mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
smh22@firebug.cl.cam.ac.uk
e7f4f3a1de
integrate into Xen Management and which support the new access control labels (labels replace the ssidref numbers at the management user interface). Signed-off by: Reiner Sailer <sailer@us.ibm.com>
56 lines
1.7 KiB
Python
56 lines
1.7 KiB
Python
#!/usr/bin/env python
|
|
# -*- mode: python; -*-
|
|
import sys
|
|
import traceback
|
|
import getopt
|
|
|
|
# add fallback path for non-native python path installs if needed
|
|
sys.path.insert(-1, '/usr/lib/python')
|
|
sys.path.insert(-1, '/usr/lib64/python')
|
|
|
|
from xen.util.security import ACMError, err, get_decision, active_policy
|
|
|
|
def usage():
|
|
print "Usage: acm_getdecision -i domainid --label labelname"
|
|
print " Test program illustrating the retrieval of"
|
|
print " access control decisions from Xen. At this time,"
|
|
print " only sharing (STE) policy decisions are supported."
|
|
print " Arguments are two paramters in any combination:"
|
|
print "\t -i domain_id or --domid domain_id"
|
|
print "\t -l labelname or --label labelname"
|
|
print " Return value:"
|
|
print "\t PERMITTED if access is permitted"
|
|
print "\t DENIED if access is denied"
|
|
print "\t ACMError -- e.g., unknown label or domain id"
|
|
err("Usage")
|
|
|
|
try:
|
|
|
|
if len(sys.argv) != 5:
|
|
usage()
|
|
|
|
decision_args = []
|
|
|
|
for idx in range(1, len(sys.argv), 2):
|
|
if sys.argv[idx] in ['-i', '--domid']:
|
|
decision_args.append(['domid', sys.argv[idx+1]])
|
|
elif sys.argv[idx] in ['-l', '--label']:
|
|
decision_args.append(['access_control',
|
|
['policy', active_policy],
|
|
['label', sys.argv[idx+1]]
|
|
])
|
|
else:
|
|
print "unknown argument %s" % sys.argv[idx]
|
|
usage()
|
|
|
|
if len(decision_args) != 2:
|
|
print "too many arguments"
|
|
usage()
|
|
|
|
print get_decision(decision_args[0], decision_args[1])
|
|
|
|
except ACMError:
|
|
pass
|
|
except:
|
|
traceback.print_exc(limit=1)
|