ia64/xen-unstable

changeset 14626:50965ae270c9

[ACM] Allow version information to be embedded in the XML representation of
the ACM policy. The translation tool has been adapted to parse the
version found in the XML representation and put it into the binary
policy. Xen has been adapted to remember the version information and
report it when asked for the current policy.

Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
author kfraser@localhost.localdomain
date Wed Mar 28 14:00:56 2007 +0100 (2007-03-28)
parents 32f532e6c054
children 72ea3ff64ad8
files tools/security/policies/security_policy.xsd tools/security/secpol_tool.c tools/security/secpol_xml2bin.c tools/security/secpol_xml2bin.h xen/acm/acm_policy.c xen/include/acm/acm_core.h xen/include/public/acm.h
line diff
     1.1 --- a/tools/security/policies/security_policy.xsd	Wed Mar 28 13:56:22 2007 +0100
     1.2 +++ b/tools/security/policies/security_policy.xsd	Wed Mar 28 14:00:56 2007 +0100
     1.3 @@ -22,6 +22,8 @@
     1.4  				<xsd:element name="Reference" type="xsd:string" minOccurs="0" maxOccurs="1" />
     1.5  				<xsd:element name="Date" minOccurs="0" maxOccurs="1" type="xsd:string"></xsd:element>
     1.6  				<xsd:element name="NameSpaceUrl" minOccurs="0" maxOccurs="1" type="xsd:string"></xsd:element>
     1.7 +				<xsd:element name="Version" minOccurs="0" maxOccurs="1" type="VersionFormat"/>
     1.8 +				<xsd:element ref="FromPolicy" minOccurs="0" maxOccurs="1"/>
     1.9  			</xsd:sequence>
    1.10  		</xsd:complexType>
    1.11  	</xsd:element>
    1.12 @@ -116,4 +118,17 @@
    1.13  			<xsd:enumeration value="PrimaryPolicyComponent"></xsd:enumeration>
    1.14  		</xsd:restriction>
    1.15  	</xsd:simpleType>
    1.16 +	<xsd:element name="FromPolicy">
    1.17 +		<xsd:complexType>
    1.18 +			<xsd:sequence>
    1.19 +				<xsd:element name="PolicyName" minOccurs="1" maxOccurs="1" type="xsd:string"/>
    1.20 +				<xsd:element name="Version" minOccurs="1" maxOccurs="1" type="VersionFormat"/>
    1.21 +			</xsd:sequence>
    1.22 +		</xsd:complexType>
    1.23 +	</xsd:element>
    1.24 +	<xsd:simpleType name="VersionFormat">
    1.25 +		<xsd:restriction base="xsd:string">
    1.26 +			<xsd:pattern value="[0-9]{1,8}.[0-9]{1,8}"></xsd:pattern>
    1.27 +		</xsd:restriction>
    1.28 +	</xsd:simpleType>
    1.29  </xsd:schema>
     2.1 --- a/tools/security/secpol_tool.c	Wed Mar 28 13:56:22 2007 +0100
     2.2 +++ b/tools/security/secpol_tool.c	Wed Mar 28 14:00:56 2007 +0100
     2.3 @@ -172,6 +172,9 @@ void acm_dump_policy_buffer(void *buf, i
     2.4      printf("============\n");
     2.5      printf("POLICY REFERENCE = %s.\n", policy_reference_name);
     2.6      printf("PolicyVer = %x.\n", ntohl(pol->policy_version));
     2.7 +    printf("XML Vers. = %d.%d\n",
     2.8 +           ntohl(pol->xml_pol_version.major),
     2.9 +           ntohl(pol->xml_pol_version.minor));
    2.10      printf("Magic     = %x.\n", ntohl(pol->magic));
    2.11      printf("Len       = %x.\n", ntohl(pol->len));
    2.12      printf("Primary   = %s (c=%x, off=%x).\n",
     3.1 --- a/tools/security/secpol_xml2bin.c	Wed Mar 28 13:56:22 2007 +0100
