This patch adds new python access control management scripts, which

integrate into Xen Management and which support the new access control 
labels (labels replace the ssidref numbers at the management user 
interface).

Signed-off by: Reiner Sailer <sailer@us.ibm.com>

tools/security/python/xensec_tools/acm_getdecision

@@ -0,0 +1,55 @@
+#!/usr/bin/env python
+#  -*- mode: python; -*-
+import sys
+import traceback
+import getopt
+
+# add fallback path for non-native python path installs if needed
+sys.path.insert(-1, '/usr/lib/python')
+sys.path.insert(-1, '/usr/lib64/python')
+
+from xen.util.security import ACMError, err, get_decision, active_policy
+
+def usage():
+    print "Usage: acm_getdecision -i domainid --label labelname"
+    print "  Test program illustrating the retrieval of"
+    print "  access control decisions from Xen. At this time,"
+    print "  only sharing (STE) policy decisions are supported."
+    print "  Arguments are two paramters in any combination:"
+    print "\t -i domain_id or --domid domain_id"
+    print "\t -l labelname or --label labelname"
+    print "  Return value:"
+    print "\t PERMITTED if access is permitted"
+    print "\t DENIED if access is denied"
+    print "\t ACMError -- e.g., unknown label or domain id"
+    err("Usage")
+
+try:
+
+    if len(sys.argv) != 5:
+        usage()
+
+    decision_args = []
+
+    for idx in range(1, len(sys.argv), 2):
+        if sys.argv[idx] in ['-i', '--domid']:
+            decision_args.append(['domid', sys.argv[idx+1]])
+        elif sys.argv[idx] in ['-l', '--label']:
+            decision_args.append(['access_control',
+                                  ['policy', active_policy],
+                                  ['label', sys.argv[idx+1]]
+                                  ])
+        else:
+            print "unknown argument %s" % sys.argv[idx]
+            usage()
+
+    if len(decision_args) != 2:
+        print "too many arguments"
+        usage()
+
+    print get_decision(decision_args[0], decision_args[1])
+
+except ACMError:
+	pass
+except:
+    traceback.print_exc(limit=1)

tools/security/python/xensec_tools/acm_getlabel

@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+#  -*- mode: python; -*-
+import sys
+import traceback
+import getopt
+
+# add fallback path for non-native python path installs if needed
+sys.path.insert(-1, '/usr/lib/python')
+sys.path.insert(-1, '/usr/lib64/python')
+
+from xen.util.security import ACMError, err, get_ssid
+
+# getopt.gnu_getopt is better, but only exists in Python 2.3+.  Use
+# getopt.getopt if gnu_getopt is not available.  This will mean that options
+# may only be specified before positional arguments.
+if not hasattr(getopt, 'gnu_getopt'):
+    getopt.gnu_getopt = getopt.getopt
+
+def usage():
+    print "Usage: acm_getlabel -i domainid"
+    print "  Test program illustrating the retrieval of"
+    print "  label information (for domains) from Xen."
+    print "  Argument is one paramter describing the domain"
+    print "  for which the label is retrieved."
+    print "\t -i domain_id or --domid=domain_id"
+    print "  Return value:"
+    print "\t none -- Error (e.g., unknown ssidref, label, or domain id)"
+    print "\t (labelname, policyname, ssidref)"
+    err("Usage")
+
+try:
+    domid = None
+    (options, params) = getopt.gnu_getopt(sys.argv[1:], ':i:', ['domid='])
+    for (k, v) in options:
+        if k in ['-i', '--domid']:
+            if not domid:
+                domid = v
+            else:
+                usage()
+    if not domid:
+        usage()
+
+    print get_ssid(domid)
+
+except ACMError:
+    pass
+except:
+    traceback.print_exc(limit=1)