From d285ffba7b9e2af55cf7765963764d2acd616a24 Mon Sep 17 00:00:00 2001 From: asteroide Date: Mon, 24 Apr 2017 11:37:15 +0200 Subject: Add the moon_orchestrator element. Change-Id: I09712c0b6e8e7d17a765829a981280ca5fd8af75 --- .../conf/dockers/template.dockerfile | 25 ++++++ moonv4/moon_orchestrator/conf/moon.conf | 87 ++++++++++++++++++++ moonv4/moon_orchestrator/conf/plugins/authz.py | 66 +++++++++++++++ .../conf/policies/policy_authz/assignment.json | 55 +++++++++++++ .../conf/policies/policy_authz/metadata.json | 23 ++++++ .../conf/policies/policy_authz/metarule.json | 24 ++++++ .../conf/policies/policy_authz/perimeter.json | 21 +++++ .../conf/policies/policy_authz/rule.json | 25 ++++++ .../conf/policies/policy_authz/scope.json | 49 +++++++++++ .../policies/policy_empty_admin/assignment.json | 7 ++ .../conf/policies/policy_empty_admin/metadata.json | 12 +++ .../conf/policies/policy_empty_admin/metarule.json | 12 +++ .../policies/policy_empty_admin/perimeter.json | 39 +++++++++ .../conf/policies/policy_empty_admin/rule.json | 3 + .../conf/policies/policy_empty_admin/scope.json | 7 ++ .../policies/policy_empty_authz/assignment.json | 7 ++ .../conf/policies/policy_empty_authz/metadata.json | 12 +++ .../conf/policies/policy_empty_authz/metarule.json | 12 +++ .../policies/policy_empty_authz/perimeter.json | 5 ++ .../conf/policies/policy_empty_authz/rule.json | 3 + .../conf/policies/policy_empty_authz/scope.json | 7 ++ .../conf/policies/policy_mls_authz/assignment.json | 29 +++++++ .../conf/policies/policy_mls_authz/metadata.json | 18 +++++ .../conf/policies/policy_mls_authz/metarule.json | 12 +++ .../conf/policies/policy_mls_authz/perimeter.json | 21 +++++ .../conf/policies/policy_mls_authz/rule.json | 16 ++++ .../conf/policies/policy_mls_authz/scope.json | 26 ++++++ .../policies/policy_rbac_admin/assignment.json | 48 +++++++++++ .../conf/policies/policy_rbac_admin/metadata.json | 18 +++++ .../conf/policies/policy_rbac_admin/metarule.json | 12 +++ .../conf/policies/policy_rbac_admin/perimeter.json | 42 ++++++++++ .../conf/policies/policy_rbac_admin/rule.json | 94 ++++++++++++++++++++++ .../conf/policies/policy_rbac_admin/scope.json | 48 +++++++++++ .../conf/policies/policy_root/assignment.json | 39 +++++++++ .../conf/policies/policy_root/metadata.json | 19 +++++ .../conf/policies/policy_root/metarule.json | 12 +++ .../conf/policies/policy_root/perimeter.json | 31 +++++++ .../conf/policies/policy_root/rule.json | 44 ++++++++++ .../conf/policies/policy_root/scope.json | 39 +++++++++ 39 files changed, 1069 insertions(+) create mode 100644 moonv4/moon_orchestrator/conf/dockers/template.dockerfile create mode 100644 moonv4/moon_orchestrator/conf/moon.conf create mode 100644 moonv4/moon_orchestrator/conf/plugins/authz.py create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_authz/assignment.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_authz/metadata.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_authz/metarule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_authz/perimeter.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_authz/rule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_authz/scope.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_admin/assignment.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metadata.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metarule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_admin/perimeter.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_admin/rule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_admin/scope.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_authz/assignment.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metadata.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metarule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_authz/perimeter.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_authz/rule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_empty_authz/scope.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_mls_authz/assignment.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metadata.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metarule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_mls_authz/perimeter.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_mls_authz/rule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_mls_authz/scope.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/assignment.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metadata.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metarule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/perimeter.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/rule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/scope.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_root/assignment.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_root/metadata.