def getDeviceDetails(self, config):
"""@see DevController.getDeviceDetails"""
uname = config.get('uname', '')
dev = config.get('dev', '')
if 'ioemu:' in dev:
(_, dev) = string.split(dev, ':', 1)
try:
(dev, dev_type) = string.split(dev, ':', 1)
except ValueError:
dev_type = "disk"
if not uname:
if dev_type == 'cdrom':
(typ, params) = ("", "")
else:
raise VmError(
'Block device must have physical details specified')
else:
try:
(typ, params) = string.split(uname, ':', 1)
if not self._isValidProtocol(typ):
raise VmError('Block device type "%s" is invalid.' % typ)
except ValueError:
raise VmError(
'Block device must have physical details specified')
mode = config.get('mode', 'r')
if mode not in ('r', 'w', 'w!'):
raise VmError('Invalid mode')
back = {
'dev': dev,
'type': typ,
'params': params,
'mode': mode,
}
uuid = config.get('uuid')
if uuid:
back['uuid'] = uuid
bootable = config.get('bootable', None)
if bootable != None:
back['bootable'] = str(bootable)
if security.on() == xsconstants.XS_POLICY_USE:
self.do_access_control(config, uname)
(device_path, devid) = blkif.blkdev_name_to_number(dev)
if devid is None:
raise VmError('Unable to find number for device (%s)' % (dev))
front = {device_path: "%i" % devid, 'device-type': dev_type}
protocol = config.get('protocol')
if protocol:
front['protocol'] = protocol
return (devid, back, front)
def getDeviceDetails(self, config):
"""@see DevController.getDeviceDetails"""
uname = config.get('uname', '')
dev = config.get('dev', '')
if 'ioemu:' in dev:
(_, dev) = string.split(dev, ':', 1)
try:
(dev, dev_type) = string.split(dev, ':', 1)
except ValueError:
dev_type = "disk"
if not uname:
if dev_type == 'cdrom':
(typ, params) = ("", "")
else:
raise VmError(
'Block device must have physical details specified')
else:
try:
(typ, params) = string.split(uname, ':', 1)
if typ not in ('phy', 'file', 'tap'):
raise VmError(
'Block device must have "phy", "file" or "tap" '
'specified to type')
except ValueError:
raise VmError(
'Block device must have physical details specified')
mode = config.get('mode', 'r')
if mode not in ('r', 'w', 'w!'):
raise VmError('Invalid mode')
back = {'dev' : dev,
'type' : typ,
'params' : params,
'mode' : mode,
}
uuid = config.get('uuid')
if uuid:
back['uuid'] = uuid
if security.on() == xsconstants.XS_POLICY_ACM:
self.do_access_control(config, uname)
(device_path, devid) = blkif.blkdev_name_to_number(dev)
if devid is None:
raise VmError('Unable to find number for device (%s)' % (dev))
front = { device_path : "%i" % devid,
'device-type' : dev_type
}
protocol = config.get('protocol')
if protocol:
front['protocol'] = protocol
return (devid, back, front)
def getDeviceDetails(self, config):
"""@see DevController.getDeviceDetails"""
script = config.get('script', xoptions.get_vif_script())
typ = config.get('type')
bridge = config.get('bridge')
mac = config.get('mac')
vifname = config.get('vifname')
rate = config.get('rate')
uuid = config.get('uuid')
ipaddr = config.get('ip')
model = config.get('model')
accel = config.get('accel')
sec_lab = config.get('security_label')
if not mac:
raise VmError("MAC address not specified or generated.")
devid = self.allocateDeviceID()
back = { 'script' : script,
'mac' : mac }
if typ:
back['type'] = typ
if ipaddr:
back['ip'] = ipaddr
if bridge:
back['bridge'] = bridge
if vifname:
back['vifname'] = vifname
if rate:
back['rate'] = rate
if uuid:
back['uuid'] = uuid
if model:
back['model'] = model
if accel:
back['accel'] = accel
if sec_lab:
back['security_label'] = sec_lab
config_path = "device/%s/%d/" % (self.deviceClass, devid)
for x in back:
self.vm._writeVm(config_path + x, back[x])
back['handle'] = "%i" % devid
back['script'] = os.path.join(xoptions.network_script_dir, script)
if rate:
back['rate'] = parseRate(rate)
front = {}
if typ != 'ioemu':
front = { 'handle' : "%i" % devid,
'mac' : mac }
if security.on():
self.do_access_control(config)
return (devid, back, front)
def config_security_check(config, verbose):
"""Checks each resource listed in the config to see if the active
policy will permit creation of a new domain using the config.
