mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
kaf24@firebug.cl.cam.ac.uk
a7da7a4ecb
access control module and makes the tools more self-explanatory. Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
137 lines
3.2 KiB
Bash
137 lines
3.2 KiB
Bash
#!/bin/sh
|
|
# *
|
|
# * setlabel
|
|
# *
|
|
# * Copyright (C) 2005 IBM Corporation
|
|
# *
|
|
# * Authors:
|
|
# * Stefan Berger <stefanb@us.ibm.com>
|
|
# *
|
|
# * This program is free software; you can redistribute it and/or
|
|
# * modify it under the terms of the GNU General Public License as
|
|
# * published by the Free Software Foundation, version 2 of the
|
|
# * License.
|
|
# *
|
|
# * 'setlabel' labels virtual machine (domain) configuration files with
|
|
# * security identifiers that can be enforced in Xen.
|
|
# *
|
|
# * 'setlabel -?' shows the usage of the program
|
|
# *
|
|
# * 'setlabel -l vmconfig-file' lists all available labels (only VM
|
|
# * labels are used right now)
|
|
# *
|
|
# * 'setlabel vmconfig-file security-label map-file' inserts the 'ssidref'
|
|
# * that corresponds to the security-label under the
|
|
# * current policy (if policy changes, 'label'
|
|
# * must be re-run over the configuration files;
|
|
# * map-file is created during policy translation and
|
|
# * is found in the policy's directory
|
|
#
|
|
|
|
if [ -z "$runbash" ]; then
|
|
runbash="1"
|
|
export runbash
|
|
exec sh -c "bash $0 $*"
|
|
fi
|
|
|
|
export PATH=$PATH:.
|
|
source labelfuncs.sh
|
|
|
|
usage ()
|
|
{
|
|
echo "Use this tool to put the ssidref corresponding to a label of a policy into
|
|
the VM configuration file, or use it to display all labels of a policy.
|
|
|
|
Usage: $0 [Option] <vmfile> <label> [<policy name>]
|
|
or $0 -l [<policy name>]
|
|
|
|
Valid options are:
|
|
-r : to relabel a file without being prompted
|
|
|
|
vmfile : XEN vm configuration file; give complete path
|
|
label : the label to map to an ssidref
|
|
policy name : the name of the policy, i.e. 'chwall'
|
|
If the policy name is omitted, it is attempted
|
|
to find the current policy's name in grub.conf.
|
|
|
|
-l [<policy name>] is used to show valid labels in the map file of
|
|
the given or current policy. If the policy name
|
|
is omitted, it will be tried to determine the
|
|
current policy from grub.conf (/boot/grub/grub.conf)
|
|
|
|
"
|
|
}
|
|
|
|
|
|
if [ "$1" == "-r" ]; then
|
|
mode="relabel"
|
|
shift
|
|
elif [ "$1" == "-l" ]; then
|
|
mode="show"
|
|
shift
|
|
elif [ "$1" == "-?" ]; then
|
|
mode="usage"
|
|
fi
|
|
|
|
if [ "$mode" == "show" ]; then
|
|
if [ "$1" == "" ]; then
|
|
findGrubConf
|
|
ret=$?
|
|
if [ $ret -eq 0 ]; then
|
|
echo "Could not find grub.conf"
|
|
exit -1;
|
|
fi
|
|
findPolicyInGrub $grubconf
|
|
if [ "$policy" != "" ]; then
|
|
echo "Assuming policy to be '$policy'.";
|
|
else
|
|
echo "Could not find policy."
|
|
exit -1;
|
|
fi
|
|
else
|
|
policy=$1;
|
|
fi
|
|
|
|
|
|
findMapFile $policy
|
|
res=$?
|
|
if [ "$res" != "0" ]; then
|
|
showLabels $mapfile
|
|
else
|
|
echo "Could not find map file for policy '$policy'."
|
|
fi
|
|
elif [ "$mode" == "usage" ]; then
|
|
usage
|
|
else
|
|
if [ "$2" == "" ]; then
|
|
usage
|
|
exit -1
|
|
fi
|
|
if [ "$3" == "" ]; then
|
|
findGrubConf
|
|
ret=$?
|
|
if [ $ret -eq 0 ]; then
|
|
echo "Could not find grub.conf"
|
|
exit -1;
|
|
fi
|
|
findPolicyInGrub $grubconf
|
|
if [ "$policy" != "" ]; then
|
|
echo "Assuming policy to be '$policy'.";
|
|
else
|
|
echo "Could not find policy."
|
|
exit -1;
|
|
fi
|
|
|
|
else
|
|
policy=$3;
|
|
fi
|
|
findMapFile $policy
|
|
res=$?
|
|
if [ "$res" != "0" ]; then
|
|
relabel $1 $2 $mapfile $mode
|
|
else
|
|
echo "Could not find map file for policy '$3'."
|
|
fi
|
|
|
|
fi
|