예제 #1
0
    def getDeviceDetails(self, config):
        """@see DevController.getDeviceDetails"""
        uname = config.get('uname', '')
        dev = config.get('dev', '')

        if 'ioemu:' in dev:
            (_, dev) = string.split(dev, ':', 1)
        try:
            (dev, dev_type) = string.split(dev, ':', 1)
        except ValueError:
            dev_type = "disk"

        if not uname:
            if dev_type == 'cdrom':
                (typ, params) = ("", "")
            else:
                raise VmError(
                    'Block device must have physical details specified')
        else:
            try:
                (typ, params) = string.split(uname, ':', 1)
                if not self._isValidProtocol(typ):
                    raise VmError('Block device type "%s" is invalid.' % typ)
            except ValueError:
                raise VmError(
                    'Block device must have physical details specified')

        mode = config.get('mode', 'r')
        if mode not in ('r', 'w', 'w!'):
            raise VmError('Invalid mode')

        back = {
            'dev': dev,
            'type': typ,
            'params': params,
            'mode': mode,
        }

        uuid = config.get('uuid')
        if uuid:
            back['uuid'] = uuid

        bootable = config.get('bootable', None)
        if bootable != None:
            back['bootable'] = str(bootable)

        if security.on() == xsconstants.XS_POLICY_USE:
            self.do_access_control(config, uname)

        (device_path, devid) = blkif.blkdev_name_to_number(dev)
        if devid is None:
            raise VmError('Unable to find number for device (%s)' % (dev))

        front = {device_path: "%i" % devid, 'device-type': dev_type}

        protocol = config.get('protocol')
        if protocol:
            front['protocol'] = protocol

        return (devid, back, front)
예제 #2
0
    def getDeviceDetails(self, config):
        """@see DevController.getDeviceDetails"""
        uname = config.get('uname', '')
        dev = config.get('dev', '')
        
        if 'ioemu:' in dev:
            (_, dev) = string.split(dev, ':', 1)
        try:
            (dev, dev_type) = string.split(dev, ':', 1)
        except ValueError:
            dev_type = "disk"

        if not uname:
            if dev_type == 'cdrom':
                (typ, params) = ("", "")
            else:
                raise VmError(
                    'Block device must have physical details specified')
        else:
            try:
                (typ, params) = string.split(uname, ':', 1)
                if typ not in ('phy', 'file', 'tap'):
                    raise VmError(
                        'Block device must have "phy", "file" or "tap" '
                        'specified to type')
            except ValueError:
                raise VmError(
                    'Block device must have physical details specified')

        mode = config.get('mode', 'r')
        if mode not in ('r', 'w', 'w!'):
            raise VmError('Invalid mode')

        back = {'dev'    : dev,
                'type'   : typ,
                'params' : params,
                'mode'   : mode,
                }

        uuid = config.get('uuid')
        if uuid:
            back['uuid'] = uuid

        if security.on() == xsconstants.XS_POLICY_ACM:
            self.do_access_control(config, uname)

        (device_path, devid) = blkif.blkdev_name_to_number(dev)
        if devid is None:
            raise VmError('Unable to find number for device (%s)' % (dev))

        front = { device_path : "%i" % devid,
                  'device-type' : dev_type
                }

        protocol = config.get('protocol')
        if protocol:
            front['protocol'] = protocol

        return (devid, back, front)
예제 #3
0
    def getDeviceDetails(self, config):
        """@see DevController.getDeviceDetails"""

        script  = config.get('script', xoptions.get_vif_script())
        typ     = config.get('type')
        bridge  = config.get('bridge')
        mac     = config.get('mac')
        vifname = config.get('vifname')
        rate    = config.get('rate')
        uuid    = config.get('uuid')
        ipaddr  = config.get('ip')
        model   = config.get('model')
        accel   = config.get('accel')
        sec_lab = config.get('security_label')

        if not mac:
            raise VmError("MAC address not specified or generated.")

        devid = self.allocateDeviceID()

        back = { 'script' : script,
                 'mac'    : mac }
        if typ:
            back['type'] = typ
        if ipaddr:
            back['ip'] = ipaddr
        if bridge:
            back['bridge'] = bridge
        if vifname:
            back['vifname'] = vifname
        if rate:
            back['rate'] = rate
        if uuid:
            back['uuid'] = uuid
        if model:
            back['model'] = model
        if accel:
            back['accel'] = accel
        if sec_lab:
            back['security_label'] = sec_lab

        config_path = "device/%s/%d/" % (self.deviceClass, devid)
        for x in back:
            self.vm._writeVm(config_path + x, back[x])

        back['handle'] = "%i" % devid
        back['script'] = os.path.join(xoptions.network_script_dir, script)
        if rate:
            back['rate'] = parseRate(rate)

        front = {}
        if typ != 'ioemu':
            front = { 'handle' : "%i" % devid,
                      'mac'    : mac }

        if security.on():
            self.do_access_control(config)

        return (devid, back, front)
예제 #4
0
def config_security_check(config, verbose):
    """Checks each resource listed in the config to see if the active
       policy will permit creation of a new domain using the config.
       Returns 1 if the config passes all tests, otherwise 0.
    """
    answer = 1

