167 lines
6.6 KiB
Diff
167 lines
6.6 KiB
Diff
From 86f741bf77f39d4af3698b71797e430c2a6989c3 Mon Sep 17 00:00:00 2001
|
|
Message-Id: <86f741bf77f39d4af3698b71797e430c2a6989c3@dist-git>
|
|
From: Michal Privoznik <mprivozn@redhat.com>
|
|
Date: Thu, 3 Jan 2019 10:03:44 +0100
|
|
Subject: [PATCH] qemu_security: Fully implement qemuSecurityDomainSetPathLabel
|
|
|
|
Even though the current use of the function does not require full
|
|
implementation with transactions (none of the callers pass a path
|
|
somewhere under /dev), it doesn't hurt either. Moreover, in
|
|
future patches the paradigm is going to shift so that any API
|
|
that touches a file is required to use transactions.
|
|
|
|
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
Reviewed-by: John Ferlan <jferlan@redhat.com>
|
|
(cherry picked from commit da24db2d30352c094f76dffb523e7f344ff8e30d)
|
|
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1658112
|
|
|
|
Signed-off-by: Erik Skultety <eskultet@redhat.com>
|
|
Message-Id: <4de2beabd9868259f1856f7eafcc835b5b2a3d6b.1546506016.git.eskultet@redhat.com>
|
|
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
|
---
|
|
src/qemu/qemu_domain.c | 3 +--
|
|
src/qemu/qemu_process.c | 15 ++++++---------
|
|
src/qemu/qemu_security.c | 30 ++++++++++++++++++++++++++++++
|
|
src/qemu/qemu_security.h | 6 +++++-
|
|
4 files changed, 42 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
|
|
index 95b84af78a..c9899b9e6d 100644
|
|
--- a/src/qemu/qemu_domain.c
|
|
+++ b/src/qemu/qemu_domain.c
|
|
@@ -801,8 +801,7 @@ qemuDomainWriteMasterKeyFile(virQEMUDriverPtr driver,
|
|
goto cleanup;
|
|
}
|
|
|
|
- if (qemuSecurityDomainSetPathLabel(driver->securityManager,
|
|
- vm->def, path, false) < 0)
|
|
+ if (qemuSecurityDomainSetPathLabel(driver, vm, path, false) < 0)
|
|
goto cleanup;
|
|
|
|
ret = 0;
|
|
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
|
|
index 34aac69afc..c0f95dd5f1 100644
|
|
--- a/src/qemu/qemu_process.c
|
|
+++ b/src/qemu/qemu_process.c
|
|
@@ -2778,8 +2778,7 @@ qemuProcessStartManagedPRDaemon(virDomainObjPtr vm)
|
|
virCgroupAddMachineTask(priv->cgroup, cpid) < 0)
|
|
goto cleanup;
|
|
|
|
- if (qemuSecurityDomainSetPathLabel(driver->securityManager,
|
|
- vm->def, socketPath, true) < 0)
|
|
+ if (qemuSecurityDomainSetPathLabel(driver, vm, socketPath, true) < 0)
|
|
goto cleanup;
|
|
|
|
priv->prDaemonRunning = true;
|
|
@@ -3656,7 +3655,7 @@ qemuProcessNeedMemoryBackingPath(virDomainDefPtr def,
|
|
|
|
static int
|
|
qemuProcessBuildDestroyMemoryPathsImpl(virQEMUDriverPtr driver,
|
|
- virDomainDefPtr def,
|
|
+ virDomainObjPtr vm,
|
|
const char *path,
|
|
bool build)
|
|
{
|
|
@@ -3671,8 +3670,7 @@ qemuProcessBuildDestroyMemoryPathsImpl(virQEMUDriverPtr driver,
|
|
return -1;
|
|
}
|
|
|
|
- if (qemuSecurityDomainSetPathLabel(driver->securityManager,
|
|
- def, path, true) < 0)
|
|
+ if (qemuSecurityDomainSetPathLabel(driver, vm, path, true) < 0)
|
|
return -1;
|
|
} else {
|
|
if (virFileDeleteTree(path) < 0)
|
|
@@ -3708,7 +3706,7 @@ qemuProcessBuildDestroyMemoryPaths(virQEMUDriverPtr driver,
|
|
if (!path)
