--- /dev/null
+#!/usr/bin/env python
+#===========================================================================
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of version 2.1 of the GNU Lesser General Public
+# License as published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+#============================================================================
+# Copyright (C) 2006 International Business Machines Corp.
+# Author: Reiner Sailer
+#============================================================================
+# use 'yum install wxPython' to get wx or download from www.wxpython.org
+import sys, time, string
+import wx
+import wx.lib.buttons as buttons
+"""
+This program creates a default policy based on names of organizations and departments.
+The resulting policy can be refined using the policy generation tool (xensec_gen).
+"""
+
+helpprovider = wx.SimpleHelpProvider()
+wx.HelpProvider_Set(helpprovider)
+
+ID_CS_START=1000
+
+realm_bmp = None
+workload_bmp = None
+conflict_bmp = None
+realm_icon = None
+workload_icon = None
+
+class orgTreeCtrl(wx.TreeCtrl):
+
+ event = None
+
+ def __init__(self, parent, id, pos, size, style, validator, name):
+ wx.TreeCtrl.__init__(self, parent, id, pos, size, style,
+ validator, name)
+ self.parent = parent
+ orgs_root = self.AddRoot(text="Organization / Department")
+ rootfont = wx.Font(pointSize=12, family=wx.FONTFAMILY_DEFAULT,
+ style=wx.FONTSTYLE_NORMAL, weight=wx.FONTWEIGHT_LIGHT)
+ self.SetItemFont(orgs_root, rootfont)
+ self.SetItemBackgroundColour(orgs_root, wx.LIGHT_GREY)
+
+
+ def LabelExists(self, label, item):
+ for i in iterchildren(self.GetItemParent(item)):
+ if (self.GetItemText(i) == label) and (i != item):
+ return True
+ return False
+
+
+ def _OrgEdt(self, event):
+ item = self.event.GetItem()
+ self.OrgEdt(item)
+
+
+ def OrgEdt(self, item):
+ oldlabel= self.GetItemText(item)
+ #get new name
+ dlg = wx.TextEntryDialog(self, "Please enter org/dept name:",
+ "Naming a Workload",
+ style=wx.CANCEL | wx.OK | wx.CENTRE | wx.TE_NOHIDESEL)
+ dlg.SetValue(oldlabel)
+ ret = dlg.ShowModal()
+ newlabel = dlg.GetValue()
+ dlg.Destroy()
+ if (ret == wx.ID_CANCEL) or (newlabel == ''):
+ return False
+
+ #now check if the new name is permissible
+ if self.LabelExists(newlabel, item):
+ dlg = wx.MessageDialog(self, 'Item with name ' + newlabel + ' already exists!',
+ 'Rename', style=wx.OK)
+ dlg.ShowModal()
+ dlg.Destroy()
+ return False
+
+ #all checkspassed, change item and adapt runtime exclusion rules
+ self.SetItemText(item, newlabel)
+ app.win.LabelReplaceInConflictsets(item, oldlabel, newlabel)
+ return True
+
+
+ def _OrgRAdd(self, event):
+ self.OrgRAdd()
+
+
+ def OrgRAdd(self):
+ new = self.AppendItem(self.GetRootItem(), text="")
+ self.SetItemBold(new, True)
+ self.SetItemImage(new, realm_icon, wx.TreeItemIcon_Normal)
+ self.EnsureVisible(new)
+ if not self.OrgEdt(new):
+ self.Delete(new)
+
+
+ def _OrgWAdd(self, event):
+ item = self.event.GetItem()
+ self.OrgWAdd(item)
+
+
+ def OrgWAdd(self, item):
+ new = self.AppendItem(item, text="")
+ self.Expand(item)
+ self.SetItemImage(new, workload_icon, wx.TreeItemIcon_Normal)
+ self.EnsureVisible(new)
+ if not self.OrgEdt(new):
+ self.Delete(new)
+
+
+class OrgsPanel(wx.Panel):
+ ID_CONSADDBTN = 145
+ ID_REALMADDBTN = 144
+
+ def __init__(self, parent, ID):
+ global realm_icon, workload_icon
+
+ wx.Panel.__init__(self, parent, -1)
+
+ #create image list
+ imagelist = wx.ImageList(16, 17, True)
+ #define generic function and use it for all input
+ realm_icon = imagelist.Add(realm_bmp)
+ workload_icon = imagelist.Add(workload_bmp)
+
+ #left tree control for organizations / workload definitions
+ orgshdrbox = wx.StaticBox(self, -1, "")
+ orgshdrboxsizer = wx.StaticBoxSizer(orgshdrbox, wx.HORIZONTAL)
+ orgshdr = wx.StaticText(self, -1, "Organization / Department Definition",
+ style=wx.ALIGN_CENTER)
+ orgshdr.SetHelpText(RealmWorkloadPanelHelp)
+ points = orgshdr.GetFont().GetPointSize() # get the current size
+ hdrfont = wx.Font(points + 2, family=wx.DEFAULT,
+ style=wx.FONTSTYLE_NORMAL, weight=wx.BOLD)
+ orgshdr.SetFont(hdrfont)
+ orgshdr.SetForegroundColour('MEDIUMBLUE')
+ orgshdr.SetBackgroundColour('SNOW')
+ orgshdrboxsizer.Add(orgshdr, proportion=1, flag=wx.EXPAND | wx.ALL | wx.ALIGN_LEFT, border=5)
+ addorgsbutton = wx.Button(self, self.ID_REALMADDBTN, "New Org", style=wx.BU_EXACTFIT)
+ addorgsbutton.SetToolTipString("Add A New Organization")
+ addorgsbutton.SetHelpText(NewRealmButtonHelp)
+ addorgsbutton.SetForegroundColour('MEDIUMBLUE')
+ addfont = wx.Font(points, family=wx.DEFAULT,
+ style=wx.FONTSTYLE_NORMAL, weight=wx.BOLD)
+ addorgsbutton.SetFont(addfont)
+ orgshdrboxsizer.Add(addorgsbutton, proportion=0, flag=wx.EXPAND | wx.ALL | wx.ALIGN_RIGHT, border=0)
+
+ self.orgs = orgTreeCtrl(self, -1,
+ pos=wx.DefaultPosition,
+ size=wx.DefaultSize,
+ style=wx.TR_HAS_BUTTONS | wx.TR_HIDE_ROOT | wx.TR_NO_LINES
+ | wx.TR_MULTIPLE,
+ validator=wx.DefaultValidator,
+ name="orgs")
+ self.orgs.AssignImageList(imagelist)
+ self.orgs.SetHelpText(RealmWorkloadPanelHelp)
+
+ self.addconsbutton = wx.Button(self, self.ID_CONSADDBTN,
+ "Create run-time exclusion rule from selection -->",
+ style=wx.BU_EXACTFIT)
+ self.addconsbutton.SetToolTipString("Create New Exclusion rule From Above Workload Selection")
+ self.addconsbutton.SetHelpText(CreateRunTimeButtonHelp)
+ self.addconsbutton.SetForegroundColour('MEDIUMBLUE')
+ addfont = wx.Font(points, family=wx.DEFAULT,
+ style=wx.FONTSTYLE_NORMAL, weight=wx.BOLD)
+ self.addconsbutton.SetFont(addfont)
+ self.addconsbutton.Bind(wx.EVT_BUTTON, self._AddConflict, id=self.ID_CONSADDBTN)
+
+ orgsvbox = wx.BoxSizer(wx.VERTICAL)
+ orgsvbox.Add(orgshdrboxsizer, proportion=0, flag=wx.EXPAND | wx.ALL, border=5)
+ orgsvbox.Add(self.orgs, proportion=1, flag=wx.EXPAND | wx.ALL, border=5)
+ orgsvbox.Add(self.addconsbutton, proportion=0, flag=wx.EXPAND | wx.ALL, border=5)
+ self.SetSizer(orgsvbox)
+ addorgsbutton.Bind(wx.EVT_BUTTON, self.orgs._OrgRAdd, id= self.ID_REALMADDBTN)
+
+
+ def _AddConflict(self, event):
+ app.win.conspanel._AddNewConflict(event)
+
+
+class ConsPanel(wx.Panel):
+ ID_CONSSELECT = 151
+ ID_CONSADD = 152
+ ID_CONSRENAME = 153
+ ID_CONSDEL = 154
+ ID_CONSSELECTSUB= 155
+
+ conflictMAX = ID_CS_START
+
+ def __init__(self, parent, ID):
+ self.conflictsets = []
+ self.parent = parent
+ wx.Panel.__init__(self, parent, -1)
+ #header
+ conshdrbox = wx.StaticBox(self, -1, "")
+ conshdrboxsizer = wx.StaticBoxSizer(conshdrbox, wx.HORIZONTAL)
+ conshdr = wx.StaticText(self, -1, "Run-time Exclusion Rules", style=wx.ALIGN_CENTER)
+ conshdr.SetHelpText(RunTimeExclusionPanelHelp)
+ points = conshdr.GetFont().GetPointSize() # get the current size
+ hdrfont = wx.Font(points + 2, family=wx.DEFAULT,
+ style=wx.FONTSTYLE_NORMAL, weight=wx.BOLD)
+ conshdr.SetFont(hdrfont)
+ conshdr.SetForegroundColour('ORANGERED')
+
+ #context help button
+ ctxHelp = wx.ContextHelpButton(self)
+ ctxHelp.SetHelpText("Context Help Button.")
+ ctxHelp.SetToolTipString("Context Help: Press this button, then press any other button or panel to get help.")