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_root/metarule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_root/perimeter.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_root/rule.json create mode 100644 moonv4/moon_orchestrator/conf/policies/policy_root/scope.json (limited to 'moonv4/moon_orchestrator/conf') diff --git a/moonv4/moon_orchestrator/conf/dockers/template.dockerfile b/moonv4/moon_orchestrator/conf/dockers/template.dockerfile new file mode 100644 index 00000000..6bb8a0c6 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/dockers/template.dockerfile @@ -0,0 +1,25 @@ +# Pull base image. +FROM ubuntu:latest + +{{ proxy }} + +RUN apt-get update && apt-get install python3.5 python3-pip -y + +ADD dist/moon_utilities-0.1.0.tar.gz /root +WORKDIR /root/moon_utilities-0.1.0 +RUN pip3 install pip --upgrade +RUN pip3 install --upgrade -r requirements.txt +RUN pip3 install --upgrade . + +ADD dist/moon_db-0.1.0.tar.gz /root +WORKDIR /root/moon_db-0.1.0 +RUN pip3 install --upgrade -r requirements.txt +RUN pip3 install --upgrade . + +{{ run }} + +{% for port in ports %} +EXPOSE {{ port }} +{% endfor %} + +CMD {{ cmd }} diff --git a/moonv4/moon_orchestrator/conf/moon.conf b/moonv4/moon_orchestrator/conf/moon.conf new file mode 100644 index 00000000..c0d1d14c --- /dev/null +++ b/moonv4/moon_orchestrator/conf/moon.conf @@ -0,0 +1,87 @@ +[DEFAULT] +# proxy URL +#proxy=http://172.28.16.30:3128 +proxy= +transport_url=rabbit://moon:p4sswOrd1@messenger:5672/moon +#transport_url=rabbit://moon:p4sswOrd@localhost:5672/moon + +debug=True + +# directory where the python packages can be found +dist_dir=/home/vdsq3226/projets/opnfv/moonv4/moon_orchestrator/dist +plugin_dir=/etc/moon/plugins + +docker_url=unix://var/run/docker.sock + +root_policy_directory=policy_root +policy_directory=/etc/moon/policies + +[slave] + +# name of the slave +# example slave_name=slave1 +slave_name= + +# URL of the RabbitMQ bus of the Master +# example: master_url=rabbit://moon:p4sswOrd1@master_messenger:5672/moon +master_url= + +# login name of the master administrator +# example: master_login=admin +master_login= + +# password of the master administrator +# example: master_password=p4ssw0rd +master_password= + +[database] + +# Database for that server (may be different from master to slave) +url=mysql+pymysql://moon:p4sswOrd1@db/moon +driver=sql + +[database_configuration] + +# Database for configuration elements (may be different from master to slave) +driver=memory +url= + +[orchestrator] +host=127.0.0.1 +port=38002 +container= + +[security_router] +host=172.18.0.10 + +# Name of the container to download (if empty build from scratch) +# example: container=moon/moon_secrouter:latest +container= + +[security_manager] +host=172.18.0.10 + +# Name of the container to download (if empty build from scratch) +# example: container=moon/moon_manager:latest +container= + +[interface] +host=172.18.0.11 +port=38001 +# Name of the container to download (if empty build from scratch) +# example: container=moon/moon_interface:latest +container= + +[security_function] +# Name of the container to download (if empty build from scratch) +# example: container=moon/moon_secfunction:latest +container= + +[keystone] +url=http://keystone:5000/v3 +user=admin +password=p4ssw0rd +domain=default +project=admin +check_token=False +server_crt=False diff --git a/moonv4/moon_orchestrator/conf/plugins/authz.py b/moonv4/moon_orchestrator/conf/plugins/authz.py new file mode 100644 index 00000000..c472b36a --- /dev/null +++ b/moonv4/moon_orchestrator/conf/plugins/authz.py @@ -0,0 +1,66 @@ +# Copyright 2015 Open Platform for NFV Project, Inc. and its contributors +# This software is distributed under the terms and conditions of the 'Apache-2.0' +# license which can be found in the file 'LICENSE' in this package distribution +# or at 'http://www.apache.org/licenses/LICENSE-2.0'. + +import os +import time +import hashlib +from oslo_config import cfg +from oslo_log import log as logging +import oslo_messaging +from moon_orchestrator.dockers import DockerBase + +LOG = logging.getLogger(__name__) +CONF = cfg.CONF +DOMAIN = "moon_orchestrator" + +__CWD__ = os.path.dirname(os.path.abspath(__file__)) +# TODO (asteroide): select the right template folder +TEMPLATES_FOLDER = os.path.join(__CWD__, "..", "conf", "dockers") +# TODO (asteroide): add specific configuration options for that plugin + + +class AuthzFunction(DockerBase): + + id = "moon_authz_function" + __build = """RUN mkdir -p /etc/moon/ +COPY conf /etc/moon/ +ADD dist/{py_pkg}.tar.gz /root +WORKDIR /root/{py_pkg} +RUN pip3 install -r requirements.txt +RUN pip3 install . +""" + + def __init__(self, uuid, conf_file="", docker=None, network_config=None): + self.id = "authz_"+hashlib.sha224(uuid.encode("utf-8")).hexdigest() + super(AuthzFunction, self).__init__( + name="moon_authz", + run_cmd=["python3", "-m", "moon_authz", uuid], + conf_file=conf_file, + docker=docker, + network_config=network_config, + build_cmd=self.