From a363067a1bdf411c28032b926b451fc9d0964dc6 Mon Sep 17 00:00:00 2001 From: WuKong Date: Mon, 12 Oct 2015 14:29:11 +0200 Subject: create scenario test Change-Id: Id392d900583a31fb53a9da5bcb0c47746f34491a Signed-off-by: WuKong --- .../keystone/tests/moon/scenario/test_nova_a.sh | 33 ++++++++++++++++++ .../keystone/tests/moon/scenario/test_nova_b.sh | 39 ++++++++++++++++++++++ .../keystone/tests/moon/scenario/test_nova_c.sh | 37 ++++++++++++++++++++ 3 files changed, 109 insertions(+) create mode 100644 keystone-moon/keystone/tests/moon/scenario/test_nova_a.sh create mode 100644 keystone-moon/keystone/tests/moon/scenario/test_nova_b.sh create mode 100644 keystone-moon/keystone/tests/moon/scenario/test_nova_c.sh (limited to 'keystone-moon/keystone') diff --git a/keystone-moon/keystone/tests/moon/scenario/test_nova_a.sh b/keystone-moon/keystone/tests/moon/scenario/test_nova_a.sh new file mode 100644 index 00000000..36afd5a1 --- /dev/null +++ b/keystone-moon/keystone/tests/moon/scenario/test_nova_a.sh @@ -0,0 +1,33 @@ +#!/usr/bin/env bash + +# as user admin + +# create authz intraextension +moon intraextension add policy_mls_authz test_authz + +# create admin intraextension +moon intraextension add policy_rbac_admin test_admin + +# create tenant +moon tenant add --authz xxx --admin xxx `demo` + +# check that now moon authorizes the manipulation list_servers +nova list + +# select the authz intraextension +moon intraextension select `test_authz_uuid` + +# del object assignment for servers +moon object assignment del `servers_uuid` `object_security_level_uuid` `low_uuid` + +# add object assignment for servers +moon object assignment add `servers_uuid` `object_security_level_uuid` `high_uuid` + +# check now moon block the manipulation list_servers +nova list + +# del object assignment for servers +moon object assignment del `servers_uuid` `object_security_level_uuid` `high_uuid` + +# add object assignment for servers +moon object assignment add `servers_uuid` `object_security_level_uuid` `low_uuid` \ No newline at end of file diff --git a/keystone-moon/keystone/tests/moon/scenario/test_nova_b.sh b/keystone-moon/keystone/tests/moon/scenario/test_nova_b.sh new file mode 100644 index 00000000..f2c0e4fc --- /dev/null +++ b/keystone-moon/keystone/tests/moon/scenario/test_nova_b.sh @@ -0,0 +1,39 @@ +#!/usr/bin/env bash + +# as user admin + +# create authz intraextension +moon intraextension add policy_mls_authz test_authz + +# create admin intraextension +moon intraextension add policy_rbac_admin test_admin + +# create tenant +moon tenant add --authz xxx --admin xxx demo + +# select the authz tenant +moon intraextension select `test_authz_uuid` + +# create a VM (vm1) in OpenStack +nova create vm1..... + +# add corresponding object in moon +moon object add vm1 + +# check that moon blocks the vm1 manipulatin +nova vm1 suspend .... + +# add object assignment for vm1 +moon object assignment `vm1_uuid` `object_security_level_uuid` `high_uuid` + +# check now moon block the manipulation of vm1 +nova vm1 suspend .... + +# del object assignment for servers +moon object assignment del `vm1_uuid` `object_security_level_uuid` `high_uuid` + +# add object assignment for servers +moon object assignment add `vm1_uuid` `object_security_level_uuid` `low_uuid` + +# check now moon unblock the manipulation of vm1 +nova vm1 suspend .... \ No newline at end of file diff --git a/keystone-moon/keystone/tests/moon/scenario/test_nova_c.sh b/keystone-moon/keystone/tests/moon/scenario/test_nova_c.sh new file mode 100644 index 00000000..bf4bd3c8 --- /dev/null +++ b/keystone-moon/keystone/tests/moon/scenario/test_nova_c.sh @@ -0,0 +1,37 @@ +#!/usr/bin/env bash + +# as user demo +. openrc demo + +# create authz intraextension +moon intraextension add policy_mls_authz test_authz + +# create admin intraextension +moon intraextension add policy_rbac_admin test_admin + +# create tenant +moon tenant add --authz xxx --admin xxx demo + +# select the authz tenant +moon intraextension select `test_authz_uuid` + +# check that moon blocks modification of object assignments +moon object assignment add `vm1_uuid` `object_security_level_uuid` `high_uuid` + +# as user admin +. openrc admin + +# select the admin intraextension +moon intraextension select `test_admin_uuid` + +# add write permission to the dev_role user for assignment table +moon rule add `rbac_rule_uuid` [`dev_role_uuid`, `write_uuid`, `authz.assignment`] + +# as user demo +. openrc demo + +# select the authz intraextension +moon intraextension select `test_authz_uuid` + +# check that moon authorizes modification of rule table by demo +moon object assignment add `vm1_uuid` `object_security_level_uuid` `high_uuid` -- cgit 1.2.3-korg