+
+
+ conshdrboxsizer.Add(conshdr, proportion=1, flag=wx.EXPAND | wx.ALL | wx.ALIGN_LEFT, border=5)
+ conshdrboxsizer.Add(ctxHelp, proportion=0, flag=wx.EXPAND | wx.ALL | wx.ALIGN_RIGHT, border=0)
+ #scrolledwindow for all the run-time exclusion rules
+ conflictspanel = wx.ScrolledWindow(self, -1, (0,0),
+ style = wx.FULL_REPAINT_ON_RESIZE |
+ wx.VSCROLL )
+ conflictspanel.SetVirtualSize((1000, 1000))
+ conflictspanel.SetScrollRate(5,5)
+ self.conflictsboxsizer = wx.BoxSizer(wx.VERTICAL)
+
+ #self.conflictsboxsizer.Fit(self)
+ conflictspanel.SetSizer(self.conflictsboxsizer)
+ consvbox = wx.BoxSizer(wx.VERTICAL)
+ consvbox.Add(conshdrboxsizer, proportion=0, flag=wx.EXPAND | wx.ALL, border=5)
+ consvbox.Add(conflictspanel, proportion=1, flag=wx.EXPAND | wx.ALL, border=5)
+ self.SetSizer(consvbox)
+ self.consvbox = consvbox
+ self.conflictspanel=conflictspanel
+
+ self.cmenu = wx.Menu()
+ self.cmenu.Append(self.ID_CONSRENAME, "Rename Run-time Exclusion Rule", "Rename Run-time Exclusion Rule")
+ self.cmenu.AppendSeparator()
+ self.cmenu.Append(self.ID_CONSDEL, "Delete Run-time Exclusion Rule", "Delete Run-time Exclusion Rule")
+ self.Bind(wx.EVT_MENU, self._CSRename, id=self.ID_CONSRENAME)
+ self.Bind(wx.EVT_MENU, self._CSDelete, id=self.ID_CONSDEL)
+
+
+ #Helper methods called from anywhere
+ def New(self):
+ #delete all run-time exclusion rules
+ for i in self.conflictsets:
+ i.Disable()
+ i.Destroy()
+ self.conflictsets = []
+ self.conflictsboxsizer.Layout()
+ size=self.GetSize()
+ self.Fit()
+ self.SetSize(size)
+
+
+ def DelCSById(self, delid):
+ #delete CS representation
+ delpos, item = self.GetCSBox(delid)
+ if item:
+ self.DelCSByItem(item)
+
+
+ def DelCSByItem(self, item):
+ #delete CS representation
+ self.conflictsets.remove(item)
+ exists = self.conflictsboxsizer.Detach(item)
+ if exists:
+ item.Destroy()
+ self.RefreshMe()
+
+
+ def RefreshMe(self):
+ size=self.parent.GetSize()
+ self.parent.Fit()
+ self.parent.SetSize(size)
+
+
+ def GetOrgSelection(self):
+ (tree, selection) = GetOrgsSelection()
+ if not len(selection):
+ dlg = wx.MessageDialog(self, 'You must select first at least one Organization/Department workload!',
+ 'Creating A New Run-time Rule', wx.OK | wx.ICON_ERROR)
+ dlg.ShowModal()
+ dlg.Destroy()
+ return None,None
+ # now rewrite selection (realm.workload extension, check consistency)
+ alist = []
+ for i in selection:
+ if isRealm(i):
+ alist.append(tree.GetItemText(i))
+ else:
+ alist.append(tree.GetItemText(tree.GetItemParent(i))
+ + "." + tree.GetItemText(i))
+
+ if isRealm(i):
+ for j in selection:
+ if tree.GetItemParent(j) == i:
+ violation = ("[ " + tree.GetItemText(i) + ", " +
+ tree.GetItemText(i) + "." + tree.GetItemText(j) + " ]")
+ dlg = wx.MessageDialog(self,
+ 'Invalid Selection ' + violation + '.\n\n' +
+ 'You can only select EITHER an Organization OR specific Department!',
+ 'Creating A New Run-time Exclusion Rule', wx.OK | wx.ICON_ERROR)
+ dlg.ShowModal()
+ dlg.Destroy()
+ return None,None
+ return (alist, selection)
+
+
+ def AddConflict(self, name, types):
+ csbox = myCSPanel(self, self.conflictMAX, name, types)
+ self.conflictsboxsizer.Add(csbox, proportion=0, flag=wx.EXPAND | wx.ALL, border=5)
+ self.conflictsets.append(csbox)
+ self.conflictMAX = self.conflictMAX+3
+ self.RefreshMe()
+ csbox.RefreshMe()
+
+
+ def GetCSBox(self, id):
+ pos = -1
+ i = 0
+ while self.conflictsboxsizer.GetItem(i):
+ item = self.conflictsboxsizer.GetItem(i).GetWindow()
+ if ((item.cbmp.GetId() == id) or
+ (item.add_selection.GetId() == id) or
+ (item.del_selection.GetId() == id)):
+ pos = i
+ box = item
+ break
+ i = i + 1
+ if pos < 0:
+ print "Run-time Exclusion Rule Not Found ERROR!"
+ return (None, None)
+ else:
+ return (pos, box)
+
+
+ #bind methods
+ def _AddNewConflict(self, event):
+ # first get the conflicting workload types with current selection
+ types, items = self.GetOrgSelection()
+ if not types:
+ return
+ #get name for conflict set
+ dlg = wx.TextEntryDialog(
+ self, 'Please enter a name for the Run-time Exclusion Rule:', 'Creating A New Run-time Exclusion Rule')
+ dlg.SetValue("")
+ ret = dlg.ShowModal()
+ name = dlg.GetValue()
+ dlg.Destroy()
+ if ret != wx.ID_OK:
+ return
+ self.AddConflict(name, types)
+
+
+ def _OnClick(self, event):
+ self.event = event
+ app.win.SetStatusText("")
+ self.PopupMenu(self.cmenu)
+
+
+ def _CSRename(self, event):
+ delpos, item = self.GetCSBox(self.event.GetId())
+ if not item:
+ return
+ #allow to name the conflict set
+ dlg = wx.TextEntryDialog(
+ self, 'Please enter a new name for the Conflict Set:', 'Renaming A Run-time Exclusion Rule')
+ dlg.SetValue(item.box.GetLabel())
+ ret = dlg.ShowModal()
+ name = dlg.GetValue()
+ dlg.Destroy()
+ if ret != wx.ID_OK:
+ return
+ item.box.SetLabel(name)
+ item.box.SetFont(wx.Font(item.GetFont().GetPointSize(), family=wx.DEFAULT,
+ style=wx.FONTSTYLE_NORMAL, weight=wx.BOLD))
+
+
+ def _CSDelete(self, event):
+ delid = self.event.GetId()
+ self.DelCSById(delid)
+
+
+ def _AddOrgSelection(self, event):
+ addid = event.GetId()
+ addpos, item = self.GetCSBox(addid)
+ alist, items = self.GetOrgSelection()
+ if not alist:
+ return
+ existing = []
+ for i in range(0, item.clb.GetCount()):
+ existing.append(item.clb.GetString(i))
+
+ #now make sure that we don't get realm + workload into the same CS
+ for i in items:
+ if isRealm(i):
+ #ensure no workload of this realm is already in CS
+ realm = app.win.orgs.GetItemText(i)
+ for j in iterchildren(i):
+ workload = app.win.orgs.GetItemText(j)
+ try:
+ idx = existing.index (realm + "." + workload)
+ except:
+ #ok, does not exist
+ continue
+ #nok, exists already
+ violation = ("[ " + realm + ", " +
+ realm + "." + workload + " ]")
+ dlg = wx.MessageDialog(self,
+ 'Invalid Selection ' + violation + '.\n\n' +
+ 'You can only have EITHER an Organization OR a specific Department workload\n' +
+ 'in a single Run-time Exclusion Rule',
+ 'Adding Orgs/Depts workloads to a Run-time Exclusion Rule',
+ wx.OK | wx.ICON_ERROR)
+ dlg.ShowModal()
+ dlg.Destroy()
+ return
+
+ else:
+ #ensure realm of this workload is not in CS
+ realm = app.win.orgs.GetItemText(app.win.orgs.GetItemParent(i))
+ try:
+ idx = existing.index(realm)
+ except:
+ #ok, does not exist
+ continue
+ #nok, exists already
+ violation = ("[ " + realm + "." + app.win.orgs.GetItemText(i) +
+ ", " + realm + " ]")
+ dlg = wx.MessageDialog(self,
+ 'Invalid Selection ' + violation + '.\n\n' +
+ 'You can only have EITHER an Organization OR a specific Department workload\n' +
+ 'in a single Run-time Exclusion Rule',
+ 'Adding Orgs/Depts workloads to a Run-time Exclusion Rule',
+ wx.OK | wx.ICON_ERROR)
+ dlg.ShowModal()
+ dlg.Destroy()
+ return
+ #check if any of the selections are already in the conflict set
+ overlap=[]
+ for l in alist:
+ for e in existing:
+ if l == e:
+ overlap.append(str(l))
+ if len(overlap):
+ if len(overlap) == 1:
+ message = "Selected item " + str(overlap) +\
+ " is already in the Run-time Exclusion rule and will be ignored.\n\n Continue?"
+ else:
+ message = "Selected items " + str(overlap) +\
+ " are already in the Run-time Exclusion rule and will be ignored.\n\n Continue?"