__build, + id=self.id, + tag="" + # tag=CONF.security_function.container + ) + # note(asteroide): time to let the new docker boot + time.sleep(3) + self.get_status() + + def get_status(self): + transport = oslo_messaging.get_transport(CONF) + target = oslo_messaging.Target(topic=self.id, version='1.0') + client = oslo_messaging.RPCClient(transport, target) + LOG.info("Calling Status on {}".format(self.id)) + ret = client.call({"component_id": self.id}, 'get_status', args=None) + LOG.info(ret) + return ret + + +def run(uuid, conf_file="", docker=None, network_config=None): + return AuthzFunction(uuid, + conf_file=conf_file, + docker=docker, + network_config=network_config) diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/assignment.json new file mode 100644 index 00000000..7a6c722e --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/assignment.json @@ -0,0 +1,55 @@ +{ + "subject_assignments": { + "subject_security_level":{ + "admin": ["high"], + "demo": ["medium"] + }, + "domain":{ + "admin": ["ft"], + "demo": ["xx"] + }, + "role": { + "admin": ["admin"], + "demo": ["dev"] + } + }, + + "action_assignments": { + "resource_action":{ + "pause": ["vm_admin"], + "unpause": ["vm_admin"], + "start": ["vm_admin"], + "stop": ["vm_admin"], + "list": ["vm_access", "vm_admin"], + "create": ["vm_admin"], + "storage_list": ["storage_access"], + "download": ["storage_access"], + "post": ["storage_admin"], + "upload": ["storage_admin"] + }, + "access": { + "pause": ["write"], + "unpause": ["write"], + "start": ["write"], + "stop": ["write"], + "list": ["read"], + "create": ["write"], + "storage_list": ["read"], + "download": ["read"], + "post": ["write"], + "upload": ["write"] + } + }, + + "object_assignments": { + "object_security_level": { + "servers": ["low"] + }, + "type": { + "servers": ["computing"] + }, + "object_id": { + "servers": ["servers"] + } + } +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/metadata.json new file mode 100644 index 00000000..21a99eb2 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/metadata.json @@ -0,0 +1,23 @@ +{ + "name": "Simple_Policy", + "genre": "authz", + "description": "Simple Security Policy", + "pdp_pipeline": ["authz:rbac_rule", "authz:mls_rule"], + + "subject_categories": [ + "subject_security_level", + "domain", + "role" + ], + + "action_categories": [ + "resource_action", + "access" + ], + + "object_categories": [ + "object_security_level", + "type", + "object_id" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/metarule.json new file mode 100644 index 00000000..c9afd6c2 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/metarule.json @@ -0,0 +1,24 @@ +{ + "sub_meta_rules": { + "mls_rule": { + "subject_categories": ["subject_security_level"], + "action_categories": ["resource_action"], + "object_categories": ["object_security_level"], + "algorithm": "inclusion" + }, + "dte_rule": { + "subject_categories": ["domain"], + "action_categories": ["access"], + "object_categories": ["type"], + "algorithm": "inclusion" + }, + "rbac_rule": { + "subject_categories": ["role", "domain"], + "action_categories": ["access"], + "object_categories": ["object_id"], + "algorithm": "inclusion" + } + }, + "aggregation": "all_true" +} + diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/perimeter.json new file mode 100644 index 00000000..47a8ee45 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/perimeter.json @@ -0,0 +1,21 @@ +{ + "subjects": [ + "admin", + "demo" + ], + "actions": [ + "pause", + "unpause", + "start", + "stop", + "create", + "list", + "upload", + "download", + "post", + "storage_list" + ], + "objects": [ + "servers" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/rule.json new file mode 100644 index 00000000..25f9d93a --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/rule.json @@ -0,0 +1,25 @@ +{ + "mls_rule":[ + ["high", "vm_admin", "medium"], + ["high", "vm_admin", "low"], + ["medium", "vm_admin", "low"], + ["high", "vm_access", "high"], + ["high", "vm_access", "medium"], + ["high", "vm_access", "low"], + ["medium", "vm_access", "medium"], + ["medium", "vm_access", "low"], + ["low", "vm_access", "low"] + ], + "dte_rule":[ + ["ft", "read", "computing"], + ["ft", "write", "computing"], + ["ft", "read", "storage"], + ["ft", "write", "storage"], + ["xx", "read", "storage"] + ], + "rbac_rule":[ + ["dev", "xx", "read", "servers"], + ["admin", "xx", "read", "servers"], + ["admin", "ft", "read", "servers"] + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_authz/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_authz/scope.json new file mode 100644 index 00000000..9b313daf --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_authz/scope.json @@ -0,0 +1,49 @@ +{ + "subject_scopes": { + "role": [ + "admin", + "dev" + ], + "subject_security_level": [ + "high", + "medium", + "low" + ], + "domain": [ + "ft", + "xx" + ] + }, + + "action_scopes": { + "resource_action": [ + "vm_admin", + "vm_access", + "storage_admin", + "storage_access" + ], + "access": [ + "write", + "read" + ] + }, + + "object_scopes": { + "object_security_level": [ + "high", + "medium", + "low" + ], + "type": [ + "computing", + "storage" + ], + "object_id": [ + "servers", + "vm1", + "vm2", + "file1", + "file2" + ] + } +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/assignment.json new file mode 100644 index 00000000..24018a09 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/assignment.json @@ -0,0 +1,7 @@ +{ + "subject_assignments": {}, + + "action_assignments": {}, + + "object_assignments": {} +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metadata.json new file mode 100644 index 00000000..3c9be2e5 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metadata.json @@ -0,0 +1,12 @@ +{ + "name": "Empty_Policy", + "model": "", + "genre": "admin", + "description": "Empty Policy", + + "subject_categories": [], + + "action_categories": [], + + "object_categories": [] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metarule.json new file mode 100644 index 00000000..7acd8848 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/metarule.json @@ -0,0 +1,12 @@ +{ + "sub_meta_rules": { + "mls_rule": { + "subject_categories": [], + "action_categories": [], + "object_categories": [], + "algorithm": "" + } + }, + "aggregation": "" +} + diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/perimeter.json new file mode 100644 index 00000000..54dbfc31 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/perimeter.json @@ -0,0 +1,39 @@ +{ + "subjects": [], + "actions": [ + "read", + "write" + ], + "objects": [ + "authz.subjects", + "authz.objects", + "authz.actions", + "authz.subject_categories", + "authz.object_categories", + "authz.action_categories", + "authz.subject_scopes", + "authz.object_scopes", + "authz.action_scopes", + "authz.subject_assignments", + "authz.object_assignments", + "authz.action_assignments", + "authz.aggregation_algorithm", + "authz.sub_meta_rules", + "authz.rules", + "admin.subjects", + "admin.objects", + "admin.actions", + "admin.subject_categories", + "admin.object_categories", + "admin.action_categories", + "admin.subject_scopes", + "admin.object_scopes", + "admin.action_scopes", + "admin.subject_assignments", + "admin.object_assignments", + "admin.action_assignments", + "admin.aggregation_algorithm", + "admin.sub_meta_rules", + "admin.rules" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/rule.json new file mode 100644 index 00000000..fe4fae5a --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/rule.json @@ -0,0 +1,3 @@ +{ + "mls_rule":[] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/scope.json new file mode 100644 index 00000000..1efebe6f --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_admin/scope.json @@ -0,0 +1,7 @@ +{ + "subject_scopes": {}, + + "action_scopes": {}, + + "object_scopes": {} +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/assignment.json new file mode 100644 index 00000000..24018a09 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/assignment.json @@ -0,0 +1,7 @@ +{ + "subject_assignments": {}, + + "action_assignments": {}, + + "object_assignments": {} +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metadata.json new file mode 100644 index 00000000..4f300d78 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metadata.json @@ -0,0 +1,12 @@ +{ + "name": "MLS_Policy", + "model": "MLS", + "genre": "authz", + "description": "Multi Level Security Policy", + + "subject_categories": [], + + "action_categories": [], + + "object_categories": [] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metarule.json new file mode 100644 index 00000000..7acd8848 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/metarule.json @@ -0,0 +1,12 @@ +{ + "sub_meta_rules": { + "mls_rule": { + "subject_categories": [], + "action_categories": [], + "object_categories": [], + "algorithm": "" + } + }, + "aggregation": "" +} + diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/perimeter.json new file mode 100644 index 00000000..9da8a8c0 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/perimeter.json @@ -0,0 +1,5 @@ +{ + "subjects": [], + "actions": [], + "objects": [] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/rule.json new file mode 100644 index 00000000..fe4fae5a --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/rule.json @@ -0,0 +1,3 @@ +{ + "mls_rule":[] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/scope.json new file mode 100644 index 00000000..1efebe6f --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_empty_authz/scope.json @@ -0,0 +1,7 @@ +{ + "subject_scopes": {}, + + "action_scopes": {}, + + "object_scopes": {} +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/assignment.json new file mode 100644 index 00000000..0712dfbc --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/assignment.json @@ -0,0 +1,29 @@ +{ + "subject_assignments": { + "subject_security_level":{ + "admin": ["high"], + "demo": ["medium"] + } + }, + + "action_assignments": { + "resource_action":{ + "pause": ["vm_admin"], + "unpause": ["vm_admin"], + "start": ["vm_admin"], + "stop": ["vm_admin"], + "list": ["vm_access", "vm_admin"], + "create": ["vm_admin"], + "storage_list": ["storage_access"], + "download": ["storage_access"], + "post": ["storage_admin"], + "upload": ["storage_admin"] + } + }, + + "object_assignments": { + "object_security_level": { + "servers": ["low"] + } + } +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metadata.json new file mode 100644 index 00000000..c419c815 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metadata.json @@ -0,0 +1,18 @@ +{ + "name": "MLS_Policy", + "model": "MLS", + "genre": "authz", + "description": "Multi Level Security Policy", + + "subject_categories": [ + "subject_security_level" + ], + + "action_categories": [ + "resource_action" + ], + + "object_categories": [ + "object_security_level" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metarule.json new file mode 100644 index 00000000..e068927c --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/metarule.json @@ -0,0 +1,12 @@ +{ + "sub_meta_rules": { + "mls_rule": { + "subject_categories": ["subject_security_level"], + "action_categories": ["resource_action"], + "object_categories": ["object_security_level"], + "algorithm": "inclusion" + } + }, + "aggregation": "all_true" +} + diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/perimeter.json new file mode 100644 index 00000000..47a8ee45 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/perimeter.json @@ -0,0 +1,21 @@ +{ + "subjects": [ + "admin", + "demo" + ], + "actions": [ + "pause", + "unpause", + "start", + "stop", + "create", + "list", + "upload", + "download", + "post", + "storage_list" + ], + "objects": [ + "servers" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/rule.json new file mode 100644 index 00000000..b17dc822 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/rule.json @@ -0,0 +1,16 @@ +{ + "mls_rule":[ + ["high", "vm_admin", "medium"], + ["high", "vm_admin", "low"], + ["medium", "vm_admin", "low"], + ["high", "vm_access", "medium"], + ["high", "vm_access", "low"], + ["medium", "vm_access", "low"], + ["high", "storage_admin", "medium"], + ["high", "storage_admin", "low"], + ["medium", "storage_admin", "low"], + ["high", "storage_access", "medium"], + ["high", "storage_access", "low"], + ["medium", "storage_access", "low"] + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/scope.json new file mode 100644 index 00000000..6cc1c28e --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_mls_authz/scope.json @@ -0,0 +1,26 @@ +{ + "subject_scopes": { + "subject_security_level": [ + "high", + "medium", + "low" + ] + }, + + "action_scopes": { + "resource_action": [ + "vm_admin", + "vm_access", + "storage_admin", + "storage_access" + ] + }, + + "object_scopes": { + "object_security_level": [ + "high", + "medium", + "low" + ] + } +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/assignment.json new file mode 100644 index 00000000..f2378333 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/assignment.json @@ -0,0 +1,48 @@ +{ + "subject_assignments": { + "role": { + "admin": ["root_role"], + "demo": ["dev_role"] + } + }, + "action_assignments": { + "action_id": { + "read": ["read"], + "write": ["write"] + } + }, + "object_assignments": { + "object_id": { + "authz.subjects": ["authz.subjects"], + "authz.objects": ["authz.objects"], + "authz.actions": ["authz.actions"], + "authz.subject_categories": ["authz.subject_categories"], + "authz.object_categories": ["authz.object_categories"], + "authz.action_categories": ["authz.action_categories"], + "authz.subject_scopes": ["authz.subject_scopes"], + "authz.object_scopes": ["authz.object_scopes"], + "authz.action_scopes": ["authz.action_scopes"], + "authz.subject_assignments": ["authz.subject_assignments"], + "authz.object_assignments": ["authz.object_assignments"], + "authz.action_assignments": ["authz.action_assignments"], + "authz.aggregation_algorithm": ["authz.aggregation_algorithm"], + "authz.sub_meta_rules": ["authz.sub_meta_rules"], + "authz.rules": ["authz.rules"], + "admin.subjects": ["admin.subjects"], + "admin.objects": ["admin.objects"], + "admin.actions": ["admin.actions"], + "admin.subject_categories": ["admin.subject_categories"], + "admin.object_categories": ["admin.object_categories"], + "admin.action_categories": ["admin.action_categories"], + "admin.subject_scopes": ["admin.subject_scopes"], + "admin.object_scopes": ["admin.object_scopes"], + "admin.action_scopes": ["admin.action_scopes"], + "admin.subject_assignments": ["admin.subject_assignments"], + "admin.object_assignments": ["admin.object_assignments"], + "admin.action_assignments": ["admin.action_assignments"], + "admin.aggregation_algorithm": ["admin.aggregation_algorithm"], + "admin.sub_meta_rules": ["admin.sub_meta_rules"], + "admin.rules": ["admin.rules"] + } + } +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metadata.json