ia64/xen-unstable

changeset 15619:e1f74a5a09cb

Merge
author Tim Deegan <Tim.Deegan@xensource.com>
date Wed Jul 18 13:56:21 2007 +0100 (2007-07-18)
parents ad87a4912874 ad1c6cf0baaf
children 0eaa9f605b92
files
line diff
     1.1 --- a/tools/python/xen/util/acmpolicy.py	Wed Jul 18 13:56:00 2007 +0100
     1.2 +++ b/tools/python/xen/util/acmpolicy.py	Wed Jul 18 13:56:21 2007 +0100
     1.3 @@ -122,7 +122,8 @@ class ACMPolicy(XSPolicy):
     1.4              rc = -xsconstants.XSERR_GENERAL_FAILURE
     1.5          if rc != xsconstants.XSERR_SUCCESS:
     1.6              log.warn("XML did not validate against schema")
     1.7 -        rc = self.__validate_name_and_labels()
     1.8 +        if rc == xsconstants.XSERR_SUCCESS:
     1.9 +            rc = self.__validate_name_and_labels()
    1.10          return rc
    1.11  
    1.12      def __validate_name_and_labels(self):
    1.13 @@ -626,14 +627,15 @@ class ACMPolicy(XSPolicy):
    1.14      def policy_get_stes_of_vmlabel(self, vmlabel):
    1.15          """ Get a list of all STEs of a given VMlabel """
    1.16          return self.__policy_get_stes_of_labeltype(vmlabel,
    1.17 -                                                   "VirtualMachineLabel")
    1.18 +                                        "/SubjectLabels", "VirtualMachineLabel")
    1.19  
    1.20      def policy_get_stes_of_resource(self, reslabel):
    1.21          """ Get a list of all resources of a given VMlabel """
    1.22 -        return self.__policy_get_stes_of_labeltype(reslabel, "ResourceLabel")
    1.23 +        return self.__policy_get_stes_of_labeltype(reslabel,
    1.24 +                                        "/ObjectLabels", "ResourceLabel")
    1.25  
    1.26 -    def __policy_get_stes_of_labeltype(self, label, labeltype):
    1.27 -        node = self.dom_get_node("SecurityLabelTemplate/SubjectLabels")
    1.28 +    def __policy_get_stes_of_labeltype(self, label, path, labeltype):
    1.29 +        node = self.dom_get_node("SecurityLabelTemplate" + path)
    1.30          if node:
    1.31              i = 0
    1.32              while i < len(node.childNodes):
    1.33 @@ -661,7 +663,8 @@ class ACMPolicy(XSPolicy):
    1.34              return False
    1.35          for res in resources:
    1.36              res_stes = self.policy_get_stes_of_resource(res)
    1.37 -            if len( set(res_stes).union( set(vm_stes) ) ) == 0:
    1.38 +            if len(res_stes) == 0 or \
    1.39 +               len( set(res_stes).intersection( set(vm_stes) ) ) == 0:
    1.40                  return False
    1.41          return True
    1.42  
     2.1 --- a/tools/python/xen/util/security.py	Wed Jul 18 13:56:00 2007 +0100
     2.2 +++ b/tools/python/xen/util/security.py	Wed Jul 18 13:56:21 2007 +0100
     2.3 @@ -799,9 +799,10 @@ def is_resource_in_use(resource):
     2.4              lst.append(dominfo)
     2.5      return lst
     2.6  
     2.7 -def devices_equal(res1, res2):
     2.8 +def devices_equal(res1, res2, mustexist=True):
     2.9      """ Determine whether two devices are equal """
    2.10 -    return (unify_resname(res1) == unify_resname(res2))
    2.11 +    return (unify_resname(res1, mustexist) ==
    2.12 +            unify_resname(res2, mustexist))
    2.13  
    2.14  def is_resource_in_use_by_dom(dominfo, resource):
    2.15      """ Determine whether a resources is in use by a given domain
    2.16 @@ -817,7 +818,7 @@ def is_resource_in_use_by_dom(dominfo, r
    2.17          dev = devs[uuid]
    2.18          if len(dev) >= 2 and dev[1].has_key('uname'):
    2.19              # dev[0] is type, i.e. 'vbd'
    2.20 -            if devices_equal(dev[1]['uname'], resource):
    2.21 +            if devices_equal(dev[1]['uname'], resource, mustexist=False):
    2.22                  log.info("RESOURCE IN USE: Domain %d uses %s." %
    2.23                           (dominfo.domid, resource))
    2.24                  return True
     3.1 --- a/tools/python/xen/xend/XendAPI.py	Wed Jul 18 13:56:00 2007 +0100
     3.2 +++ b/tools/python/xen/xend/XendAPI.py	Wed Jul 18 13:56:21 2007 +0100
     3.3 @@ -1410,22 +1410,22 @@ class XendAPI(object):
     3.4      def VM_set_memory_dynamic_max(self, session, vm_ref, mem):
     3.5          dom = XendDomain.instance().get_vm_by_uuid(vm_ref)
     3.6          dom.set_memory_dynamic_max(int(mem))
     3.7 -        return xen_api_success_void()
     3.8 +        return self._VM_save(dom)
     3.9  
    3.10      def VM_set_memory_dynamic_min(self, session, vm_ref, mem):
    3.11          dom = XendDomain.instance().get_vm_by_uuid(vm_ref)
    3.12          dom.set_memory_dynamic_min(int(mem))
    3.13 -        return xen_api_success_void()
    3.14 +        return self._VM_save(dom)
    3.15  
    3.16      def VM_set_memory_static_max(self, session, vm_ref, mem):
    3.17          dom = XendDomain.instance().get_vm_by_uuid(vm_ref)
    3.18          dom.set_memory_static_max(int(mem))
    3.19 -        return xen_api_success_void()
    3.20 +        return self._VM_save(dom)
    3.21      
    3.22      def VM_set_memory_static_min(self, session, vm_ref, mem):
    3.23          dom = XendDomain.instance().get_vm_by_uuid(vm_ref)
    3.24          dom.set_memory_static_min(int(mem))
    3.25 -        return xen_api_success_void()
    3.26 +        return self._VM_save(dom)
    3.27  
    3.28      def VM_set_memory_dynamic_max_live(self, session, vm_ref, mem):
    3.29          dom = XendDomain.instance().get_vm_by_uuid(vm_ref)
    3.30 @@ -1620,7 +1620,8 @@ class XendAPI(object):
    3.31          (rc, errors, oldlabel, new_ssidref) = \
    3.32                                   dom.set_security_label(sec_label, old_label)
    3.33          if rc != xsconstants.XSERR_SUCCESS:
    3.34 -            return xen_api_error(['SECURITY_ERROR', rc])
    3.35 +            return xen_api_error(['SECURITY_ERROR', rc,
    3.36 +                                 xsconstants.xserr2string(-rc)])
    3.37          if rc == 0:
    3.38              rc = new_ssidref
    3.39          return xen_api_success(rc)
    3.40 @@ -2239,7 +2240,8 @@ class XendAPI(object):
    3.41          vdi = XendNode.instance().get_vdi_by_uuid(vdi_ref)
    3.42          rc = vdi.set_security_label(sec_lab, old_lab)
    3.43          if rc < 0:
    3.44 -            return xen_api_error(['SECURITY_ERROR', rc])
    3.45 +            return xen_api_error(['SECURITY_ERROR', rc,
    3.46 +                                 xsconstants.xserr2string(-rc)])
    3.47          return xen_api_success(rc)
    3.48  
    3.49      def VDI_get_security_label(self, session, vdi_ref):
     4.1 --- a/tools/python/xen/xend/XendVDI.py	Wed Jul 18 13:56:00 2007 +0100
     4.2 +++ b/tools/python/xen/xend/XendVDI.py	Wed Jul 18 13:56:21 2007 +0100
     4.3 @@ -24,6 +24,7 @@ import os
     4.4  from xen.util.xmlrpclib2 import stringify
     4.5  from xmlrpclib import dumps, loads
     4.6  from xen.util import security, xsconstants
     4.7 +from xen.xend.XendError import SecurityError
     4.8  
     4.9  KB = 1024
    4.10  MB = 1024 * 1024
     5.1 --- a/tools/python/xen/xend/XendXSPolicyAdmin.py	Wed Jul 18 13:56:00 2007 +0100
     5.2 +++ b/tools/python/xen/xend/XendXSPolicyAdmin.py	Wed Jul 18 13:56:21 2007 +0100
     5.3 @@ -56,7 +56,10 @@ class XSPolicyAdmin:
     5.4              typ = data[1]
     5.5              try:
     5.6                  if typ == xsconstants.ACM_POLICY_ID:
     5.7 -                    self.xsobjs[ref] = ACMPolicy(name=name, ref=ref)
     5.8 +                    try:
     5.9 +                        self.xsobjs[ref] = ACMPolicy(name=name, ref=ref)
    5.10 +                    except Exception, e:
    5.11 +                        del self.policies[ref]
    5.12                  else:
    5.13                      del self.policies[ref]
    5.14              except Exception, e:
    5.15 @@ -271,6 +274,10 @@ class XSPolicyAdmin:
    5.16                  return pol
    5.17          return None
    5.18  
    5.19 +    def get_hv_loaded_policy_name(self):
    5.20 +        security.refresh_security_policy()
    5.21 +        return security.active_policy
    5.22 +
    5.23      def get_policy_by_name(self, name):
    5.24          for pol in self.xsobjs.values():
    5.25              if pol.get_name() == name:
     6.1 --- a/tools/python/xen/xm/cfgbootpolicy.py	Wed Jul 18 13:56:00 2007 +0100
     6.2 +++ b/tools/python/xen/xm/cfgbootpolicy.py	Wed Jul 18 13:56:21 2007 +0100
     6.3 @@ -170,8 +170,9 @@ def cfgbootpolicy_xapi(policy, user_titl
     6.4              OptionError("No policy installed on system?")
     6.5          acmpol = ACMPolicy(xml=xml)
     6.6          if acmpol.get_name() != policy:
     6.7 -            OptionError("Policy installed on system '%s' does not match the "
     6.8 -                        "request policy '%s'" % (acmpol.get_name(), policy))
     6.9 +            raise OptionError("Policy installed on system '%s' does not "
    6.10 +                              "match the requested policy '%s'" %
    6.11 +                              (acmpol.get_name(), policy))
    6.12          flags = int(policystate['flags']) | xsconstants.XS_INST_BOOT
    6.13          rc = int(server.xenapi.XSPolicy.activate_xspolicy(xs_ref, flags))
    6.14          if rc == flags:
     7.1 --- a/tools/xm-test/lib/XmTestLib/XenAPIDomain.py	Wed Jul 18 13:56:00 2007 +0100
     7.2 +++ b/tools/xm-test/lib/XmTestLib/XenAPIDomain.py	Wed Jul 18 13:56:21 2007 +0100
     7.3 @@ -23,6 +23,7 @@ import os
     7.4  import sys
     7.5  from XmTestLib import *
     7.6  from types import DictType
     7.7 +from acm import *
     7.8  
     7.9  
    7.10  class XenAPIConfig:
    7.11 @@ -38,6 +39,9 @@ class XenAPIConfig:
    7.12                             'kernel' : 'PV_kernel',
    7.13                             'ramdisk': 'PV_ramdisk',
    7.14                             'root'   : 'PV_args'}
    7.15 +        if isACMEnabled():
    7.16 +            #A default so every VM can start with ACM enabled
    7.17 +            self.opts["security_label"] = "ACM:xm-test:red"
    7.18  
    7.19      def setOpt(self, name, value):
    7.20          """Set an option in the config"""
     8.1 --- a/tools/xm-test/lib/XmTestLib/acm.py	Wed Jul 18 13:56:00 2007 +0100
     8.2 +++ b/tools/xm-test/lib/XmTestLib/acm.py	Wed Jul 18 13:56:21 2007 +0100
     8.3 @@ -19,6 +19,9 @@
     8.4  """
     8.5  from Test import *
     8.6  from xen.util import security
     8.7 +from xen.xm.main import server
     8.8 +from xen.util import xsconstants
     8.9 +import re
    8.10  
    8.11  try:
    8.12      from acm_config import *
    8.13 @@ -32,16 +35,47 @@ def isACMEnabled():
    8.14      return security.on()
    8.15  
    8.16  
    8.17 +def getSystemPolicyName():
    8.18 +    s,o = traceCommand("xm getpolicy")
    8.19 +    m = re.compile("Policy name[\s]*: ([A-z\-]+)").search(o)
    8.20 +    if m:
    8.21 +        polname = m.group(1)
    8.22 +        return polname
    8.23 +    return ""
    8.24 +
    8.25 +
    8.26 +def ACMLoadPolicy_XenAPI(policy='xm-test'):
    8.27 +    polname = getSystemPolicyName()
    8.28 +    if polname != policy:
    8.29 +        # Try it, maybe it's not activated
    8.30 +        traceCommand("xm setpolicy %s %s" %
    8.31 +                     (xsconstants.XS_POLICY_ACM, policy))
    8.32 +        polname = getSystemPolicyName()
    8.33 +        if polname != policy:
    8.34 +            FAIL("Need to have a system with no or policy '%s' active, "
    8.35 +                 "not %s" % (policy,polname))
    8.36 +        else:
    8.37 +            s, o = traceCommand("xm activatepolicy --load")
    8.38 +    else:
    8.39 +        s, o = traceCommand("xm activatepolicy --load")
    8.40 +        if not re.search("Successfully", o):
    8.41 +            FAIL("Could not set the policy '%s'." % policy)
    8.42 +
    8.43 +
    8.44  def ACMLoadPolicy(policy='xm-test'):
    8.45 -    s, o = traceCommand("xm makepolicy %s" % (policy))
    8.46 -    if s != 0:
    8.47 -        FAIL("Need to be able to do 'xm makepolicy %s' but could not" %
    8.48 -             (policy))
    8.49 -    s, o = traceCommand("xm loadpolicy %s" % (policy))
    8.50 -    if s != 0:
    8.51 -        FAIL("Could not load the required policy '%s'.\n"
    8.52 -             "Start the system without any policy.\n%s" %
    8.53 -             (policy, o))
    8.54 +    from xen.xm import main
    8.55 +    if main.serverType == main.SERVER_XEN_API:
    8.56 +        ACMLoadPolicy_XenAPI()
    8.57 +    else:
    8.58 +        s, o = traceCommand("xm makepolicy %s" % (policy))
    8.59 +        if s != 0:
    8.60 +            FAIL("Need to be able to do 'xm makepolicy %s' but could not" %
    8.61 +                 (policy))
    8.62 +        s, o = traceCommand("xm loadpolicy %s" % (policy))
    8.63 +        if s != 0:
    8.64 +            FAIL("Could not load the required policy '%s'.\n"
    8.65 +                 "Start the system without any policy.\n%s" %
    8.66 +                 (policy, o))
    8.67  
    8.68  def ACMPrepareSystem(resources):
    8.69      if isACMEnabled():
     9.1 --- a/tools/xm-test/tests/security-acm/01_security-acm_basic.py	Wed Jul 18 13:56:00 2007 +0100
     9.2 +++ b/tools/xm-test/tests/security-acm/01_security-acm_basic.py	Wed Jul 18 13:56:21 2007 +0100
     9.3 @@ -15,6 +15,7 @@
     9.4  
     9.5  from XmTestLib import *
     9.6  from xen.util import security
     9.7 +from xen.util import xsconstants
     9.8  import commands
     9.9  import os
    9.10  import re
    9.11 @@ -28,7 +29,7 @@ if not isACMEnabled():
    9.12      SKIP("Not running this test since ACM not enabled.")
    9.13  
    9.14  status, output = traceCommand("xm makepolicy %s" % (testpolicy))
    9.15 -if status != 0 or output != "":
    9.16 +if status != 0:
    9.17      FAIL("'xm makepolicy' failed with status %d and output\n%s" %
    9.18           (status,output));
    9.19  
    9.20 @@ -47,7 +48,7 @@ status, output = traceCommand("xm rmlabe
    9.21  status, output = traceCommand("xm addlabel %s dom %s %s" %
    9.22                                (testlabel, vmconfigfile, testpolicy))
    9.23  if status != 0:
    9.24 -    FAIL("'xm addlabel' failed with status %d.\n" % status)
    9.25 +    FAIL("(1) 'xm addlabel' failed with status %d.\n" % status)
    9.26  
    9.27  status, output = traceCommand("xm getlabel dom %s" %
    9.28                                (vmconfigfile))
    9.29 @@ -55,8 +56,9 @@ status, output = traceCommand("xm getlab
    9.30  if status != 0:
    9.31      FAIL("'xm getlabel' failed with status %d, output:\n%s" %
    9.32           (status, output))
    9.33 -if output != "policy=%s,label=%s" % (testpolicy,testlabel):
    9.34 -    FAIL("Received unexpected output from 'xm getlabel': \n%s" %
    9.35 +if output != "policytype=%s,policy=%s,label=%s" % \
    9.36 +             (xsconstants.ACM_POLICY_ID, testpolicy, testlabel):
    9.37 +    FAIL("(1) Received unexpected output from 'xm getlabel dom': \n%s" %
    9.38           (output))
    9.39  
    9.40  
    9.41 @@ -74,30 +76,34 @@ status, output = traceCommand("xm getlab
    9.42                                (vmconfigfile))
    9.43  
    9.44  if output != "Error: 'Domain not labeled'":
    9.45 -    FAIL("Received unexpected output from 'xm getlabel': \n%s" %
    9.46 +    FAIL("(2) Received unexpected output from 'xm getlabel dom': \n%s" %
    9.47           (output))
    9.48  
    9.49  #Whatever label the resource might have, remove it
    9.50  status, output = traceCommand("xm rmlabel res %s" %
    9.51                                (testresource))
    9.52 +if status != 0:
    9.53 +    FAIL("'xm rmlabel' on resource failed with status %d.\n" % status)
    9.54  
    9.55  status, output = traceCommand("xm addlabel %s res %s %s" %
    9.56                                (testlabel, testresource, testpolicy))
    9.57  if status != 0:
    9.58 -    FAIL("'xm addlabel' on resource failed with status %d.\n" % status)
    9.59 +    FAIL("(2) 'xm addlabel' on resource failed with status %d.\n" % status)
    9.60  
    9.61  status, output = traceCommand("xm getlabel res %s" % (testresource))
    9.62  
    9.63  if status != 0:
    9.64      FAIL("'xm getlabel' on resource failed with status %d, output:\n%s" %
    9.65           (status, output))
    9.66 -if output != "policy=%s,label=%s" % (testpolicy,testlabel):
    9.67 -    FAIL("Received unexpected output from 'xm getlabel': \n%s" %
    9.68 +if output != "%s:%s:%s" % (xsconstants.ACM_POLICY_ID,\
    9.69 +                           testpolicy,testlabel):
    9.70 +    FAIL("Received unexpected output from 'xm getlabel res': \n%s" %
    9.71           (output))
    9.72  
    9.73  status, output = traceCommand("xm resources")
    9.74  
    9.75  if status != 0:
    9.76 +    print "status = %s" % str(status)
    9.77      FAIL("'xm resources' did not run properly")
    9.78  if not re.search(security.unify_resname(testresource), output):
    9.79      FAIL("'xm resources' did not show the tested resource '%s'." %
    9.80 @@ -117,5 +123,5 @@ status, output = traceCommand("xm getlab
    9.81                                (testresource))
    9.82  
    9.83  if output != "Error: 'Resource not labeled'":
    9.84 -    FAIL("Received unexpected output from 'xm getlabel': \n%s" %
    9.85 +    FAIL("Received unexpected output from 'xm getlabel res': \n%s" %
    9.86           (output))
    10.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
    10.2 +++ b/tools/xm-test/tests/security-acm/07_security-acm_pol_update.py	Wed Jul 18 13:56:21 2007 +0100
    10.3 @@ -0,0 +1,303 @@
    10.4 +#!/usr/bin/python
    10.5 +
    10.6 +# Copyright (C) International Business Machines Corp., 2006