+ dlg = wx.MessageDialog(self,
+ message, 'Adding Orgs/Depts workloads to a Run-time Exclusion rule',
+ wx.YES | wx.NO | wx.ICON_EXCLAMATION)
+ ret = dlg.ShowModal()
+ dlg.Destroy()
+ if ret != wx.ID_YES:
+ return
+
+ for s in alist:
+ try:
+ existing.index(s)
+ except Exception:
+ # s not yet in list box, add it
+ item.AddTypes([s])
+ self.RefreshMe()
+
+
+ def _DelConSelection(self, event):
+ eventid = event.GetId()
+ pos, item = self.GetCSBox(eventid)
+ idtuple = item.clb.GetSelections()
+ idlist = []
+ for i in idtuple:
+ idlist.append(i)
+ #delete reverse, otherwise item mubers get messed up while deleting
+ idlist.reverse()
+ for i in idlist:
+ item.clb.Delete(i)
+ item.RefreshMe()
+ if item.clb.GetCount() < 2:
+ dlg = wx.MessageDialog(self,
+ """Run-time exclusion set has less than two types.\n\n
+ Do you want to delete this rule?""",
+ 'Deleting Orgs/Depts workloads from a Run-time Exclusion rule',
+ wx.YES| wx.NO | wx.ICON_QUESTION)
+ ret = dlg.ShowModal()
+ dlg.Destroy()
+ if ret == wx.ID_YES:
+ self.DelCSById(eventid)
+ return
+ else:
+ for i in item.clb.GetSelections():
+ item.clb.Deselect(i)
+ self.RefreshMe()
+
+
+class myCSPanel(wx.Panel):
+ def __init__(self, parent, ID, title, list=[]):
+ wx.Panel.__init__(self, parent.conflictspanel, -1)
+ self.parent = parent
+ cspansizer = wx.BoxSizer(wx.VERTICAL)
+ self.box = wx.StaticBox(self, -1, title)
+ csboxsizer = wx.StaticBoxSizer(self.box, wx.HORIZONTAL)
+ #left: type add/del
+ typesizer = wx.BoxSizer(wx.VERTICAL)
+ self.add_selection = wx.Button(self, ID+1, "--> Add", style=wx.BU_EXACTFIT)
+ self.add_selection.SetToolTipString("Add Workload Selection To Run-time Exclusion rule")
+ self.add_selection.SetHelpText(AddToExclusionButtonHelp)
+ self.add_selection.SetForegroundColour('MEDIUMBLUE')
+ points = self.add_selection.GetFont().GetPointSize()
+ addfont = wx.Font(points, family=wx.DEFAULT,
+ style=wx.FONTSTYLE_NORMAL, weight=wx.BOLD)
+ self.add_selection.SetFont(addfont)
+ self.box.SetFont(addfont)
+ typesizer.Add(self.add_selection, proportion = 0, flag = wx.EXPAND | wx.ALL,border=0)
+ typesizer.Add((5,5))
+ self.del_selection = wx.Button(self, ID+2, "<-- Del", style=wx.BU_EXACTFIT)
+ self.del_selection.SetToolTipString("Delete Workload Selection From Run-time Exclusion Rule")
+ self.del_selection.SetHelpText(DelFromExclusionButtonHelp)
+ self.del_selection.SetForegroundColour('ORANGERED')
+ self.del_selection.SetFont(addfont)
+ typesizer.Add(self.del_selection, proportion = 0, flag = wx.EXPAND | wx.ALL, border=0)
+ csboxsizer.Add(typesizer, proportion = 0, border=0)
+ csboxsizer.Add((5,5))
+ #middle: types
+ self.clb = wx.ListBox(self, id=-1, choices=list,
+ style= wx.LB_MULTIPLE | wx.LB_SORT )
+ self.clb.SetHelpText(ExclusionSetHelp)
+ csboxsizer.Add(self.clb, proportion=1, flag=wx.EXPAND | wx.ALL, border=0)
+ csboxsizer.Add((5,5))
+ #right: Conflictset-global ops button
+ bmpsizer = wx.BoxSizer(wx.VERTICAL)
+ self.cbmp = buttons.GenBitmapButton(self, ID, conflict_bmp, style=wx.BU_EXACTFIT)
+ self.cbmp.SetHelpText(ManageExclusionButtonHelp)
+ self.cbmp.SetToolTipString("Rename/Delete\nAssociated Run-time Exclusion Rule")
+ bmpsizer.Add(self.cbmp, proportion = 0, flag = wx.EXPAND | wx.ALL, border=0)
+ csboxsizer.Add(bmpsizer, proportion=0, border=5)
+ cspansizer.Add(csboxsizer, proportion=0, flag=wx.EXPAND | wx.ALL, border=0)
+ self.csboxsizer=csboxsizer
+ self.cspansizer=cspansizer
+ self.SetSizer(cspansizer)
+ self.cbmp.Bind(wx.EVT_LEFT_DOWN, parent._OnClick, id=ID)
+ self.add_selection.Bind(wx.EVT_BUTTON, parent._AddOrgSelection, id=ID + 1)
+ self.del_selection.Bind(wx.EVT_BUTTON, parent._DelConSelection, id=ID + 2)
+
+ # append and delete an item to get rid of
+ # the ugly vertical scroll bar on the Listbox on Linux
+ def RefreshMe(self):
+ x = self.clb.Append(" ")
+ app.win.conspanel.RefreshMe()
+ self.clb.Delete(x)
+ self.Layout()
+ app.win.conspanel.Layout()
+
+
+ def AddTypes(self, list):
+ for i in list:
+ self.clb.Append(i)
+ self.RefreshMe()
+
+
+ def GetTypes(self):
+ alist = []
+ for i in range(0, self.clb.GetCount()):
+ alist.append(self.clb.GetString(i))
+ return alist
+
+
+ def GetBoxName(self):
+ return self.box.GetLabel()
+
+
+ def Replace(self, oldlabel, newlabel):
+ index = self.clb.FindString(oldlabel)
+ if index != wx.NOT_FOUND:
+ self.clb.SetString(index, newlabel)
+
+
+ def Delete(self, label):
+ index = self.clb.FindString(label)
+ if index != wx.NOT_FOUND:
+ self.clb.Delete(index)
+
+
+class myHelpPanel(wx.Panel):
+ def __init__(self, parent, ID):
+ wx.Panel.__init__(self, parent, -1)
+
+
+class ezFrame(wx.Frame):
+
+ ID_ABOUT = 101
+ ID_NEW = 102
+ ID_OPEN = 103
+ ID_SAVE = 104
+ ID_SAVEAS = 105
+ ID_EXIT = 106
+ ID_HELP = 107
+
+ ID_ITRENAME = 111
+ ID_ITADD = 112
+ ID_ITDEL = 113
+
+ ID_COLLAPSEALL = 121
+ ID_EXPANDALL = 122
+ ID_SORTALL = 123
+
+ ID_TRANSLATE = 131
+
+ ID_ORGEDT = 141
+ ID_ORGADD = 142
+ ID_ORGDEL = 143
+
+ def __init__(self, parent, ID, title):
+ global realm_bmp, workload_bmp, conflict_bmp
+
+ wx.Frame.__init__(self, parent, ID, title,
+ wx.DefaultPosition,
+ wx.Size(700,450)
+ )
+
+ realm_bmp = GetIconBitmap('Organization')
+ workload_bmp = GetIconBitmap('Department')
+ conflict_bmp = GetIconBitmap('Conflict')
+ self.SetHelpText(GetHelp)
+ self.orgfilename = None
+ self.CreateStatusBar()
+ self.SetStatusText("")
+ self.bkg = wx.Panel(self)
+
+ self.orgswin = wx.SashLayoutWindow(
+ self.bkg, -1, wx.DefaultPosition, (300, 150),wx.SW_3DSASH | wx.SW_BORDER)
+
+ self.orgswin.SetDefaultSize((300,150))
+ self.orgswin.SetOrientation(wx.LAYOUT_VERTICAL)
+ self.orgswin.SetAlignment(wx.LAYOUT_LEFT)
+ self.orgspanel = OrgsPanel(self.orgswin, -1)
+ self.orgs = self.orgspanel.orgs
+
+ self.realm_menu = wx.Menu()
+ self.realm_menu.Append(self.ID_ORGADD, "Add Department\tctrl-a", "Add Department Workload")
+ self.realm_menu.AppendSeparator()
+ self.realm_menu.AppendSeparator()
+ self.realm_menu.Append(self.ID_ORGEDT, "Rename Organization\tctrl-r", "Rename Organization Workload")
+ self.realm_menu.Append(self.ID_ORGDEL, "Delete Organization\tctrl-d", "Delete Organization Workload")
+ self.realm_menu.Bind(wx.EVT_MENU, self.orgs._OrgEdt, id= self.ID_ORGEDT)
+ self.realm_menu.Bind(wx.EVT_MENU, self.orgs._OrgWAdd, id= self.ID_ORGADD)
+ self.realm_menu.Bind(wx.EVT_MENU, self._ItemDel, id=self.ID_ORGDEL)
+
+ self.workload_menu = wx.Menu()
+ self.workload_menu.Append(self.ID_ORGEDT, "Rename Department\tctrl-r", "Rename Department Workload")
+ self.workload_menu.Append(self.ID_ORGDEL, "Delete Department\tctrl-d", "Delete Department Workload")
+ self.workload_menu.Bind(wx.EVT_MENU, self.orgs._OrgEdt, id= self.ID_ORGEDT)
+ self.workload_menu.Bind(wx.EVT_MENU, self._ItemDel, id=self.ID_ORGDEL)
+
+ self.orgs.Bind(wx.EVT_TREE_ITEM_RIGHT_CLICK, self._OrgRightClick)
+ self.orgs.Bind(wx.EVT_TREE_SEL_CHANGED, self._OrgSelectionChanged)
+
+ self.conswin = wx.SashLayoutWindow(
+ self.bkg, -1, wx.DefaultPosition, (300, 150),
+ #wx.NO_BORDER | wx.SW_3D
+ wx.SW_3DSASH | wx.SW_BORDER
+ )
+ self.conswin.SetDefaultSize((300,150))
+ self.conswin.SetOrientation(wx.LAYOUT_VERTICAL)
+ self.conswin.SetAlignment(wx.LAYOUT_RIGHT)
+ self.conswin.SetSashVisible(wx.SASH_LEFT, True)
+ self.conswin.SetSashVisible(wx.SASH_RIGHT, False)
+
+ #right tree control for non-concurrent workload execution
+ self.conspanel = ConsPanel(self.conswin, -1)
+ self.conspanel.RefreshMe()
+ self.bkg.Bind(wx.EVT_SASH_DRAGGED_RANGE, self._OnSashDrag, id=self.conswin.GetId(),
+ id2=self.conswin.GetId())
+ self.bkg.Bind(wx.EVT_SIZE, self._OnSize)
+
+ # Main Menu
+ # -File
+ fmenu = wx.Menu()
+ fmenu.Append(self.ID_OPEN, "Open Workload Definition...\tctrl-o", "Open current workload definition")
+ fmenu.Append(self.ID_SAVE, "Save Workload Definition\tctrl-s", "Save workload defintion")
