--- xen-unstable.hg/Config.mk | 2 xen-unstable.hg/docs/src/user.tex | 53 +- xen-unstable.hg/tools/security/Makefile | 15 xen-unstable.hg/tools/security/policies/example/chwall/client_v1-security_policy.xml | 90 ---- xen-unstable.hg/tools/security/policies/example/chwall_ste/client_v1-security_policy.xml | 194 --------- xen-unstable.hg/tools/security/policies/example/client_v1-security_policy.xml | 195 ++++++++++ xen-unstable.hg/tools/security/policies/example/test-security_policy.xml | 97 ++++ xen-unstable.hg/tools/security/python/xensec_gen/cgi-bin/policy.cgi | 1 xen-unstable.hg/tools/security/xensec_ezpolicy | 5 xen-unstable.hg/tools/xm-test/tests/security-acm/xm-test-security_policy.xml | 1 10 files changed, 328 insertions(+), 325 deletions(-) Index: root/xen-unstable.hg/tools/security/policies/example/chwall/client_v1-security_policy.xml =================================================================== --- root.orig/xen-unstable.hg/tools/security/policies/example/chwall/client_v1-security_policy.xml +++ /dev/null @@ -1,90 +0,0 @@ - - - - - - - - example.chwall.client_v1 - www.ibm.com/example/chwall/client_v1 - 2006-03-31 - - - - - - - - - - - cw_SystemManagement - cw_Sensitive - cw_Isolated - cw_Distrusted - - - - cw_Sensitive - cw_Distrusted - - - - - - - - - - - - dom_HomeBanking - - cw_Sensitive - - - - - dom_Fun - - cw_Distrusted - - - - - - dom_BoincClient - - cw_Isolated - - - - - - - dom_SystemManagement - - cw_SystemManagement - - - - - - dom_StorageDomain - - cw_SystemManagement - - - - - - dom_NetworkDomain - - cw_SystemManagement - - - - - - - Index: root/xen-unstable.hg/tools/security/policies/example/chwall_ste/client_v1-security_policy.xml =================================================================== --- root.orig/xen-unstable.hg/tools/security/policies/example/chwall_ste/client_v1-security_policy.xml +++ /dev/null @@ -1,194 +0,0 @@ - - - - - - - - example.chwall_ste.client_v1 - www.ibm.com/example/chwall_ste/client_v1 - 2006-03-31 - - - - - - - ste_SystemManagement - ste_PersonalFinances - ste_InternetInsecure - ste_DonatedCycles - ste_PersistentStorageA - ste_NetworkAdapter0 - - - - - - - - - - - - cw_SystemManagement - cw_Sensitive - cw_Isolated - cw_Distrusted - - - - - cw_Sensitive - cw_Distrusted - - - - - - - - - - - - dom_HomeBanking - - ste_PersonalFinances - - - - cw_Sensitive - - - - - dom_Fun - - ste_InternetInsecure - - - - cw_Distrusted - - - - - - dom_BoincClient - - ste_DonatedCycles - - - - cw_Isolated - - - - - - - dom_SystemManagement - - - - ste_SystemManagement - ste_PersonalFinances - ste_InternetInsecure - ste_DonatedCycles - ste_PersistentStorageA - ste_NetworkAdapter0 - - - - cw_SystemManagement - - - - - - dom_StorageDomain - - - ste_PersistentStorageA - - ste_PersonalFinances - ste_InternetInsecure - - - - cw_SystemManagement - - - - - - dom_NetworkDomain - - - ste_NetworkAdapter0 - - ste_PersonalFinances - ste_InternetInsecure - ste_DonatedCycles - - - - cw_SystemManagement - - - - - - - res_ManagementResource - - ste_SystemManagement - - - - - res_HardDrive(hda) - - ste_PersistentStorageA - - - - - res_LogicalDiskPartition1(hda1) - - ste_PersonalFinances - - - - - res_LogicalDiskPartition2(hda2) - - ste_InternetInsecure - - - - - res_EthernetCard - - ste_NetworkAdapter0 - - - - - res_SecurityToken - - ste_PersonalFinances - - - - - res_GraphicsAdapter - - ste_SystemManagement - - - - - - Index: root/xen-unstable.hg/docs/src/user.tex =================================================================== --- root.orig/xen-unstable.hg/docs/src/user.tex +++ root/xen-unstable.hg/docs/src/user.tex @@ -2673,33 +2673,34 @@ one of these workload types. The XML Pol xsi:schemaLocation= "http://www.ibm.com ../../security_policy.xsd "> 04 -05 example.chwall_ste.test +05 example.test 06 Wed Jul 12 17:32:59 2006 -07 -08 -09 -10 -11 SystemManagement -12 PepsiCo -13 CocaCola -14 -15 -16 -17 -18 -19 SystemManagement -20 PepsiCo -21 CocaCola -22 -23 -24 -25 -26 CocaCola -27 PepsiCo -28 -29 -30 -31 +07 1.0 +08 +09 +10 +11 +12 SystemManagement +13 PepsiCo +14 CocaCola +15 +16 +17 +18 +19 +20 SystemManagement +21 PepsiCo +22 CocaCola +23 +24 +25 +26 +27 CocaCola +28 PepsiCo +29 +30 +31 +32 \end{verbatim} \end{scriptsize} \caption{Example XML security policy file -- Part I: Types and Rules Definition.} Index: root/xen-unstable.hg/tools/security/xensec_ezpolicy =================================================================== --- root.orig/xen-unstable.hg/tools/security/xensec_ezpolicy +++ root/xen-unstable.hg/tools/security/xensec_ezpolicy @@ -1131,15 +1131,16 @@ def dict_read(dictname, filename): #==================== Policy Generation/Translation functions -def printPolicyHeader (fd, policyname, timestamp): +def printPolicyHeader (fd, policyname, timestamp, version="1.0"): fd.write( """ %s %s + %s -""" % (policyname, timestamp)) +""" % (policyname, timestamp, version)) Index: root/xen-unstable.hg/tools/security/policies/example/client_v1-security_policy.xml =================================================================== --- /dev/null +++ root/xen-unstable.hg/tools/security/policies/example/client_v1-security_policy.xml @@ -0,0 +1,195 @@ + + + + + + + + example.client_v1 + www.ibm.com/example/client_v1 + 2006-03-31 + 1.0 + + + + + + + ste_SystemManagement + ste_PersonalFinances + ste_InternetInsecure + ste_DonatedCycles + ste_PersistentStorageA + ste_NetworkAdapter0 + + + + + + + + + + + + cw_SystemManagement + cw_Sensitive + cw_Isolated + cw_Distrusted + + + + + cw_Sensitive + cw_Distrusted + + + + + + + + + + + + dom_HomeBanking + + ste_PersonalFinances + + + + cw_Sensitive + + + + + dom_Fun + + ste_InternetInsecure + + + + cw_Distrusted + + + + + + dom_BoincClient + + ste_DonatedCycles + + + + cw_Isolated + + + + + + + dom_SystemManagement + + + + ste_SystemManagement + ste_PersonalFinances + ste_InternetInsecure + ste_DonatedCycles + ste_PersistentStorageA + ste_NetworkAdapter0 + + + + cw_SystemManagement + + + + + + dom_StorageDomain + + + ste_PersistentStorageA + + ste_PersonalFinances + ste_InternetInsecure + + + + cw_SystemManagement + + + + + + dom_NetworkDomain + + + ste_NetworkAdapter0 + + ste_PersonalFinances + ste_InternetInsecure + ste_DonatedCycles + + + + cw_SystemManagement + + + + + + + res_ManagementResource + + ste_SystemManagement + + + + + res_HardDrive(hda) + + ste_PersistentStorageA + + + + + res_LogicalDiskPartition1(hda1) + + ste_PersonalFinances + + + + + res_LogicalDiskPartition2(hda2) + + ste_InternetInsecure + + + + + res_EthernetCard + + ste_NetworkAdapter0 + + + + + res_SecurityToken + + ste_PersonalFinances + + + + + res_GraphicsAdapter + + ste_SystemManagement + + + + + + Index: root/xen-unstable.hg/tools/security/Makefile =================================================================== --- root.orig/xen-unstable.hg/tools/security/Makefile +++ root/xen-unstable.hg/tools/security/Makefile @@ -16,12 +16,6 @@ LDFLAGS += $(shell xml2-config --libs ifeq ($(ACM_DEFAULT_SECURITY_POLICY),ACM_NULL_POLICY) POLICY=null endif -ifeq ($(ACM_DEFAULT_SECURITY_POLICY),ACM_CHINESE_WALL_POLICY) -POLICY=chwall -endif -ifeq ($(ACM_DEFAULT_SECURITY_POLICY),ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY) -POLICY=ste -endif ifeq ($(ACM_DEFAULT_SECURITY_POLICY),ACM_CHINESE_WALL_AND_SIMPLE_TYPE_ENFORCEMENT_POLICY) POLICY=chwall_ste endif @@ -46,7 +40,7 @@ ACM_SECGEN_HTMLDIR= /var/lib/xensec_gen ACM_SECGEN_CGIDIR = $(ACM_SECGEN_HTMLDIR)/cgi-bin ACM_SCHEMA = security_policy.xsd -ACM_EXAMPLES = chwall ste chwall_ste +ACM_EXAMPLES = client_v1 test ACM_POLICY_SUFFIX = security_policy.xml ifeq ($(ACM_SECURITY),y) @@ -66,8 +60,7 @@ install: all $(ACM_CONFIG_FILE) $(INSTALL_DATA) policies/$(ACM_SCHEMA) $(DESTDIR)$(ACM_POLICY_DIR) $(INSTALL_DIR) $(DESTDIR)$(ACM_POLICY_DIR)/example for i in $(ACM_EXAMPLES); do \ - $(INSTALL_DIR) $(DESTDIR)$(ACM_POLICY_DIR)/example/$$i; \ - $(INSTALL_DATA) policies/example/$$i/client_v1-$(ACM_POLICY_SUFFIX) $(DESTDIR)$(ACM_POLICY_DIR)/example/$$i; \ + $(INSTALL_DATA) policies/example/$$i-$(ACM_POLICY_SUFFIX) $(DESTDIR)$(ACM_POLICY_DIR)/example/; \ done $(INSTALL_DIR) $(DESTDIR)$(ACM_SCRIPT_DIR) $(INSTALL_PROG) $(ACM_SCRIPTS) $(DESTDIR)$(ACM_SCRIPT_DIR) @@ -94,10 +87,10 @@ build: $(ACM_INST_TOOLS) $(ACM_NOINST_TO chmod 700 $(ACM_SCRIPTS) xensec_tool: $(OBJS_TOOL) - $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^ -L$(XEN_LIBXC) -lxenctrl + $(CC) -g $(CFLAGS) $(LDFLAGS) -O0 -o $@ $^ -L$(XEN_LIBXC) -lxenctrl xensec_xml2bin: $(OBJS_XML2BIN) - $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^ + $(CC) -g $(CFLAGS) $(LDFLAGS) -O0 -o $@ $^ xensec_gen: xensec_gen.py cp -f $^ $@ Index: root/xen-unstable.hg/tools/security/policies/example/test-security_policy.xml =================================================================== --- /dev/null +++ root/xen-unstable.hg/tools/security/policies/example/test-security_policy.xml @@ -0,0 +1,97 @@ + + + + + example.test + Mon Apr 16 13:13:59 2007 + 1.0 + + + + + SystemManagement + PepsiCo + CocaCola + + + + + + SystemManagement + PepsiCo + CocaCola + VIOServer + + + + + + + + SystemManagement + + SystemManagement + PepsiCo + CocaCola + + + SystemManagement + + + + + PepsiCo + + PepsiCo + + + PepsiCo + + + + + CocaCola + + CocaCola + + + CocaCola + + + + + VIO + + CocaCola + PepsiCo + + + VIOServer + + + + + + + SystemManagement + + SystemManagement + + + + + PepsiCo + + PepsiCo + + + + + CocaCola + + CocaCola + + + + + Index: root/xen-unstable.hg/tools/security/python/xensec_gen/cgi-bin/policy.cgi =================================================================== --- root.orig/xen-unstable.hg/tools/security/python/xensec_gen/cgi-bin/policy.cgi +++ root/xen-unstable.hg/tools/security/python/xensec_gen/cgi-bin/policy.cgi @@ -1816,6 +1816,7 @@ def sendPHeaderXml( ): # Policy header definition print '' print ' ' + formPolicyName[1] + '' + print ' 1.0' if len( formPolicyUrl[1] ) > 0: print ' ' + formPolicyUrl[1] + '' if len( formPolicyRef[1] ) > 0: Index: root/xen-unstable.hg/tools/xm-test/tests/security-acm/xm-test-security_policy.xml =================================================================== --- root.orig/xen-unstable.hg/tools/xm-test/tests/security-acm/xm-test-security_policy.xml +++ root/xen-unstable.hg/tools/xm-test/tests/security-acm/xm-test-security_policy.xml @@ -4,6 +4,7 @@ xm-test Fri Sep 29 14:44:38 2006 + 1.0 Index: root/xen-unstable.hg/Config.mk =================================================================== --- root.orig/xen-unstable.hg/Config.mk +++ root/xen-unstable.hg/Config.mk @@ -83,8 +83,6 @@ ACM_SECURITY ?= n # ACM_DEFAULT_SECURITY_POLICY # Supported models are: # ACM_NULL_POLICY -# ACM_CHINESE_WALL_POLICY -# ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY # ACM_CHINESE_WALL_AND_SIMPLE_TYPE_ENFORCEMENT_POLICY ACM_DEFAULT_SECURITY_POLICY ?= ACM_NULL_POLICY