     3.2 +++ b/tools/security/secpol_xml2bin.c	Wed Mar 28 14:00:56 2007 +0100
     3.3 @@ -108,26 +108,25 @@ char *policy_filename = NULL,
     3.4  
     3.5  char *policy_reference_name = NULL;
     3.6  
     3.7 +char *policy_version_string = NULL;
     3.8 +
     3.9  void walk_labels(xmlNode * start, xmlDocPtr doc, unsigned long state);
    3.10  
    3.11  void usage(char *prg)
    3.12  {
    3.13 -    printf("Usage: %s [OPTIONS] POLICYNAME\n", prg);
    3.14 -    printf
    3.15 -        ("POLICYNAME is the directory name within the policy directory\n");
    3.16 -    printf
    3.17 -        ("that contains the policy files.  The default policy directory\n");
    3.18 -    printf("is '%s' (see the '-d' option below to change it)\n",
    3.19 -           POLICY_DIR);
    3.20 -    printf
    3.21 -        ("The policy files contained in the POLICYNAME directory must be named:\n");
    3.22 -    printf("\tPOLICYNAME-security_policy.xml\n");
    3.23 -    printf("\tPOLICYNAME-security_label_template.xml\n\n");
    3.24 -    printf("OPTIONS:\n");
    3.25 -    printf("\t-d POLICYDIR\n");
    3.26 -    printf
    3.27 -        ("\t\tUse POLICYDIR as the policy directory. This directory must contain\n");
    3.28 -    printf("\t\tthe policy schema file 'security_policy.xsd'\n");
    3.29 +    printf(
    3.30 +    "Usage: %s [OPTIONS] POLICYNAME\n"
    3.31 +    "POLICYNAME is the directory name within the policy directory\n"
    3.32 +    "that contains the policy files.  The default policy directory\n"
    3.33 +    "is '%s' (see the '-d' option below to change it)\n"
    3.34 +    "The policy files contained in the POLICYNAME directory must be named:\n"
    3.35 +    "\tPOLICYNAME-security_policy.xml\n"
    3.36 +    "\tPOLICYNAME-security_label_template.xml\n\n"
    3.37 +    "OPTIONS:\n"
    3.38 +    "\t-d POLICYDIR\n"
    3.39 +    "\t\tUse POLICYDIR as the policy directory. This directory must \n"
    3.40 +    "\t\tcontain the policy schema file 'security_policy.xsd'\n",
    3.41 +    prg, POLICY_DIR);
    3.42      exit(EXIT_FAILURE);
    3.43  }
    3.44  
    3.45 @@ -300,25 +299,50 @@ void walk_policy(xmlNode * start, xmlDoc
    3.46          case XML2BIN_CHWALLTYPES:
    3.47          case XML2BIN_CONFLICTSETS:
    3.48          case XML2BIN_POLICYHEADER:
    3.49 +        case XML2BIN_FROMPOLICY:
    3.50              walk_policy(cur_node->children, doc, state | (1 << code));
    3.51              break;
    3.52  
    3.53          case XML2BIN_POLICYNAME:       /* get policy reference name .... */
    3.54 -            if (state != XML2BIN_PN_S) {
    3.55 +            if (state != XML2BIN_PN_S &&
    3.56 +                state != XML2BIN_PN_frompolicy_S) {
    3.57                  printf("ERROR: >Url< >%s< out of context.\n",
    3.58                         (char *) xmlNodeListGetString(doc,
    3.59                                                       cur_node->
    3.60                                                       xmlChildrenNode, 1));
    3.61                  exit(EXIT_FAILURE);
    3.62              }
    3.63 -            policy_reference_name = (char *)
    3.64 -                xmlNodeListGetString(doc, cur_node->xmlChildrenNode, 1);