+ fmenu.Append(self.ID_SAVEAS, "Save Workload Defintion as...\talt-s", "Save into new file")
+ fmenu.AppendSeparator()
+ fmenu.Append(self.ID_TRANSLATE, "Save as Xen ACM Security Policy ...\talt-t", "Create Xen ACM security policy")
+ fmenu.AppendSeparator()
+ fmenu.Append(self.ID_NEW, "New\tctrl-n", "Create a new oganization definition")
+ fmenu.AppendSeparator()
+ fmenu.Append(self.ID_EXIT, "Exit\tctrl-x", "Terminate the program")
+ self.fmenu = fmenu
+
+ # -Edit
+ emenu = wx.Menu()
+ emenu.Append(self.ID_ITRENAME, "Rename\tctrl-r", "Rename Selected Organization/Department")
+ emenu.Append(self.ID_ITADD, "Add\tctrl-a", "Add Child to Selected Organization/Department")
+ emenu.Append(self.ID_ITDEL, "Delete\tctrl-d", "Delete Selected Organization/Department")
+ self.emenu = emenu
+ # -Help
+ hmenu = wx.Menu()
+ hmenu.Append(self.ID_HELP, "Step-By-Step Help\tctrl-h", "More information about this program")
+ hmenu.Append(self.ID_ABOUT, "About", "More information about this program")
+ self.hmenu = hmenu
+
+ # -View
+ vmenu = wx.Menu()
+ vmenu.Append(self.ID_SORTALL, "Sort All", "Sort Entries In All Trees")
+ vmenu.Append(self.ID_COLLAPSEALL, "Collapse All\tctrl-c", "Collapse All Trees")
+ vmenu.Append(self.ID_EXPANDALL, "Expand All\tctrl-e", "Expand All Trees")
+ self.vmenu = vmenu
+
+ menuBar = wx.MenuBar()
+ menuBar.Append(fmenu, "&File");
+ menuBar.Append(emenu, "&Edit");
+ menuBar.Append(vmenu, "&View");
+ menuBar.Append(hmenu, "&Help");
+
+ self.SetMenuBar(menuBar)
+
+ self.Bind(wx.EVT_MENU, self._OpenSpec, id=self.ID_OPEN)
+ self.Bind(wx.EVT_MENU, self._SaveSpec, id=self.ID_SAVE)
+ self.Bind(wx.EVT_MENU, self._SaveAsSpec,id=self.ID_SAVEAS)
+ self.Bind(wx.EVT_MENU, self._NewSpec, id=self.ID_NEW)
+ self.Bind(wx.EVT_MENU, self._TimeToQuit,id=self.ID_EXIT)
+ self.Bind(wx.EVT_MENU, self._TranslateSpec, id=self.ID_TRANSLATE)
+
+ self.Bind(wx.EVT_MENU, self._ItemRename, id=self.ID_ITRENAME)
+ self.Bind(wx.EVT_MENU, self._ItemAdd, id=self.ID_ITADD)
+ self.Bind(wx.EVT_MENU, self._ItemDel, id=self.ID_ITDEL)
+
+ self.Bind(wx.EVT_MENU, self._SortAll, id=self.ID_SORTALL)
+ self.Bind(wx.EVT_MENU, self._CollapseAll,id=self.ID_COLLAPSEALL)
+ self.Bind(wx.EVT_MENU, self._ExpandAll, id=self.ID_EXPANDALL)
+
+ self.Bind(wx.EVT_MENU, self._Help, id=self.ID_HELP)
+ self.Bind(wx.EVT_MENU, self._OnAbout, id=self.ID_ABOUT)
+ self.Bind(wx.EVT_CLOSE, self._TimeToQuit)
+
+
+ def RefreshMe(self):
+ size=self.GetSize()
+ self.Fit()
+ self.SetSize(size)
+
+ #helper methods
+ def Load(self, file):
+ self.orgfilename = file
+ dictname = 'ezpolicy'
+ d = {}
+ # read in the config file
+ globs = {}
+ locs = {}
+ execfile(file, globs, locs)
+ for (k, v) in locs.items():
+ if k == dictname:
+ d = v
+ break
+ dict2org(d)
+ self.orgspanel.orgs.UnselectAll()
+ self.SetTitle("ezPolicy: " + self.orgfilename)
+ self._ExpandAll(None)
+
+
+ def Save(self, file):
+ dictname = 'ezpolicy'
+ d = org2dict()
+ fd = open(file, "w")
+ fd.write(dictname + " = ")
+ fd.write(str(d))
+ fd.close()
+
+
+ def New(self):
+ self.orgspanel.orgs.DeleteChildren(self.orgspanel.orgs.GetRootItem())
+ self.conspanel.New()
+
+
+ def LabelReplaceInConflictsets(self, item, oldlabel, newlabel):
+ if isRealm(item):
+ replace = [[ oldlabel, newlabel]]
+ for i in iterchildren(item):
+ replace.append([(oldlabel + "." + self.orgs.GetItemText(i)),
+ (newlabel + "." + self.orgs.GetItemText(i))])
+ else:
+ parent = self.orgs.GetItemParent(item)
+ replace = [
+ [(self.orgs.GetItemText(parent) + "." + oldlabel),
+ (self.orgs.GetItemText(parent) + "." + newlabel)]
+ ]
+ for r in replace:
+ for i in self.conspanel.conflictsets:
+ if r[0] in i.GetTypes():
+ i.Replace(r[0], r[1])
+
+
+ def OrgDelItem(self, item):
+ label = self.orgs.GetItemText(item)
+ if isRealm(item):
+ delset = [label]
+ for i in iterchildren(item):
+ delset.append(label + "." + self.orgs.GetItemText(i))
+ else:
+ parent = self.orgs.GetItemParent(item)
+ delset = [self.orgs.GetItemText(parent) + "." + label]
+ for i in self.conspanel.conflictsets:
+ for l in delset:
+ i.Delete(l)
+ #need to run in reverse order when deleting items
+ rev = []
+ for i in self.conspanel.conflictsets:
+ rev.append(i)
+ rev.reverse()
+ for i in rev:
+ if len(i.GetTypes()) < 1:
+ self.conspanel.DelCSByItem(i)
+ self.orgs.Delete(item)
+
+
+ def _OnSashDrag(self, event):
+ if event.GetDragStatus() == wx.SASH_STATUS_OUT_OF_RANGE:
+ return
+ w = event.GetEventObject()
+ if w is self.conswin:
+ self.conswin.SetDefaultSize((event.GetDragRect().width, 1000))
+ wx.LayoutAlgorithm().LayoutWindow(self.bkg, self.orgswin)
+ self.RefreshMe()
+
+
+ def _OnSize(self, event):
+ wx.LayoutAlgorithm().LayoutWindow(self.bkg, self.orgswin)
+
+
+ def _OrgSelectionChanged(self, event):
+ self.orgs.event = event
+ item = self.orgs.event.GetItem()
+ if not item.IsOk() or not self.orgs.IsSelected(item):
+ self.emenu.Enable(self.ID_ITRENAME, False)
+ self.emenu.Enable(self.ID_ITADD, False)
+ self.emenu.Enable(self.ID_ITDEL, False)
+ return
+ self.SetStatusText("")
+ #enable/disable edit menu functions
+ if isRealm(item):
+ self.emenu.Enable(self.ID_ITRENAME, True)
+ self.emenu.Enable(self.ID_ITADD, True)
+ self.emenu.Enable(self.ID_ITDEL, True)
+ elif isWorkload(item):
+ self.emenu.Enable(self.ID_ITRENAME, True)
+ self.emenu.Enable(self.ID_ITADD, False)
+ self.emenu.Enable(self.ID_ITDEL, True)
+ if len(self.orgs.GetSelections()) > 1:
+ self.emenu.Enable(self.ID_ITRENAME, False)
+ self.emenu.Enable(self.ID_ITADD, False)
+
+
+ def _OrgRightClick(self, event):
+ self.SetStatusText("")
+ self.orgs.event = event
+ item = self.orgs.event.GetItem()
+ #del not permitted on root items
+ if isWorkload(item):
+ self.workload_menu.Enable(self.ID_ORGDEL, True)
+ self.workload_menu.Enable(self.ID_ORGEDT, True)
+ if len(self.orgs.GetSelections()) > 1:
+ self.workload_menu.Enable(self.ID_ORGEDT, False)
+ self.PopupMenu(self.workload_menu)
+ else:
+ self.realm_menu.Enable(self.ID_ORGDEL, True)
+ self.realm_menu.Enable(self.ID_ORGEDT, True)
+ self.realm_menu.Enable(self.ID_ORGADD, True)
+ if len(self.orgs.GetSelections()) > 1:
+ self.realm_menu.Enable(self.ID_ORGEDT, False)
+ self.realm_menu.Enable(self.ID_ORGADD, False)
+ self.PopupMenu(self.realm_menu)
+
+
+ def _OpenSpec(self, event):
+ filediag = wx.FileDialog(self, defaultFile="myspec.wld",
+ wildcard="*.wld", style=wx.OPEN | wx.OVERWRITE_PROMPT,
+ message="Select Workload Definition file name")
+ ret = filediag.ShowModal()
+ name = filediag.GetPath()
+ filediag.Destroy()
+ if ret not in [wx.ID_OK]:
+ return
+ self.orgfilename = name
+ self.Load(self.orgfilename)
+ self.SetTitle("ezPolicy: " + self.orgfilename)
+
+
+ def _SaveSpec(self, event):
+ if not self.orgfilename:
+ filediag = wx.FileDialog(self, defaultFile="myspec.wld",
+ wildcard="*.wld", style=wx.SAVE | wx.OVERWRITE_PROMPT,
+ message="Select Workload Definition file name")
+ ret = filediag.ShowModal()
+ name = filediag.GetPath()
+ filediag.Destroy()
+ if ret not in [wx.ID_OK]:
+ return
+ self.orgfilename = name
+ self.Save(self.orgfilename)
+ self.SetTitle("ezPolicy: " + self.orgfilename)
+
+
+ def _SaveAsSpec(self, event):
+ if not self.orgfilename:
+ self.orgfilename = "DEFAULT.wld"
+ filediag = wx.FileDialog(self, defaultFile=self.orgfilename,
+ wildcard="*.wld", style=wx.SAVE | wx.OVERWRITE_PROMPT,
+ message="Select Workload Definition file name")
+ ret = filediag.ShowModal()
+ name = filediag.GetPath()
+ filediag.Destroy()
+ if ret not in [wx.ID_OK]:
+ return
+ self.orgfilename = name
+ self.Save(self.orgfilename)
+ self.SetTitle("ezPolicy: " + self.orgfilename)
+
+
+ def _NewSpec(self, event):
+ self.orgfilename = None
+ #reset trees etc
+ self.New()
+ self.SetTitle("ezPolicy: *New File*")
+
+
+ def _TranslateSpec(self, event):
+ policyname = transInfo()
+ if not policyname:
+ return
+ path="/etc/xen/acm-security/policies/"
+ nameparts=string.split(policyname, ".")
