tree 337ecd3039f28d10afa09ebb2dba636ba69ca2ce
parent 9ab2f94794c4f4ca1856d35c87abe9fa77356fa3
author Johnathan Mantey <johnathanx.mantey@intel.com> 1617905138 -0700
committer Vernon Mauery <vernon.mauery@linux.intel.com> 1618949520 +0000

Permit assignment the IPMI management channel via JSON

phosphor-ipmi-host hard codes Channel 1 as the LAN NIC responsible for
managing and updating IPMI, Redfish, and web server access
permissions. Systems that do not have an lan-802.3 channel type
configured for IPMI Channel 1 have no way of assigning permissions
that flow to phosphor-user-manager. The inability to update
permissions within phosphor-user-manaager ultimaltely flows to Redfish
and HTTPS access.

The changes in this commit provide flexibility in assigning the IPMI
channel used to propagate permission changes to
phosphor-user-manager. A new boolean keyword, is_managment_nic, is
added. This entry is added to the JSON file, channel_config.json by
default, to announce which lan-802.3 IPMI channel is to be used to
assign IPMI permissions used by phosphor-user-manager. Only one
channel can have this ability. If the keyword is missing in the JSON
file, the code falls back to using Channel 1.

Tested:
Fully testing this change requires using code that dynamically
disables Channel 1. The SUT only has a single NIC, which is not
assigned to Channel 1.

Fully reprogrammed SPI to enter a pristine state.
Created a new user, channel 3, id 2, privilege=4

Confirmed LAN "ipmitool raw 6 1" succeeds
Confirmed Web access to new user account
Confirmed Redfish acess to new user account
Confirmed BMC console "ipmitool raw 6 1" succeeds

Used BMC console ipmitool to change user permissions from 4 to
15 (i.e. no access)

Confirmed LAN "ipmitool raw 6 1" succeeds
Confirmed Web access to new user account fails
Confirmed Redfish acess to new user account fails
Confirmed BMC console "ipmitool raw 6 1" fails

Used BMC console ipmitool to change user permissions from 15 to
4 (i.e. admin)

All of the prior tests work as expected.

Change-Id: I5f6941fefc4f80742e404de1f22ba10cbedf5d5d
Signed-off-by: Johnathan Mantey <johnathanx.mantey@intel.com>