From: emellor@leeni.uk.xensource.com Date: Thu, 29 Jun 2006 10:13:11 +0000 (+0100) Subject: Replace changesets 10521, 10526, and 10527 with this new version that does not X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~15912^2~42^2 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks://%22Dat/%22http:/www.example.com/cgi/%22https:/%22bookmarks:/%22Dat?a=commitdiff_plain;h=ee590e60840e151cdfa7548b71f9a9e55618a7fb;p=xen.git Replace changesets 10521, 10526, and 10527 with this new version that does not use xml.marshal. This patch adds new xm subcommands to support working with resource labels. The new subcommands are 'xm resources', 'xm rmlabel', 'xm getlabel' and 'xm dry-run'. In addition, the 'xm addlabel' subcommand now uses an updated syntax to support labeling both domains and resources. See the xm man page for details on each subcommand. Beyond the new subcommands, this patch allows users to immediately see when security checks will fail by pushing some basic security checking into the beginning of 'xm create' and 'xm block-attach'. ACM security attributes for block devices are added to XenStore in order to support the final security enforcement, which will be performed in the kernel and included in a separate patch. Signed-off-by: Bryan D. Payne Signed-off-by: Reiner Sailer --- diff --git a/tools/python/xen/util/dictio.py b/tools/python/xen/util/dictio.py new file mode 100644 index 0000000000..4fcebdb88a --- /dev/null +++ b/tools/python/xen/util/dictio.py @@ -0,0 +1,50 @@ +#=========================================================================== +# This library is free software; you can redistribute it and/or +# modify it under the terms of version 2.1 of the GNU Lesser General Public +# License as published by the Free Software Foundation. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +#============================================================================ +# Copyright (C) 2006 International Business Machines Corp. +# Author: Bryan D. Payne +#============================================================================ + + +def dict_read(dictname, filename): + """Loads and returns the dictionary named from + the file. + """ + dict = {} + + # read in the config file + globs = {} + locs = {} + execfile(filename, globs, locs) + + for (k, v) in locs.items(): + if k == dictname: + dict = v + break + + return dict + +def dict_write(dict, dictname, filename): + """Writes to using the name . If the file + contains any other data, it will be overwritten. + """ + prefix = dictname + " = {\n" + suffix = "}\n" + fd = open(filename, "wb") + fd.write(prefix) + for key in dict: + line = " '" + str(key) + "': " + str(dict[key]) + ",\n" + fd.write(line) + fd.write(suffix) + fd.close() diff --git a/tools/python/xen/util/security.py b/tools/python/xen/util/security.py index df970f355e..015de985b1 100644 --- a/tools/python/xen/util/security.py +++ b/tools/python/xen/util/security.py @@ -22,10 +22,10 @@ import logging import sys, os, string, re import traceback import shutil -#from xml.marshal import generic from xen.lowlevel import acm from xen.xend import sxp from xen.xend.XendLogging import log +from xen.util import dictio #global directories and tools for security management policy_dir_prefix = "/etc/xen/acm-security/policies" @@ -551,20 +551,16 @@ def get_res_label(resource): (label, policy) = default_res_label() # load the resource label file - configfile = res_label_filename - if not os.path.isfile(configfile): + res_label_cache = {} + try: + res_label_cache = dictio.dict_read("resources", res_label_filename) + except: log.info("Resource label file not found.") return default_res_label() -# -# Commented out pending replacement for xml.marshal.generic -# -# fd = open(configfile, "rb") -# res_label_cache = generic.load(fd) -# fd.close() -# # find the resource information -# if res_label_cache.has_key(resource): -# (policy, label) = res_label_cache[resource] + # find the resource information + if res_label_cache.has_key(resource): + (policy, label) = res_label_cache[resource] return (label, policy) diff --git a/tools/python/xen/xm/addlabel.py b/tools/python/xen/xm/addlabel.py index e3966c9f59..2344bf501f 100644 --- a/tools/python/xen/xm/addlabel.py +++ b/tools/python/xen/xm/addlabel.py @@ -22,7 +22,7 @@ import sys, os import string import traceback -#from xml.marshal import generic +from xen.util