External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-21 12:05:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: Skip labeling resources when seclabel defaults to none

Browse Source 
If a domain is explicitly configured with <seclabel type="none"/> we
correctly ensure that no labeling will be done by setting
norelabel=true. However, if no seclabel element is present in domain XML
and hypervisor is configured not to confine domains by default, we only
set type to "none" without turning off relabeling. Thus if such a domain
is being started, security driver wants to relabel resources with
default label, which doesn't make any sense.

Moreover, with SELinux security driver, the generated image label lacks
"s0" sensitivity, which causes setfilecon() fail with EINVAL in
enforcing mode.
(cherry picked from commit ce53382ba28179d3a504b29b4f888b6e130d53f0)
This commit is contained in:
Jiri Denemark 2012-07-25 14:38:27 +02:00 committed by Cole Robinson
parent b9964013c3
commit 3883ef0360
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/security/security_manager.c
View File

@ -296,10 +296,12 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr,
virDomainDefPtr vm)
{
if (vm->seclabel.type == VIR_DOMAIN_SECLABEL_DEFAULT) {
if (mgr->defaultConfined)
if (mgr->defaultConfined) {
vm->seclabel.type = VIR_DOMAIN_SECLABEL_DYNAMIC;
else
} else {
vm->seclabel.type = VIR_DOMAIN_SECLABEL_NONE;
vm->seclabel.norelabel = true;
}
}
if ((vm->seclabel.type == VIR_DOMAIN_SECLABEL_NONE) &&