+ if len(nameparts) > 1:
+ path = path + "/".join(nameparts[0:len(nameparts)-1])
+ deffile = nameparts[len(nameparts) - 1] + "-security_policy.xml"
+ filediag = wx.FileDialog(self, defaultDir=path, defaultFile=deffile,
+ wildcard="*.xml", message="Select Policy File Name",
+ style=wx.SAVE | wx.OVERWRITE_PROMPT)
+ ret = filediag.ShowModal()
+ filename = filediag.GetPath()
+ filediag.Destroy()
+ if ret not in [wx.ID_OK]:
+ return
+ #translate data into default policy
+ timestamp = time.asctime()
+ d = org2dict()
+ types = []
+ for i in d['orgs']:
+ types.append(str(i[0]))
+ for j in i[1]:
+ types.append(str(i[0]) + "." + str(j))
+ f = open(filename, "w")
+ printPolicyHeader (f, policyname, timestamp)
+ printPolicy(f, types, d['cons'])
+ printLabels(f, d, types)#, d['cons'])
+ printTrailer(f)
+ f.close()
+
+
+ def _ItemRename(self, event):
+ #ensure only 1 item is selected
+ sels = self.orgs.GetSelections()
+ if len(sels) != 1:
+ return
+ self.orgs.OrgEdt(sels[0])
+
+
+ def _ItemAdd(self, event):
+ #ensure only 1 item is selected + add figure
+ sels = self.orgs.GetSelections()
+ if len(sels) != 1:
+ return
+ self.orgs.OrgWAdd(sels[0])
+
+
+ def _ItemDel(self, event):
+ sels = self.orgs.GetSelections()
+ for i in sels:
+ self.OrgDelItem(i)
+
+
+ def _CollapseAll(self, event):
+ for i in iterchildren(self.orgs.GetRootItem()):
+ self.orgs.Collapse(i)
+
+
+ def _ExpandAll(self, event):
+ for i in iterchildren(self.orgs.GetRootItem()):
+ self.orgs.Expand(i)
+
+
+ def _SortAll(self, event):
+ #would be nice to also sort the organizations
+ for i in iterchildren(self.orgs.GetRootItem()):
+ if self.orgs.GetChildrenCount(i) > 0:
+ self.orgs.SortChildren(i)
+
+
+ def _OnAbout(self, event):
+ dlg = wx.MessageDialog(self,
+ "This program helps you to define the structure\n"
+ "of organizations and their departments.\n\n"
+ "It translates this \'Workload Definition\' into\n"
+ "a simple workload protection policy for the\n"
+ "Xen Access Control Module.\n\n\n"
+ "Copyright (c) 2006: IBM Corporation\n"
+ "Author:\nReiner Sailer <sailer@us.ibm.com>",
+ "About Me", wx.OK | wx.ICON_INFORMATION)
+ dlg.ShowModal()
+ dlg.Destroy()
+
+
+ def _Help(self, event):
+ hpopup = wx.Frame(self,-1, "HELP: Creating a Xen Security Policy in 3 Steps" )
+ HelpHtmlWindow(hpopup, -1)
+ hpopup.SetSize((650,650))
+ hpopup.Show(True)
+
+
+ def _TimeToQuit(self, event):
+ self.Bind(wx.EVT_CLOSE, None)
+ self.orgs.Bind(wx.EVT_TREE_ITEM_RIGHT_CLICK, None)
+ self.orgs.Bind(wx.EVT_TREE_SEL_CHANGED, None)
+ self.Close(True)
+
+
+class ezApp(wx.App):
+
+ def OnInit(self):
+ self.win = ezFrame(None, -1, title="EZ Workload Protection Policy Tool")
+ self.win.Show(True)
+ self.SetTopWindow(self.win)
+ return True
+
+
+ def Load(self, file):
+ self.win.Load(file)
+
+
+ def New(self):
+ self.win.New()
+
+
+def isRealm(it):
+ if not it:
+ return False
+ return (app.win.orgspanel.orgs.GetItemParent(it) == app.win.orgspanel.orgs.GetRootItem())
+
+
+def isWorkload(it):
+ if not it or not app.win.orgs.GetItemParent(it):
+ return False
+ return (app.win.orgspanel.orgs.GetItemParent(app.win.orgspanel.orgs.GetItemParent(it))
+ == app.win.orgspanel.orgs.GetRootItem())
+
+
+def GetOrgsSelection():
+ return (app.win.orgspanel.orgs, app.win.orgspanel.orgs.GetSelections())
+
+
+def transInfo():
+ info = wx.TextEntryDialog(app.win, message="POLICYNAME",
+ caption="Translate: Creating The Xen/ACM Policy")
+ ret = info.ShowModal()
+ name = info.GetValue()
+ info.Destroy()
+ if ret in [wx.ID_OK]:
+ return name
+ return None
+
+
+def iterchildren(node):
+ cid, citem = app.win.orgspanel.orgs.GetFirstChild(node)
+ while cid.IsOk():
+ yield cid
+ cid, citem = app.win.orgspanel.orgs.GetNextChild(node, citem)
+
+
+def dict2org(d):
+ # release old structure
+ app.New()
+ # fill them with dict content
+ for i in d['orgs']:
+ orgnode = app.win.orgspanel.orgs.AppendItem(app.win.orgspanel.orgs.GetRootItem(), text=i[0])
+ app.win.orgspanel.orgs.SetItemBold(orgnode, True)
+ app.win.orgspanel.orgs.SetItemImage(orgnode, realm_icon, wx.TreeItemIcon_Normal)
+ for j in i[1]:
+ wlnode = app.win.orgspanel.orgs.AppendItem(orgnode, text=j)
+ app.win.orgspanel.orgs.SetItemImage(wlnode, workload_icon, wx.TreeItemIcon_Normal)
+ for i in d['cons']:
+ app.win.conspanel.AddConflict(i[0], i[1])
+
+
+def org2dict():
+ global app
+ dic = {}
+ o= []
+ for i in iterchildren(app.win.orgs.GetRootItem()):
+ d = []
+ for j in iterchildren(i):
+ d.append(str(app.win.orgspanel.orgs.GetItemText(j)))
+ o.append([str(app.win.orgspanel.orgs.GetItemText(i)) , d])
+ dic['orgs'] = o
+ c=[]
+ for i in app.win.conspanel.conflictsets:
+ c.append([i.GetBoxName() , i.GetTypes()])
+ dic['cons'] = c
+ return dic
+
+
+def dict_read(dictname, filename):
+ """Loads <filename> and returns the dictionary named <dictname> from
+ the file.