    # get the domain acm_label
    domain_label = None
    domain_policy = None
    for x in sxp.children(config):
        if sxp.name(x) == 'security':
            domain_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
            domain_policy = sxp.child_value(sxp.name(sxp.child0(x)), 'policy')

    # if no domain label, use default
    if not domain_label and security.on():
        try:
            domain_label = security.ssidref2label(security.NULL_SSIDREF)
        except:
            import traceback
            traceback.print_exc(limit=1)
            return 0
        domain_policy = 'NULL'
    elif not domain_label:
        domain_label = ""
        domain_policy = 'NULL'

    if verbose:
        print "Checking resources:"

    # build a list of all resources in the config file
    resources = []
    for x in sxp.children(config):
        if sxp.name(x) == 'device':
            if sxp.name(sxp.child0(x)) == 'vbd':
                resources.append(sxp.child_value(sxp.child0(x), 'uname'))

    # perform a security check on each resource
    for resource in resources:
        try:
            security.res_security_check(resource, domain_label)
            if verbose:
                print "   %s: PERMITTED" % (resource)

        except security.XSMError:
            print "   %s: DENIED" % (resource)
            (poltype, res_label, res_policy) = security.get_res_label(resource)
            if not res_label:
                res_label = ""
            print "   --> res: %s (%s:%s)" % (str(res_label),
                                           str(poltype), str(res_policy))
            print "   --> dom: %s (%s:%s)" % (str(domain_label),
                                           str(poltype), str(domain_policy))

            answer = 0

    return answer
예제 #5
0
def config_security_check(config, verbose):
    """Checks each resource listed in the config to see if the active
       policy will permit creation of a new domain using the config.
       Returns 1 if the config passes all tests, otherwise 0.
    """
    answer = 1

    # get the domain acm_label
    domain_label = None
    domain_policy = None
    for x in sxp.children(config):
        if sxp.name(x) == 'security':
            domain_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
            domain_policy = sxp.child_value(sxp.name(sxp.child0(x)), 'policy')

    # if no domain label, use default
    if not domain_label and security.on():
        try:
            domain_label = security.ssidref2label(security.NULL_SSIDREF)
        except:
            import traceback
            traceback.print_exc(limit=1)
            return 0
        domain_policy = 'NULL'
    elif not domain_label:
        domain_label = ""
        domain_policy = 'NULL'

    if verbose:
        print "Checking resources:"

    # build a list of all resources in the config file
    resources = []
    for x in sxp.children(config):
        if sxp.name(x) == 'device':
            if sxp.name(sxp.child0(x)) == 'vbd':
                resources.append(sxp.child_value(sxp.child0(x), 'uname'))

    # perform a security check on each resource
    for resource in resources:
        try:
            security.res_security_check(resource, domain_label)
            if verbose:
                print "   %s: PERMITTED" % (resource)

        except security.XSMError:
            print "   %s: DENIED" % (resource)
            (poltype, res_label, res_policy) = security.get_res_label(resource)
            if not res_label:
                res_label = ""
            print "   --> res: %s (%s:%s)" % (str(res_label), str(poltype),
                                              str(res_policy))
            print "   --> dom: %s (%s:%s)" % (str(domain_label), str(poltype),
                                              str(domain_policy))

            answer = 0

    return answer
예제 #6
0
    def getDeviceDetails(self, config):
        """@see DevController.getDeviceDetails"""

        script = config.get('script', xoptions.get_vif_script())
        typ = config.get('type')
        bridge = config.get('bridge')
        mac = config.get('mac')
        vifname = config.get('vifname')
        rate = config.get('rate')
        uuid = config.get('uuid')
        ipaddr = config.get('ip')
        model = config.get('model')
        accel = config.get('accel')
        sec_lab = config.get('security_label')

        if not mac:
            raise VmError("MAC address not specified or generated.")