    3.65 -            if (!policy_reference_name) {
    3.66 -                printf("ERROR: empty >policy reference name (Url)<!\n");
    3.67 +            if (state == XML2BIN_PN_S) {
    3.68 +                policy_reference_name = (char *)
    3.69 +                    xmlNodeListGetString(doc, cur_node->xmlChildrenNode, 1);
    3.70 +                if (!policy_reference_name) {
    3.71 +                    printf("ERROR: empty >policy reference name (Url)<!\n");
    3.72 +                    exit(EXIT_FAILURE);
    3.73 +                } else
    3.74 +                    printf("Policy Reference name (Url): %s\n",
    3.75 +                           policy_reference_name);
    3.76 +            }
    3.77 +            break;
    3.78 +
    3.79 +        case XML2BIN_VERSION:         /* get policy version number .... */
    3.80 +            if (state != XML2BIN_PN_S &&
    3.81 +                state != XML2BIN_PN_frompolicy_S) {
    3.82 +                printf("ERROR: >Url< >%s< out of context.\n",
    3.83 +                       (char *) xmlNodeListGetString(doc,
    3.84 +                                                     cur_node->
    3.85 +                                                     xmlChildrenNode, 1));
    3.86                  exit(EXIT_FAILURE);
    3.87 -            } else
    3.88 -                printf("Policy Reference name (Url): %s\n",
    3.89 -                       policy_reference_name);
    3.90 +            }
    3.91 +            if (state == XML2BIN_PN_S) {
    3.92 +                policy_version_string = (char *)
    3.93 +                    xmlNodeListGetString(doc, cur_node->xmlChildrenNode, 1);
    3.94 +                if (!policy_version_string) {
    3.95 +                    printf("ERROR: empty >policy version string <!\n");
    3.96 +                    exit(EXIT_FAILURE);
    3.97 +                } else
    3.98 +                    printf("Policy version string: %s\n",
    3.99 +                           policy_version_string);
   3.100 +            }
   3.101              break;
   3.102  
   3.103          case XML2BIN_STE:
   3.104 @@ -1135,9 +1159,12 @@ int write_binary(char *filename)
   3.105          NULL, *policy_reference_buffer = NULL;
   3.106      u_int32_t len;
   3.107      int fd, ret = 0;
   3.108 +    uint32_t major = 0, minor = 0;
   3.109  
   3.110      u_int32_t len_ste = 0, len_chwall = 0, len_pr = 0;  /* length of policy components */
   3.111  
   3.112 +    sscanf(policy_version_string,"%d.%d", &major, &minor);
   3.113 +
   3.114      /* open binary file */
   3.115      if ((fd =
   3.116           open(filename, O_WRONLY | O_CREAT | O_TRUNC,
   3.117 @@ -1152,6 +1179,8 @@ int write_binary(char *filename)
   3.118      /* determine primary component (default chwall) */
   3.119      header.policy_version = htonl(ACM_POLICY_VERSION);
   3.120      header.magic = htonl(ACM_MAGIC);
   3.121 +    header.xml_pol_version.major = htonl(major);
   3.122 +    header.xml_pol_version.minor = htonl(minor);
   3.123  
   3.124      len = sizeof(struct acm_policy_buffer);
   3.125      if (have_chwall)
     4.1 --- a/tools/security/secpol_xml2bin.h	Wed Mar 28 13:56:22 2007 +0100