    10.7 +# Author: Stefan Berger <stefanb@us.ibm.com>
    10.8 +
    10.9 +# Test to exercise the xspolicy class
   10.10 +
   10.11 +from XmTestLib import xapi
   10.12 +from XmTestLib.XenAPIDomain import XmTestAPIDomain
   10.13 +from XmTestLib import *
   10.14 +from xen.xend import XendAPIConstants
   10.15 +from xen.util import acmpolicy, security, xsconstants
   10.16 +from xen.util.acmpolicy import ACMPolicy
   10.17 +from xen.xend.XendDomain import DOM0_UUID
   10.18 +
   10.19 +import commands
   10.20 +import os
   10.21 +import base64
   10.22 +
   10.23 +xm_test = {}
   10.24 +xm_test['policyname'] = "xm-test"
   10.25 +xm_test['date'] = "Fri Sep 29 14:44:38 2006"
   10.26 +xm_test['url']  = None
   10.27 +
   10.28 +vm_label_red   = "%s:xm-test:red" % xsconstants.ACM_POLICY_ID
   10.29 +vm_label_green = "%s:xm-test:green" % xsconstants.ACM_POLICY_ID
   10.30 +vm_label_blue  = "%s:xm-test:blue" % xsconstants.ACM_POLICY_ID
   10.31 +vm_label_sys   = "%s:xm-test:SystemManagement" % xsconstants.ACM_POLICY_ID
   10.32 +
   10.33 +vm_label_black = "%s:xm-test:black"
   10.34 +
   10.35 +session = xapi.connect()
   10.36 +
   10.37 +oldlabel = session.xenapi.VM.get_security_label(DOM0_UUID)
   10.38 +
   10.39 +ssidref = session.xenapi.VM.set_security_label(DOM0_UUID,
   10.40 +                                               vm_label_sys,
   10.41 +                                               oldlabel)
   10.42 +if int(ssidref) <= 0 or int(ssidref) != 0x00010001:
   10.43 +    FAIL("(0) Domain-0 label for '%s' has unexpected failure: %08x" %
   10.44 +         (vm_label_sys, int(ssidref)))
   10.45 +print "ssidref for '%s' is 0x%08x" % (vm_label_sys, int(ssidref))
   10.46 +
   10.47 +
   10.48 +xstype = session.xenapi.XSPolicy.get_xstype()
   10.49 +if int(xstype) & xsconstants.XS_POLICY_ACM == 0:
   10.50 +    SKIP("ACM not enabled/compiled in Xen")
   10.51 +
   10.52 +policystate = session.xenapi.XSPolicy.get_xspolicy()
   10.53 +if not policystate.has_key('xs_ref'):
   10.54 +    FAIL("get_xspolicy must return member 'xs_ref'")
   10.55 +
   10.56 +xs_ref = policystate['xs_ref']
   10.57 +if xs_ref != "":
   10.58 +    origpolicyxml = session.xenapi.ACMPolicy.get_xml(xs_ref)
   10.59 +else:
   10.60 +    origpolicyxml = ""
   10.61 +
   10.62 +f = open("xm-test-security_policy.xml", 'r')
   10.63 +if f:
   10.64 +    newpolicyxml = f.read()
   10.65 +    f.close()
   10.66 +else:
   10.67 +    FAIL("Could not read 'xm-test' policy")
   10.68 +
   10.69 +try:
   10.70 +    os.unlink("/boot/xm-test.bin")
   10.71 +except:
   10.72 +    pass
   10.73 +
   10.74 +policystate = session.xenapi.XSPolicy.get_xspolicy()
   10.75 +
   10.76 +if int(policystate['type']) == 0:
   10.77 +    policystate = session.xenapi.XSPolicy.set_xspolicy(
   10.78 +                          xsconstants.XS_POLICY_ACM,
   10.79 +                          newpolicyxml,
   10.80 +                          xsconstants.XS_INST_LOAD | xsconstants.XS_INST_BOOT,
   10.81 +                          1)
   10.82 +    if int(policystate['flags']) == -1:
   10.83 +        FAIL("Could not set the new policy.")
   10.84 +
   10.85 +print "state of policy = %s " % policystate
   10.86 +
   10.87 +rc = session.xenapi.XSPolicy.activate_xspolicy(
   10.88 +                          policystate['xs_ref'],
   10.89 +                          xsconstants.XS_INST_LOAD | xsconstants.XS_INST_BOOT)
   10.90 +if int(rc) != xsconstants.XS_INST_LOAD | xsconstants.XS_INST_BOOT:
   10.91 +    FAIL("Could not activate the current policy: rc = %08x" % int(rc))
   10.92 +
   10.93 +if not os.path.exists("/boot/xm-test.bin"):
   10.94 +    FAIL("Binary policy was not installed. Check grub config file.")
   10.95 +
   10.96 +policystate = session.xenapi.XSPolicy.get_xspolicy()
   10.97 +
   10.98 +if int(policystate['flags']) != xsconstants.XS_INST_BOOT | \
   10.99 +                                xsconstants.XS_INST_LOAD:
  10.100 +    FAIL("Flags (%x) are not indicating the correct state of the policy.",
  10.101 +         int(policystate['flags']))
  10.102 +
  10.103 +policystate = session.xenapi.XSPolicy.get_xspolicy()
  10.104 +xs_ref = policystate['xs_ref']
  10.105 +
  10.106 +newpolicyxml = None
  10.107 +f = open("xm-test-new-security_policy.xml", 'r')
  10.108 +if f:
  10.109 +    newpolicyxml = f.read()
  10.110 +    f.close()
  10.111 +else:
  10.112 +    FAIL("Could not read 'xm-test-new' policy")
  10.113 +
  10.114 +cur_acmpol = ACMPolicy(xml = policystate['repr'])
  10.115 +new_acmpol = ACMPolicy(xml = newpolicyxml)
  10.116 +
  10.117 +new_acmpol.update_frompolicy(cur_acmpol)
  10.118 +
  10.119 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  10.120 +                          new_acmpol.toxml(),
  10.121 +                          xsconstants.XS_INST_LOAD | xsconstants.XS_INST_BOOT,
  10.122 +                          1)
  10.123 +
  10.124 +f = open("xm-test-security_policy.xml", 'r')
  10.125 +if f:
  10.126 +    newpolicyxml = f.read()
  10.127 +    f.close()
  10.128 +else:
  10.129 +    FAIL("Could not read 'xm-test-new' policy")
  10.130 +
  10.131 +cur_acmpol = new_acmpol
  10.132 +new_acmpol = ACMPolicy(xml = newpolicyxml)
  10.133 +
  10.134 +new_acmpol.update_frompolicy(cur_acmpol)
  10.135 +
  10.136 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  10.137 +                          new_acmpol.toxml(),
  10.138 +                          xsconstants.XS_INST_LOAD | xsconstants.XS_INST_BOOT,
  10.139 +                          1)
  10.140 +
  10.141 +dom0_lab = session.xenapi.VM.get_security_label(DOM0_UUID)
  10.142 +
  10.143 +ssidref = session.xenapi.VM.set_security_label(DOM0_UUID,
  10.144 +                                               vm_label_sys, dom0_lab)
  10.145 +if int(ssidref) <= 0 or int(ssidref) != 0x00010001:
  10.146 +    FAIL("(1) Domain-0 label for '%s' has unexpected failure: %08x" %
  10.147 +         (vm_label_sys, int(ssidref)))
  10.148 +print "ssidref for '%s' is 0x%08x" % (vm_label_sys, int(ssidref))
  10.149 +
  10.150 +try:
  10.151 +    ssidref = session.xenapi.VM.set_security_label(DOM0_UUID,
  10.152 +                                                   vm_label_black,
  10.153 +                                                   vm_label_sys)
  10.154 +    FAIL("Could set label '%s', although it's not in the policy. "
  10.155 +         "ssidref=%s" % (vm_label_black, ssidref))
  10.156 +except:
  10.157 +    pass
  10.158 +
  10.159 +ssidref = session.xenapi.VM.set_security_label(DOM0_UUID,
  10.160 +                                               vm_label_red,
  10.161 +                                               vm_label_sys)
  10.162 +if int(ssidref) <= 0:
  10.163 +    FAIL("(2) Domain-0 label for '%s' has unexpected failure: %08x" %
  10.164 +         (vm_label_red, int(ssidref)))
  10.165 +print "ssidref for '%s' is 0x%08x" % (vm_label_red, int(ssidref))
  10.166 +
  10.167 +label = session.xenapi.VM.get_security_label(DOM0_UUID)
  10.168 +
  10.169 +if label != vm_label_red:
  10.170 +    FAIL("Dom0 label '%s' not as expected '%s'" % (label, vm_label_red))
  10.171 +
  10.172 +
  10.173 +ssidref = session.xenapi.VM.set_security_label(DOM0_UUID,
  10.174 +                                               vm_label_sys,
  10.175 +                                               vm_label_red)
  10.176 +if int(ssidref) <= 0 or int(ssidref) != 0x00010001:
  10.177 +    FAIL("(3) Domain-0 label for '%s' has unexpected failure: %08x" %
  10.178 +         (vm_label_sys, int(ssidref)))
  10.179 +
  10.180 +label = session.xenapi.VM.get_security_label(DOM0_UUID)
  10.181 +
  10.182 +if label != vm_label_sys:
  10.183 +    FAIL("Dom0 label '%s' not as expected '%s'" % label, dom0_label)
  10.184 +
  10.185 +header = session.xenapi.ACMPolicy.get_header(xs_ref)
  10.186 +
  10.187 +if header['policyname'] != xm_test['policyname']:
  10.188 +    FAIL("Name in header is '%s', expected is '%s'." %
  10.189 +         (header['policyname'],xm_test['policyname']))
  10.190 +if header['date'] != xm_test['date']:
  10.191 +    FAIL("Date in header is '%s', expected is '%s'." %
  10.192 +         (header['date'],xm_test['date']))
  10.193 +if header.has_key("url") and header['url' ] != xm_test['url' ]:
  10.194 +    FAIL("URL  in header is '%s', expected is '%s'." %
  10.195 +         (header['url' ],xm_test['url' ]))
  10.196 +
  10.197 +# Create another domain
  10.198 +try:
  10.199 +    # XmTestAPIDomain tries to establish a connection to XenD
  10.200 +    domain = XmTestAPIDomain(extraConfig={ 'security_label' : vm_label_blue })
  10.201 +except Exception, e:
  10.202 +    SKIP("Skipping test. Error: %s" % str(e))
  10.203 +
  10.204 +
  10.205 +vm_uuid = domain.get_uuid()
  10.206 +
  10.207 +res = session.xenapi.VM.get_security_label(vm_uuid)
  10.208 +if res != vm_label_blue:
  10.209 +    FAIL("VM has security label '%s', expected is '%s'" %
  10.210 +         (res, vm_label_blue))
  10.211 +
  10.212 +try:
  10.213 +    domain.start(noConsole=True)
  10.214 +except:
  10.215 +    FAIL("Could not create domain")
  10.216 +
  10.217 +
  10.218 +# Attempt to relabel the running domain
  10.219 +ssidref = session.xenapi.VM.set_security_label(vm_uuid,
  10.220 +                                               vm_label_red,
  10.221 +                                               vm_label_blue)
  10.222 +if int(ssidref) <= 0:
  10.223 +    FAIL("Could not relabel running domain to '%s'." % vm_label_red)
  10.224 +
  10.225 +# user domain is 'red', dom0 is current 'SystemManagement'.
  10.226 +# Try to move domain-0 to 'red' first, then to 'blue'.
  10.227 +
  10.228 +# Moving domain-0 to 'red' should work
  10.229 +ssidref = session.xenapi.VM.set_security_label(DOM0_UUID,
  10.230 +                                               vm_label_red,
  10.231 +                                               vm_label_sys)
  10.232 +if int(ssidref) <= 0:
  10.233 +    FAIL("Could not label domain-0 '%s'" % vm_label_red)
  10.234 +
  10.235 +# Moving the guest domain to 'blue' should not work due to conflict set
  10.236 +try:
  10.237 +    ssidref = session.xenapi.VM.set_security_label(vm_uuid,
  10.238 +                                                   vm_label_blue,
  10.239 +                                                   vm_label_red)
  10.240 +    FAIL("Could label guest domain with '%s', although this is in a conflict "
  10.241 +         "set. ssidref=%x" % (vm_label_blue,int(ssidref)))
  10.242 +except:
  10.243 +    pass
  10.244 +
  10.245 +label = session.xenapi.VM.get_security_label(vm_uuid)
  10.246 +if label != vm_label_red:
  10.247 +    FAIL("User domain has wrong label '%s', expected '%s'." %
  10.248 +         (label, vm_label_red))
  10.249 +
  10.250 +label = session.xenapi.VM.get_security_label(DOM0_UUID)
  10.251 +if label != vm_label_red:
  10.252 +    FAIL("Domain-0 has wrong label '%s'; expected '%s'." %
  10.253 +         (label, vm_label_red))
  10.254 +
  10.255 +ssidref = session.xenapi.VM.set_security_label(DOM0_UUID,
  10.256 +                                               vm_label_sys,
  10.257 +                                               vm_label_red)
  10.258 +if int(ssidref) < 0:
  10.259 +    FAIL("Could not set the domain-0 security label to '%s'." %
  10.260 +         (vm_label_sys))
  10.261 +
  10.262 +# pause the domain and relabel it...
  10.263 +session.xenapi.VM.pause(vm_uuid)
  10.264 +
  10.265 +label = session.xenapi.VM.get_security_label(vm_uuid)
  10.266 +if label != vm_label_red:
  10.267 +    FAIL("User domain has wrong label '%s', expected '%s'." %
  10.268 +         (label, vm_label_red))
  10.269 +
  10.270 +ssidref = session.xenapi.VM.set_security_label(vm_uuid,
  10.271 +                                               vm_label_blue,
  10.272 +                                               vm_label_red)
  10.273 +print "guest domain new label '%s'; ssidref is 0x%08x" % \
  10.274 +      (vm_label_blue, int(ssidref))
  10.275 +if int(ssidref) <= 0:
  10.276 +    FAIL("Could not label guest domain with '%s'" % (vm_label_blue))
  10.277 +
  10.278 +label = session.xenapi.VM.get_security_label(vm_uuid)
  10.279 +if label != vm_label_blue:
  10.280 +    FAIL("User domain has wrong label '%s', expected '%s'." %
  10.281 +         (label, vm_label_blue))
  10.282 +
  10.283 +session.xenapi.VM.unpause(vm_uuid)
  10.284 +
  10.285 +rc = session.xenapi.VM.suspend(vm_uuid)
  10.286 +
  10.287 +ssidref = session.xenapi.VM.set_security_label(vm_uuid,
  10.288 +                                               vm_label_green,
  10.289 +                                               vm_label_blue)
  10.290 +print "guest domain new label '%s'; ssidref is 0x%08x" % \
  10.291 +      (vm_label_green, int(ssidref))
  10.292 +if int(ssidref) < 0:
  10.293 +    FAIL("Could not label suspended guest domain with '%s'" % (vm_label_blue))
  10.294 +
  10.295 +label = session.xenapi.VM.get_security_label(vm_uuid)
  10.296 +if label != vm_label_green:
  10.297 +    FAIL("User domain has wrong label '%s', expected '%s'." %
  10.298 +         (label, vm_label_green))
  10.299 +
  10.300 +
  10.301 +rc = session.xenapi.VM.resume(vm_uuid, False)
  10.302 +
  10.303 +label = session.xenapi.VM.get_security_label(vm_uuid)
  10.304 +if label != vm_label_green:
  10.305 +    FAIL("User domain has wrong label '%s', expected '%s'." %
  10.306 +         (label, vm_label_green))
    11.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
    11.2 +++ b/tools/xm-test/tests/security-acm/08_security-acm_xapi.py	Wed Jul 18 13:56:21 2007 +0100
    11.3 @@ -0,0 +1,354 @@
    11.4 +#!/usr/bin/python
    11.5 +
    11.6 +# Copyright (C) International Business Machines Corp., 2007
    11.7 +# Author: Stefan Berger <stefanb@us.ibm.com>
    11.8 +
    11.9 +# VM creation test with labeled VM and labeled VDI
   11.10 +
   11.11 +from XmTestLib import xapi
   11.12 +from XmTestLib.XenAPIDomain import XmTestAPIDomain
   11.13 +from XmTestLib import *
   11.14 +from xen.xend import XendAPIConstants
   11.15 +from xen.util import acmpolicy, security, xsconstants
   11.16 +import commands
   11.17 +import os
   11.18 +
   11.19 +vm_label_red    = xsconstants.ACM_POLICY_ID + ":xm-test:red"
   11.20 +vm_label_green  = xsconstants.ACM_POLICY_ID + ":xm-test:green"
   11.21 +vdi_label_red   = xsconstants.ACM_POLICY_ID + ":xm-test:red"
   11.22 +vdi_label_green = xsconstants.ACM_POLICY_ID + ":xm-test:green"
   11.23 +
   11.24 +vdi_file = "/dev/ram0"
   11.25 +vdi_path = "phy:" + vdi_file
   11.26 +
   11.27 +#Note:
   11.28 +# If during the suspend/resume operations 'red' instead of 'green' is
   11.29 +# used, the Chinese Wall policy goes into effect and disallows the
   11.30 +# suspended VM from being resumed...
   11.31 +
   11.32 +try:
   11.33 +    # XmTestAPIDomain tries to establish a connection to XenD
   11.34 +    domain = XmTestAPIDomain(extraConfig={ 'security_label' : vm_label_red })
   11.35 +except Exception, e:
   11.36 +    SKIP("Skipping test. Error: %s" % str(e))
   11.37 +
   11.38 +vm_uuid = domain.get_uuid()
   11.39 +
   11.40 +session = xapi.connect()
   11.41 +xstype = session.xenapi.XSPolicy.get_xstype()
   11.42 +if int(xstype) & xsconstants.XS_POLICY_ACM == 0:
   11.43 +    SKIP("ACM not enabled/compiled in Xen")
   11.44 +
   11.45 +f = open("xm-test-security_policy.xml", 'r')
   11.46 +if f:
   11.47 +    newpolicyxml = f.read()
   11.48 +    f.close()
   11.49 +else:
   11.50 +    FAIL("Could not read 'xm-test' policy")
   11.51 +
   11.52 +policystate = session.xenapi.XSPolicy.get_xspolicy()
   11.53 +if int(policystate['type']) == 0:
   11.54 +    policystate = session.xenapi.XSPolicy.set_xspolicy(
   11.55 +                         xsconstants.XS_POLICY_ACM,
   11.56 +                         newpolicyxml,
   11.57 +                         xsconstants.XS_INST_BOOT | xsconstants.XS_INST_LOAD,
   11.58 +                         True)
   11.59 +    if int(policystate['flags']) == -1:
   11.60 +        FAIL("Could not set the new policy.")
   11.61 +
   11.62 +policystate = session.xenapi.XSPolicy.get_xspolicy()
   11.63 +print "policystate = %s" % policystate
   11.64 +acm_ref = policystate['xs_ref']
   11.65 +
   11.66 +
   11.67 +#
   11.68 +# Some tests with labeling of resources
   11.69 +#
   11.70 +labels = session.xenapi.XSPolicy.get_labeled_resources()
   11.71 +print "labeled resources are:\n%s" % labels
   11.72 +
   11.73 +oldlabel = session.xenapi.XSPolicy.get_resource_label("phy:/dev/ram0")
   11.74 +
   11.75 +rc  = session.xenapi.XSPolicy.set_resource_label("phy:/dev/ram0", "",
   11.76 +                                                 oldlabel)
   11.77 +
   11.78 +rc  = session.xenapi.XSPolicy.set_resource_label("phy:/dev/ram0",
   11.79 +                                                 vdi_label_green,
   11.80 +                                                 "")
   11.81 +
   11.82 +res = session.xenapi.XSPolicy.get_resource_label("phy:/dev/ram0")
   11.83 +if res != vdi_label_green:
   11.84 +    FAIL("(1) get_resource_label returned unexpected result %s, wanted %s" %
   11.85 +         (res, vdi_label_green))
   11.86 +
   11.87 +
   11.88 +#
   11.89 +# Some test with labeling of VMs
   11.90 +#
   11.91 +
   11.92 +res = session.xenapi.VM.get_security_label(vm_uuid)
   11.93 +
   11.94 +if res != vm_label_red:
   11.95 +    FAIL("VM.get_security_label returned wrong security label '%s'." % res)
   11.96 +
   11.97 +res = session.xenapi.VM.set_security_label(vm_uuid, vm_label_green,
   11.98 +                                                    vm_label_red)
   11.99 +
  11.100 +res = session.xenapi.VM.get_security_label(vm_uuid)
  11.101 +if res != vm_label_green:
  11.102 +     FAIL("VM does not show expected label '%s' but '%s'." %
  11.103 +          (vm_label_green, res))
  11.104 +
  11.105 +res = session.xenapi.VM.set_security_label(vm_uuid, "", vm_label_green)
  11.106 +if int(res) != 0:
  11.107 +    FAIL("Should be able to unlabel the domain while it's halted.")
  11.108 +
  11.109 +res = session.xenapi.VM.get_security_label(vm_uuid)
  11.110 +if res != "":
  11.111 +    FAIL("Unexpected VM security label after removal: %s" % res)
  11.112 +
  11.113 +res = session.xenapi.VM.set_security_label(vm_uuid, vm_label_red, res)
  11.114 +if int(res) != 0:
  11.115 +    FAIL("Could not label the VM to '%s'" % vm_label_red)
  11.116 +
  11.117 +res = session.xenapi.VM.get_security_label(vm_uuid)
  11.118 +if res != vm_label_red:
  11.119 +    FAIL("VM has wrong label '%s', expected '%s'." % (res, vm_label_red))
  11.120 +
  11.121 +sr_uuid = session.xenapi.SR.get_by_name_label("Local")
  11.122 +if len(sr_uuid) == 0:
  11.123 +    FAIL("Could not get a handle on SR 'Local'")
  11.124 +
  11.125 +
  11.126 +vdi_rec = { 'name_label'  : "My disk",
  11.127 +            'SR'          : sr_uuid[0],
  11.128 +            'virtual_size': 0,
  11.129 +            'sector_size' : 512,
  11.130 +            'parent'      : '',
  11.131 +            'SR_name'     : 'Local',
  11.132 +            'type'        : 'system',
  11.133 +            'shareable'   : False,
  11.134 +            'read-only'   : False,
  11.135 +            'other_config': {'location': vdi_path}
  11.136 +}
  11.137 +
  11.138 +vdi_ref = session.xenapi.VDI.create(vdi_rec)
  11.139 +
  11.140 +res = session.xenapi.VDI.get_name_label(vdi_ref)
  11.141 +if res != vdi_rec['name_label']:
  11.142 +    print "Destroying VDI now"
  11.143 +    session.xenapi.VDI.destroy(vdi_ref)
  11.144 +    FAIL("VDI_get_name_label return wrong information")
  11.145 +
  11.146 +res = session.xenapi.VDI.get_record(vdi_ref)
  11.147 +print "vdi_record : %s" % res
  11.148 +
  11.149 +oldlabel = session.xenapi.XSPolicy.get_resource_label(vdi_path)
  11.150 +
  11.151 +#Remove label from VDI device
  11.152 +rc  = session.xenapi.XSPolicy.set_resource_label(vdi_path,
  11.153 +                                                 "",
  11.154 +                                                 oldlabel)
  11.155 +
  11.156 +
  11.157 +# Attach a VBD to the VM
  11.158 +
  11.159 +vbd_rec = { 'VM'      : vm_uuid,
  11.160 +            'VDI'     : vdi_ref,
  11.161 +            'device'  : "xvda1",
  11.162 +            'mode'    : 1,
  11.163 +            'bootable': 0,
  11.164 +}
  11.165 +
  11.166 +vbd_ref = session.xenapi.VBD.create(vbd_rec)
  11.167 +
  11.168 +res = session.xenapi.VBD.get_record(vbd_ref)
  11.169 +
  11.170 +try:
  11.171 +    domain.start(noConsole=True)
  11.172 +    # Should not get here.
  11.173 +    print "Destroying VDI now"
  11.174 +    session.xenapi.VDI.destroy(vdi_ref)
  11.175 +    FAIL("Could start VM with a VBD that it is not allowed to access.")
  11.176 +except:
  11.177 +    pass
  11.178 +    print "Could not create domain -- that's good"
  11.179 +
  11.180 +
  11.181 +#
  11.182 +# Label the VDI now
  11.183 +#
  11.184 +
  11.185 +rc    = session.xenapi.VDI.set_security_label(vdi_ref, vdi_label_red, "")
  11.186 +if int(rc) != 0:
  11.187 +    FAIL("Could not set the VDI label to '%s'" % vdi_label_red)
  11.188 +
  11.189 +label = session.xenapi.VDI.get_security_label(vdi_ref)
  11.190 +if label != vdi_label_red:
  11.191 +    session.xenapi.VDI.destroy(vdi_ref)
  11.192 +    FAIL("Unexpected label '%s' on VDI, wanted '%s'" %
  11.193 +         (label, vdi_label_red))
  11.194 +
  11.195 +rc    = session.xenapi.VDI.set_security_label(vdi_ref, "", label)
  11.196 +if int(rc) != 0:
  11.197 +    session.xenapi.VDI.destroy(vdi_ref)
  11.198 +    FAIL("Should be able to unlabel VDI.")
  11.199 +
  11.200 +rc    = session.xenapi.VDI.set_security_label(vdi_ref, vdi_label_red, "")
  11.201 +if int(rc) != 0:
  11.202 +    session.xenapi.VDI.destroy(vdi_ref)
  11.203 +    FAIL("Should be able to label VDI with label '%s'" % vid_label_red)
  11.204 +
  11.205 +res   = session.xenapi.XSPolicy.get_resource_label(vdi_path)
  11.206 +if res != vdi_label_red:
  11.207 +    session.xenapi.VDI.destroy(vdi_ref)
  11.208 +    FAIL("(2) get_resource_label on %s returned unexpected result %s, wanted '%s'" %
  11.209 +         (vdi_path, res, vdi_label_red))
  11.210 +
  11.211 +res = session.xenapi.VDI.get_security_label(vdi_ref)
  11.212 +if res != vdi_label_red:
  11.213 +    session.xenapi.VDI.destroy(vdi_ref)
  11.214 +    FAIL("get_security_label returned unexpected result %s, wanted '%s'" %
  11.215 +         (res, vdi_label_red))
  11.216 +
  11.217 +domain.start(noConsole=True)
  11.218 +
  11.219 +console = domain.getConsole()
  11.220 +
  11.221 +domName = domain.getName()
  11.222 +
  11.223 +try:
  11.224 +    run = console.runCmd("cat /proc/interrupts")
  11.225 +except ConsoleError, e:
  11.226 +    saveLog(console.getHistory())
  11.227 +    FAIL("Could not access proc-filesystem")
  11.228 +
  11.229 +# Try to relabel while VM is running
  11.230 +try:
  11.231 +    res = session.xenapi.VM.set_security_label(vm_uuid, vm_label_green,
  11.232 +                                               vm_label_red)
  11.233 +except:
  11.234 +    pass
  11.235 +
  11.236 +lab = session.xenapi.VM.get_security_label(vm_uuid)
  11.237 +if lab == vm_label_green:
  11.238 +    FAIL("Should not be able to reset the security label while running."
  11.239 +         "tried to set to %s, got %s, old: %s" %(vm_label_green, lab,
  11.240 +         vm_label_red))
  11.241 +
  11.242 +
  11.243 +#
  11.244 +# Suspend the domain and relabel it
  11.245 +#
  11.246 +
  11.247 +try:
  11.248 +    status, output = traceCommand("xm suspend %s" % domName,
  11.249 +                                  timeout=30)
  11.250 +except TimeoutError, e:
  11.251 +    session.xenapi.VDI.destroy(vdi_ref)
  11.252 +    FAIL("Failure from suspending VM: %s." % str(e))
  11.253 +
  11.254 +# Try to relabel while VM is suspended -- this should work
  11.255 +
  11.256 +rc  = session.xenapi.VM.set_security_label(vm_uuid, vm_label_green,
  11.257 +                                           vm_label_red)
  11.258 +if int(rc) != 0:
  11.259 +    FAIL("VM security label could not be set to %s" % vm_label_green)
  11.260 +
  11.261 +res = session.xenapi.VM.get_security_label(vm_uuid)
  11.262 +if res != vm_label_green:
  11.263 +    session.xenapi.VDI.destroy(vdi_ref)
  11.264 +    FAIL("VM (suspended) has label '%s', expected '%s'." %
  11.265 +         (res, vm_label_green))
  11.266 +
  11.267 +status, output = traceCommand("xm list")
  11.268 +
  11.269 +#Try to resume now -- should fail due to denied access to block device
  11.270 +try:
  11.271 +    status, output = traceCommand("xm resume %s" % domName,
  11.272 +                                  timeout=30)
  11.273 +    if status == 0:
  11.274 +        session.xenapi.VDI.destroy(vdi_ref)
  11.275 +        FAIL("Could resume re-labeled VM: %s" % output)
  11.276 +except Exception, e:
  11.277 +    session.xenapi.VDI.destroy(vdi_ref)
  11.278 +    FAIL("1. Error resuming the VM: %s." % str(e))
  11.279 +
  11.280 +# Relabel VM so it would resume
  11.281 +res = session.xenapi.VM.set_security_label(vm_uuid, vm_label_red,
  11.282 +                                           vm_label_green)
  11.283 +if int(res) != 0:
  11.284 +    session.xenapi.VDI.destroy(vdi_ref)
  11.285 +    FAIL("Could not relabel VM to have it resume.")
  11.286 +
  11.287 +res = session.xenapi.VM.get_security_label(vm_uuid)
  11.288 +if res != vm_label_red:
  11.289 +    session.xenapi.VDI.destroy(vdi_ref)
  11.290 +    FAIL("VM (suspended) has label '%s', expected '%s'." %
  11.291 +         (res, vm_label_red))
  11.292 +
  11.293 +
  11.294 +# Relabel the resource so VM should not resume
  11.295 +try:
  11.296 +    session.xenapi.XSPolicy.set_resource_label(vdi_path,
  11.297 +                                               vdi_label_green,
  11.298 +                                               "")
  11.299 +except Exception, e:
  11.300 +    session.xenapi.VDI.destroy(vdi_ref)
  11.301 +    FAIL("Could not label the VDI to '%s': %x" %
  11.302 +         (vdi_label_green, int(rc)))
  11.303 +
  11.304 +#Try to resume now -- should fail due to denied access to block device
  11.305 +try:
  11.306 +    status, output = traceCommand("xm resume %s" % domName,
  11.307 +                                  timeout=30)
  11.308 +    if status == 0:
  11.309 +        session.xenapi.VDI.destroy(vdi_ref)
  11.310 +        FAIL("Could resume re-labeled VM: %s" % output)
  11.311 +except Exception, e:
  11.312 +    session.xenapi.VDI.destroy(vdi_ref)
  11.313 +    FAIL("2. Error resuming the VM: %s." % str(e))
  11.314 +
  11.315 +
  11.316 +status, output = traceCommand("xm list")
  11.317 +
  11.318 +# Relabel the resource so VM can resume
  11.319 +try:
  11.320 +    session.xenapi.XSPolicy.set_resource_label(vdi_path,
  11.321 +                                               vdi_label_red,
  11.322 +                                               vdi_label_green)
  11.323 +except Exception, e:
  11.324 +    session.xenapi.VDI.destroy(vdi_ref)
  11.325 +    FAIL("Could not label the resource to '%s'" % vid_label_red)
  11.326 +
  11.327 +res = session.xenapi.XSPolicy.get_resource_label(vdi_path)
  11.328 +if res != vdi_label_red:
  11.329 +    session.xenapi.VDI.destroy(vdi_ref)
  11.330 +    FAIL("'%s' has label '%s', expected '%s'." %
  11.331 +         (vdi_path, res, vdi_label_red))
  11.332 +
  11.333 +#Try to resume now -- should work
  11.334 +try:
  11.335 +    status, output = traceCommand("xm resume %s" % domName,
  11.336 +                                  timeout=30)
  11.337 +    if status != 0:
  11.338 +        session.xenapi.VDI.destroy(vdi_ref)
  11.339 +        FAIL("Could not resume re-labeled VM: %s" % output)
  11.340 +except Exception, e:
  11.341 +    session.xenapi.VDI.destroy(vdi_ref)
  11.342 +    FAIL("3. Error resuming the VM: %s." % str(e))
  11.343 +
  11.344 +
  11.345 +status, output = traceCommand("xm list")
  11.346 +
  11.347 +console = domain.getConsole()
  11.348 +
  11.349 +try:
  11.350 +    run = console.runCmd("cat /proc/interrupts")
  11.351 +except ConsoleError, e:
  11.352 +    saveLog(console.getHistory())
  11.353 +    session.xenapi.VDI.destroy(vdi_ref)
  11.354 +    FAIL("Could not access proc-filesystem")
  11.355 +
  11.356 +domain.stop()
  11.357 +domain.destroy()
    12.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
    12.2 +++ b/tools/xm-test/tests/security-acm/09_security-acm_pol_update.py	Wed Jul 18 13:56:21 2007 +0100
    12.3 @@ -0,0 +1,427 @@
    12.4 +#!/usr/bin/python
    12.5 +
    12.6 +# Copyright (C) International Business Machines Corp., 2007
    12.7 +# Author: Stefan Berger <stefanb@us.ibm.com>
    12.8 +
    12.9 +# Test to exercise the xspolicy and acmpolicy classes
   12.10 +
   12.11 +from XmTestLib import xapi
   12.12 +from XmTestLib.XenAPIDomain import XmTestAPIDomain
   12.13 +from XmTestLib import *
   12.14 +from xen.xend import XendAPIConstants
   12.15 +from xen.util import security, xsconstants
   12.16 +from xen.util.acmpolicy import ACMPolicy
   12.17 +from xen.xend.XendDomain import DOM0_UUID
   12.18 +import base64
   12.19 +import struct
   12.20 +import time
   12.21 +
   12.22 +def typestoxml(types):
   12.23 +    res = ""
   12.24 +    for t in types:
   12.25 +        res += "<Type>" + t + "</Type>\n"
   12.26 +    return res
   12.27 +
   12.28 +def cfstoxml(cfss):
   12.29 +    res = ""
   12.30 +    for cfs in cfss:
   12.31 +        res += "<Conflict name=\"" + cfs['name'] + "\">\n" + \
   12.32 +               typestoxml(cfs['chws']) + \
   12.33 +               "</Conflict>\n"
   12.34 +    return res
   12.35 +
   12.36 +def vmlabelstoxml(vmlabels, vmfrommap):
   12.37 +    res = ""
   12.38 +    for vmlabel in vmlabels:
   12.39 +        res += "<VirtualMachineLabel>\n"
   12.40 +        if vmlabel['name'] in vmfrommap:
   12.41 +            res += "<Name from=\""+ vmfrommap[vmlabel['name']] +"\">"
   12.42 +        else:
   12.43 +            res += "<Name>"
   12.44 +        res += vmlabel['name'] + "</Name>\n"
   12.45 +        res += "<SimpleTypeEnforcementTypes>\n" + \
   12.46 +                  typestoxml(vmlabel['stes']) + \
   12.47 +               "</SimpleTypeEnforcementTypes>\n"
   12.48 +        if vmlabel.has_key('chws'):
   12.49 +            res += "<ChineseWallTypes>\n" + \
   12.50 +                     typestoxml(vmlabel['chws']) + \
   12.51 +                   "</ChineseWallTypes>\n"
   12.52 +        res += "</VirtualMachineLabel>\n"
   12.53 +    return res
   12.54 +
   12.55 +
   12.56 +def reslabelstoxml(reslabels, resfrommap):
   12.57 +    res = ""
   12.58 +    for reslabel in reslabels:
   12.59 +        res += "<ResourceLabel>\n"
   12.60 +        if resfrommap.has_key(reslabel['name']):
   12.61 +            res += "<Name from=\""+ resfrommap[reslabel['name']] +"\">"
   12.62 +        else:
   12.63 +            res += "<Name>"
   12.64 +        res += reslabel['name'] + "</Name>\n"
   12.65 +        res += "<SimpleTypeEnforcementTypes>\n" + \
   12.66 +                  typestoxml(reslabel['stes']) + \
   12.67 +               "</SimpleTypeEnforcementTypes>\n"
   12.68 +        res += "</ResourceLabel>\n"
   12.69 +    return res
   12.70 +
   12.71 +def create_xml_policy(hdr, stes, chws,
   12.72 +                      vmlabels, vmfrommap, bootstrap,
   12.73 +                      reslabels, resfrommap,
   12.74 +                      cfss):
   12.75 +    hdr_xml ="<PolicyHeader>\n" + \
   12.76 +             "  <PolicyName>" + hdr['name'] + "</PolicyName>\n" + \
   12.77 +             "  <Version>"    + hdr['version'] + "</Version>\n" + \
   12.78 +             "  <FromPolicy>\n" + \
   12.79 +             "    <PolicyName>" + hdr['oldname'] + "</PolicyName>\n" + \
   12.80 +             "    <Version>"    + hdr['oldversion'] + "</Version>\n" + \
   12.81 +             "  </FromPolicy>\n" + \
   12.82 +               "</PolicyHeader>\n"
   12.83 +
   12.84 +    stes_xml = "<SimpleTypeEnforcement>\n" + \
   12.85 +               "  <SimpleTypeEnforcementTypes>\n" + \
   12.86 +                typestoxml(stes) + \
   12.87 +               "  </SimpleTypeEnforcementTypes>\n" + \
   12.88 +               "</SimpleTypeEnforcement>\n"
   12.89 +
   12.90 +    chws_xml = "<ChineseWall>\n" + \
   12.91 +               "  <ChineseWallTypes>\n" + \
   12.92 +               typestoxml(chws) + \
   12.93 +               "  </ChineseWallTypes>\n" + \
   12.94 +               "  <ConflictSets>\n" + \
   12.95 +               cfstoxml(cfss) + \
   12.96 +               "  </ConflictSets>\n" + \
   12.97 +               "</ChineseWall>\n"
   12.98 +
   12.99 +    subjlabel_xml = "<SubjectLabels bootstrap=\""+ bootstrap +"\">\n" + \
  12.100 +                     vmlabelstoxml(vmlabels, vmfrommap) + \
  12.101 +                    "</SubjectLabels>\n"
  12.102 +    objlabel_xml  = "<ObjectLabels>\n" + \
  12.103 +                      reslabelstoxml(reslabels, resfrommap) + \
  12.104 +                    "</ObjectLabels>\n"
  12.105 +
  12.106 +    policyxml = "<?xml version=\"1.0\" ?>\n" + \
  12.107 +                "<SecurityPolicyDefinition xmlns=\"http://www.ibm.com\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:schemaLocation=\"http://www.ibm.com ../../security_policy.xsd \">\n" + \
  12.108 +                hdr_xml + \
  12.109 +                stes_xml + \
  12.110 +                chws_xml + \
  12.111 +                "<SecurityLabelTemplate>\n" + \
  12.112 +                  subjlabel_xml + \
  12.113 +                  objlabel_xml + \
  12.114 +                "</SecurityLabelTemplate>\n" + \
  12.115 +                "</SecurityPolicyDefinition>\n"
  12.116 +    return policyxml
  12.117 +
  12.118 +
  12.119 +def update_hdr(hdr):
  12.120 +    """ Update the version information in the header """
  12.121 +    hdr['oldversion'] = hdr['version']
  12.122 +    hdr['oldname']    = hdr['name']
  12.123 +    vers = hdr['version']
  12.124 +    tmp = vers.split('.')