        devid = self.allocateDeviceID()

        back = {'script': script, 'mac': mac}
        if typ:
            back['type'] = typ
        if ipaddr:
            back['ip'] = ipaddr
        if bridge:
            back['bridge'] = bridge
        if vifname:
            back['vifname'] = vifname
        if rate:
            back['rate'] = rate
        if uuid:
            back['uuid'] = uuid
        if model:
            back['model'] = model
        if accel:
            back['accel'] = accel
        if sec_lab:
            back['security_label'] = sec_lab

        config_path = "device/%s/%d/" % (self.deviceClass, devid)
        for x in back:
            self.vm._writeVm(config_path + x, back[x])

        back['handle'] = "%i" % devid
        back['script'] = os.path.join(xoptions.network_script_dir, script)
        if rate:
            back['rate'] = parseRate(rate)

        front = {}
        if typ != 'ioemu':
            front = {'handle': "%i" % devid, 'mac': mac}

        if security.on():
            self.do_access_control(config)

        return (devid, back, front)
예제 #7
0
def check_domain_label(config, verbose):
    """All that we need to check here is that the domain label exists and
       is not null when security is on.  Other error conditions are
       handled when the config file is parsed.
    """
    answer = 0
    default_label = None
    secon = 0
    if security.on():
        default_label = security.ssidref2label(security.NULL_SSIDREF)
        secon = 1

    # get the domain acm_label
    dom_label = None
    dom_name = None
    for x in sxp.children(config):
        if sxp.name(x) == 'security':
            dom_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
        if sxp.name(x) == 'name':
            dom_name = sxp.child0(x)

    # sanity check on domain label
    if verbose:
        print "Checking domain:"
    if (not secon) and (not dom_label):
        answer = 1
        if verbose:
            print "   %s: PERMITTED" % (dom_name)
    elif (secon) and (dom_label) and (dom_label != default_label):
        answer = 1
        if verbose:
            print "   %s: PERMITTED" % (dom_name)
    else:
        print "   %s: DENIED" % (dom_name)
        if not secon:
            print "   --> Security off, but domain labeled"
        else:
            print "   --> Domain not labeled"
        answer = 0

    return answer
예제 #8
0
def check_domain_label(config, verbose):
    """All that we need to check here is that the domain label exists and
       is not null when security is on.  Other error conditions are
       handled when the config file is parsed.
    """
    answer = 0
    default_label = None
    secon = 0
    if security.on():
        default_label = security.ssidref2label(security.NULL_SSIDREF)
        secon = 1

    # get the domain acm_label
    dom_label = None
    dom_name = None
    for x in sxp.children(config):
        if sxp.name(x) == 'security':
            dom_label = sxp.child_value(sxp.name(sxp.child0(x)), 'label')
        if sxp.name(x) == 'name':
            dom_name = sxp.child0(x)

    # sanity check on domain label
    if verbose:
        print "Checking domain:"
    if (not secon) and (not dom_label):
        answer = 1
        if verbose:
            print "   %s: PERMITTED" % (dom_name)
    elif (secon) and (dom_label) and (dom_label != default_label):
        answer = 1
        if verbose:
            print "   %s: PERMITTED" % (dom_name)
    else:
        print "   %s: DENIED" % (dom_name)
        if not secon:
            print "   --> Security off, but domain labeled"
        else:
            print "   --> Domain not labeled"
        answer = 0

    return answer
예제 #9
0
def main(argv):
    policyref = None
    policy_type = ""
    if len(argv) not in (4, 5):
        raise OptionError('Needs either 2 or 3 arguments')

    label = argv[1]

    if len(argv) == 5:
        policyref = argv[4]
    elif security.on() == xsconstants.XS_POLICY_ACM:
        policyref = security.active_policy
        policy_type = xsconstants.ACM_POLICY_ID
    else:
        raise OptionError("ACM security is not enabled. You must specify "\
                          "the policy on the command line.")

    if argv[2].lower() == "dom":
        configfile = argv[3]
        if configfile[0] != '/':
            for prefix in [os.path.realpath(os.path.curdir), auxbin.xen_configdir()]:
                configfile = prefix + "/" + configfile
                if os.path.isfile(configfile):
                    break
        if not validate_config_file(configfile):
            raise OptionError('Invalid config file')
        else:
            add_domain_label(label, configfile, policyref)
    elif argv[2].lower() == "mgt":
        domain = argv[3]
        if policy_type == "":
            tmp = policyref.split(":")
            if len(tmp) != 2:
                raise OptionError("Policy name in wrong format.")
            policy_type, policyref = tmp
        add_domain_label_xapi(label, domain, policyref, policy_type)
    elif argv[2].lower() == "res":
        resource = argv[3]
        if policy_type == "":
            tmp = policyref.split(":")
            if len(tmp) == 1:
                policy_type = xsconstants.ACM_POLICY_ID
            elif len(tmp) == 2:
                policy_type, policyref = tmp
            else:
                raise OptionError("Policy name in wrong format.")
        add_resource_label(label, resource, policyref, policy_type)
    elif argv[2].lower().startswith("vif-"):
        try:
            idx = int(argv[2][4:])
            if idx < 0:
                raise
        except:
            raise OptionError("Bad VIF device index.")
        vmname = argv[3]
        if policy_type == "":
            tmp = policyref.split(":")
            if len(tmp) != 2:
                raise OptionError("Policy name in wrong format.")
            policy_type, policyref = tmp
        add_vif_label(label, vmname, idx, policyref, policy_type)
    else:
        raise OptionError('Need to specify either "dom", "mgt" or "res" as '
                          'object to add label to.')
예제 #10
0
def main(argv):
    policyref = None
    policy_type = ""
    if len(argv) not in (4, 5):
        raise OptionError('Needs either 2 or 3 arguments')