|
|
goto cleanup;
|
|
|
|
- if (qemuProcessBuildDestroyMemoryPathsImpl(driver, vm->def,
|
|
+ if (qemuProcessBuildDestroyMemoryPathsImpl(driver, vm,
|
|
path, build) < 0)
|
|
goto cleanup;
|
|
|
|
@@ -3720,7 +3718,7 @@ qemuProcessBuildDestroyMemoryPaths(virQEMUDriverPtr driver,
|
|
if (qemuGetMemoryBackingDomainPath(vm->def, cfg, &path) < 0)
|
|
goto cleanup;
|
|
|
|
- if (qemuProcessBuildDestroyMemoryPathsImpl(driver, vm->def,
|
|
+ if (qemuProcessBuildDestroyMemoryPathsImpl(driver, vm,
|
|
path, build) < 0)
|
|
goto cleanup;
|
|
|
|
@@ -4904,8 +4902,7 @@ qemuProcessMakeDir(virQEMUDriverPtr driver,
|
|
goto cleanup;
|
|
}
|
|
|
|
- if (qemuSecurityDomainSetPathLabel(driver->securityManager,
|
|
- vm->def, path, true) < 0)
|
|
+ if (qemuSecurityDomainSetPathLabel(driver, vm, path, true) < 0)
|
|
goto cleanup;
|
|
|
|
ret = 0;
|
|
diff --git a/src/qemu/qemu_security.c b/src/qemu/qemu_security.c
|
|
index af3be42854..268def309a 100644
|
|
--- a/src/qemu/qemu_security.c
|
|
+++ b/src/qemu/qemu_security.c
|
|
@@ -493,3 +493,33 @@ qemuSecurityCleanupTPMEmulator(virQEMUDriverPtr driver,
|
|
{
|
|
virSecurityManagerRestoreTPMLabels(driver->securityManager, def);
|
|
}
|
|
+
|
|
+
|
|
+int
|
|
+qemuSecurityDomainSetPathLabel(virQEMUDriverPtr driver,
|
|
+ virDomainObjPtr vm,
|
|
+ const char *path,
|
|
+ bool allowSubtree)
|
|
+{
|
|
+ int ret = -1;
|
|
+
|
|
+ if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT) &&
|
|
+ virSecurityManagerTransactionStart(driver->securityManager) < 0)
|
|
+ goto cleanup;
|
|
+
|
|
+ if (virSecurityManagerDomainSetPathLabel(driver->securityManager,
|
|
+ vm->def,
|
|
+ path,
|
|
+ allowSubtree) < 0)
|
|
+ goto cleanup;
|
|
+
|
|
+ if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT) &&
|
|
+ virSecurityManagerTransactionCommit(driver->securityManager,
|
|
+ vm->pid) < 0)
|
|
+ goto cleanup;
|
|
+
|
|
+ ret = 0;
|
|
+ cleanup:
|
|
+ virSecurityManagerTransactionAbort(driver->securityManager);
|
|
+ return ret;
|
|
+}
|
|
diff --git a/src/qemu/qemu_security.h b/src/qemu/qemu_security.h
|
|
index a189b63828..fd11fbdd9d 100644
|
|
--- a/src/qemu/qemu_security.h
|
|
+++ b/src/qemu/qemu_security.h
|
|
@@ -95,12 +95,16 @@ int qemuSecurityStartTPMEmulator(virQEMUDriverPtr driver,
|
|
void qemuSecurityCleanupTPMEmulator(virQEMUDriverPtr driver,
|
|
virDomainDefPtr def);
|
|
|
|
+int qemuSecurityDomainSetPathLabel(virQEMUDriverPtr driver,
|
|
+ virDomainObjPtr vm,
|
|
+ const char *path,
|
|
+ bool allowSubtree);
|
|
+
|
|
/* Please note that for these APIs there is no wrapper yet. Do NOT blindly add
|
|
* new APIs here. If an API can touch a /dev file add a proper wrapper instead.
|
|
*/
|
|
# define qemuSecurityCheckAllLabel virSecurityManagerCheckAllLabel
|
|
# define qemuSecurityClearSocketLabel virSecurityManagerClearSocketLabel
|
|
-# define qemuSecurityDomainSetPathLabel virSecurityManagerDomainSetPathLabel
|
|
# define qemuSecurityGenLabel virSecurityManagerGenLabel
|
|
# define qemuSecurityGetBaseLabel virSecurityManagerGetBaseLabel
|
|
# define qemuSecurityGetDOI virSecurityManagerGetDOI
|
|
--
|
|
2.22.0
|
|
|