Returns 1 if the config passes all tests, otherwise 0.
"""
answer = 1
# get the domain acm_label
domain_label = None
domain_policy = None
for x in sxp.children(config):
if sxp.name(x) == 'security':
domain_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
domain_policy = sxp.child_value(sxp.name(sxp.child0(x)), 'policy')
# if no domain label, use default
if not domain_label and security.on():
try:
domain_label = security.ssidref2label(security.NULL_SSIDREF)
except:
import traceback
traceback.print_exc(limit=1)
return 0
domain_policy = 'NULL'
elif not domain_label:
domain_label = ""
domain_policy = 'NULL'
if verbose:
print "Checking resources:"
# build a list of all resources in the config file
resources = []
for x in sxp.children(config):
if sxp.name(x) == 'device':
if sxp.name(sxp.child0(x)) == 'vbd':
resources.append(sxp.child_value(sxp.child0(x), 'uname'))
# perform a security check on each resource
for resource in resources:
try:
security.res_security_check(resource, domain_label)
if verbose:
print " %s: PERMITTED" % (resource)
except security.XSMError:
print " %s: DENIED" % (resource)
(poltype, res_label, res_policy) = security.get_res_label(resource)
if not res_label:
res_label = ""
print " --> res: %s (%s:%s)" % (str(res_label),
str(poltype), str(res_policy))
print " --> dom: %s (%s:%s)" % (str(domain_label),
str(poltype), str(domain_policy))
answer = 0
return answer
def config_security_check(config, verbose):
"""Checks each resource listed in the config to see if the active
policy will permit creation of a new domain using the config.
Returns 1 if the config passes all tests, otherwise 0.
"""
answer = 1
# get the domain acm_label
domain_label = None
domain_policy = None
for x in sxp.children(config):
if sxp.name(x) == 'security':
domain_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
domain_policy = sxp.child_value(sxp.name(sxp.child0(x)), 'policy')
# if no domain label, use default
if not domain_label and security.on():
try:
domain_label = security.ssidref2label(security.NULL_SSIDREF)
except:
import traceback
traceback.print_exc(limit=1)
return 0
domain_policy = 'NULL'
elif not domain_label:
domain_label = ""
domain_policy = 'NULL'
if verbose:
print "Checking resources:"
# build a list of all resources in the config file
resources = []
for x in sxp.children(config):
if sxp.name(x) == 'device':
if sxp.name(sxp.child0(x)) == 'vbd':
resources.append(sxp.child_value(sxp.child0(x), 'uname'))
# perform a security check on each resource
for resource in resources:
try:
security.res_security_check(resource, domain_label)
if verbose:
print " %s: PERMITTED" % (resource)
except security.XSMError:
print " %s: DENIED" % (resource)
(poltype, res_label, res_policy) = security.get_res_label(resource)
if not res_label:
res_label = ""
print " --> res: %s (%s:%s)" % (str(res_label), str(poltype),
str(res_policy))
print " --> dom: %s (%s:%s)" % (str(domain_label), str(poltype),
str(domain_policy))
answer = 0
return answer
def getDeviceDetails(self, config):
"""@see DevController.getDeviceDetails"""
script = config.get('script', xoptions.get_vif_script())
typ = config.get('type')
bridge = config.get('bridge')
mac = config.get('mac')
vifname = config.get('vifname')
rate = config.get('rate')
uuid = config.get('uuid')
ipaddr = config.get('ip')
model = config.get('model')
accel = config.get('accel')
sec_lab = config.get('security_label')
if not mac:
raise VmError("MAC address not specified or generated.")