new file mode 100644 index 00000000..9ee8a11d --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metadata.json @@ -0,0 +1,18 @@ +{ + "name": "RBAC Admin Policy", + "model": "RBAC", + "genre": "admin", + "description": "", + + "subject_categories": [ + "role" + ], + + "action_categories": [ + "action_id" + ], + + "object_categories": [ + "object_id" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metarule.json new file mode 100644 index 00000000..86dbfad2 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/metarule.json @@ -0,0 +1,12 @@ +{ + "sub_meta_rules": { + "rbac_rule": { + "subject_categories": ["role"], + "action_categories": ["action_id"], + "object_categories": ["object_id"], + "algorithm": "inclusion" + } + }, + "aggregation": "all_true" +} + diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/perimeter.json new file mode 100644 index 00000000..1155533e --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/perimeter.json @@ -0,0 +1,42 @@ +{ + "subjects": [ + "admin", + "demo" + ], + "actions": [ + "read", + "write" + ], + "objects": [ + "authz.subjects", + "authz.objects", + "authz.actions", + "authz.subject_categories", + "authz.object_categories", + "authz.action_categories", + "authz.subject_scopes", + "authz.object_scopes", + "authz.action_scopes", + "authz.subject_assignments", + "authz.object_assignments", + "authz.action_assignments", + "authz.aggregation_algorithm", + "authz.sub_meta_rules", + "authz.rules", + "admin.subjects", + "admin.objects", + "admin.actions", + "admin.subject_categories", + "admin.object_categories", + "admin.action_categories", + "admin.subject_scopes", + "admin.object_scopes", + "admin.action_scopes", + "admin.subject_assignments", + "admin.object_assignments", + "admin.action_assignments", + "admin.aggregation_algorithm", + "admin.sub_meta_rules", + "admin.rules" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/rule.json new file mode 100644 index 00000000..c89ceff3 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/rule.json @@ -0,0 +1,94 @@ +{ + "rbac_rule":[ + ["root_role" , "read", "authz.subjects"], + ["root_role" , "read", "authz.objects"], + ["root_role" , "read", "authz.actions"], + ["root_role" , "read", "authz.subject_categories"], + ["root_role" , "read", "authz.object_categories"], + ["root_role" , "read", "authz.action_categories"], + ["root_role" , "read", "authz.subject_scopes"], + ["root_role" , "read", "authz.object_scopes"], + ["root_role" , "read", "authz.action_scopes"], + ["root_role" , "read", "authz.subject_assignments"], + ["root_role" , "read", "authz.object_assignments"], + ["root_role" , "read", "authz.action_assignments"], + ["root_role" , "read", "authz.aggregation_algorithm"], + ["root_role" , "read", "authz.sub_meta_rules"], + ["root_role" , "read", "authz.rules"], + ["root_role" , "write", "authz.subjects"], + ["root_role" , "write", "authz.objects"], + ["root_role" , "write", "authz.actions"], + ["root_role" , "write", "authz.subject_categories"], + ["root_role" , "write", "authz.object_categories"], + ["root_role" , "write", "authz.action_categories"], + ["root_role" , "write", "authz.subject_scopes"], + ["root_role" , "write", "authz.object_scopes"], + ["root_role" , "write", "authz.action_scopes"], + ["root_role" , "write", "authz.subject_assignments"], + ["root_role" , "write", "authz.object_assignments"], + ["root_role" , "write", "authz.action_assignments"], + ["root_role" , "write", "authz.aggregation_algorithm"], + ["root_role" , "write", "authz.sub_meta_rules"], + ["root_role" , "write", "authz.rules"], + ["root_role" , "read", "admin.subjects"], + ["root_role" , "read", "admin.objects"], + ["root_role" , "read", "admin.actions"], + ["root_role" , "read", "admin.subject_categories"], + ["root_role" , "read", "admin.object_categories"], + ["root_role" , "read", "admin.action_categories"], + ["root_role" , "read", "admin.subject_scopes"], + ["root_role" , "read", "admin.object_scopes"], + ["root_role" , "read", "admin.action_scopes"], + ["root_role" , "read", "admin.subject_assignments"], + ["root_role" , "read", "admin.object_assignments"], + ["root_role" , "read", "admin.action_assignments"], + ["root_role" , "read", "admin.aggregation_algorithm"], + ["root_role" , "read", "admin.sub_meta_rules"], + ["root_role" , "read", "admin.rules"], + ["root_role" , "write", "admin.subjects"], + ["root_role" , "write", "admin.objects"], + ["root_role" , "write", "admin.actions"], + ["root_role" , "write", "admin.subject_categories"], + ["root_role" , "write", "admin.object_categories"], + ["root_role" , "write", "admin.action_categories"], + ["root_role" , "write", "admin.subject_scopes