+ """
+ dic = {}
+
+ # read in the config file
+ globs = {}
+ locs = {}
+ execfile(filename, globs, locs)
+
+ for (k, v) in locs.items():
+ if k == dictname:
+ dic = v
+ break
+ return dic
+
+#==================== Policy Generation/Translation functions
+
+def printPolicyHeader (fd, policyname, timestamp):
+ fd.write( """<?xml version=\"1.0\" encoding=\"UTF-8\"?>
+<!-- Auto-generated by ezPolicy -->
+<SecurityPolicyDefinition xmlns=\"http://www.ibm.com\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:schemaLocation=\"http://www.ibm.com ../../security_policy.xsd \">
+ <PolicyHeader>
+ <PolicyName>%s</PolicyName>
+ <Date>%s</Date>
+ </PolicyHeader>
+""" % (policyname, timestamp))
+
+
+
+def printPolicy(fd, types, cons):
+ fd.write("""
+ <SimpleTypeEnforcement>
+ <SimpleTypeEnforcementTypes>
+ <Type>SystemManagement</Type>\n""")
+
+ # add dynamically created type definitions org.dept
+ for i in types:
+ fd.write(""" <Type>%s</Type>\n""" % i)
+
+ fd.write(""" </SimpleTypeEnforcementTypes>
+ </SimpleTypeEnforcement>
+
+ <ChineseWall priority="PrimaryPolicyComponent">
+ <ChineseWallTypes>
+ <Type>SystemManagement</Type>\n""")
+
+ #add dinamically created cw types
+ for i in types:
+ fd.write(""" <Type>%s</Type>\n""" % i)
+
+ fd.write(""" </ChineseWallTypes>\n\n""")
+
+ if len(cons):
+ fd.write(""" <ConflictSets>\n""")
+ for i in cons:
+ if len(i[1]) < 2:
+ print "Ignoring Run-time exclusion set %s (less than 2 types}" % i[0]
+ continue
+ #name is optional but must be set
+ if i[0]:
+ rer_name = str(i[0])
+ else:
+ rer_name = str("RER")
+ fd.write(""" <Conflict name=\"%s\">\n""" % rer_name)
+ for j in i[1]:
+ fd.write(""" <Type>%s</Type>\n""" % str(j))
+ fd.write(""" </Conflict>\n""")
+ fd.write(""" </ConflictSets>\n""")
+
+ fd.write(""" </ChineseWall>\n\n""")
+
+
+
+def printLabels(fd, d, types): #, cons):
+ fd.write( """ <SecurityLabelTemplate>
+ <SubjectLabels bootstrap=\"SystemManagement\">""")
+
+ # create default boot label for dom0
+ fd.write("""\n <VirtualMachineLabel>
+ <Name>SystemManagement</Name>
+ <SimpleTypeEnforcementTypes>
+ <Type>SystemManagement</Type>\n""")
+ # add dynamically created type definitions org.dept
+ for i in types:
+ fd.write(""" <Type>%s</Type>\n""" % i)
+
+ fd.write(""" </SimpleTypeEnforcementTypes>
+ <ChineseWallTypes>
+ <Type>SystemManagement</Type>
+ </ChineseWallTypes>
+ </VirtualMachineLabel>\n""")
+
+ # create one Udom label for each type ste type
+ for i in d['orgs']:
+ organization = i[0]
+ fd.write("""\n <VirtualMachineLabel>
+ <Name>%s</Name>
+ <SimpleTypeEnforcementTypes>
+ <Type>%s</Type>
+ </SimpleTypeEnforcementTypes>
+ <ChineseWallTypes>
+ <Type>%s</Type>
+ </ChineseWallTypes>
+ </VirtualMachineLabel>\n""" % (organization, organization, organization))
+ for j in i[1]:
+ workload = organization + "." + j
+ fd.write("""\n <VirtualMachineLabel>
+ <Name>%s</Name>
+ <SimpleTypeEnforcementTypes>
+ <Type>%s</Type>
+ </SimpleTypeEnforcementTypes>
+ <ChineseWallTypes>
+ <Type>%s</Type>
+ <Type>%s</Type>
+ </ChineseWallTypes>
+ </VirtualMachineLabel>\n""" % (workload, workload, organization , workload))
+
+ fd.write(""" </SubjectLabels>\n\n""")
+
+ #create resource labels for each type
+ fd.write(""" <ObjectLabels>""")
+ for i in ['SystemManagement'] + types:
+ fd.write("""\n <ResourceLabel>
+ <Name>%s</Name>
+ <SimpleTypeEnforcementTypes>
+ <Type>%s</Type>
+ </SimpleTypeEnforcementTypes>
+ </ResourceLabel>\n""" % (i, i))
+ fd.write(""" </ObjectLabels>
+ </SecurityLabelTemplate>\n""")
+
+def printTrailer(fd):
+ fd.write( """</SecurityPolicyDefinition>\n""")
+
+#============== the icons/bitmaps ======================================
+# to ensure the program runs anywhere, we include the buttons right here
+# while this makes the file even bigger, it also makes it easier to use
+import cStringIO
+
+def GetIconBitmap(name):
+ return wx.BitmapFromImage(GetIconImage(name))
+
+def GetIconImage(name):
+ if name == 'Organization':
+ iostream = cStringIO.StringIO(GetOrganizationIconData())
+ elif name == 'Department':
+ iostream = cStringIO.StringIO(GetDepartmentIconData())
+ elif name == 'Conflict':
+ iostream = cStringIO.StringIO(GetConflictIconData())
+ else:
+ sys.exit("UNKNOWN ICON NAME")
+ return wx.ImageFromStream(iostream)
+
+def GetOrganizationIconData():
+ return \
+'\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52\
+\x00\x00\x00\x10\x00\x00\x00\x11\x08\x02\x00\x00\x00\x5b\xcd\xbb\
+\x93\x00\x00\x00\x03\x73\x42\x49\x54\x08\x08\x08\xdb\xe1\x4f\xe0\
+\x00\x00\x02\x7b\x49\x44\x41\x54\x28\x91\x5d\xd1\xcb\x4f\x13\x51\
+\x14\x06\xf0\x73\x1f\x74\x3a\x33\x9d\x96\x87\x0a\x14\x30\x3c\xd4\
+\x60\x34\xf1\xb1\x70\xa5\x26\x2e\xfc\x87\x4d\xdc\x18\x17\x26\x08\
+\x26\x44\x01\xc1\x07\x10\x52\x1e\x96\xb6\x94\x4a\x87\x0e\x33\x73\
+\xef\xdc\x7b\xcf\x71\x01\x31\x81\x6f\x73\x36\xe7\xb7\xf8\xf2\x31\
+\x22\x82\xab\x50\x51\x68\xa5\xd2\x6e\x77\xbf\xdd\xf8\x36\x52\x1b\
+\x5f\x78\xfc\xc6\x0f\x6b\x70\x3d\xf2\xea\x97\x28\x8e\xbb\xfd\x7e\
+\xd7\xb9\xb4\x3e\xe9\xe3\x99\x1d\x34\x3f\x34\xb9\xaa\x2f\xbe\x0d\
+\x2a\xa3\x8c\xb1\xff\x80\x5f\x1e\x63\x4c\x9a\x1e\x23\xaa\x24\xd1\
+\x8c\x91\xe0\xae\x04\xb1\xed\x7e\x6a\xff\x7e\x7f\x11\xb7\x01\xe8\
+\x26\x90\x52\x02\x98\x30\xac\xf8\x7e\x95\x88\x13\x5a\x0e\x4e\xe0\
+\xb9\xe9\x6f\xf5\xbb\x87\x5a\x17\x37\x01\xe7\x1c\x00\x38\x37\x9e\
+\x87\x9c\x91\xb3\xce\x21\x2f\xc8\x4b\xac\xec\xf5\xf6\x76\xd7\xdf\
+\xa9\x6c\x70\xad\x03\x00\x30\xc6\x6b\x35\x19\x86\x5c\x48\x42\x59\
+\x71\xd1\x3d\x88\x26\x82\x68\x8a\xf4\xa0\x68\x7f\x69\xed\xc0\x9d\
+\xb9\xd7\x41\xf5\xf6\x15\x50\x2a\x07\x60\xe5\xb2\x04\x00\x6b\x1d\
+\x56\x67\x71\x68\xbc\x67\x43\xe3\xa2\x49\x8c\xcb\x10\xe7\xad\xa5\
+\x53\x80\x5b\xb3\xaf\xa4\x52\x79\x9e\x0f\x8c\x4d\x01\xdc\x25\xb6\
+\x08\x27\x38\xaa\xb9\x3b\x4a\xb4\x13\x30\x02\x69\xc0\x1c\xc7\x9e\
+\xea\x2c\x1f\x1b\x23\x9b\xad\x46\xaa\xce\x53\x60\x7e\x09\xa7\x2e\
+\x81\xc3\xf6\x05\x58\xc7\x12\x2c\x45\x1e\x17\x45\xce\x19\x32\x42\
+\x61\xbb\x67\xad\x75\x79\xd0\x69\x9f\x23\x0e\xc0\x1f\x2e\xb3\x67\
+\x00\x00\x80\x04\x85\x25\x72\x56\x7a\xa1\xc7\x32\x61\x33\xb8\x1a\
+\x97\xca\xc1\xa8\x74\xa2\xd2\xd3\x8a\x0b\xc8\x0c\x68\xa5\x8c\xb1\
+\x8e\x0d\x21\x22\x3a\xc7\x3c\xe9\x51\x21\x51\x01\x21\x00\x38\xe4\
+\x95\xb1\xfb\x7c\xb8\x12\x0a\x00\xb2\x46\x19\x6c\xfd\x39\xdc\xda\
+\xda\x56\xca\x5c\x6e\x6f\xb4\x4e\xe2\x93\xbf\x49\xac\x8d\x23\x00\
+\xc7\x82\x70\x64\x5a\xd6\xc2\x00\x6d\x47\x08\x40\x12\x8d\x9d\x5f\
+\x5f\x77\xe2\xdb\x33\x73\x51\x89\x98\x60\x71\xaf\xf9\xf3\x70\xa5\
+\x99\x1c\x3c\x19\xe3\xf5\x9a\x57\x1d\x1e\xf5\x82\x31\x59\xe8\x84\
+\x9b\x6c\x38\x08\x98\xc7\xb2\x76\x7a\xd2\xcf\x38\xc0\xf3\x49\xe6\
+\x97\x82\xc1\xc9\xd2\x86\x5b\xdf\x3f\x75\x8d\x01\x3d\xb9\x55\x79\
+\x51\xf2\x26\x84\x2f\x3f\xaf\x7d\x0c\xfd\xe0\xe9\xdd\xa7\xbe\x70\
+\xdb\x1d\x1f\x31\x16\x9c\xcd\x4f\x8d\x29\xad\x3b\x71\x13\x88\x72\