devid = self.allocateDeviceID()
back = {'script': script, 'mac': mac}
if typ:
back['type'] = typ
if ipaddr:
back['ip'] = ipaddr
if bridge:
back['bridge'] = bridge
if vifname:
back['vifname'] = vifname
if rate:
back['rate'] = rate
if uuid:
back['uuid'] = uuid
if model:
back['model'] = model
if accel:
back['accel'] = accel
if sec_lab:
back['security_label'] = sec_lab
config_path = "device/%s/%d/" % (self.deviceClass, devid)
for x in back:
self.vm._writeVm(config_path + x, back[x])
back['handle'] = "%i" % devid
back['script'] = os.path.join(xoptions.network_script_dir, script)
if rate:
back['rate'] = parseRate(rate)
front = {}
if typ != 'ioemu':
front = {'handle': "%i" % devid, 'mac': mac}
if security.on():
self.do_access_control(config)
return (devid, back, front)
def check_domain_label(config, verbose):
"""All that we need to check here is that the domain label exists and
is not null when security is on. Other error conditions are
handled when the config file is parsed.
"""
answer = 0
default_label = None
secon = 0
if security.on():
default_label = security.ssidref2label(security.NULL_SSIDREF)
secon = 1
# get the domain acm_label
dom_label = None
dom_name = None
for x in sxp.children(config):
if sxp.name(x) == 'security':
dom_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
if sxp.name(x) == 'name':
dom_name = sxp.child0(x)
# sanity check on domain label
if verbose:
print "Checking domain:"
if (not secon) and (not dom_label):
answer = 1
if verbose:
print " %s: PERMITTED" % (dom_name)
elif (secon) and (dom_label) and (dom_label != default_label):
answer = 1
if verbose:
print " %s: PERMITTED" % (dom_name)
else:
print " %s: DENIED" % (dom_name)
if not secon:
print " --> Security off, but domain labeled"
else:
print " --> Domain not labeled"
answer = 0
return answer
def check_domain_label(config, verbose):
"""All that we need to check here is that the domain label exists and
is not null when security is on. Other error conditions are
handled when the config file is parsed.
"""
answer = 0
default_label = None
secon = 0
if security.on():
default_label = security.ssidref2label(security.NULL_SSIDREF)
secon = 1
# get the domain acm_label
dom_label = None
dom_name = None
for x in sxp.children(config):
if sxp.name(x) == 'security':
dom_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
if sxp.name(x) == 'name':
dom_name = sxp.child0(x)
# sanity check on domain label
if verbose:
print "Checking domain:"
if (not secon) and (not dom_label):
answer = 1
if verbose:
print " %s: PERMITTED" % (dom_name)
elif (secon) and (dom_label) and (dom_label != default_label):
answer = 1
if verbose:
print " %s: PERMITTED" % (dom_name)
else:
print " %s: DENIED" % (dom_name)
if not secon:
print " --> Security off, but domain labeled"
else:
print " --> Domain not labeled"
answer = 0
return answer
def main(argv):
policyref = None
policy_type = ""
if len(argv) not in (4, 5):
raise OptionError('Needs either 2 or 3 arguments')
label = argv[1]
if len(argv) == 5:
policyref = argv[4]
elif security.on() == xsconstants.XS_POLICY_ACM:
policyref = security.active_policy
policy_type = xsconstants.ACM_POLICY_ID
else:
raise OptionError("ACM security is not enabled. You must specify "\
"the policy on the command line.")
if argv[2].lower() == "dom":
configfile = argv[3]
if configfile[0] != '/':
for prefix in [os.path.realpath(os.path.curdir), auxbin.xen_configdir()]:
configfile = prefix + "/" + configfile
if os.path.isfile(configfile):
break
if not validate_config_file(configfile):
raise OptionError('Invalid config file')
else:
add_domain_label(label, configfile, policyref)
elif argv[2].lower() == "mgt":
domain = argv[3]
if policy_type == "":
tmp = policyref.split(":")
if len(tmp) != 2:
raise OptionError("Policy name in wrong format.")
policy_type, policyref = tmp
add_domain_label_xapi(label, domain, policyref, policy_type)
elif argv[2].lower() == "res":
resource = argv[3]
if policy_type == "":
tmp = policyref.split(":")
if len(tmp) == 1:
policy_type = xsconstants.ACM_POLICY_ID
elif len(tmp) == 2:
policy_type, policyref = tmp
else:
raise OptionError("Policy name in wrong format.")
add_resource_label(label, resource, policyref, policy_type)
elif argv[2].lower().startswith("vif-"):
try:
idx = int(argv[2][4:])
if idx < 0:
raise
except:
raise OptionError("Bad VIF device index.")