"], + ["root_role" , "write", "admin.object_scopes"], + ["root_role" , "write", "admin.action_scopes"], + ["root_role" , "write", "admin.subject_assignments"], + ["root_role" , "write", "admin.object_assignments"], + ["root_role" , "write", "admin.action_assignments"], + ["root_role" , "write", "admin.aggregation_algorithm"], + ["root_role" , "write", "admin.sub_meta_rules"], + ["root_role" , "write", "admin.rules"], + ["dev_role" , "read", "authz.subjects"], + ["dev_role" , "read", "authz.objects"], + ["dev_role" , "read", "authz.actions"], + ["dev_role" , "read", "authz.subject_categories"], + ["dev_role" , "read", "authz.object_categories"], + ["dev_role" , "read", "authz.action_categories"], + ["dev_role" , "read", "authz.subject_scopes"], + ["dev_role" , "read", "authz.object_scopes"], + ["dev_role" , "read", "authz.action_scopes"], + ["dev_role" , "read", "authz.subject_assignments"], + ["dev_role" , "read", "authz.object_assignments"], + ["dev_role" , "read", "authz.action_assignments"], + ["dev_role" , "read", "authz.aggregation_algorithm"], + ["dev_role" , "read", "authz.sub_meta_rules"], + ["dev_role" , "read", "authz.rules"], + ["dev_role" , "read", "admin.subjects"], + ["dev_role" , "read", "admin.objects"], + ["dev_role" , "read", "admin.actions"], + ["dev_role" , "read", "admin.subject_categories"], + ["dev_role" , "read", "admin.object_categories"], + ["dev_role" , "read", "admin.action_categories"], + ["dev_role" , "read", "admin.subject_scopes"], + ["dev_role" , "read", "admin.object_scopes"], + ["dev_role" , "read", "admin.action_scopes"], + ["dev_role" , "read", "admin.subject_assignments"], + ["dev_role" , "read", "admin.object_assignments"], + ["dev_role" , "read", "admin.action_assignments"], + ["dev_role" , "read", "admin.aggregation_algorithm"], + ["dev_role" , "read", "admin.sub_meta_rules"], + ["dev_role" , "read", "admin.rules"] + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/scope.json new file mode 100644 index 00000000..149056a6 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_rbac_admin/scope.json @@ -0,0 +1,48 @@ +{ + "subject_scopes": { + "role": [ + "root_role", + "dev_role" + ] + }, + "action_scopes": { + "action_id": [ + "read", + "write" + ] + }, + "object_scopes": { + "object_id": [ + "authz.subjects", + "authz.objects", + "authz.actions", + "authz.subject_categories", + "authz.object_categories", + "authz.action_categories", + "authz.subject_scopes", + "authz.object_scopes", + "authz.action_scopes", + "authz.subject_assignments", + "authz.object_assignments", + "authz.action_assignments", + "authz.aggregation_algorithm", + "authz.sub_meta_rules", + "authz.rules", + "admin.subjects", + "admin.objects", + "admin.actions", + "admin.subject_categories", + "admin.object_categories", + "admin.action_categories", + "admin.subject_scopes", + "admin.object_scopes", + "admin.action_scopes", + "admin.subject_assignments", + "admin.object_assignments", + "admin.action_assignments", + "admin.aggregation_algorithm", + "admin.sub_meta_rules", + "admin.rules" + ] + } +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/assignment.json b/moonv4/moon_orchestrator/conf/policies/policy_root/assignment.json new file mode 100644 index 00000000..e849ae13 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_root/assignment.json @@ -0,0 +1,39 @@ +{ + "subject_assignments": { + "role": { + "admin": ["root_role"] + } + }, + + "action_assignments": { + "action_id": { + "read": ["read"], + "write": ["write"] + } + }, + + "object_assignments": { + "object_id": { + "templates": ["templates"], + "sub_meta_rule_algorithms": ["sub_meta_rule_algorithms"], + "aggregation_algorithms": ["aggregation_algorithms"], + "tenants": ["tenants"], + "intra_extensions": ["intra_extensions"], + "admin.subjects": ["admin.subjects"], + "admin.objects": ["admin.objects"], + "admin.actions": ["admin.actions"], + "admin.subject_categories": ["admin.subject_categories"], + "admin.object_categories": ["admin.object_categories"], + "admin.action_categories": ["admin.action_categories"], + "admin.subject_category_scopes": ["admin.subject_category_scopes"], + "admin.object_category_scopes": ["admin.object_category_scopes"], + "admin.action_category_scopes": ["admin.action_category_scopes"], + "admin.subject_assignments": ["admin.subject_assignments"], + "admin.object_assignments": ["admin.object_assignments"], + "admin.action_assignments": ["admin.action_assignments"], + "admin.aggregation_algorithm": ["admin.aggregation_algorithm"], + "admin.sub_meta_rules": ["admin.sub_meta_rules"], + "admin.rules": ["admin.rules"] + } + } +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/metadata.json b/moonv4/moon_orchestrator/conf/policies/policy_root/metadata.json new file mode 100644 index 00000000..9dd7a928 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_root/metadata.json @@ -0,0 +1,19 @@ +{ + "name": "Root