External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-07 17:28:15 +00:00
Code

Allow passing a vroot into security manager hostdev labelling

Browse Source 
When LXC labels USB devices during hotplug, it is running in
host context, so it needs to pass in a vroot path to the
container root.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2012-11-27 16:17:47 +00:00
parent 89c5a9d0e8
commit df5928ea56
13 changed files with 95 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/qemu/qemu_cgroup.c
View File

@ -290,7 +290,8 @@ int qemuSetupCgroup(virQEMUDriverPtr driver,
continue;
if ((usb = usbGetDevice(hostdev->source.subsys.u.usb.bus,
hostdev->source.subsys.u.usb.device)) == NULL)
hostdev->source.subsys.u.usb.device,
NULL)) == NULL)
goto cleanup;
if (usbDeviceFileIterate(usb, qemuSetupHostUsbDeviceCgroup,

11
src/qemu/qemu_hostdev.c
View File

@ -179,7 +179,8 @@ qemuUpdateActiveUsbHostdevs(virQEMUDriverPtr driver,
continue;
usb = usbGetDevice(hostdev->source.subsys.u.usb.bus,
hostdev->source.subsys.u.usb.device);
hostdev->source.subsys.u.usb.device,
NULL);
if (!usb) {
VIR_WARN("Unable to reattach USB device %03d.%03d on domain %s",
hostdev->source.subsys.u.usb.bus,
@ -653,6 +654,7 @@ qemuFindHostdevUSBDevice(virDomainHostdevDefPtr hostdev,
if (vendor && bus) {
rc = usbFindDevice(vendor, product, bus, device,
NULL,
autoAddress ? false : mandatory,
usb);
if (rc < 0) {
@ -673,7 +675,7 @@ qemuFindHostdevUSBDevice(virDomainHostdevDefPtr hostdev,
if (vendor) {
usbDeviceList *devs;
rc = usbFindDeviceByVendor(vendor, product, mandatory, &devs);
rc = usbFindDeviceByVendor(vendor, product, NULL, mandatory, &devs);
if (rc < 0)
return -1;
@ -713,7 +715,7 @@ qemuFindHostdevUSBDevice(virDomainHostdevDefPtr hostdev,
bus, device);
}
} else if (!vendor && bus) {
if (usbFindDeviceByBus(bus, device, mandatory, usb) < 0)
if (usbFindDeviceByBus(bus, device, NULL, mandatory, usb) < 0)
return -1;
}
@ -934,7 +936,8 @@ qemuDomainReAttachHostUsbDevices(virQEMUDriverPtr driver,
continue;
usb = usbGetDevice(hostdev->source.subsys.u.usb.bus,
hostdev->source.subsys.u.usb.device);
hostdev->source.subsys.u.usb.device,
NULL);
if (!usb) {
VIR_WARN("Unable to reattach USB device %03d.%03d on domain %s",

11
src/qemu/qemu_hotplug.c
View File

@ -1105,7 +1105,8 @@ int qemuDomainAttachHostUsbDevice(virQEMUDriverPtr driver,
}
if ((usb = usbGetDevice(hostdev->source.subsys.u.usb.bus,
hostdev->source.subsys.u.usb.device)) == NULL)
hostdev->source.subsys.u.usb.device,
NULL)) == NULL)
goto error;
data.vm = vm;
@ -1173,7 +1174,7 @@ int qemuDomainAttachHostDevice(virQEMUDriverPtr driver,
}
if (virSecurityManagerSetHostdevLabel(driver->securityManager,
vm->def, hostdev) < 0)
vm->def, hostdev, NULL) < 0)
goto cleanup;
switch (hostdev->source.subsys.type) {
@ -1201,7 +1202,7 @@ int qemuDomainAttachHostDevice(virQEMUDriverPtr driver,
error:
if (virSecurityManagerRestoreHostdevLabel(driver->securityManager,
vm->def, hostdev) < 0)
vm->def, hostdev, NULL) < 0)
VIR_WARN("Unable to restore host device labelling on hotplug fail");
cleanup:
@ -2394,7 +2395,7 @@ qemuDomainDetachHostUsbDevice(virQEMUDriverPtr driver,
if (ret < 0)
return -1;
usb = usbGetDevice(subsys->u.usb.bus, subsys->u.usb.device);
usb = usbGetDevice(subsys->u.usb.bus, subsys->u.usb.device, NULL);
if (usb) {
usbDeviceListDel(driver->activeUsbHostdevs, usb);
usbFreeDevice(usb);
@ -2445,7 +2446,7 @@ int qemuDomainDetachThisHostDevice(virQEMUDriverPtr driver,
if (!ret) {
if (virSecurityManagerRestoreHostdevLabel(driver->securityManager,
vm->def, detach) < 0) {
vm->def, detach, NULL) < 0) {
VIR_WARN("Failed to restore host device labelling");
}
virDomainHostdevRemove(vm->def, idx);