vmname = argv[3]
if policy_type == "":
tmp = policyref.split(":")
if len(tmp) != 2:
raise OptionError("Policy name in wrong format.")
policy_type, policyref = tmp
add_vif_label(label, vmname, idx, policyref, policy_type)
else:
raise OptionError('Need to specify either "dom", "mgt" or "res" as '
'object to add label to.')
def main(argv):
policyref = None
policy_type = ""
if len(argv) not in (4, 5):
raise OptionError('Needs either 2 or 3 arguments')
label = argv[1]
if len(argv) == 5:
policyref = argv[4]
elif security.on() == xsconstants.XS_POLICY_ACM:
policyref = security.active_policy
policy_type = xsconstants.ACM_POLICY_ID
else:
raise OptionError("ACM security is not enabled. You must specify "\
"the policy on the command line.")
if argv[2].lower() == "dom":
configfile = argv[3]
if configfile[0] != '/':
for prefix in [os.path.realpath(os.path.curdir), "/etc/xen"]:
configfile = prefix + "/" + configfile
if os.path.isfile(configfile):
break
if not validate_config_file(configfile):
raise OptionError('Invalid config file')
else:
add_domain_label(label, configfile, policyref)
elif argv[2].lower() == "mgt":
domain = argv[3]
if policy_type == "":
tmp = policyref.split(":")
if len(tmp) != 2:
raise OptionError("Policy name in wrong format.")
policy_type, policyref = tmp
add_domain_label_xapi(label, domain, policyref, policy_type)
elif argv[2].lower() == "res":
resource = argv[3]
if policy_type == "":
tmp = policyref.split(":")
if len(tmp) == 1:
policy_type = xsconstants.ACM_POLICY_ID
elif len(tmp) == 2:
policy_type, policyref = tmp
else:
raise OptionError("Policy name in wrong format.")
add_resource_label(label, resource, policyref, policy_type)
elif argv[2].lower().startswith("vif-"):
try:
idx = int(argv[2][4:])
if idx < 0:
raise
except:
raise OptionError("Bad VIF device index.")
vmname = argv[3]
if policy_type == "":
tmp = policyref.split(":")
if len(tmp) != 2:
raise OptionError("Policy name in wrong format.")
policy_type, policyref = tmp
add_vif_label(label, vmname, idx, policyref, policy_type)
else:
raise OptionError('Need to specify either "dom", "mgt" or "res" as '
'object to add label to.')
def isACMEnabled():
return security.on()
def isACMEnabled():
return security.on()
def getDeviceDetails(self, config):
"""@see DevController.getDeviceDetails"""
uname = config.get('uname', '')
dev = config.get('dev', '')
if 'ioemu:' in dev:
(_, dev) = string.split(dev, ':', 1)
try:
(dev, dev_type) = string.split(dev, ':', 1)
except ValueError:
dev_type = "disk"
if not uname:
if dev_type == 'cdrom':
(typ, params) = ("", "")
else:
raise VmError(
'Block device must have physical details specified')
else:
try:
(typ, params) = string.split(uname, ':', 1)
if not self._isValidProtocol(typ):
raise VmError('Block device type "%s" is invalid.' % typ)
except ValueError:
raise VmError(
'Block device must have physical details specified')
mode = config.get('mode', 'r')
if mode not in ('r', 'w', 'w!'):
raise VmError('Invalid mode')
back = {'dev' : dev,
'type' : typ,
'params' : params,
'mode' : mode,
}
uuid = config.get('uuid')
if uuid:
back['uuid'] = uuid
bootable = config.get('bootable', None)
if bootable != None:
back['bootable'] = str(bootable)
if 'snapshotname' in self.vm.info:
back['snapshot'] = self.vm.info['snapshotname']
self.vm.info.pop('snapshotname')
if security.on() == xsconstants.XS_POLICY_USE:
self.do_access_control(config, uname)
(device_path, devid) = blkif.blkdev_name_to_number(dev)
if devid is None:
raise VmError('Unable to find number for device (%s)' % (dev))
front = { device_path : "%i" % devid,
'device-type' : dev_type
}
protocol = config.get('protocol')
if protocol:
front['protocol'] = protocol
return (devid, back, front)