  12.125 +    if len(tmp) == 1:
  12.126 +        rev = 1
  12.127 +    else:
  12.128 +        rev = int(tmp[1]) + 1
  12.129 +    hdr['version'] = "%s.%s" % (tmp[0],rev)
  12.130 +    return hdr
  12.131 +
  12.132 +session = xapi.connect()
  12.133 +
  12.134 +policystate = session.xenapi.XSPolicy.get_xspolicy()
  12.135 +
  12.136 +if policystate['repr'] != "":
  12.137 +    print "%s" % policystate['repr']
  12.138 +    try:
  12.139 +        acmpol = ACMPolicy(xml=policystate['repr'])
  12.140 +    except Exception, e:
  12.141 +        FAIL("Failure from creating ACMPolicy object: %s" % str(e))
  12.142 +    oldname = acmpol.policy_dom_get_hdr_item("PolicyName")
  12.143 +    oldvers = acmpol.policy_dom_get_hdr_item("Version")
  12.144 +    tmp = oldvers.split(".")
  12.145 +    if len(tmp) == 1:
  12.146 +        rev = 1
  12.147 +    else:
  12.148 +        rev = int(tmp[1]) + 1
  12.149 +    newvers = "%s.%s" % (tmp[0], str(rev))
  12.150 +    print "old name/version = %s/%s" % (oldname, oldvers)
  12.151 +else:
  12.152 +    oldname = None
  12.153 +    oldvers = None
  12.154 +    newvers = "1.0"
  12.155 +
  12.156 +# Initialize the header of the policy
  12.157 +hdr = {}
  12.158 +hdr['name'] = "xm-test"
  12.159 +hdr['version'] = newvers
  12.160 +
  12.161 +if oldname:
  12.162 +    hdr['oldname']    = oldname
  12.163 +    if oldvers and oldvers != "":
  12.164 +        hdr['oldversion'] = oldvers
  12.165 +
  12.166 +stes = [ "SystemManagement", "red", "green", "blue" ]
  12.167 +
  12.168 +chws = [ "SystemManagement", "red", "green", "blue" ]
  12.169 +
  12.170 +bootstrap = "SystemManagement"
  12.171 +
  12.172 +vm_sysmgt = { 'name' : bootstrap,
  12.173 +              'stes' : stes,
  12.174 +              'chws' : [ "SystemManagement" ] }
  12.175 +
  12.176 +vm_red   = { 'name' : "red" ,
  12.177 +             'stes' : ["red"] ,
  12.178 +             'chws' : ["red"] }
  12.179 +
  12.180 +vm_green = { 'name' : "green" ,
  12.181 +             'stes' : ["green"] ,
  12.182 +             'chws' : ["green"] }
  12.183 +
  12.184 +vm_blue  = { 'name' : "blue" ,
  12.185 +             'stes' : ["blue"] ,
  12.186 +             'chws' : ["blue"] }
  12.187 +
  12.188 +res_red   = { 'name' : "red" ,
  12.189 +              'stes' : ["red"] }
  12.190 +
  12.191 +res_green = { 'name' : "green" ,
  12.192 +              'stes' : ["green"] }
  12.193 +
  12.194 +res_blue  = { 'name' : "blue" ,
  12.195 +              'stes' : ["blue"] }
  12.196 +
  12.197 +cfs_1 = { 'name' : "CFS1",
  12.198 +          'chws' : [ "red" , "blue" ] }
  12.199 +
  12.200 +vmlabels = [ vm_sysmgt, vm_red, vm_green, vm_blue ]
  12.201 +vmfrommap = {}
  12.202 +reslabels = [ res_red, res_green, res_blue ]
  12.203 +resfrommap = {}
  12.204 +cfss = [ cfs_1 ]
  12.205 +
  12.206 +vm_label_red    = xsconstants.ACM_POLICY_ID + ":xm-test:red"
  12.207 +vm_label_green  = xsconstants.ACM_POLICY_ID + ":xm-test:green"
  12.208 +vm_label_blue   = xsconstants.ACM_POLICY_ID + ":xm-test:blue"
  12.209 +
  12.210 +xml = create_xml_policy(hdr, stes, chws,
  12.211 +                        vmlabels, vmfrommap, bootstrap,
  12.212 +                        reslabels, resfrommap,
  12.213 +                        cfss)
  12.214 +
  12.215 +xml_good = xml
  12.216 +
  12.217 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.218 +                                                   xml,
  12.219 +                                                   xsconstants.XS_INST_LOAD,
  12.220 +                                                   True)
  12.221 +
  12.222 +print "\n\npolicystate = %s" % policystate
  12.223 +
  12.224 +policystate = session.xenapi.XSPolicy.get_xspolicy()
  12.225 +
  12.226 +#
  12.227 +# Create two non-conflicting domains and start them
  12.228 +#
  12.229 +try:
  12.230 +    # XmTestAPIDomain tries to establish a connection to XenD
  12.231 +    domain1 = XmTestAPIDomain(extraConfig={ 'security_label' : vm_label_red })
  12.232 +except Exception, e:
  12.233 +    SKIP("Skipping test. Error: %s" % str(e))
  12.234 +
  12.235 +
  12.236 +vm1_uuid = domain1.get_uuid()
  12.237 +
  12.238 +try:
  12.239 +    domain1.start(noConsole=True)
  12.240 +except:
  12.241 +    FAIL("Could not start domain1")
  12.242 +
  12.243 +print "Domain 1 started"
  12.244 +
  12.245 +try:
  12.246 +    # XmTestAPIDomain tries to establish a connection to XenD
  12.247 +    domain2 = XmTestAPIDomain(extraConfig={'security_label': vm_label_green })
  12.248 +except Exception, e:
  12.249 +    SKIP("Skipping test. Error: %s" % str(e))
  12.250 +
  12.251 +vm2_uuid = domain2.get_uuid()
  12.252 +
  12.253 +try:
  12.254 +    domain2.start(noConsole=True)
  12.255 +except:
  12.256 +    FAIL("Could not start domain1")
  12.257 +
  12.258 +
  12.259 +print "Domain 2 started"
  12.260 +
  12.261 +# Try a policy that would put the two domains into conflict
  12.262 +cfs_2 = { 'name' : "CFS1",
  12.263 +          'chws' : [ "red" , "green" ] }
  12.264 +cfss = [ cfs_2 ]
  12.265 +
  12.266 +hdr = update_hdr(hdr)
  12.267 +xml = create_xml_policy(hdr, stes, chws,
  12.268 +                        vmlabels, vmfrommap, bootstrap,
  12.269 +                        reslabels, resfrommap,
  12.270 +                        cfss)
  12.271 +
  12.272 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.273 +                                                   xml,
  12.274 +                                                   xsconstants.XS_INST_LOAD,
  12.275 +                                                   True)
  12.276 +
  12.277 +print "policystate %s" % policystate
  12.278 +
  12.279 +if int(policystate['xserr']) == 0:
  12.280 +    FAIL("(1) Should not have been able to set this policy.")
  12.281 +
  12.282 +if len(policystate['errors']) == 0:
  12.283 +    FAIL("Hypervisor should have reported errros.")
  12.284 +
  12.285 +errors = base64.b64decode(policystate['errors'])
  12.286 +
  12.287 +print "Length of errors: %d" % len(errors)
  12.288 +a,b = struct.unpack("!ii",errors)
  12.289 +
  12.290 +print "%08x , %08x" % (a,b)
  12.291 +
  12.292 +#
  12.293 +# Create a faulty policy with 'red' STE missing
  12.294 +#
  12.295 +
  12.296 +cfss = [ cfs_1 ]
  12.297 +stes = [ "SystemManagement", "green", "blue" ]
  12.298 +
  12.299 +xml = create_xml_policy(hdr, stes, chws,
  12.300 +                        vmlabels, vmfrommap, bootstrap,
  12.301 +                        reslabels, resfrommap,
  12.302 +                        cfss)
  12.303 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.304 +                                                   xml,
  12.305 +                                                   xsconstants.XS_INST_LOAD,
  12.306 +                                                   True)
  12.307 +
  12.308 +print "Result from setting faulty(!) policy with STE 'red' missing:"
  12.309 +print "policystate %s" % policystate
  12.310 +
  12.311 +if int(policystate['xserr']) == 0:
  12.312 +    FAIL("(2) Should not have been able to set this policy.")
  12.313 +
  12.314 +#
  12.315 +# Create a policy with 'red' VMLabel missing -- should not work since it is
  12.316 +# in use.
  12.317 +#
  12.318 +stes = [ "SystemManagement", "red", "green", "blue" ]
  12.319 +
  12.320 +vmlabels = [ vm_sysmgt, vm_green, vm_blue ]
  12.321 +
  12.322 +xml = create_xml_policy(hdr, stes, chws,
  12.323 +                        vmlabels, vmfrommap, bootstrap,
  12.324 +                        reslabels, resfrommap,
  12.325 +                        cfss)
  12.326 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.327 +                                                   xml,
  12.328 +                                                   xsconstants.XS_INST_LOAD,
  12.329 +                                                   True)
  12.330 +print "Result from setting faulty(!) policy with VMlabel 'red' missing:"
  12.331 +print "policystate %s" % policystate
  12.332 +
  12.333 +if int(policystate['xserr']) == 0:
  12.334 +    FAIL("(3) Should not have been able to set this policy.")
  12.335 +
  12.336 +#
  12.337 +# Create a policy with 'blue' VMLabel missing -- should work since it is NOT
  12.338 +# in use.