Policy", + "model": "RBAC", + "genre": "admin", + "description": "root extension", + "pdp_pipeline": ["authz:rbac_rule"], + + "subject_categories": [ + "role" + ], + + "action_categories": [ + "action_id" + ], + + "object_categories": [ + "object_id" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/metarule.json b/moonv4/moon_orchestrator/conf/policies/policy_root/metarule.json new file mode 100644 index 00000000..86dbfad2 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_root/metarule.json @@ -0,0 +1,12 @@ +{ + "sub_meta_rules": { + "rbac_rule": { + "subject_categories": ["role"], + "action_categories": ["action_id"], + "object_categories": ["object_id"], + "algorithm": "inclusion" + } + }, + "aggregation": "all_true" +} + diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/perimeter.json b/moonv4/moon_orchestrator/conf/policies/policy_root/perimeter.json new file mode 100644 index 00000000..788a27f2 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_root/perimeter.json @@ -0,0 +1,31 @@ +{ + "subjects": [ + "admin" + ], + "actions": [ + "read", + "write" + ], + "objects": [ + "templates", + "aggregation_algorithms", + "sub_meta_rule_algorithms", + "tenants", + "intra_extensions", + "admin.subjects", + "admin.objects", + "admin.actions", + "admin.subject_categories", + "admin.object_categories", + "admin.action_categories", + "admin.subject_category_scopes", + "admin.object_category_scopes", + "admin.action_category_scopes", + "admin.subject_assignments", + "admin.object_assignments", + "admin.action_assignments", + "admin.aggregation_algorithm", + "admin.sub_meta_rules", + "admin.rules" + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/rule.json b/moonv4/moon_orchestrator/conf/policies/policy_root/rule.json new file mode 100644 index 00000000..9bbd5e4c --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_root/rule.json @@ -0,0 +1,44 @@ +{ + "rbac_rule":[ + ["root_role" , "read", "templates"], + ["root_role" , "read", "aggregation_algorithms"], + ["root_role" , "read", "sub_meta_rule_algorithms"], + ["root_role" , "read", "tenants"], + ["root_role" , "read", "intra_extensions"], + ["root_role" , "write", "templates"], + ["root_role" , "write", "aggregation_algorithms"], + ["root_role" , "write", "sub_meta_rule_algorithms"], + ["root_role" , "write", "tenants"], + ["root_role" , "write", "intra_extensions"], + ["root_role" , "read", "admin.subjects"], + ["root_role" , "read", "admin.objects"], + ["root_role" , "read", "admin.actions"], + ["root_role" , "read", "admin.subject_categories"], + ["root_role" , "read", "admin.object_categories"], + ["root_role" , "read", "admin.action_categories"], + ["root_role" , "read", "admin.subject_category_scopes"], + ["root_role" , "read", "admin.object_category_scopes"], + ["root_role" , "read", "admin.action_category_scopes"], + ["root_role" , "read", "admin.subject_assignments"], + ["root_role" , "read", "admin.object_assignments"], + ["root_role" , "read", "admin.action_assignments"], + ["root_role" , "read", "admin.aggregation_algorithm"], + ["root_role" , "read", "admin.sub_meta_rules"], + ["root_role" , "read", "admin.rules"], + ["root_role" , "write", "admin.subjects"], + ["root_role" , "write", "admin.objects"], + ["root_role" , "write", "admin.actions"], + ["root_role" , "write", "admin.subject_categories"], + ["root_role" , "write", "admin.object_categories"], + ["root_role" , "write", "admin.action_categories"], + ["root_role" , "write", "admin.subject_category_scopes"], + ["root_role" , "write", "admin.object_category_scopes"], + ["root_role" , "write", "admin.action_category_scopes"], + ["root_role" , "write", "admin.subject_assignments"], + ["root_role" , "write", "admin.object_assignments"], + ["root_role" , "write", "admin.action_assignments"], + ["root_role" , "write", "admin.aggregation_algorithm"], + ["root_role" , "write", "admin.sub_meta_rules"], + ["root_role" , "write", "admin.rules"] + ] +} diff --git a/moonv4/moon_orchestrator/conf/policies/policy_root/scope.json b/moonv4/moon_orchestrator/conf/policies/policy_root/scope.json new file mode 100644 index 00000000..43f9ced8 --- /dev/null +++ b/moonv4/moon_orchestrator/conf/policies/policy_root/scope.json @@ -0,0 +1,39 @@ +{ + "subject_scopes": { + "role": [ + "root_role" + ] + }, + + "action_scopes": { + "action_id": [ + "read", + "write" + ] + }, + + "object_scopes": { + "object_id": [ + "templates", + "aggregation_algorithms", + "sub_meta_rule_algorithms", + "tenants", + "intra_extensions", + "admin.subjects", + "admin.objects", + "admin.actions", + "admin.subject_categories", + "admin.object_categories", + "admin.action_categories", + "admin.subject_category_scopes", + "admin.object_category_scopes", + "admin.action_category_scopes", + "admin.subject_assignments", + "admin.object_assignments", + "admin.action_assignments", + "admin.aggregation_algorithm", + "admin.sub_meta_rules", + "admin.rules" + ] + } +} -- cgit 1.2.3-korg