Creating Policy Elements

Policy rule criteria consist of resource sets, user sets, signature sets, process sets, action, and effect, and are called policy elements. These elements should exist on the CipherTrust Manager before you can use them in security policies. This section describes steps to create policy elements using the CTE API.

Click the following tabs for details on policy elements.

Creating User Sets

• The name field is mandatory for creating a user set.

• Any number of users can be added to a single user set.

• Add users by specifying uname, gname, uid, or gid.

The following sample creates a user set, UserSet1 having two users, user1 and user2.

API

/v1/transparent-encryption/usersets

Sample

{
    "name": UserSet1,
       "users": [
            {
                "gid": 1001,
                "gname": "user1",
                "os_domain": "Linux",
                "uid": 1001,
                "uname": "user1"
            },
            {
                "gid": 1002,
                "gname": "user2",
                "os_domain": "Linux",
                "uid": 1002,
                "uname": "user2"
            }
        ]
}

Creating Resource Sets

• The name field is mandatory for creating a resource set.

• The type field determines the type of the resource set. The type can be Directory or Classification. The default type is Directory.

• Any number of resources can be added to a single resource set.

• Add resources by specifying paths using directory and/or file fields. For Directory type resource sets, you can specify whether to include subdirectories by using include_subfolders. Set to true to include subdirectories, set to false to exclude.

• Set hdfs to true for an HDFS path.

The following samples create two resource sets, ResourceSet1 and ResourceSetHDFS1 of the type Directory having two resources.

API

/v1/transparent-encryption/resourcesets

Sample

{
    "name": "ResourceSet1",   
    "resources": [
        {
                "directory": "/home/test-user/dir1/,
                "file": *.txt,
                "include_subfolders": true
        },
        {
                "directory": "/home/test-user/dir2/,
                "file": *.bin,
                "include_subfolders": true
        }
    ],
    "type": "Directory"
}

Sample (HDFS)

{
    "name": "ResourceSetHDFS1",
    "resources": [
        {
                "directory": "/home/test-user/dir3/,
                "file": *.txt,
                "include_subfolders": true,
                "hdfs": true
        },
        {
                "directory": "/home/test-user/dir4/,
                "file": *.bin,
                "include_subfolders": true,
                "hdfs": true
        }
    ],
    "type": "Directory"
}

/v1/transparent-encryption/signaturesets

{
    "name": "SignatureSet1",   
    "source_list": [
        "/usr/bin",
        "/usr/sbin"
    ]
}

/v1/transparent-encryption/processsets

{
    "name": "ProcessSet1",
    "processes": [
        {
            "signature": "SignatureSet1",
            "directory": "/home/testUser",
            "file": "*"
        },
        {
            "signature": "SignatureSet2",
            "directory": "/home/kyloTest",
            "file": "kylo.bin"
        }
    ]
}