import dictio from xen.util import security def usage(): @@ -79,17 +79,13 @@ def add_resource_label(label, resource, policyref): return # see if this resource is already in the file + access_control = {} file = security.res_label_filename - if not os.path.isfile(file): + try: + access_control = dictio.dict_read("resources", file) + except: print "Resource file not found, creating new file at:" print "%s" % (file) - fd = open(file, "w") - fd.close(); - access_control = {} - else: - fd = open(file, "rb") -# access_control = generic.load(fd) - fd.close() if access_control.has_key(resource): security.err("This resource is already labeled.") @@ -97,9 +93,7 @@ def add_resource_label(label, resource, policyref): # write the data to file new_entry = { resource : tuple([policyref, label]) } access_control.update(new_entry) - fd = open(file, "wb") -# generic.dump(access_control, fd) - fd.close() + dictio.dict_write(access_control, "resources", file) except security.ACMError: pass diff --git a/tools/python/xen/xm/getlabel.py b/tools/python/xen/xm/getlabel.py index e1c62d473a..c984dec02a 100644 --- a/tools/python/xen/xm/getlabel.py +++ b/tools/python/xen/xm/getlabel.py @@ -21,7 +21,7 @@ import sys, os, re import string import traceback -#from xml.marshal import generic +from xen.util import dictio from xen.util import security def usage(): @@ -33,17 +33,15 @@ def usage(): def get_resource_label(resource): """Gets the resource label """ + # read in the resource file + file = security.res_label_filename try: - # read in the resource file - file = security.res_label_filename - if os.path.isfile(file): - fd = open(file, "rb") -# access_control = generic.load(fd) - fd.close() - else: - print "Resource label file not found" - return + access_control = dictio.dict_read("resources", file) + except: + print "Resource label file not found" + return + try: # get the entry and print label if access_control.has_key(resource): policy = access_control[resource][0] @@ -100,7 +98,6 @@ def get_domain_label(configfile): data = data.strip() data = data.lstrip("[\'") data = data.rstrip("\']") - (p, l) = data.split(",") print data except security.ACMError: diff --git a/tools/python/xen/xm/resources.py b/tools/python/xen/xm/resources.py index 0108fed8f9..a7a93251ac 100644 --- a/tools/python/xen/xm/resources.py +++ b/tools/python/xen/xm/resources.py @@ -21,7 +21,7 @@ import sys, os import string import traceback -#from xml.marshal import generic +from xen.util import dictio from xen.util import security def usage(): @@ -40,24 +40,15 @@ def print_resource_data(access_control): print " label: "+label -def get_resource_data(): - """Returns the resource dictionary. - """ - file = security.res_label_filename - if not os.path.isfile(file): +def main (argv): + try: + file = security.res_label_filename + access_control = dictio.dict_read("resources", file) + except: security.err("Resource file not found.") - fd = open(file, "rb") -# access_control = generic.load(fd) - fd.close() - return access_control - - -def main (argv): try: - access_control = get_resource_data() print_resource_data(access_control) - except security.ACMError: pass except: diff --git a/tools/python/xen/xm/rmlabel.py b/tools/python/xen/xm/rmlabel.py index c031ab3f87..b149ec691b 100644 --- a/tools/python/xen/xm/rmlabel.py +++ b/tools/python/xen/xm/rmlabel.py @@ -21,7 +21,7 @@ import sys, os, re import string import traceback -#from xml.marshal import generic +from xen.util import dictio from xen.util import security def usage(): @@ -36,22 +36,18 @@ def usage(): def rm_resource_label(resource): """Removes a resource label from the global resource label file. """ + # read in the resource file + file = security.res_label_filename try: - # read in the resource file - file = security.res_label_filename - if os.path.isfile(file): - fd = open(file, "rb") -# access_control = generic.load(fd) - fd.close() - else: - security.err("Resource file not found, cannot remove label!") + access_control = dictio.dict_read("resources", file) + except: + security.err("Resource file not found, cannot remove label!") + try: # remove the entry and update file if access_control.has_key(resource): del access_control[resource] - fd = open(file, "wb") -# generic.dump(access_control, fd) - fd.close() + dictio.dict_write(access_control, "resources", file) else: security.err("Label does not exist in resource label file.")