                 sec_lab, new_seclab = labels
                 if sec_lab != new_seclab:
                     log.info("Updating domain %s to new label '%s'." % \
-                             (new_seclab, sec_lab))
+                             (sec_lab, new_seclab))
                     # This better be working!
                     dominfo.set_security_label(new_seclab,
                                                sec_lab,
diff -r 6384e168f122 -r 92e43b36d211 tools/python/xen/xm/activatepolicy.py
--- a/tools/python/xen/xm/activatepolicy.py     Mon Aug 06 10:10:34 2007 +0100
+++ b/tools/python/xen/xm/activatepolicy.py     Mon Aug 06 10:11:25 2007 +0100
@@ -23,7 +23,7 @@ from xen.util import xsconstants
 from xen.util import xsconstants
 from xml.dom import minidom
 from xen.xm.opts import OptionError
-from xen.xm import getpolicy
+from xen.xm import getpolicy, setpolicy
 from xen.xm import main as xm_main
 from xen.xm.main import server
 
@@ -38,6 +38,9 @@ def help():
       --boot     Have the system boot with the policy. Changes the default
                  title in grub.conf.
       --noboot   Remove the policy from the default entry in grub.conf.
+      --remove   Attempt to remove the current policy by installing the
+                 default policy; this works only if no domains are
+                 running.
     """
 
 def activate_policy(flags):
@@ -56,6 +59,25 @@ def remove_bootpolicy():
 def remove_bootpolicy():
     server.xenapi.XSPolicy.rm_xsbootpolicy()
 
+def install_default_policy():
+    if xm_main.serverType != xm_main.SERVER_XEN_API:
+        raise OptionError('xm needs to be configured to use the xen-api.')
+    xs_type = int(server.xenapi.XSPolicy.get_xstype())
+    if xs_type & xsconstants.XS_POLICY_ACM == 0:
+        raise OptionError('ACM policy type not supported on system.')
+    policystate = server.xenapi.XSPolicy.get_xspolicy()
+    if int(policystate['type']) == 0:
+        print 'No policy is installed.'
+        return
+    if int(policystate['type']) != xsconstants.XS_POLICY_ACM:
+        print "Unknown policy type '%s'." % policystate['type']
+    flags = int(policystate['flags'])
+    if flags & xsconstants.XS_INST_LOAD == 0:
+        print "Default policy is already loaded."
+        return
+    setpolicy.setpolicy(xsconstants.ACM_POLICY_ID, 'default', flags, True,
+                        False)
+
 def main(argv):
     if xm_main.serverType != xm_main.SERVER_XEN_API:
         raise OptionError('xm needs to be configured to use the xen-api.')
@@ -69,6 +91,9 @@ def main(argv):
             flags |= xsconstants.XS_INST_LOAD
         elif '--noboot' == argv[c]:
             remove_bootpolicy()
+        elif '--remove' == argv[c]:
+            install_default_policy()
+            return
         else:
             raise OptionError("Unknown command line option '%s'" % argv[c])
         c += 1
diff -r 6384e168f122 -r 92e43b36d211 tools/python/xen/xm/resources.py
--- a/tools/python/xen/xm/resources.py  Mon Aug 06 10:10:34 2007 +0100
+++ b/tools/python/xen/xm/resources.py  Mon Aug 06 10:11:25 2007 +0100
@@ -58,7 +58,6 @@ def main (argv):
         try:
             filename = security.res_label_filename
             access_control = dictio.dict_read("resources", filename)
-            print access_control
         except:
             raise OptionError("Resource file not found")
 
diff -r 6384e168f122 -r 92e43b36d211 tools/python/xen/xm/setpolicy.py
--- a/tools/python/xen/xm/setpolicy.py  Mon Aug 06 10:10:34 2007 +0100
+++ b/tools/python/xen/xm/setpolicy.py  Mon Aug 06 10:11:25 2007 +0100
@@ -24,6 +24,7 @@ import sys
 import sys
 import string
 from xen.util import xsconstants
+from xen.util.acmpolicy import ACMPolicy
 from xen.xm.opts import OptionError
 from xen.util.security import policy_dir_prefix
 from xen.xm import main as xm_main
@@ -40,9 +41,38 @@ def help():
     The following options are defined
       --load     Load the policy immediately
       --boot     Have the system load the policy during boot
+      --update   Automatically adapt the policy so that it will be
+                 treated as an update to the current policy
     """
 
