External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-07 17:28:15 +00:00
Code

virt-aa-helper: Add support for smartcard host-certificates

Browse Source 
When emulating smartcard with host certificates, qemu needs to
be able to read the certificates files. Add necessary code to
add the smartcard certificates file path to the apparmor profile.

Passthrough support has been tested with spicevmc and remote-viewer.

v2:
- Fix CodingStyle
- Add support for 'host' case.
- Add a comment to mention that the passthrough case doesn't need
  some configuration
- Use one rule with '{,*}' instead of two rules.

Signed-off-by: Arnaud Patard <apatard@hupstream.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
Acked-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
This commit is contained in:
Arnaud Patard 2019-12-05 18:11:41 +01:00 committed by Christian Ehrhardt
parent c4a78d00f8
commit 800aed4644
No known key found for this signature in database
GPG Key ID: BA3E29338280B242
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/security/virt-aa-helper.c
View File

@ -1265,6 +1265,39 @@ get_files(vahControl * ctl)
}
}
for (i = 0; i < ctl->def->nsmartcards; i++) {
virDomainSmartcardDefPtr sc = ctl->def->smartcards[i];
virDomainSmartcardType sc_type = sc->type;
char *sc_db = (char *)VIR_DOMAIN_SMARTCARD_DEFAULT_DATABASE;
if (sc->data.cert.database)
sc_db = sc->data.cert.database;
switch (sc_type) {
/*
* Note: At time of writing, to get this working, qemu seccomp sandbox has
* to be disabled or the host must be running QEMU with commit
* 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8.
* It's possibly due to libcacard:vcard_emul_new_event_thread(), which calls
* PR_CreateThread(), which calls {g,s}etpriority(). And resourcecontrol seccomp
* filter forbids it (cf src/qemu/qemu_command.c which seems to always use
* resourcecontrol=deny).
*/
case VIR_DOMAIN_SMARTCARD_TYPE_HOST:
virBufferAddLit(&buf, " \"/etc/pki/nssdb/{,*}\" rk,\n");
break;
case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
virBufferAsprintf(&buf, " \"%s/{,*}\" rk,\n", sc_db);
break;
/*
* Nothing to do for passthrough, as the smartcard
* access is done through TCP or Spice
*/
case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH:
break;
case VIR_DOMAIN_SMARTCARD_TYPE_LAST:
break;
}
}
if (ctl->def->virtType == VIR_DOMAIN_VIRT_KVM) {
for (i = 0; i < ctl->def->nnets; i++) {
virDomainNetDefPtr net = ctl->def->nets[i];