acm, xend: Fix resetting policy.

Fix a problem when resetting the policy and the label of Domain-0
needs to be renamed.

Signed-off-by: Stefan Berger <stefanb@us.ibm.com>

diff --git a/tools/python/xen/util/acmpolicy.py b/tools/python/xen/util/acmpolicy.py
index 48e044d318cee30ae00f5974b748e40e3dd98045..ef31734ad3fe9d1aff399123ad44f1529de0ff74 100644 (file)
--- a/tools/python/xen/util/acmpolicy.py
+++ b/tools/python/xen/util/acmpolicy.py
@@ -337,7 +337,8 @@ class ACMPolicy(XSPolicy):
             rc, errors = security.change_acm_policy(bin_pol,
                                         del_array, chg_array,
                                         vmlabel_map, reslabel_map,
-                                        self, acmpol_new)
+                                        self, acmpol_new,
+                                        acmpol_new.is_default_policy())
 
             if rc == 0:
                 # Replace the old DOM with the new one and save it

diff --git a/tools/python/xen/util/xsm/acm/acm.py b/tools/python/xen/util/xsm/acm/acm.py
index 8bb0928c6ead39ab1729f6aafa6e335f84d39708..98b6ec1312074f957e52a0b6f8e9f2cb950d8ba5 100644 (file)
--- a/tools/python/xen/util/xsm/acm/acm.py
+++ b/tools/python/xen/util/xsm/acm/acm.py
@@ -1342,7 +1342,8 @@ def relabel_domains(relabel_list):
 
 
 def change_acm_policy(bin_pol, del_array, chg_array,
-                      vmlabel_map, reslabel_map, cur_acmpol, new_acmpol):
+                      vmlabel_map, reslabel_map, cur_acmpol, new_acmpol,
+                      is_reset):
     """
        Change the ACM policy of the system by relabeling
        domains and resources first and doing some access checks.
@@ -1451,8 +1452,11 @@ def change_acm_policy(bin_pol, del_array, chg_array,
                 continue
 
             new_vmlabel = vmlabel
-            if vmlabel_map.has_key(vmlabel):
-                # renaming of the label
+            if vmlabel_map.has_key(vmlabel) and \
+               (not is_reset or name == "Domain-0") :
+                # renaming of the label; this is only allowed if it's
+                # not a reset of the policy or if it is a reset, then
+                # only for Domain-0
                 new_vmlabel = vmlabel_map[vmlabel]
                 polname = new_policyname
             elif new_vmlabel not in polnew_vmlabels and \