Whitelist IPMI commands based on Restricted mode
Whitelisting of IPMI commands is done to ensure that in restricted
mode only whitelisted commands are executed. Commands that are not
whitelisted is restricted and insufficient privilege is returned as the
completion code.
When the server is deployed it would be set to restricted mode. In this
scenario certain IPMI commands need to be restricted which would not be
added to the whitelist.
Change-Id: I90b8124e34263c4ffc5bcf06a28a7e88231aaf40
Signed-off-by: Tom Joseph <tomjoseph@in.ibm.com>
diff --git a/Makefile b/Makefile
index 08900ca..447b129 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,8 @@
TESTADDSEL = testaddsel
DAEMON = ipmid
-DAEMON_OBJ = ipmid.o
+DAEMON_OBJ = ipmid.o \
+ ipmiwhitelist.o
LIB_APP_OBJ = apphandler.o \
sensorhandler.o \
@@ -44,8 +45,14 @@
INCLUDEDIR ?= /usr/include
LIBDIR ?= /usr/lib
+WHITELIST_SRC = ipmiwhitelist.C
+WHITELIST_CONF ?= host-ipmid-whitelist.conf
+
all: $(DAEMON) $(LIB_APP) $(LIB_HOST_SRV) $(TESTER)
+$(WHITELIST_SRC) : generate_whitelist.sh $(WHITELIST_CONF)
+ ./$^ > $@
+
%.o: %.C
$(CXX) -std=c++14 -fpic -c $< $(CXXFLAGS) $(INC_FLAG) $(IPMID_PATH) -o $@
@@ -62,11 +69,11 @@
$(CXX) $^ $(LDFLAGS) $(LIB_FLAG) -o $@ -ldl
clean:
- rm -f $(DAEMON) $(TESTER) *.o *.so
+ rm -f $(DAEMON) $(TESTER) *.o *.so $(WHITELIST_SRC)
$(TESTADDSEL): $(TESTADDSEL_OBJ)
$(CXX) $^ $(LDFLAGS) $(LIB_FLAG) -o $@ -ldl
-
+
install:
install -m 0755 -d $(DESTDIR)$(SBINDIR)
install -m 0755 ipmid $(DESTDIR)$(SBINDIR)
@@ -75,3 +82,4 @@
install -m 0755 -d $(DESTDIR)$(INCLUDEDIR)/host-ipmid
install -m 0644 $(INSTALLED_HEADERS) $(DESTDIR)$(INCLUDEDIR)/host-ipmid
+