     4.2 +++ b/tools/security/secpol_xml2bin.h	Wed Mar 28 14:00:56 2007 +0100
     4.3 @@ -22,31 +22,35 @@
     4.4  #define SCHEMA_FILENAME     			"security_policy.xsd"
     4.5  
     4.6  /* basic states (used as 1 << X) */
     4.7 -#define ENDOFLIST_POS           22  /* ADAPT!! this position will be NULL; stay below 32 (bit) */
     4.8 -#define XML2BIN_SECPOL          0   /* policy tokens */
     4.9 -#define XML2BIN_STE             1
    4.10 -#define XML2BIN_CHWALL          2
    4.11 -#define XML2BIN_CONFLICTSETS    3
    4.12 -#define XML2BIN_CSTYPE          4
    4.13 -#define XML2BIN_POLICYHEADER    5
    4.14 -#define XML2BIN_NSURL           6
    4.15 -#define XML2BIN_POLICYNAME      7
    4.16 -#define XML2BIN_URL             8
    4.17 -#define XML2BIN_REFERENCE       9
    4.18 -#define XML2BIN_DATE            10
    4.19 +enum {
    4.20 +    XML2BIN_SECPOL = 0,   /* policy tokens */
    4.21 +    XML2BIN_STE,
    4.22 +    XML2BIN_CHWALL,
    4.23 +    XML2BIN_CONFLICTSETS,
    4.24 +    XML2BIN_CSTYPE,
    4.25 +    XML2BIN_POLICYHEADER,
    4.26 +    XML2BIN_NSURL,
    4.27 +    XML2BIN_POLICYNAME,
    4.28 +    XML2BIN_URL,
    4.29 +    XML2BIN_REFERENCE,
    4.30 +    XML2BIN_DATE,
    4.31 +    XML2BIN_VERSION,
    4.32 +    XML2BIN_FROMPOLICY,
    4.33  
    4.34 -#define XML2BIN_LABELTEMPLATE   11  /* label tokens */
    4.35 -#define XML2BIN_SUBJECTS        12
    4.36 -#define XML2BIN_OBJECTS         13
    4.37 -#define XML2BIN_VM              14
    4.38 -#define XML2BIN_RES             15
    4.39 -#define XML2BIN_NAME            16
    4.40 +    XML2BIN_LABELTEMPLATE,  /* label tokens */
    4.41 +    XML2BIN_SUBJECTS,
    4.42 +    XML2BIN_OBJECTS,
    4.43 +    XML2BIN_VM,
    4.44 +    XML2BIN_RES,
    4.45 +    XML2BIN_NAME,
    4.46  
    4.47 -#define XML2BIN_STETYPES        17  /* shared tokens */
    4.48 -#define XML2BIN_CHWALLTYPES     18
    4.49 -#define XML2BIN_TYPE            19
    4.50 -#define XML2BIN_TEXT            20
    4.51 -#define XML2BIN_COMMENT         21
    4.52 +    XML2BIN_STETYPES,
    4.53 +    XML2BIN_CHWALLTYPES,
    4.54 +    XML2BIN_TYPE,
    4.55 +    XML2BIN_TEXT,
    4.56 +    XML2BIN_COMMENT,
    4.57 +    ENDOFLIST_POS /* keep last ! */
    4.58 +};
    4.59  
    4.60  /* type "data type" (currently 16bit) */
    4.61  typedef u_int16_t type_t;
    4.62 @@ -68,6 +72,8 @@ char *token[32] =                       
    4.63      [XML2BIN_URL]           = "PolicyUrl",
    4.64      [XML2BIN_REFERENCE]     = "Reference",
    4.65      [XML2BIN_DATE]          = "Date",
    4.66 +    [XML2BIN_VERSION]       = "Version",
    4.67 +    [XML2BIN_FROMPOLICY]    = "FromPolicy",
    4.68  
    4.69      [XML2BIN_LABELTEMPLATE] = "SecurityLabelTemplate", /* label-template xml */
    4.70      [XML2BIN_SUBJECTS]      = "SubjectLabels",
    4.71 @@ -79,7 +85,7 @@ char *token[32] =                       
    4.72      [XML2BIN_STETYPES]      = "SimpleTypeEnforcementTypes", /* common tags */
    4.73      [XML2BIN_CHWALLTYPES]   = "ChineseWallTypes",
    4.74      [XML2BIN_TYPE]          = "Type",
    4.75 -	[XML2BIN_TEXT]          = "text",