-def setpolicy(policytype, policy_name, flags, overwrite):
+def create_update_xml(xml):
+    """
+        Adapt the new policy's xml header to be a simple type of an
+        update to the currently enforce policy on the remote system.
+        Increases the minor number by '1'.
+    """
+    policystate = server.xenapi.XSPolicy.get_xspolicy()
+    if int(policystate['type']) == 0:
+        return xml
+    curpol = ACMPolicy(xml = policystate['repr'])
+    curpol_version = curpol.get_version()
+    tmp = curpol_version.split('.')
+    if len(tmp) == 2:
+        maj = int(tmp[0])
+        min = int(tmp[1])
+    else:
+        maj = int(tmp)
+        min = 0
+    min += 1
+    newpol_version = ""+str(maj)+"."+str(min)
+
+    newpol = ACMPolicy(xml = xml)
+    newpol.set_frompolicy_name(curpol.get_name())
+    newpol.set_frompolicy_version(curpol.get_version())
+    newpol.set_policy_version(newpol_version)
+    return newpol.toxml()
+
+def setpolicy(policytype, policy_name, flags, overwrite, is_update=False):
     if xm_main.serverType != xm_main.SERVER_XEN_API:
         raise OptionError('xm needs to be configured to use the xen-api.')
     if policytype != xsconstants.ACM_POLICY_ID:
@@ -60,6 +90,9 @@ def setpolicy(policytype, policy_name, f
             f.close()
         except:
             raise OptionError("Not a valid policy file")
+
+        if is_update:
+            xml = create_update_xml(xml)
 
         try:
             policystate = server.xenapi.XSPolicy.set_xspolicy(xs_type,
@@ -96,18 +129,21 @@ def main(argv):
 
     policytype  = argv[1]
     policy_name = argv[2]
+    is_update = False
 
     flags = 0
     if '--load' in argv:
         flags |= xsconstants.XS_INST_LOAD
     if '--boot' in argv:
         flags |= xsconstants.XS_INST_BOOT
+    if '--update' in argv:
+        is_update = True
 
     overwrite = True
     if '--nooverwrite' in argv:
         overwrite = False
 
-    setpolicy(policytype, policy_name, flags, overwrite)
+    setpolicy(policytype, policy_name, flags, overwrite, is_update)
 
 if __name__ == '__main__':
     try:
diff -r 6384e168f122 -r 92e43b36d211 tools/security/Makefile
--- a/tools/security/Makefile   Mon Aug 06 10:10:34 2007 +0100
+++ b/tools/security/Makefile   Mon Aug 06 10:11:25 2007 +0100
@@ -12,13 +12,6 @@ CFLAGS     += $(shell xml2-config --cfla
 CFLAGS     += $(shell xml2-config --cflags )
 CFLAGS     += $(shell if [[ $(XML2VERSION) < 2.6.20 ]]; then echo ""; else 
echo "-DVALIDATE_SCHEMA"; fi )
 LDFLAGS    += $(shell xml2-config --libs ) # if this does not work, try 
-L/usr/lib -lxml2 -lz -lpthread -lm
-
-ifeq ($(ACM_DEFAULT_SECURITY_POLICY),ACM_NULL_POLICY)
-POLICY=null
-endif
-ifeq 
($(ACM_DEFAULT_SECURITY_POLICY),ACM_CHINESE_WALL_AND_SIMPLE_TYPE_ENFORCEMENT_POLICY)
-POLICY=chwall_ste
-endif
 
 SRCS_TOOL     = secpol_tool.c
 OBJS_TOOL    := $(patsubst %.c,%.o,$(filter %.c,$(SRCS_TOOL)))
@@ -41,6 +34,7 @@ ACM_SECGEN_CGIDIR = $(ACM_SECGEN_HTMLDIR
 
 ACM_SCHEMA        = security_policy.xsd
 ACM_EXAMPLES      = client_v1 test
+ACM_DEF_POLICIES  = default default-ul
 ACM_POLICY_SUFFIX = security_policy.xml
 
 ifeq ($(ACM_SECURITY),y)
@@ -61,6 +55,9 @@ install: all $(ACM_CONFIG_FILE)
        $(INSTALL_DIR) $(DESTDIR)$(ACM_POLICY_DIR)/example
        for i in $(ACM_EXAMPLES); do \
                $(INSTALL_DATA) policies/example/$$i-$(ACM_POLICY_SUFFIX) 
$(DESTDIR)$(ACM_POLICY_DIR)/example/; \
+       done
+       for i in $(ACM_DEF_POLICIES); do \
+               $(INSTALL_DATA) policies/$$i-$(ACM_POLICY_SUFFIX) 
$(DESTDIR)$(ACM_POLICY_DIR); \
        done
        $(INSTALL_DIR) $(DESTDIR)$(ACM_SCRIPT_DIR)
        $(INSTALL_PROG) $(ACM_SCRIPTS) $(DESTDIR)$(ACM_SCRIPT_DIR)

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.