10
src/security/security_apparmor.c
View File

@ -742,8 +742,8 @@ AppArmorReserveSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
static int
AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
struct SDPDOP *ptr;
int ret = -1;
@ -770,7 +770,8 @@ AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
switch (dev->source.subsys.type) {
case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: {
usbDevice *usb = usbGetDevice(dev->source.subsys.u.usb.bus,
dev->source.subsys.u.usb.device);
dev->source.subsys.u.usb.device,
vroot);
if (!usb)
goto done;
@ -808,7 +809,8 @@ done:
static int
AppArmorRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED)
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED,
const char *vroot ATTRIBUTE_UNUSED)
{
const virSecurityLabelDefPtr secdef =

20
src/security/security_dac.c
View File

@ -474,7 +474,8 @@ virSecurityDACSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
static int
virSecurityDACSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
void *params[] = {mgr, def};
virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr);
@ -494,7 +495,8 @@ virSecurityDACSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
return 0;
usb = usbGetDevice(dev->source.subsys.u.usb.bus,
dev->source.subsys.u.usb.device);
dev->source.subsys.u.usb.device,
vroot);
if (!usb)
goto done;
@ -550,8 +552,9 @@ virSecurityDACRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
static int
virSecurityDACRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def ATTRIBUTE_UNUSED,
virDomainHostdevDefPtr dev)
virDomainDefPtr def ATTRIBUTE_UNUSED,
virDomainHostdevDefPtr dev,
const char *vroot)
{
virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr);
@ -571,7 +574,8 @@ virSecurityDACRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr,
return 0;
usb = usbGetDevice(dev->source.subsys.u.usb.bus,
dev->source.subsys.u.usb.device);
dev->source.subsys.u.usb.device,
vroot);
if (!usb)
goto done;
@ -728,7 +732,8 @@ virSecurityDACRestoreSecurityAllLabel(virSecurityManagerPtr mgr,
for (i = 0 ; i < def->nhostdevs ; i++) {
if (virSecurityDACRestoreSecurityHostdevLabel(mgr,
def,
def->hostdevs[i]) < 0)
def->hostdevs[i],
NULL) < 0)
rc = -1;
}
for (i = 0 ; i < def->ndisks ; i++) {
@ -793,7 +798,8 @@ virSecurityDACSetSecurityAllLabel(virSecurityManagerPtr mgr,
for (i = 0 ; i < def->nhostdevs ; i++) {
if (virSecurityDACSetSecurityHostdevLabel(mgr,
def,
def->hostdevs[i]) < 0)
def->hostdevs[i],
NULL) < 0)
return -1;
}

6
src/security/security_driver.h
View File

@ -61,10 +61,12 @@ typedef int (*virSecurityDomainSetImageLabel) (virSecurityManagerPtr mgr,
virDomainDiskDefPtr disk);
typedef int (*virSecurityDomainRestoreHostdevLabel) (virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainHostdevDefPtr dev);
virDomainHostdevDefPtr dev,
const char *vroot);
typedef int (*virSecurityDomainSetHostdevLabel) (virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainHostdevDefPtr dev);
virDomainHostdevDefPtr dev,
const char *vroot);
typedef int (*virSecurityDomainSetSavedStateLabel) (virSecurityManagerPtr mgr,
virDomainDefPtr def,
const char *savefile);