    4.76 +    [XML2BIN_TEXT]          = "text",
    4.77      [XML2BIN_COMMENT]       = "comment",
    4.78      [ENDOFLIST_POS]         = NULL  /* End of LIST, adapt ENDOFLIST_POS
    4.79                                         when adding entries */
    4.80 @@ -112,6 +118,10 @@ char *token[32] =                       
    4.81  #define XML2BIN_PN_S ((1 << XML2BIN_SECPOL) | \
    4.82                   (1 << XML2BIN_POLICYHEADER))
    4.83  
    4.84 +#define XML2BIN_PN_frompolicy_S ((1 << XML2BIN_SECPOL) | \
    4.85 +                 (1 << XML2BIN_POLICYHEADER) | \
    4.86 +                 (1 << XML2BIN_FROMPOLICY))
    4.87 +
    4.88  /* label xml states */
    4.89  #define XML2BIN_VM_S ((1 << XML2BIN_SECPOL) | \
    4.90                   (1 << XML2BIN_LABELTEMPLATE) |	\
    4.91 @@ -147,7 +157,7 @@ char *token[32] =                       
    4.92   */
    4.93  
    4.94  /* protects from unnoticed changes in struct acm_policy_buffer */
    4.95 -#define WRITTEN_AGAINST_ACM_POLICY_VERSION  2
    4.96 +#define WRITTEN_AGAINST_ACM_POLICY_VERSION  3
    4.97  
    4.98  /* protects from unnoticed changes in struct acm_chwall_policy_buffer */
    4.99  #define WRITTEN_AGAINST_ACM_CHWALL_VERSION  1
     5.1 --- a/xen/acm/acm_policy.c	Wed Mar 28 13:56:22 2007 +0100
     5.2 +++ b/xen/acm/acm_policy.c	Wed Mar 28 14:00:56 2007 +0100
     5.3 @@ -116,6 +116,10 @@ do_acm_set_policy(void *buf, u32 buf_siz
     5.4           acm_secondary_ops->set_binary_policy(buf + offset, length))
     5.5          goto error_lock_free;
     5.6  
     5.7 +    memcpy(&acm_bin_pol.xml_pol_version,
     5.8 +           &pol->xml_pol_version,
     5.9 +           sizeof(acm_bin_pol.xml_pol_version));
    5.10 +
    5.11      write_unlock(&acm_bin_pol_rwlock);
    5.12      return ACM_OK;
    5.13  
    5.14 @@ -132,7 +136,7 @@ acm_get_policy(XEN_GUEST_HANDLE(void) bu
    5.15      u8 *policy_buffer;
    5.16      int ret;
    5.17      struct acm_policy_buffer *bin_pol;
    5.18 - 
    5.19 +
    5.20      if (buf_size < sizeof(struct acm_policy_buffer))
    5.21          return -EFAULT;
    5.22  
    5.23 @@ -151,6 +155,10 @@ acm_get_policy(XEN_GUEST_HANDLE(void) bu
    5.24      bin_pol->primary_buffer_offset = cpu_to_be32(be32_to_cpu(bin_pol->len));
    5.25      bin_pol->secondary_buffer_offset = cpu_to_be32(be32_to_cpu(bin_pol->len));
    5.26       
    5.27 +    memcpy(&bin_pol->xml_pol_version,
    5.28 +           &acm_bin_pol.xml_pol_version,
    5.29 +           sizeof(struct acm_policy_version));
    5.30 +
    5.31      ret = acm_dump_policy_reference(policy_buffer + be32_to_cpu(bin_pol->policy_reference_offset),
    5.32                                      buf_size - be32_to_cpu(bin_pol->policy_reference_offset));
    5.33      if (ret < 0)
     6.1 --- a/xen/include/acm/acm_core.h	Wed Mar 28 13:56:22 2007 +0100
     6.2 +++ b/xen/include/acm/acm_core.h	Wed Mar 28 14:00:56 2007 +0100
     6.3 @@ -29,6 +29,7 @@ struct acm_binary_policy {
     6.4      char *policy_reference_name;
     6.5      u16 primary_policy_code;
     6.6      u16 secondary_policy_code;
     6.7 +    struct acm_policy_version xml_pol_version;
     6.8  };
     6.9  
    6.10  struct chwall_binary_policy {
