[Xen-changelog] [xen-unstable] xend: XSPolicy.can_run xend support

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1207040883 -3600
# Node ID ff32e4cd61af0b14e402124ea1b2c26842c680b8
# Parent  6a7a61c26b14376820f4b8ec58bc7db37e0452dc
xend: XSPolicy.can_run xend support

Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>
---
 tools/python/xen/util/xsconstants.py  |    8 ++++--
 tools/python/xen/util/xsm/acm/acm.py  |   42 +++++++++++++++++++++++++++++++++-
 tools/python/xen/xend/XendXSPolicy.py |   10 +++++++-
 3 files changed, 56 insertions(+), 4 deletions(-)

diff -r 6a7a61c26b14 -r ff32e4cd61af tools/python/xen/util/xsconstants.py
--- a/tools/python/xen/util/xsconstants.py      Tue Apr 01 10:07:35 2008 +0100
+++ b/tools/python/xen/util/xsconstants.py      Tue Apr 01 10:08:03 2008 +0100
@@ -57,7 +57,9 @@ XSERR_RESOURCE_ACCESS          = 23 + XS
 XSERR_RESOURCE_ACCESS          = 23 + XSERR_BASE
 XSERR_HV_OP_FAILED             = 24 + XSERR_BASE
 XSERR_BOOTPOLICY_INSTALL_ERROR = 25 + XSERR_BASE
-XSERR_LAST                     = 25 + XSERR_BASE ## KEEP LAST
+XSERR_VM_NOT_AUTHORIZED        = 26 + XSERR_BASE
+XSERR_VM_IN_CONFLICT           = 27 + XSERR_BASE
+XSERR_LAST                     = 27 + XSERR_BASE ## KEEP LAST
 
 XSERR_MESSAGES = [
     '',
@@ -85,7 +87,9 @@ XSERR_MESSAGES = [
     'The policy is not loaded',
     'Error accessing resource',
     'Operation failed in hypervisor',
-    'Boot policy installation error'
+    'Boot policy installation error',
+    'VM is not authorized to run',
+    'VM label conflicts with another VM'
 ]
 
 def xserr2string(err):
diff -r 6a7a61c26b14 -r ff32e4cd61af tools/python/xen/util/xsm/acm/acm.py
--- a/tools/python/xen/util/xsm/acm/acm.py      Tue Apr 01 10:07:35 2008 +0100
+++ b/tools/python/xen/util/xsm/acm/acm.py      Tue Apr 01 10:08:03 2008 +0100
@@ -68,6 +68,7 @@ policy_name_re = re.compile(".*[chwall|s
 #decision hooks known to the hypervisor
 ACMHOOK_sharing = 1
 ACMHOOK_authorization = 2
+ACMHOOK_conflictset = 3
 
 #other global variables
 NULL_SSIDREF = 0
@@ -373,7 +374,7 @@ def label2ssidref(labelname, policyname,
         else:
             return (sec_ssid[0] << 16) | pri_ssid[0]
     finally:
-       mapfile_unlock()
+        mapfile_unlock()
 
 
 def refresh_ssidref(config):
@@ -550,6 +551,18 @@ def hv_get_policy():
     if len(bin_pol) == 0:
         bin_pol = None
     return rc, bin_pol
+
+
+def is_in_conflict(ssidref):
+    """ Check whether the given ssidref is in conflict with any running
+        domain.
+    """
+    decision = acm.getdecision('ssidref', str(ssidref),
+                               'ssidref', str(ssidref),
+                               ACMHOOK_conflictset)
+    if decision == "DENIED":
+        return True
+    return False
 
 
 def set_policy(xs_type, xml, flags, overwrite):
@@ -1550,6 +1563,33 @@ def get_security_label(self, xspol=None)
     return label
 
 
+def check_can_run(sec_label):
+    """ Check whether a VM could run, given its vm label. A VM can run if
+       - it is authorized
+       - is not in conflict with any running domain
+    """
+    try:
+        mapfile_lock()
+
+        if sec_label == None or sec_label == "":
+            vm_label = ACM_LABEL_UNLABELED
+        else:
+            poltype, policy, vm_label = sec_label.split(':')
+            if policy != get_active_policy_name():
+                return -xsconstants.XSERR_BAD_POLICY_NAME
+        ssidref = label2ssidref(vm_label, policy, 'dom')
+        if ssidref != xsconstants.INVALID_SSIDREF:
+            if not has_authorization(ssidref):
+                return -xsconstants.XSERR_VM_NOT_AUTHORIZED
+            if is_in_conflict(ssidref):
+                return -xsconstants.XSERR_VM_IN_CONFLICT
+            return -xsconstants.XSERR_SUCCESS
+        else:
+            return -xsconstants.XSERR_BAD_LABEL
+    finally:
+        mapfile_unlock()
+
+
 __cond = threading.Condition()
 __script_runner = None
 __orders = []
diff -r 6a7a61c26b14 -r ff32e4cd61af tools/python/xen/xend/XendXSPolicy.py
--- a/tools/python/xen/xend/XendXSPolicy.py     Tue Apr 01 10:07:35 2008 +0100
+++ b/tools/python/xen/xend/XendXSPolicy.py     Tue Apr 01 10:08:03 2008 +0100
@@ -48,7 +48,8 @@ class XendXSPolicy(XendBase):
                   'rm_xsbootpolicy',
                   'get_resource_label',
                   'set_resource_label',
-                  'get_labeled_resources' ]
+                  'get_labeled_resources',
+                  'can_run' ]
         return XendBase.getFuncs() + funcs
 
     getClass    = classmethod(getClass)
@@ -190,6 +191,12 @@ class XendXSPolicy(XendBase):
         res = security.get_resource_label_xapi(resource)
         return res
 
+    def can_run(self, sec_label):
+        irc = security.validate_label_xapi(sec_label, 'dom')
+        if irc != xsconstants.XSERR_SUCCESS:
+            raise SecurityError(irc)
+        return security.check_can_run(sec_label)
+
     get_xstype      = classmethod(get_xstype)
     get_xspolicy    = classmethod(get_xspolicy)
     set_xspolicy    = classmethod(set_xspolicy)
@@ -198,6 +205,7 @@ class XendXSPolicy(XendBase):
     set_resource_label = classmethod(set_resource_label)
     get_resource_label = classmethod(get_resource_label)
     get_labeled_resources = classmethod(get_labeled_resources)
+    can_run = classmethod(can_run)
 
 
 class XendACMPolicy(XendXSPolicy):

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog