mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 02:30:03 +01:00
A new ACM security tool providing support to aid in the
creation/generation of the XML security policy files for the Xen ACM security architecture. It is a python- based, web-based tool named xensec_gen that allows users to create or modify XML policy files through a browser. The resulting XML policy files can then be copied or moved to the appropriate location in the /etc/xen/acm-security directory structure in order to be translated into binary and used within the Xen system. Signed-off-by: Tom Lendacky <toml@us.ibm.com>
This commit is contained in:
kaf24@firebug.cl.cam.ac.uk committed
1 parent
bb79a7bc45
commit
f0756c96a0
8 files changed
+3221
-4
No files matched your search
@@ -0,0 +1,30 @@
|
||||
#!/usr/bin/python
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License,
|
||||
# or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
#
|
||||
|
||||
from distutils.core import setup
|
||||
import os
|
||||
|
||||
# This setup script is invoked from the parent directory, so base
|
||||
# everything as if executing from there.
|
||||
XEN_ROOT = "../.."
|
||||
|
||||
setup(name = 'xensec_gen',
|
||||
version = '3.0',
|
||||
description = 'Xen XML Security Policy Generator',
|
||||
package_dir = { 'xen' : 'python' },
|
||||
packages = ['xen.xensec_gen'],
|
||||
)
|
||||
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,126 @@
|
||||
<!--
|
||||
The Initial Developer of the Original Code is International
|
||||
Business Machines Corporation. Portions created by IBM
|
||||
Corporation are Copyright (C) 2005 International Business
|
||||
Machines Corporation. All Rights Reserved.
|
||||
-->
|
||||
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
|
||||
"http://www.w3.org/TR/html4/loose.dtd">
|
||||
<HTML>
|
||||
<HEAD>
|
||||
<META name="author" content="Tom Lendacky">
|
||||
<META name="copyright" content="Copyright (C) 2005 International Business Machines Corporation. All rights reserved">
|
||||
|
||||
<STYLE type="text/css">
|
||||
<!--
|
||||
BODY {background-color: #EEEEFF;}
|
||||
TABLE.xen {width: 100%; border: 0px solid black;}
|
||||
TD {border: 0px solid black;}
|
||||
TD.heading {border: 0px solid black; font-weight: bold; font-size: larger;}
|
||||
-->
|
||||
</STYLE>
|
||||
<TITLE>Xen Security Policy Tool</TITLE>
|
||||
</HEAD>
|
||||
|
||||
<BODY>
|
||||
<H1>Xen Security Policy Generation Tool</H1>
|
||||
|
||||
<CENTER>
|
||||
<FORM action="/cgi-bin/policy.cgi" method="post" enctype="multipart/form-data">
|
||||
<TABLE class="xen">
|
||||
<COLGROUP>
|
||||
<COL width="25%">
|
||||
<COL width="20%">
|
||||
<COL width="55%">
|
||||
</COLGROUP>
|
||||
|
||||
<TR>
|
||||
<TD valign="top" class="heading">
|
||||
Security Policy
|
||||
</TD>
|
||||
<TD valign="top" colspan="2">
|
||||
To generate a new Xen Security Policy leave the
|
||||
<B>"Policy File"</B> entry field
|
||||
empty and click the "Create" button.<BR>
|
||||
To modify an existing Xen Security Policy enter the
|
||||
file name containing the policy in the
|
||||
<B>"Policy File"</B> entry field
|
||||
and click the "Create" button.<HR>
|
||||
</TD>
|
||||
</TR>
|
||||
<TR>
|
||||
<TD></TD>
|
||||
<TD>
|
||||
Policy File:
|
||||
</TD>
|
||||
<TD>
|
||||
<INPUT type="file" size="50" name="i_policy">
|
||||
</TD>
|
||||
</TR>
|
||||
<TR>
|
||||
<TD></TD>
|
||||
<TD valign="top">
|
||||
<INPUT type="submit" name="i_policyCreate" value="Create">
|
||||
</TD>
|
||||
<TD></TD>
|
||||
</TR>
|
||||
</TABLE>
|
||||
</FORM>
|
||||
|
||||
<FORM action="/cgi-bin/policylabel.cgi" method="post" enctype="multipart/form-data">
|
||||
<TABLE class="xen">
|
||||
<COLGROUP>
|
||||
<COL width="25%">
|
||||
<COL width="20%">
|
||||
<COL width="55%">
|
||||
</COLGROUP>
|
||||
|
||||
<TR>
|
||||
<TD valign="top" class="heading">
|
||||
Security Policy Labeling
|
||||
</TD>
|
||||
<TD valign="top" colspan="2">
|
||||
To generate or edit the Xen Security Policy Labeling you <B>must</B>
|
||||
specify the name of
|
||||
an existing Xen Security Policy file in the
|
||||
<B>"Policy File"</B> entry field.<BR>
|
||||
To generate new Xen Security Policy Labeling leave the
|
||||
<B>"Policy Labeling File"</B> entry field
|
||||
empty and click the "Create" button.<BR>
|
||||
To modify existing Xen Security Policy Labeling enter the
|
||||
file name containing the labeling in the
|
||||
<B>"Policy Labeling File"</B> entry field
|
||||
and click the "Create" button.<HR>
|
||||
</TD>
|
||||
</TR>
|
||||
<TR>
|
||||
<TD></TD>
|
||||
<TD>
|
||||
Policy File:
|
||||
</TD>
|
||||
<TD>
|
||||
<INPUT type="file" size="50" name="i_policy">
|
||||
</TD>
|
||||
</TR>
|
||||
<TR>
|
||||
<TD></TD>
|
||||
<TD>
|
||||
Policy Labeling File:
|
||||
</TD>
|
||||
<TD>
|
||||
<INPUT type="file" size="50" name="i_policyLabel">
|
||||
</TD>
|
||||
</TR>
|
||||
<TR>
|
||||
<TD></TD>
|
||||
<TD valign="top">
|
||||
<INPUT type="submit" name="i_policyLabelCreate" value="Create">
|
||||
</TD>
|
||||
<TD></TD>
|
||||
</TR>
|
||||
</TABLE>
|
||||
</FORM>
|
||||
</CENTER>
|
||||
</BODY>
|
||||
</HTML>
|
||||
@@ -0,0 +1,185 @@
|
||||
#!/usr/bin/python
|
||||
#
|
||||
# The Initial Developer of the Original Code is International
|
||||
# Business Machines Corporation. Portions created by IBM
|
||||
# Corporation are Copyright (C) 2005 International Business
|
||||
# Machines Corporation. All Rights Reserved.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License,
|
||||
# or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
#
|
||||
|
||||
"""Xen security policy generation aid
|
||||
"""
|
||||
|
||||
import os
|
||||
import pwd
|
||||
import grp
|
||||
import sys
|
||||
import getopt
|
||||
import BaseHTTPServer
|
||||
import CGIHTTPServer
|
||||
|
||||
|
||||
gHttpPort = 7777
|
||||
gHttpDir = '/var/lib/xensec_gen'
|
||||
gLogFile = '/var/log/xensec_gen.log'
|
||||
gUser = 'nobody'
|
||||
gGroup = 'nobody'
|
||||
|
||||
def usage( ):
|
||||
print >>sys.stderr, 'Usage: ' + sys.argv[0] + ' [OPTIONS]'
|
||||
print >>sys.stderr, ' OPTIONS:'
|
||||
print >>sys.stderr, ' -p, --httpport'
|
||||
print >>sys.stderr, ' The port on which the http server is to listen'
|
||||
print >>sys.stderr, ' (default: ' + str( gHttpPort ) + ')'
|
||||
print >>sys.stderr, ' -d, --httpdir'
|
||||
print >>sys.stderr, ' The directory where the http server is to serve pages from'
|
||||
print >>sys.stderr, ' (default: ' + gHttpDir + ')'
|
||||
print >>sys.stderr, ' -l, --logfile'
|
||||
print >>sys.stderr, ' The file in which to log messages generated by this command'
|
||||
print >>sys.stderr, ' (default: ' + gLogFile + ')'
|
||||
print >>sys.stderr, ' -u, --user'
|
||||
print >>sys.stderr, ' The user under which this command is to run. This parameter'
|
||||
print >>sys.stderr, ' is only used when invoked under the "root" user'
|
||||
print >>sys.stderr, ' (default: ' + gUser + ')'
|
||||
print >>sys.stderr, ' -g, --group'
|
||||
print >>sys.stderr, ' The group under which this command is to run. This parameter'
|
||||
print >>sys.stderr, ' is only used when invoked under the "root" user'
|
||||
print >>sys.stderr, ' (default: ' + gGroup + ')'
|
||||
print >>sys.stderr, ' -f'
|
||||
print >>sys.stderr, ' Run the command in the foreground. The logfile option will be'
|
||||
print >>sys.stderr, ' ignored and all output will be directed to stdout and stderr.'
