External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-07 17:28:15 +00:00
Code
libvirt/tests/securityselinuxlabeldata/chardev.txt

8 lines
362 B
Plaintext
Raw Permalink Normal View History

Add a test suite for validating SELinux labelling There are many aspects of the guest XML which result in the SELinux driver applying file labelling. With the increasing configuration options it is desirable to test this behaviour. It is not possible to assume that the test suite has the ability to set SELinux labels. Most filesystems though will support extended attributes. Thus for the purpose of testing, it is possible to extend the existing LD_PRELOAD hack to override setfilecon() and getfilecon() to simply use the 'user.libvirt.selinux' attribute for the sake of testing. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-09-19 14:00:34 +01:00
/plain.txt;system_u:object_r:svirt_image_t:s0:c41,c264
/plain.dev;system_u:object_r:svirt_image_t:s0:c41,c264
/plain.fifo;system_u:object_r:svirt_image_t:s0:c41,c264
/nolabel.sock;
security_selinux.c: Relabel existing mode="bind" UNIX sockets This supports sockets created by libvirt and passed by FD using the same method as in security_dac.c. Signed-off-by: David Michael <david@bigbadwolfsecurity.com> Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-06-28 08:33:41 -04:00
/plain.sock;system_u:object_r:svirt_image_t:s0:c41,c264
Add a test suite for validating SELinux labelling There are many aspects of the guest XML which result in the SELinux driver applying file labelling. With the increasing configuration options it is desirable to test this behaviour. It is not possible to assume that the test suite has the ability to set SELinux labels. Most filesystems though will support extended attributes. Thus for the purpose of testing, it is possible to extend the existing LD_PRELOAD hack to override setfilecon() and getfilecon() to simply use the 'user.libvirt.selinux' attribute for the sake of testing. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-09-19 14:00:34 +01:00
/yeslabel.sock;system_u:object_r:svirt_image_t:s0:c41,c264
/altlabel.sock;system_u:object_r:svirt_image_custom_t:s0:c41,c264
Copy Permalink