mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-28 19:41:16 +00:00
security: Fix labelling host devices (bz 1145968)
The check for ISCSI devices was missing a check of subsys type, which meant we could skip labelling of other host devices as well. This fixes USB hotplug on F21 https://bugzilla.redhat.com/show_bug.cgi?id=1145968
This commit is contained in:
parent
b8b3c56566
commit
d3489548b5
@ -828,7 +828,8 @@ AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
|
||||
/* Like AppArmorRestoreSecurityImageLabel() for a networked disk,
|
||||
* do nothing for an iSCSI hostdev
|
||||
*/
|
||||
if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
||||
scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
return 0;
|
||||
|
||||
if (profile_loaded(secdef->imagelabel) < 0)
|
||||
|
@ -523,7 +523,8 @@ virSecurityDACSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
|
||||
/* Like virSecurityDACSetSecurityImageLabel() for a networked disk,
|
||||
* do nothing for an iSCSI hostdev
|
||||
*/
|
||||
if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
||||
scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
return 0;
|
||||
|
||||
cbdata.manager = mgr;
|
||||
@ -657,7 +658,8 @@ virSecurityDACRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr,
|
||||
/* Like virSecurityDACRestoreSecurityImageLabelInt() for a networked disk,
|
||||
* do nothing for an iSCSI hostdev
|
||||
*/
|
||||
if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
||||
scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
return 0;
|
||||
|
||||
switch ((virDomainHostdevSubsysType) dev->source.subsys.type) {
|
||||
|
@ -1329,7 +1329,8 @@ virSecuritySELinuxSetSecurityHostdevSubsysLabel(virDomainDefPtr def,
|
||||
/* Like virSecuritySELinuxSetSecurityImageLabelInternal() for a networked
|
||||
* disk, do nothing for an iSCSI hostdev
|
||||
*/
|
||||
if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
||||
scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
return 0;
|
||||
|
||||
switch (dev->source.subsys.type) {
|
||||
@ -1522,7 +1523,8 @@ virSecuritySELinuxRestoreSecurityHostdevSubsysLabel(virSecurityManagerPtr mgr,
|
||||
/* Like virSecuritySELinuxRestoreSecurityImageLabelInt() for a networked
|
||||
* disk, do nothing for an iSCSI hostdev
|
||||
*/
|
||||
if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
||||
scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
||||
return 0;
|
||||
|
||||
switch (dev->source.subsys.type) {
|
||||
|
Loading…
Reference in New Issue
Block a user