|
||||
print >>sys.stderr, ' -h, --help'
|
||||
print >>sys.stderr, ' Display the command usage information'
|
||||
|
||||
def runServer( aServerPort,
|
||||
aServerClass = BaseHTTPServer.HTTPServer,
|
||||
aHandlerClass = CGIHTTPServer.CGIHTTPRequestHandler ):
|
||||
serverAddress = ( '', aServerPort )
|
||||
httpd = aServerClass( serverAddress, aHandlerClass )
|
||||
httpd.serve_forever( )
|
||||
|
||||
def daemonize( aHttpDir, aLogFile, aUser, aGroup, aFork = 'true' ):
|
||||
# Do some pre-daemon activities
|
||||
os.umask( 027 )
|
||||
if os.getuid( ) == 0:
|
||||
# If we are running as root, we will change that
|
||||
uid = pwd.getpwnam( aUser )[2]
|
||||
gid = grp.getgrnam( aGroup )[2]
|
||||
|
||||
if aFork == 'true':
|
||||
# Change the owner of the log file to the user/group
|
||||
# under which the daemon is to run
|
||||
flog = open( aLogFile, 'a' )
|
||||
flog.close( )
|
||||
os.chown( aLogFile, uid, gid )
|
||||
|
||||
# Change the uid/gid of the process
|
||||
os.setgid( gid )
|
||||
os.setuid( uid )
|
||||
|
||||
# Change to the HTTP directory
|
||||
os.chdir( aHttpDir )
|
||||
|
||||
if aFork == 'true':
|
||||
# Do first fork
|
||||
try:
|
||||
pid = os.fork( )
|
||||
if pid:
|
||||
# Parent process
|
||||
return pid
|
||||
|
||||
except OSError, e:
|
||||
raise Exception, e
|
||||
|
||||
# First child process, create a new session
|
||||
os.setsid( )
|
||||
|
||||
# Do second fork
|
||||
try:
|
||||
pid = os.fork( )
|
||||
if pid:
|
||||
# Parent process
|
||||
os._exit( 0 )
|
||||
|
||||
except OSError, e:
|
||||
raise Exception, e
|
||||
|
||||
# Reset stdin/stdout/stderr
|
||||
fin = open( '/dev/null', 'r' )
|
||||
flog = open( aLogFile, 'a' )
|
||||
os.dup2( fin.fileno( ), sys.stdin.fileno( ) )
|
||||
os.dup2( flog.fileno( ), sys.stdout.fileno( ) )
|
||||
os.dup2( flog.fileno( ), sys.stderr.fileno( ) )
|
||||
|
||||
def main( ):
|
||||
httpPort = gHttpPort
|
||||
httpDir = gHttpDir
|
||||
logFile = gLogFile
|
||||
user = gUser
|
||||
group = gGroup
|
||||
doFork = 'true'
|
||||
|
||||
shortOpts = 'd:p:l:u:g:fh'
|
||||
longOpts = [ 'httpdir=', 'httpport=', 'logfile=', 'user=', 'group=', 'help' ]
|
||||
try:
|
||||
opts, args = getopt.getopt( sys.argv[1:], shortOpts, longOpts )
|
||||
|
||||
except getopt.GetoptError, e:
|
||||
print >>sys.stderr, e
|
||||
usage( )
|
||||
sys.exit( )
|
||||
|
||||
if len( args ) != 0:
|
||||
print >>sys.stderr, 'Error: command arguments are not supported'
|
||||
usage( )
|
||||
sys.exit( )
|
||||
|
||||
for opt, opt_value in opts:
|
||||
if opt in ( '-h', '--help' ):
|
||||
usage( )
|
||||
sys.exit( )
|
||||
|
||||
if opt in ( '-d', '--httpdir' ):
|
||||
httpDir = opt_value
|
||||
|
||||
if opt in ( '-p', '--httpport' ):
|
||||
try:
|
||||
httpPort = int( opt_value )
|
||||
except:
|
||||
print >>sys.stderr, 'Error: HTTP port is not valid'
|
||||
usage( )
|
||||
sys.exit( )
|
||||
|
||||
if opt in ( '-l', '--logfile' ):
|
||||
logFile = opt_value
|
||||
|
||||
if opt in ( '-u', '--user' ):
|
||||
user = opt_value
|
||||
|
||||
if opt in ( '-g', '--group' ):
|
||||
group = opt_value
|
||||
|
||||
if opt in ( '-f' ):
|
||||
doFork = 'false'
|
||||
|
||||
pid = daemonize( httpDir, logFile, user, group, doFork )
|
||||
if pid > 0:
|
||||
sys.exit( )
|
||||
|
||||
runServer( httpPort )
|
||||
|
||||
if __name__ == '__main__':
|
||||
main( )
|
||||