     7.1 --- a/xen/include/public/acm.h	Wed Mar 28 13:56:22 2007 +0100
     7.2 +++ b/xen/include/public/acm.h	Wed Mar 28 14:00:56 2007 +0100
     7.3 @@ -78,7 +78,7 @@
     7.4   * whenever the interpretation of the related
     7.5   * policy's data structure changes
     7.6   */
     7.7 -#define ACM_POLICY_VERSION 2
     7.8 +#define ACM_POLICY_VERSION 3
     7.9  #define ACM_CHWALL_VERSION 1
    7.10  #define ACM_STE_VERSION  1
    7.11  
    7.12 @@ -119,6 +119,14 @@ typedef uint16_t domaintype_t;
    7.13  /* each offset in bytes from start of the struct they
    7.14   * are part of */
    7.15  
    7.16 +/* V3 of the policy buffer aded a version structure */
    7.17 +struct acm_policy_version
    7.18 +{
    7.19 +    uint32_t major;
    7.20 +    uint32_t minor;
    7.21 +} __attribute__((packed));
    7.22 +
    7.23 +
    7.24  /* each buffer consists of all policy information for
    7.25   * the respective policy given in the policy code
    7.26   *
    7.27 @@ -136,11 +144,13 @@ struct acm_policy_buffer {
    7.28      uint32_t primary_buffer_offset;
    7.29      uint32_t secondary_policy_code;
    7.30      uint32_t secondary_buffer_offset;
    7.31 -};
    7.32 +    struct acm_policy_version xml_pol_version; /* add in V3 */
    7.33 +} __attribute__((packed));
    7.34 +
    7.35  
    7.36  struct acm_policy_reference_buffer {
    7.37      uint32_t len;
    7.38 -};
    7.39 +} __attribute__((packed));
    7.40  
    7.41  struct acm_chwall_policy_buffer {
    7.42      uint32_t policy_version; /* ACM_CHWALL_VERSION */
    7.43 @@ -152,7 +162,7 @@ struct acm_chwall_policy_buffer {
    7.44      uint32_t chwall_conflict_sets_offset;
    7.45      uint32_t chwall_running_types_offset;
    7.46      uint32_t chwall_conflict_aggregate_offset;
    7.47 -};
    7.48 +} __attribute__((packed));
    7.49  
    7.50  struct acm_ste_policy_buffer {
    7.51      uint32_t policy_version; /* ACM_STE_VERSION */
    7.52 @@ -160,7 +170,7 @@ struct acm_ste_policy_buffer {
    7.53      uint32_t ste_max_types;
    7.54      uint32_t ste_max_ssidrefs;
    7.55      uint32_t ste_ssid_offset;
    7.56 -};
    7.57 +} __attribute__((packed));
    7.58  
    7.59  struct acm_stats_buffer {
    7.60      uint32_t magic;
    7.61 @@ -169,7 +179,7 @@ struct acm_stats_buffer {
    7.62      uint32_t primary_stats_offset;
    7.63      uint32_t secondary_policy_code;
    7.64      uint32_t secondary_stats_offset;
    7.65 -};
    7.66 +} __attribute__((packed));
    7.67  
    7.68  struct acm_ste_stats_buffer {
    7.69      uint32_t ec_eval_count;
    7.70 @@ -178,7 +188,7 @@ struct acm_ste_stats_buffer {
    7.71      uint32_t gt_denied_count;
    7.72      uint32_t ec_cachehit_count;
    7.73      uint32_t gt_cachehit_count;
    7.74 -};
    7.75 +} __attribute__((packed));
    7.76  
    7.77  struct acm_ssid_buffer {
    7.78      uint32_t len;
    7.79 @@ -190,7 +200,7 @@ struct acm_ssid_buffer {
    7.80      uint32_t secondary_policy_code;
    7.81      uint32_t secondary_max_types;
    7.82      uint32_t secondary_types_offset;
    7.83 -};
    7.84 +} __attribute__((packed));
    7.85  
    7.86  #endif
    7.87