    label = argv[1]

    if len(argv) == 5:
        policyref = argv[4]
    elif security.on() == xsconstants.XS_POLICY_ACM:
        policyref = security.active_policy
        policy_type = xsconstants.ACM_POLICY_ID
    else:
        raise OptionError("ACM security is not enabled. You must specify "\
                          "the policy on the command line.")

    if argv[2].lower() == "dom":
        configfile = argv[3]
        if configfile[0] != '/':
            for prefix in [os.path.realpath(os.path.curdir), "/etc/xen"]:
                configfile = prefix + "/" + configfile
                if os.path.isfile(configfile):
                    break
        if not validate_config_file(configfile):
            raise OptionError('Invalid config file')
        else:
            add_domain_label(label, configfile, policyref)
    elif argv[2].lower() == "mgt":
        domain = argv[3]
        if policy_type == "":
            tmp = policyref.split(":")
            if len(tmp) != 2:
                raise OptionError("Policy name in wrong format.")
            policy_type, policyref = tmp
        add_domain_label_xapi(label, domain, policyref, policy_type)
    elif argv[2].lower() == "res":
        resource = argv[3]
        if policy_type == "":
            tmp = policyref.split(":")
            if len(tmp) == 1:
                policy_type = xsconstants.ACM_POLICY_ID
            elif len(tmp) == 2:
                policy_type, policyref = tmp
            else:
                raise OptionError("Policy name in wrong format.")
        add_resource_label(label, resource, policyref, policy_type)
    elif argv[2].lower().startswith("vif-"):
        try:
            idx = int(argv[2][4:])
            if idx < 0:
                raise
        except:
            raise OptionError("Bad VIF device index.")
        vmname = argv[3]
        if policy_type == "":
            tmp = policyref.split(":")
            if len(tmp) != 2:
                raise OptionError("Policy name in wrong format.")
            policy_type, policyref = tmp
        add_vif_label(label, vmname, idx, policyref, policy_type)
    else:
        raise OptionError('Need to specify either "dom", "mgt" or "res" as '
                          'object to add label to.')
예제 #11
0
def isACMEnabled():
    return security.on()
예제 #12
0
def isACMEnabled():
    return security.on()
예제 #13
0
    def getDeviceDetails(self, config):
        """@see DevController.getDeviceDetails"""
        uname = config.get('uname', '')
        dev = config.get('dev', '')
        
        if 'ioemu:' in dev:
            (_, dev) = string.split(dev, ':', 1)
        try:
            (dev, dev_type) = string.split(dev, ':', 1)
        except ValueError:
            dev_type = "disk"

        if not uname:
            if dev_type == 'cdrom':
                (typ, params) = ("", "")
            else:
                raise VmError(
                    'Block device must have physical details specified')
        else:
            try:
                (typ, params) = string.split(uname, ':', 1)
                if not self._isValidProtocol(typ):
                    raise VmError('Block device type "%s" is invalid.' % typ)
            except ValueError:
                raise VmError(
                    'Block device must have physical details specified')

        mode = config.get('mode', 'r')
        if mode not in ('r', 'w', 'w!'):
            raise VmError('Invalid mode')

        back = {'dev'    : dev,
                'type'   : typ,
                'params' : params,
                'mode'   : mode,
                }

        uuid = config.get('uuid')
        if uuid:
            back['uuid'] = uuid

        bootable = config.get('bootable', None)
        if bootable != None:
            back['bootable'] = str(bootable)

        if 'snapshotname' in self.vm.info:
            back['snapshot'] = self.vm.info['snapshotname']
            self.vm.info.pop('snapshotname')

        if security.on() == xsconstants.XS_POLICY_USE:
            self.do_access_control(config, uname)

        (device_path, devid) = blkif.blkdev_name_to_number(dev)
        if devid is None:
            raise VmError('Unable to find number for device (%s)' % (dev))

        front = { device_path : "%i" % devid,
                  'device-type' : dev_type
                }

        protocol = config.get('protocol')
        if protocol:
            front['protocol'] = protocol

        return (devid, back, front)