External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-22 19:32:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

security_selinux: Implement virSecurityManagerMoveImageMetadata

Browse Source 
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Michal Privoznik 2019-03-21 16:21:27 +01:00
parent a379b86cd2
commit 44a204e674
1 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
src/security/security_selinux.c
View File

@ -1926,6 +1926,62 @@ virSecuritySELinuxSetImageLabel(virSecurityManagerPtr mgr,
}
struct virSecuritySELinuxMoveImageMetadataData {
virSecurityManagerPtr mgr;
const char *src;
const char *dst;
};
static int
virSecuritySELinuxMoveImageMetadataHelper(pid_t pid ATTRIBUTE_UNUSED,
void *opaque)
{
struct virSecuritySELinuxMoveImageMetadataData *data = opaque;
const char *paths[2] = { data->src, data->dst };
virSecurityManagerMetadataLockStatePtr state;
int ret;
if (!(state = virSecurityManagerMetadataLock(data->mgr, paths, ARRAY_CARDINALITY(paths))))
return -1;
ret = virSecurityMoveRememberedLabel(SECURITY_SELINUX_NAME, data->src, data->dst);
virSecurityManagerMetadataUnlock(data->mgr, &state);
return ret;
}
static int
virSecuritySELinuxMoveImageMetadata(virSecurityManagerPtr mgr,
pid_t pid,
virStorageSourcePtr src,
virStorageSourcePtr dst)
{
struct virSecuritySELinuxMoveImageMetadataData data = { .mgr = mgr, 0 };
int rc;
if (src && virStorageSourceIsLocalStorage(src))
data.src = src->path;
if (dst && virStorageSourceIsLocalStorage(dst))
data.dst = dst->path;
if (!data.src)
return 0;
if (pid == -1) {
rc = virProcessRunInFork(virSecuritySELinuxMoveImageMetadataHelper,
&data);
} else {
rc = virProcessRunInMountNamespace(pid,
virSecuritySELinuxMoveImageMetadataHelper,
&data);
}
return rc;
}
static int
virSecuritySELinuxSetHostdevLabelHelper(const char *file, void *opaque)
{
@ -3475,6 +3531,7 @@ virSecurityDriver virSecurityDriverSELinux = {
.domainSetSecurityImageLabel = virSecuritySELinuxSetImageLabel,
.domainRestoreSecurityImageLabel = virSecuritySELinuxRestoreImageLabel,
.domainMoveImageMetadata = virSecuritySELinuxMoveImageMetadata,
.domainSetSecurityMemoryLabel = virSecuritySELinuxSetMemoryLabel,
.domainRestoreSecurityMemoryLabel = virSecuritySELinuxRestoreMemoryLabel,