  12.339 +#
  12.340 +vmlabels = [ vm_sysmgt, vm_red, vm_green ]
  12.341 +
  12.342 +xml = create_xml_policy(hdr, stes, chws,
  12.343 +                        vmlabels, vmfrommap, bootstrap,
  12.344 +                        reslabels, resfrommap,
  12.345 +                        cfss)
  12.346 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.347 +                                                   xml,
  12.348 +                                                   xsconstants.XS_INST_LOAD,
  12.349 +                                                   True)
  12.350 +
  12.351 +print "Result from setting (good) policy with VMlabel 'blue' missing:"
  12.352 +print "policystate %s" % policystate
  12.353 +
  12.354 +if int(policystate['xserr']) != 0:
  12.355 +    FAIL("(4) Should have been able to set this policy: %s" % xml)
  12.356 +
  12.357 +#
  12.358 +# Move the green VMLabel towards blue which should put the running
  12.359 +# domain with label blue into a conflict set
  12.360 +#
  12.361 +vmlabels = [ vm_sysmgt, vm_red, vm_blue ]
  12.362 +
  12.363 +vmfrommap = { "blue" : "green" }  #  new : old
  12.364 +
  12.365 +hdr = update_hdr(hdr)  #Needed, since last update was successful
  12.366 +xml = create_xml_policy(hdr, stes, chws,
  12.367 +                        vmlabels, vmfrommap, bootstrap,
  12.368 +                        reslabels, resfrommap,
  12.369 +                        cfss)
  12.370 +
  12.371 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.372 +                                                   xml,
  12.373 +                                                   xsconstants.XS_INST_LOAD,
  12.374 +                                                   True)
  12.375 +
  12.376 +print "policystate %s" % policystate
  12.377 +
  12.378 +if int(policystate['xserr']) == 0:
  12.379 +    FAIL("(5) Should not have been able to set this policy.")
  12.380 +
  12.381 +#
  12.382 +# Try to install a policy where a VM label has a faulty VM label name
  12.383 +#
  12.384 +vmfrommap = {}
  12.385 +
  12.386 +vm_blue_bad = { 'name' : "blue:x" ,   # ':' no allowed
  12.387 +                'stes' : ["blue"],
  12.388 +                'chws' : ["blue"] }
  12.389 +
  12.390 +vmlabels = [ vm_sysmgt, vm_red, vm_green, vm_blue_bad ]
  12.391 +
  12.392 +xml = create_xml_policy(hdr, stes, chws,
  12.393 +                        vmlabels, vmfrommap, bootstrap,
  12.394 +                        reslabels, resfrommap,
  12.395 +                        cfss)
  12.396 +
  12.397 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.398 +                                                   xml,
  12.399 +                                                   xsconstants.XS_INST_LOAD,
  12.400 +                                                   True)
  12.401 +
  12.402 +print "policystate %s" % policystate
  12.403 +
  12.404 +if int(policystate['xserr']) == 0:
  12.405 +    FAIL("(6) Should not have been able to set this policy.")
  12.406 +
  12.407 +#
  12.408 +# End the test by installing the initial policy again
  12.409 +#
  12.410 +
  12.411 +cur_version = hdr['version']
  12.412 +(maj, min) = cur_version.split(".")
  12.413 +cur_version = "%s.%s" % (maj, str(int(min)-1) )
  12.414 +
  12.415 +orig_acmpol = ACMPolicy(xml=xml_good)
  12.416 +orig_acmpol.set_frompolicy_version(cur_version)
  12.417 +orig_acmpol.set_policy_version(hdr['version'])
  12.418 +
  12.419 +policystate = session.xenapi.XSPolicy.set_xspolicy(xsconstants.XS_POLICY_ACM,
  12.420 +                                                   orig_acmpol.toxml(),
  12.421 +                                                   xsconstants.XS_INST_LOAD,
  12.422 +                                                   True)
  12.423 +
  12.424 +if int(policystate['xserr']) != 0:
  12.425 +    FAIL("(END) Should have been able to set this policy.")
  12.426 +
  12.427 +domain1.stop()
  12.428 +domain2.stop()
  12.429 +domain1.destroy()
  12.430 +domain2.destroy()
    13.1 --- a/tools/xm-test/tests/security-acm/Makefile.am	Wed Jul 18 13:56:00 2007 +0100
    13.2 +++ b/tools/xm-test/tests/security-acm/Makefile.am	Wed Jul 18 13:56:21 2007 +0100
    13.3 @@ -5,7 +5,10 @@ TESTS = 01_security-acm_basic.test \
    13.4          03_security-acm_dom_conflict.test \
    13.5          04_security-acm_dom_res.test \
    13.6          05_security-acm_dom_res_conf.test \
    13.7 -        06_security-acm_dom_block_attach.test
    13.8 +        06_security-acm_dom_block_attach.test \
    13.9 +        07_security-acm_pol_update.test \
   13.10 +        08_security-acm_xapi.test \
   13.11 +        09_security-acm_pol_update.test
   13.12  
   13.13  XFAIL_TESTS =
   13.14  
    14.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
    14.2 +++ b/tools/xm-test/tests/security-acm/xm-test-new-security_policy.xml	Wed Jul 18 13:56:21 2007 +0100
    14.3 @@ -0,0 +1,97 @@
    14.4 +<?xml version="1.0" encoding="UTF-8"?>
    14.5 +<!-- Auto-generated by ezPolicy        -->
    14.6 +<SecurityPolicyDefinition xmlns="http://www.ibm.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.ibm.com ../../security_policy.xsd ">
    14.7 +    <PolicyHeader>
    14.8 +        <PolicyName>xm-test</PolicyName>
    14.9 +        <Date>Fri Sep 29 14:44:38 2006</Date>
   14.10 +        <Version>1.1</Version>
   14.11 +        <FromPolicy>
   14.12 +            <PolicyName>xm-test</PolicyName>
   14.13 +            <Version>1.0</Version>
   14.14 +        </FromPolicy>
   14.15 +    </PolicyHeader>
   14.16 +
   14.17 +    <SimpleTypeEnforcement>
   14.18 +        <SimpleTypeEnforcementTypes>
   14.19 +            <Type>SystemManagement</Type>
   14.20 +            <Type>green</Type>
   14.21 +            <Type>red</Type>
   14.22 +        </SimpleTypeEnforcementTypes>
   14.23 +    </SimpleTypeEnforcement>
   14.24 +
   14.25 +    <ChineseWall priority="PrimaryPolicyComponent">
   14.26 +        <ChineseWallTypes>
   14.27 +            <Type>SystemManagement</Type>
   14.28 +            <Type>green</Type>
   14.29 +            <Type>red</Type>
   14.30 +        </ChineseWallTypes>
   14.31 +
   14.32 +        <ConflictSets>
   14.33 +            <Conflict name="RER">
   14.34 +                <Type>green</Type>
   14.35 +                <Type>red</Type>
   14.36 +            </Conflict>
   14.37 +       </ConflictSets>
   14.38 +    </ChineseWall>
   14.39 +
   14.40 +    <SecurityLabelTemplate>
   14.41 +        <SubjectLabels bootstrap="SystemManagement">
   14.42 +            <VirtualMachineLabel>
   14.43 +                <Name>SystemManagement</Name>
   14.44 +                <SimpleTypeEnforcementTypes>
   14.45 +                    <Type>SystemManagement</Type>
   14.46 +                    <Type>green</Type>
   14.47 +                    <Type>red</Type>
   14.48 +                </SimpleTypeEnforcementTypes>
   14.49 +                <ChineseWallTypes>
   14.50 +                    <Type>SystemManagement</Type>
   14.51 +                </ChineseWallTypes>
   14.52 +            </VirtualMachineLabel>
   14.53 +
   14.54 +            <VirtualMachineLabel>
   14.55 +                <Name>green</Name>
   14.56 +                <SimpleTypeEnforcementTypes>
   14.57 +                    <Type>green</Type>
   14.58 +                </SimpleTypeEnforcementTypes>
   14.59 +                <ChineseWallTypes>
   14.60 +                    <Type>green</Type>
   14.61 +                </ChineseWallTypes>
   14.62 +            </VirtualMachineLabel>
   14.63 +
   14.64 +            <VirtualMachineLabel>
   14.65 +                <Name>red</Name>
   14.66 +                <SimpleTypeEnforcementTypes>
   14.67 +                    <Type>red</Type>
   14.68 +                </SimpleTypeEnforcementTypes>
   14.69 +                <ChineseWallTypes>
   14.70 +                    <Type>red</Type>
   14.71 +                </ChineseWallTypes>
   14.72 +            </VirtualMachineLabel>
   14.73 +
   14.74 +        </SubjectLabels>
   14.75 +
   14.76 +        <ObjectLabels>
   14.77 +            <ResourceLabel>
   14.78 +                <Name>SystemManagement</Name>
   14.79 +                <SimpleTypeEnforcementTypes>
   14.80 +                    <Type>SystemManagement</Type>
   14.81 +                </SimpleTypeEnforcementTypes>
   14.82 +            </ResourceLabel>
   14.83 +
   14.84 +            <ResourceLabel>
   14.85 +                <Name>green</Name>
   14.86 +                <SimpleTypeEnforcementTypes>
   14.87 +                    <Type>green</Type>
   14.88 +                </SimpleTypeEnforcementTypes>
   14.89 +            </ResourceLabel>
   14.90 +
   14.91 +            <ResourceLabel>
   14.92 +                <Name>red</Name>
   14.93 +                <SimpleTypeEnforcementTypes>
   14.94 +                    <Type>red</Type>
   14.95 +                </SimpleTypeEnforcementTypes>
   14.96 +            </ResourceLabel>
   14.97 +
   14.98 +        </ObjectLabels>
   14.99 +    </SecurityLabelTemplate>
  14.100 +</SecurityPolicyDefinition>
    15.1 --- a/xen/arch/x86/hvm/vpt.c	Wed Jul 18 13:56:00 2007 +0100
    15.2 +++ b/xen/arch/x86/hvm/vpt.c	Wed Jul 18 13:56:21 2007 +0100
    15.3 @@ -261,13 +261,15 @@ void create_periodic_time(
    15.4      pt->enabled = 1;
    15.5      pt->pending_intr_nr = 0;
    15.6  
    15.7 -    if ( period < 900000 ) /* < 0.9 ms */
    15.8 +    /* Periodic timer must be at least 0.9ms. */
    15.9 +    if ( (period < 900000) && !one_shot )
   15.10      {
   15.11          gdprintk(XENLOG_WARNING,
   15.12                   "HVM_PlatformTime: program too small period %"PRIu64"\n",
   15.13                   period);
   15.14 -        period = 900000; /* force to 0.9ms */
   15.15 +        period = 900000;
   15.16      }
   15.17 +
   15.18      pt->period = period;
   15.19      pt->vcpu = v;
   15.20      pt->last_plt_gtime = hvm_get_guest_time(pt->vcpu);