External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-10-05 22:05:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu: Restore label to temp file in qemuDomainScreenshot()

Browse Source 
Obtaining a screenshot via virDomainScreenshot() works like this:
  1) we create a temp file, label it, then
  2) tell QEMU to store the screenshot into it, and
  3) finally, open the file for transfer via virStream

Since the file is just temporary and even explicitly unlinked at
the end, no seclabel restoration is done. This makes perfect
sense for security models which attach a label to file itself
(DAC, SELinux) because the label is gone with the file. However,
for models where a list of files and allowed actions is kept on a
side (AppArmor) this approach means we just append files into the
profile and never remove them. In turn, the file grows and policy
update takes longer with each entry.

Restore the seclabel for AppArmor's sake.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
This commit is contained in:
Michal Privoznik 2022-06-02 14:05:25 +02:00
parent 215b2466cd
commit 8d2567bccf
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/qemu/qemu_driver.c
View File

@ -3423,8 +3423,13 @@ qemuDomainScreenshot(virDomainPtr dom,
endjob:
VIR_FORCE_CLOSE(tmp_fd);
if (unlink_tmp)
if (unlink_tmp) {
/* This may look pointless, since we're removing the file anyways, but
* it's crucial for AppArmor. Otherwise these temp files would
* accumulate in the domain's profile. */
qemuSecurityDomainRestorePathLabel(driver, vm, tmp);
unlink(tmp);
}
qemuDomainObjEndJob(vm);