External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 13:45:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu: tpm: Avoid security labels on incoming migration with shared storage

Browse Source 
When using shared storage there is no need to apply security labels on the
storage since the files have to have been labeled already on the source
side and we must assume that the source and destination side have been
setup to use the same uid and gid for running swtpm as well as share the
same security labels. Whether the security labels can be used at all
depends on the shared storage and whether and how it supports them.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Stefan Berger 2022-10-24 06:28:47 -04:00 committed by Michal Privoznik
parent 188dfeb398
commit 2e669ec789
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/qemu/qemu_tpm.c
View File

@ -932,10 +932,19 @@ qemuTPMEmulatorStart(virQEMUDriver *driver,
virCommandSetPidFile(cmd, pidfile);
virCommandSetErrorFD(cmd, &errfd);
if (qemuSecurityStartTPMEmulator(driver, vm, cmd,
cfg->swtpm_user, cfg->swtpm_group,
NULL, &cmdret) < 0)
return -1;
if (incomingMigration &&
virFileIsSharedFS(tpm->data.emulator.storagepath) == 1) {
/* security labels must have been set up on source already */
if (qemuSecurityCommandRun(driver, vm, cmd,
cfg->swtpm_user, cfg->swtpm_group,
NULL, &cmdret) < 0) {
goto error;
}
} else if (qemuSecurityStartTPMEmulator(driver, vm, cmd,
cfg->swtpm_user, cfg->swtpm_group,
NULL, &cmdret) < 0) {
goto error;
}
if (cmdret < 0) {
/* virCommandRun() hidden in qemuSecurityStartTPMEmulator()