+\x8d\x22\xa2\x8d\x63\xdd\xef\x37\xa2\xf9\x16\xdf\x6d\x6f\x4a\x91\
+\xf9\x43\xae\x1a\xf9\x82\x0b\x21\xf8\x45\x9a\x69\x5d\x74\xba\xa7\
+\x44\x90\xb7\x1c\x9d\x1b\x8c\x2d\xa5\xf4\xeb\xa8\xb9\x77\xb4\x2f\
+\x1f\xd5\x17\xbf\x6f\xad\x2d\xaf\xad\x3e\x9c\x78\x50\xaf\x08\xa5\
+\xcc\xee\xee\xfe\x4e\x63\x73\xe5\xc7\xea\x41\xe3\xf8\x0e\x8a\x97\
+\xf7\x66\x92\x3c\xa9\x4f\x4f\x64\xa5\xb9\x87\x0b\x8b\xff\x00\x63\
+\xce\x84\xe6\xf7\x5b\x7e\xce\x00\x00\x00\x00\x49\x45\x4e\x44\xae\
+\x42\x60\x82'
+
+def GetDepartmentIconData():
+ return \
+'\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52\
+\x00\x00\x00\x10\x00\x00\x00\x11\x08\x06\x00\x00\x00\xd4\xaf\x2c\
+\xc4\x00\x00\x00\x04\x73\x42\x49\x54\x08\x08\x08\x08\x7c\x08\x64\
+\x88\x00\x00\x01\x52\x49\x44\x41\x54\x38\x8d\xd5\x92\x3d\x4b\x42\
+\x61\x18\x86\xaf\xf3\xfa\xfa\x81\xa9\x58\x48\x60\x08\x49\xd2\x26\
+\xb4\x37\x4a\x14\x6d\x6d\x42\x42\x7f\x20\x68\xae\x31\x28\xff\x85\
+\x83\xd0\x90\x05\x0d\x6d\x0d\xd2\x2a\x89\x24\x48\xb8\x85\x49\x1a\
+\x48\x87\xd4\xca\x93\xbe\xd4\x69\x38\x39\x1c\xa8\x34\x1a\xa2\x7b\
+\xbb\x79\xb8\xaf\x87\xe7\x43\x0b\x2f\x6c\xad\x05\x23\x4b\x39\x4d\
+\x38\x5d\xe6\xdb\x80\x9b\xab\xd3\x7a\xaf\x96\x99\x65\x4c\xc9\xfb\
+\x97\xd9\xdc\x43\xb3\xef\x82\x3e\xaf\xc6\x2d\x4a\x9b\x33\xc7\x0d\
+\x03\x48\x25\xa3\x4e\x25\x86\x0d\x0d\xbc\x8e\x8e\xff\x28\x95\x3a\
+\x70\x08\x21\x01\x0e\xcb\xe5\x5a\xb6\x52\xd9\xfe\x12\x60\x73\xa6\
+\x62\x7f\xae\x3a\x15\xf5\xf8\x52\x00\x8d\x6e\x97\xc5\x40\xe0\x32\
+\x0b\xdb\x00\x3e\x9f\xf0\xa4\xd3\x33\x9b\x5e\xaf\x70\x01\xe4\xf3\
+\x9d\xb6\x1d\xf0\xd6\x67\x3d\xe4\x60\xfa\xc3\xb6\x0d\x03\xb7\x10\
+\xc3\xaa\xd8\xd9\x99\x3c\x49\x24\x3c\xab\x00\xdd\xae\xc2\x30\x1e\
+\xaf\xed\x80\xef\xe5\x4e\x26\xf5\x95\x58\x4c\x07\xa0\x50\x80\x60\
+\x10\xc4\x88\xd0\x48\xfd\x1a\x30\x72\x84\x62\x24\x12\x9b\xdf\xdd\
+\x3d\x33\x95\x12\x26\x7b\xda\x8f\x00\xe7\x42\x70\x1c\x8f\x07\x34\
+\x29\x97\x91\x12\xd0\x00\xfb\x9b\x7c\x0b\xd0\xc3\x61\x5a\xa1\x90\
+\x65\x06\x03\xcc\x4f\x5e\xec\xef\x97\xf8\xcf\x01\x4f\x4f\xd4\x25\
+\xbd\xea\x05\x4a\xb7\xee\xdb\xab\x3e\x17\x5a\xad\x89\xa0\xdb\x0d\
+\x40\x43\x08\x0d\xbf\xdf\xda\xbd\x52\x14\x8b\x26\x77\x4d\x2b\x5c\
+\x2a\xa1\x67\x32\x6c\xbc\x03\x17\xdb\x6e\x97\x68\x69\xf7\x4f\x00\
+\x00\x00\x00\x49\x45\x4e\x44\xae\x42\x60\x82'
+
+def GetConflictIconData():
+ return \
+'\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52\
+\x00\x00\x00\x10\x00\x00\x00\x10\x08\x02\x00\x00\x00\x90\x91\x68\
+\x36\x00\x00\x00\x03\x73\x42\x49\x54\x08\x08\x08\xdb\xe1\x4f\xe0\
+\x00\x00\x02\x45\x49\x44\x41\x54\x28\x91\x6d\x92\x4f\x48\x9a\x71\
+\x18\xc7\x7f\xbe\xef\xab\xcd\xed\x95\xcd\x8c\x25\x83\xc0\x24\xa9\
+\xc3\x4a\x17\xce\xea\x96\x3b\xe4\x0e\x5d\xba\xce\xa8\x88\xe8\x20\
+\x1a\x15\x1d\x3a\x78\x09\xf2\xed\xcf\xe8\x32\x68\x45\x56\x93\x66\
+\x94\x78\x99\x53\x68\x4e\x1b\xe1\x61\x30\xc2\x19\x5b\x16\xac\x9c\
+\x76\x19\x92\x2e\x35\xa6\x7b\xf7\xda\xfb\x3e\x3b\xd8\x9c\x9b\x7e\
+\x8e\xdf\xdf\xf3\x81\xdf\xf3\x87\x07\x00\xe8\x0f\x99\xb3\xb3\xd0\
+\xca\xca\x17\x97\x2b\x75\x7a\x8a\xf1\xf9\x77\xea\xeb\xe5\x3a\xdd\
+\x83\xe1\xe1\x6a\x85\xa2\x58\xc3\x2b\x08\x5c\x3e\x1f\x98\x9a\xfa\
+\xb0\xb0\x80\xf3\xf9\x72\x9d\xae\x56\xa5\xe2\x58\x36\x13\x8b\x9d\
+\xb8\xdd\x3f\x2f\x2e\x1e\x8e\x8c\x3c\x9a\x9d\xc5\xab\xaa\x10\x42\
+\x08\x00\x38\x96\x75\xf6\xf4\x58\x78\xbc\x37\x46\x23\x9d\x4e\x43\
+\x09\x57\x34\xfd\x7e\x6e\x6e\x4e\x28\xb4\x6b\xb5\x2c\xc3\x00\x00\
+\x02\x80\x77\x93\x93\xd3\x08\x51\x04\x71\xec\x74\x42\x25\xbe\xfa\
+\x7c\xf3\x24\xb9\x63\x30\x00\x00\x4a\x45\x22\x33\x02\x81\xd7\x64\
+\x5a\x69\x6e\x9e\xe1\xf3\x8f\x1c\x8e\x8a\xce\xc7\xe5\x65\x0b\x86\
+\x7d\xdb\xdf\x47\xfe\x89\x89\xa7\x22\xd1\xaf\xcb\xcb\x6c\x22\x61\
+\x55\x2a\x29\x82\x08\x6f\x6d\x95\x0b\x1c\xcb\x3e\x57\x28\x3c\x43\
+\x43\x68\x5d\xa3\x71\x74\x77\x17\xd2\x5c\x32\x69\x55\xa9\x28\x82\
+\x38\xdc\xdc\x2c\x77\xbc\x26\xd3\xb3\xba\x3a\xec\xfb\xf1\xb1\xb8\
+\xa1\xa1\x30\x32\xa1\x44\xa2\xdf\xdd\xbd\xdb\xd2\xf2\xba\xbf\xff\
+\xd0\x6e\x47\xff\x22\x69\x6a\xfa\x11\x8f\x63\x1c\xcb\xb2\x0c\x53\
+\x4c\x85\xd5\xd5\x7a\xbf\xbf\x56\xa9\x74\x0f\x0c\x7c\xde\xd8\x28\
+\x15\x80\xe3\x80\xe3\xb0\xdb\x32\x59\x26\x1a\x2d\x7d\xb8\x21\x16\
+\x3f\xf1\xf9\xa4\xad\xad\x9e\xc1\xc1\x4f\x36\x5b\x31\x4f\x47\xa3\
+\xa4\x54\x8a\x7c\xe3\xe3\xf3\x24\x99\x4b\x26\xff\xfb\x31\x9d\x4a\
+\xad\x6b\x34\x14\x8e\x1f\xac\xad\x15\x9a\x5e\x6a\x6c\x74\xf5\xf5\
+\xa1\x44\x38\x4c\xe1\xf8\xdb\xd1\xd1\xf2\x2e\xe9\x74\xfa\x45\x7b\
+\xbb\x05\xc3\x42\x56\x6b\x70\x69\xc9\xc2\xe3\x9d\x05\x02\x08\x00\
+\x76\x0c\x06\x8a\x20\xc2\xdb\xdb\x15\x9c\x4c\xc6\xd6\xd1\x61\xc1\
+\xb0\x79\x92\x7c\xa5\xd7\x5f\x6f\x9a\x65\x98\x97\x9d\x9d\x14\x8e\
+\xef\x99\xcd\x57\x34\x5d\x2a\xb0\x0c\xb3\x67\x36\x4f\x23\xb4\xae\
+\x56\xe7\x73\x39\x00\xb8\x3e\xbe\x7c\x2e\xe7\x1b\x1b\x3b\x58\x5d\
+\xbd\x59\x53\x23\xef\xea\x2a\x0c\x3a\x13\x8b\x45\xbc\xde\x6c\x3c\
+\x7e\xbf\xb7\xf7\xf1\xe2\xa2\x40\x24\xfa\x7b\xad\x05\xe2\xc1\x60\
+\xc8\x6a\x3d\xf1\x78\xb2\xe7\xe7\x88\xe3\x6e\x49\xa5\x32\xad\x56\
+\x6d\x34\xde\x6b\x6b\x2b\xd6\xfc\x06\xb3\xcb\xb3\xdb\x2f\x3f\x31\
+\xa9\x00\x00\x00\x00\x49\x45\x4e\x44\xae\x42\x60\x82'
+
+#=============== help texts
+
+NewRealmButtonHelp = \
+ "Use this button to add a new top-level REALM type. \n\n\
+You can refine an existing realm by right-clicking it \
+and selecting \"Add workload\" from the pop-up menu.\n\n<Ctrl>-h for help"
+
+RealmWorkloadPanelHelp = \
+ "\
+Use this panel to define names for types of workloads that \
+shall be confined against each other.\n\n<Ctrl>-h for help"
+
+RunTimeExclusionPanelHelp = \
+ "\
+The run-time exclusion rules restrict which workload types \
+can run simultaneously on the same platform. At most one \
+type in an exclusion rule can run. If a domain starts, its \
+workload type is looked up and if it is in any exclusion rule \
+of which another type is already running, then it is denied \
+to start.\n\n<Ctrl>-h for help"
+
+CreateRunTimeButtonHelp = \
+ "\
+This button creates a new run-time exclusion rule using the \
+selection from the left side workload definition panel.\n\n<Ctrl>-h for help"
+
+AddToExclusionButtonHelp = \
+ "\
+This button adds the current selection in the left side \
+workload definition panel to the associated exclusion rule.\n\n<Ctrl>-h for help"
+
+DelFromExclusionButtonHelp = \
+ "\
+This button deletes the current selection of the associated \
+exclusion rule from the associated exclusion rule.\n\n<Ctrl>-h for help"
+
+ManageExclusionButtonHelp = \
+ "\
+This button allows to rename or delete the associated exclusion \
+rule. Left-click the button for the menu.\n\n<Ctrl>-h for help"
+
+ExclusionSetHelp = \
+ "\
+Of the workload types specified in an exclusion rule, \
+only one can run at a time on the same platform.\n\n<Ctrl>-h for help"
+
+GetHelp = \
+ "\
+Use <CTRL>-h to open the help window. Use the context help on buttons."
