External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-02 09:55:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove re-entrant API call in SELinux/AppArmor security managers

Browse Source 
The security manager drivers are not allowed to call back
out to top level security manager APIs, since that results
in recursive mutex acquisition and thus deadlock. Remove
calls to virSecurityManagerGetModel from SELinux / AppArmor
drivers

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2013-02-11 14:22:56 +00:00
parent c059cdeaf3
commit 0ab49601a8
2 changed files with 18 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/security/security_apparmor.c
View File

@ -590,7 +590,8 @@ AppArmorRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
* LOCALSTATEDIR/log/libvirt/qemu/<vm name>.log * LOCALSTATEDIR/log/libvirt/qemu/<vm name>.log
*/ */
static int static int
AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr, virDomainDefPtr def) AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr def)
{ {
int rc = -1; int rc = -1;
char *profile_name = NULL; char *profile_name = NULL;
@ -603,12 +604,12 @@ AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr, virDomainDefPtr def)
if ((profile_name = get_profile_name(def)) == NULL) if ((profile_name = get_profile_name(def)) == NULL)
return rc; return rc;
if (STRNEQ(virSecurityManagerGetModel(mgr), secdef->model)) { if (STRNEQ(SECURITY_APPARMOR_NAME, secdef->model)) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("security label driver mismatch: " _("security label driver mismatch: "
"\'%s\' model configured for domain, but " "\'%s\' model configured for domain, but "
"hypervisor driver is \'%s\'."), "hypervisor driver is \'%s\'."),
secdef->model, virSecurityManagerGetModel(mgr)); secdef->model, SECURITY_APPARMOR_NAME);
if (use_apparmor() > 0) if (use_apparmor() > 0)
goto clean; goto clean;
} }

28
src/security/security_selinux.c
View File

@ -1803,12 +1803,12 @@ virSecuritySELinuxSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
if (secdef == NULL) if (secdef == NULL)
return -1; return -1;
if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { if (!STREQ(SECURITY_SELINUX_NAME, secdef->model)) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("security label driver mismatch: " _("security label driver mismatch: "
"'%s' model configured for domain, but " "'%s' model configured for domain, but "
"hypervisor driver is '%s'."), "hypervisor driver is '%s'."),
secdef->model, virSecurityManagerGetModel(mgr)); secdef->model, SECURITY_SELINUX_NAME);
return -1; return -1;
} }
@ -1823,7 +1823,7 @@ virSecuritySELinuxSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
} }
static int static int
virSecuritySELinuxSetSecurityProcessLabel(virSecurityManagerPtr mgr, virSecuritySELinuxSetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr def) virDomainDefPtr def)
{ {
/* TODO: verify DOI */ /* TODO: verify DOI */
@ -1837,12 +1837,12 @@ virSecuritySELinuxSetSecurityProcessLabel(virSecurityManagerPtr mgr,
return 0; return 0;
VIR_DEBUG("label=%s", secdef->label); VIR_DEBUG("label=%s", secdef->label);
if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { if (!STREQ(SECURITY_SELINUX_NAME, secdef->model)) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("security label driver mismatch: " _("security label driver mismatch: "
"'%s' model configured for domain, but " "'%s' model configured for domain, but "
"hypervisor driver is '%s'."), "hypervisor driver is '%s'."),
secdef->model, virSecurityManagerGetModel(mgr)); secdef->model, SECURITY_SELINUX_NAME);
if (security_getenforce() == 1) if (security_getenforce() == 1)
return -1; return -1;
} }
@ -1859,7 +1859,7 @@ virSecuritySELinuxSetSecurityProcessLabel(virSecurityManagerPtr mgr,
} }
static int static int
virSecuritySELinuxSetSecurityDaemonSocketLabel(virSecurityManagerPtr mgr, virSecuritySELinuxSetSecurityDaemonSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr def) virDomainDefPtr def)
{ {
/* TODO: verify DOI */ /* TODO: verify DOI */
@ -1875,12 +1875,12 @@ virSecuritySELinuxSetSecurityDaemonSocketLabel(virSecurityManagerPtr mgr,
if (secdef->label == NULL) if (secdef->label == NULL)
return 0; return 0;
if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { if (!STREQ(SECURITY_SELINUX_NAME, secdef->model)) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("security label driver mismatch: " _("security label driver mismatch: "
"'%s' model configured for domain, but " "'%s' model configured for domain, but "
"hypervisor driver is '%s'."), "hypervisor driver is '%s'."),
secdef->model, virSecurityManagerGetModel(mgr)); secdef->model, SECURITY_SELINUX_NAME);
goto done; goto done;
} }
@ -1912,7 +1912,7 @@ done:
} }
static int static int
virSecuritySELinuxSetSecuritySocketLabel(virSecurityManagerPtr mgr, virSecuritySELinuxSetSecuritySocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr vm) virDomainDefPtr vm)
{ {
virSecurityLabelDefPtr secdef; virSecurityLabelDefPtr secdef;
@ -1925,12 +1925,12 @@ virSecuritySELinuxSetSecuritySocketLabel(virSecurityManagerPtr mgr,
if (secdef->label == NULL) if (secdef->label == NULL)
return 0; return 0;
if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { if (!STREQ(SECURITY_SELINUX_NAME, secdef->model)) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("security label driver mismatch: " _("security label driver mismatch: "
"'%s' model configured for domain, but " "'%s' model configured for domain, but "
"hypervisor driver is '%s'."), "hypervisor driver is '%s'."),
secdef->model, virSecurityManagerGetModel(mgr)); secdef->model, SECURITY_SELINUX_NAME);
goto done; goto done;
} }
@ -1953,7 +1953,7 @@ done:
} }
static int static int
virSecuritySELinuxClearSecuritySocketLabel(virSecurityManagerPtr mgr, virSecuritySELinuxClearSecuritySocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr def) virDomainDefPtr def)
{ {
/* TODO: verify DOI */ /* TODO: verify DOI */
@ -1966,12 +1966,12 @@ virSecuritySELinuxClearSecuritySocketLabel(virSecurityManagerPtr mgr,
if (secdef->label == NULL) if (secdef->label == NULL)
return 0; return 0;
if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { if (!STREQ(SECURITY_SELINUX_NAME, secdef->model)) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("security label driver mismatch: " _("security label driver mismatch: "
"'%s' model configured for domain, but " "'%s' model configured for domain, but "
"hypervisor driver is '%s'."), "hypervisor driver is '%s'."),
secdef->model, virSecurityManagerGetModel(mgr)); secdef->model, SECURITY_SELINUX_NAME);
if (security_getenforce() == 1) if (security_getenforce() == 1)
return -1; return -1;
} }