This adds a couple of test cases exercising the new policy management
functionality to the security tests.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Make the vTPM hotplug script use the UUID of the vTPM instance for
associating it with its instance number rather than the name of the
domain.
Also change the cleanup in the xm test to use the atexit mechanism
rather than explicitly calling a function to clean up.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
When domains are destroyed/suspend-resume/migration using the Xen-API
things break due to the domid not having been reset. This patch fixes
this. This is the best place I found for fixing this problem. I could
not push this line into _stateSet() for the case of DOM_STATE_HALTED
and left a comment regarding this.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
- Allow multiple ChineseWallTypes in a VM labels
- check for surfacing exceptions in the python code
- check for array sizes in the XML DOM in python
- properly display the labels when doing 'xm list --label' in xm's
non-Xen-API mode
- rely on the security checking hooks in xend to check access to the
block interface rather than doing this in xm.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
This patch fixes the xc_map_grant_refs() function, which would fail
because, instead of passing the malloc()-ed ioctl argument pointer to
the ioctl, the address of this pointer was being passed instead.
Signed-off-by: Derek Murray <Derek.Murray@cl.cam.ac.uk>
Once the presence of LPT1 is baked into a Windows guest, it gets upset
if it is subsequently removed. Hence we add the 'LTP1' device object
back into the ACPI DSDT, and remove IRQ 7 from the list of IRQs usable
by the PCI-ISA links.
Signed-off-by: Keir Fraser <keir@xensource.com>
functionality is needed for probing how much memory is available in a
given node prior to VM creation.
Signed-off-by: Ryan Harper <ryanh@us.ibm.com>
Signed-off-by: Keir Fraser <keir@xensource.com>
Replaces an instance of pthread_mutex_lock() that should be
pthreaad_mutex_unlock(). With thanks to our OpenTC partners at the
Technical University of Sofia, whose static analysis found this bug.
Signed-off-by: Derek G. Murray <Derek.Murray@cl.cam.ac.uk>
contents of xenstore entries. There is a bit of code cleanup as well
(snprintf vs. sprintf), one formatting fix, and comments).
There is no change to the behavior of xenstore-ls without -w.
Signed-off-by: John Zulauf <john.zulauf@intel.com>
This patch adds a couple of new commands for using the Xen-API
extensions for security policies. Older tools are converted to support
going through the Xen-API for their operations rather than doing the
operations directly in their own code.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
drives to fix a hang during SLES 9 HVM guest installation.
Without this, the SLES 9 installer kernels (32 and 64 bit) were
getting inconsistent information from QEMU as to whether the
(emulated) IDE drives support write caching (which they do). So part
of the kernel thought write caching was enabled (and enabled the usage
of barrier writes) and part of it didn't, which triggered a bug in
which the same barrier write is submitted over and over again ...
Fixed by setting another bit in the WIN_IDENTIFY (IDE drive "identify"
command) response to indicate we really, truly support write caching.
Signed-off-by: David Lively <dlively@virtualiron.com>
Signed-off-by: Ben Guthro <bguthro@virtualiron.com>
This patch implements extensions for managing security policies in
xend. The XSPolicy and ACMPolicy classes provide the interface for the
Xen-API and implement functionality for setting, updating and
activating of a Xen security policy as well as labeling of virtual
machines and resources such as block devices. Labeling of network
devices will follow.
The acmpolicy class implements a compiler for translating an XML
policy into their binary format and provides functionality for
comparing a current policy against a new one when changing/updating a
policy.
The xspolicyadmin class administers the policy of the system.
Some of the xend-internal code deals with transforming the labeling
information from the S-Expression format into the new Xen-API
format. This is similar to much of the other code that is already
there.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Fixes correctness issues with xenstored and gcc-4.2.
Original patch by Charles Coffing <ccoffing@novell.com>
Signed-off-by: Keir Fraser <keir@xensource.com>
Block-device specifiers in ioemu can contain colons, so skipping
always past the first colon is not a good idea. Better solutions are
in the pipeline to solve the blktap issues.
Signed-off-by: Keir Fraser <keir@xensource.com>
When blktap was booting system volume, PV-on-HVM domain was not able
to be started.
The configuration file is specified as follows.
disk = [ 'tap:aio:/xen/test/rhel5ga_full.img,hda,w' ]
The error occurred by the initialization of system volume in qemu-dm.
qemu: could not open hard disk image 'aio:/xen/test/rhel5ga_full.img'
Signed-off-by: Takanori Kasai <kasai.takanori@jp.fujitsu.com>
Signed-off-by: Tomonari Horikoshi <t.horikoshi@jp.fujitsu.com>
Signed-off-by: Tsunehisa Doi <Doi.Tsunehisa@jp.fujitsu.com>
Signed-off-by: Keir Fraser <keir@xensource.com>