+
+#================ html help page =================
+# for ez use included in a single file, one could also
+# optionally try to fetch the page from a public location
+import wx.html as html
+
+class HelpHtmlWindow(html.HtmlWindow):
+ def __init__(self, parent, id):
+ html.HtmlWindow.__init__(self, parent, id, style=wx.NO_FULL_REPAINT_ON_RESIZE)
+ if "gtk2" in wx.PlatformInfo:
+ self.SetStandardFonts()
+ self.SetPage(helptext)
+
+helptext = """
+<HTML>
+<HEAD>
+<META http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+<META name="GENERATOR" content="IBM WebSphere Studio Homepage Builder V6.0.2 for Windows">
+<META http-equiv="Content-Style-Type" content="text/css">
+<TITLE>Overview</TITLE>
+</HEAD>
+<BODY bgcolor="#dfdfdf" text="#000000">
+<H3><FONT color="#000000" face="Palatino Linotype">Creating A Xen Workload-Protection Security Policy</FONT></H3>
+<FONT face="Palatino Linotype">The purpose of this tool is to create a Xen security policy that understands
+the workload types that you want to confine against each other. For this
+purpose you enter the names of workload types that you want to assign to
+domains and resources. You can also define groups of workload types that
+should not run on the same system simultaneously for any reason; such groups
+are called Runtime Exclusion Sets. Please refer to the Xen User Guide for
+more information.<BR>
+<BR>
+This tool will create a unique security label for each workload type. Every
+domain and resource must be labeled so that the hypervisor system can correctly
+identify the associated workload type and control the sharing among domains
+in a way that keeps different workload types confined from each other.
+This tool ensures two things:<BR>
+<BR>
+1. The created security policy includes a distinctive label for each workload
+type defined in step 1 below. These labels must later be assigned to Domains
+and Resources to enable Xen to enforce the confinement.<BR>
+<BR>
+2. The created security policy includes access control rules that are enforced
+by the Xen Hypervisor (independently of the guest Domains) and guarantee
+that:</FONT>
+<BLOCKQUOTE><FONT face="Palatino Linotype">(i) Domains that are assigned the same workload type label can
+share (communicate,
+use common resources) without restriction through the hypervisor. Their
+interoperation can still be constraint by the domains (domain-internal
+means).</FONT></BLOCKQUOTE>
+<BLOCKQUOTE><FONT face="Palatino Linotype">(ii) Domains that are assigned different workload type labels cannot share,
+i.e., cannot communicate or use common resources. Independently enforced
+by the hypervisor, the domains cannot overrule this decision.</FONT></BLOCKQUOTE>
+<BLOCKQUOTE><FONT face="Palatino Linotype">(iii) Once a Domain labeled with a workload type of a Runtime Exclusion
+Rule is running, no other domain labeled with another workload type of
+the same Runtime Exclusion Rule can start. This holds for all Runtime Exclusion
+Rules.</FONT></BLOCKQUOTE>
+<FONT face="Palatino Linotype">While all workloads share common hardware resources, the core hypervisor
+isolation and virtualization in combination with the Xen access control
+policy ensure that, e.g., viruses in one workload type cannot infect other
+workload types and that secrets used within one workload type cannot leak
+into another workload type. Currently the Xen access control enforcement
+covers domains, local storage resources, and the local virtual network
+interfaces. Protecting sharing through the open network is subject of ongoing
+work; such protection must currently be setup manually using IP filtering
+rules in Domain0.
+<BR>
+</FONT>
+<H2><FONT color="#000000" face="Palatino Linotype">Step 1</FONT></H2>
+<FONT face="Palatino Linotype">The first step of creating a workload protection policy is to determine
+names for the different workload types. The left panel offers the means
+to define and and manage workload type definitions.<BR>
+<BR>
+A workload can be an organization name (coarse-grained type), e.g. a corporate
+realm such as IBM or PepsiCo. An organization can be refined to describe
+independent functional groupings within the organization, such as IBM.Financing
+or Pepsi.Payroll. Use the<B><I> <New Org></I></B> button on the left panel
+to create a new organization workload. To refine such a workload, right-click the
+organization and chose <B><I><Add Department></I></B>. You can add multiple
+departments to an organization but you do not have to add any.<BR>
+<BR>
+This tool will create a separate label name for each organization and for
+each department workload. The policy will be computed so that there is
+no sharing between organizations or departments by default. IBM, IBM.Financing,
+Pepsi, and Pepsi.Payroll will by default not be able to share in this simple
+policy example. You can introduce controlled sharing by refining the policy,
+which is beyond the scope of this help.<BR>
+<BR>
+As an example, define the four organizations PepsiCo, CocaCola, Avis, Hertz.
+Define department workloads Payroll, HumanResources and Financing for Avis
+and CocaCola, and PepsiCo.<BR>
+</FONT>
+<H2><FONT color="#000000" face="Palatino Linotype">Step 2</FONT></H2>
+<FONT face="Palatino Linotype">In this second step, we enter those workload types that should not run
+simultaneously on the same hardware platform. There might be multiple reasons
+for this, e.g., imperfect resource control.<BR>
+<BR>
+As an example, we will create a policy that guarantees that PepsiCo workloads
+and CocaCola workloads never run simultaneously on the same platform: <BR>
+<BR>
+1. Select the PepsiCo organization on the left panel by left-clicking it..<BR>
+<BR>
+2. Press the <Ctrl>-Key and then select CocaCola organization by
+left-clicking it while keeping the <Ctrl>-Key pressed..<BR>
+<BR>
+3. Click the <B><I><Create run-time exclusion rule from selection></I></B>
+button and enter a name for this Run-time Exclusion rule (e.g., RER1). The name is
+for your reference only. It has no impact on the policy. On the right panel, a run-time
+exclusion rule with the chosen name appears. <BR>
+<BR>
+The interpretation of the rule is as follows: If a domain labeled PepsiCo
+is running, then another domain labeled CocaCola cannot start on the same
+system and the other way round. This also holds for departments of PepsiCo
+and CocaCola (organizations dominate their departments). If PepsiCo or
+PepsiCo.Payroll etc. are running, then a domain with label CocaCola or
+CocaCola.Payroll etc. cannot start. If you want to restrict concurrency
+between specific subtypes, then you must create a Run-time Exclusion rule
+that specifies the department workload types. To exclude only CocaCola.Payroll
+and PepsiCo.Payroll from running simultaneously the Run-time Exclusion
+rule must be formed using Coca.Cola.Payroll and PepsiCo.Payroll, not their
+organizations. Consequently it does not make sense to add both an organization
+and any of its departments to the same Run-time Exclusion rule because
+any department is already covered by its organization (this tool will not
+allow it).<BR>
+<BR>
+You can create multiple Run-time Exclusion rules, all of which will be
+enforced simultaneously by the hypervisor. You do not need to define any
+Run-time Exclusion rule if you do not find it necessary. You can add or
+delete workload types from Run-time Exclusion rules using the <B><I><Add></I></B>
+and <I><B><Del></B></I> buttons associated with the rule. The <I><B><Add></B></I>
+button adds the workload types selected in the left panel to the Run-time
+Exclusion rule. The <I><B><Del></B></I> button deletes the workload types selected
+in the associated Run-time Exclusion rule from the rule. <BR>
+</FONT>
+<H2><FONT color="#000000" face="Palatino Linotype">Step 3</FONT></H2>
+<FONT face="Palatino Linotype">Now that we have defined the workloads and Run-time Exclusion rules, we
+can save the workload definition for later reference or refinement. Select
+the <I><B>File->Save Workload
+Definition as..</B></I> menu entry and choose a file name.<BR>
+<BR>
+Please use the <B><I>File->Save as Xen ACM Security Policy..</I></B> menu entry and choose a policy
+name to create a Xen Workload Protection
+security policy from the current workload definition. To simplify the succeeding
+steps, please use a name of the form "example.chwall_ste.NAME"
+where you merely replace "NAME" with a policy name of your choice.
+Save the policy under the name proposed by the tool in the proposed directory
+if you are using this tool in your Xen environment. Otherwise, you need
+to copy the resulting file into your Xen environment to the directory
+"/etc/xen/acm-security/policies/example/chwall_ste/".<BR>
+<BR>
+This tool creates policies for the Xen Chinese Wall and Simple Type Enforcement
+policy. The Xen access control policy in general is more expressive and
+this tool only uses a small subset of the possible configurations. <B><BR>
+<BR>
+Where to go from here.</B> <BR>
+<BR>
+Before the new policy can be activated, we need to translate the policy into a representation that
+Xen and the Xen-tools can work with. To this end, in your Xen environment, please issue the command
+<B><I>xm makepolicy example.chwall_ste.NAME</I></B> where NAME must be replaced by the name you chose
+for your policy in step 3 above. Then, we need to make the policy available to the Xen hypervisor. In
+your Xen environment, please issue the command <B><I>xm cfgbootpolicy example.chwall_ste.NAME</I></B>
+to install the policy for the next reboot. If the command cannot find the correct boot title, then you
+can manually install it as described in the xm man page.<BR>
+<BR>
+Finally, reboot your security-enabled Xen environment. Please refer to the xm man page for how to enable
+Xen security. After reboot, you can use <I><B>xm labels type=any</B></I> to list all the created workload l
+abels. Use the <I><B>xm addlabel</B></I> command to assign workload type labels to the associated domains
+and resources.<BR>
+<BR>
+From here, please check the Xen user guide.<BR>
+</FONT></BODY>
+</HTML>
+"""
+
+#=============== main =====
+
+def main():
+ global app
+ app = ezApp(0)
+ if len(sys.argv) in [2]:
+ app.Load(sys.argv[1])
+ app.MainLoop()
+ print "Goodbye"
+
+if __name__ == '__main__':
+ main()
+
+#==== end of file
projects / xen.git / commitdiff