Remove the resetting of the policy from this point in the test case
since the new default policy has the '__UNLABELED__' label, which is
not expected in subsequent checks.
Signed-off-by; Stefan Berger <stefanb@us.ibm.com>
Have the domains deleted if they are managed by xend and the tests are
run with '-md' as parameter to runtest.sh.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
I forgot to put in the check to prevent this test case from running
when ACM is not compiled into Xen. I am resetting the policy so that
an update with the prepared policy can be done without changing that
policy's header to match the current policy's version.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
This patch implements a (non Xen-API) legacy XML-RPC interface for the
ACM commands and funnels the calls into code introduced by the Xen-API
support for ACM security management. Since some of the functionality
has changed, also the xm applications have changed. In particular the
following old commands have been removed along with some tools the
have become obsolete now:
- loadpolicy (included in: setpolicy)
- makepolicy (included in: setpolicy)
- cfgbootpolicy (included in: setpolicy)
and the following commands been introduced:
- setpolicy
- getpolicy
- resetpolicy
All tools have been adapted to work in Xen-API and legacy XML-RPC
mode. Both modes support the same functionality.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
- recently I added an other_config field to the VTPM record which now
needs to be accounted for otherwise the test determines a bad key
- the dry-run command was throwing a different type of exception
(ACMError) than what was caught (XSMError)
- the tests based on the raw Xen-API need to build the PV_args
parameters from the old 'root' and 'extra' parameters.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
- don't reload the policy if it has been loaded
- don't always load the policy in the test suite when the policy is
already loaded
- skip tests 07 and 09 when ACM is not enabled and xm is not using the
Xen-API
- fix a problem when trying to remove an invalid label
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
This adds a couple of test cases exercising the new policy management
functionality to the security tests.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
This patch changes the XML schema of the ACM policy to require a
version and that every conflict set have a name. Every VM label must
have one Chinese Wall Type and every resource label one Simple Type
Enforcement Type. As a consequence of this some example policies
needed to be changed. Also not offering that many configuration
options for compiling xen anymore to make things simpler.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
the xm test suite. The tests can be run with ACM turned off (not
compiled into Xen; see user doc for this), but most of them will be
skipped then. They can be run with a command like
make -C tests/security-acm check-TESTS
from the xm-test directory. They are also part of the default tests in
the tests suite and part of a new group test 'security'.
Since some of the tests require resources to be labeled, one must
explicitly enable the resources to be allowed to be labeled by the
test
suite by running
./configure --enable-full-labeling
once. To turn it off, the '--enable-full-labeling' parameter should be
omitted.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Keir Fraser
Keir Fraser
kfraser@localhost.localdomain
Ewan Mellor