10
src/security/security_manager.c
View File

@ -275,10 +275,11 @@ int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr,
int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr vm,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
if (mgr->drv->domainRestoreSecurityHostdevLabel)
return mgr->drv->domainRestoreSecurityHostdevLabel(mgr, vm, dev);
return mgr->drv->domainRestoreSecurityHostdevLabel(mgr, vm, dev, vroot);
virReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__);
return -1;
@ -286,10 +287,11 @@ int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr,
int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr vm,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
if (mgr->drv->domainSetSecurityHostdevLabel)
return mgr->drv->domainSetSecurityHostdevLabel(mgr, vm, dev);
return mgr->drv->domainSetSecurityHostdevLabel(mgr, vm, dev, vroot);
virReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__);
return -1;

6
src/security/security_manager.h
View File

@ -71,10 +71,12 @@ int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr,
virDomainDiskDefPtr disk);
int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainHostdevDefPtr dev);
virDomainHostdevDefPtr dev,
const char *vroot);
int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainHostdevDefPtr dev);
virDomainHostdevDefPtr dev,
const char *vroot);
int virSecurityManagerSetSavedStateLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
const char *savefile);

6
src/security/security_nop.c
View File

@ -84,14 +84,16 @@ static int virSecurityDomainSetImageLabelNop(virSecurityManagerPtr mgr ATTRIBUTE
static int virSecurityDomainRestoreHostdevLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr vm ATTRIBUTE_UNUSED,
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED)
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED,
const char *vroot ATTRIBUTE_UNUSED)
{
return 0;
}
static int virSecurityDomainSetHostdevLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr vm ATTRIBUTE_UNUSED,
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED)
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED,
const char *vroot ATTRIBUTE_UNUSED)
{
return 0;
}

20
src/security/security_selinux.c
View File

@ -1161,7 +1161,8 @@ virSecuritySELinuxSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
static int
virSecuritySELinuxSetSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr def,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
virSecurityLabelDefPtr secdef;
@ -1185,7 +1186,8 @@ virSecuritySELinuxSetSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UN
return 0;
usb = usbGetDevice(dev->source.subsys.u.usb.bus,
dev->source.subsys.u.usb.device);
dev->source.subsys.u.usb.device,
vroot);
if (!usb)
goto done;
@ -1238,7 +1240,8 @@ virSecuritySELinuxRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
static int
virSecuritySELinuxRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr def,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
virSecurityLabelDefPtr secdef;
@ -1262,7 +1265,8 @@ virSecuritySELinuxRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUT
return 0;
usb = usbGetDevice(dev->source.subsys.u.usb.bus,
dev->source.subsys.u.usb.device);
dev->source.subsys.u.usb.device,
vroot);
if (!usb)
goto done;
@ -1504,7 +1508,8 @@ virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr,
for (i = 0 ; i < def->nhostdevs ; i++) {
if (virSecuritySELinuxRestoreSecurityHostdevLabel(mgr,
def,
def->hostdevs[i]) < 0)
def->hostdevs[i],
NULL) < 0)
rc = -1;
}
for (i = 0 ; i < def->ndisks ; i++) {
@ -1874,8 +1879,9 @@ virSecuritySELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr,
for (i = 0 ; i < def->nhostdevs ; i++) {
if (virSecuritySELinuxSetSecurityHostdevLabel(mgr,
def,
def->hostdevs[i]) < 0)
def,
def->hostdevs[i],
NULL) < 0)
return -1;
}

16
src/security/security_stack.c
View File

@ -236,7 +236,8 @@ virSecurityStackRestoreSecurityImageLabel(virSecurityManagerPtr mgr,
static int
virSecurityStackSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr vm,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr);
@ -244,7 +245,10 @@ virSecurityStackSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
int rc = 0;
for (; item; item = item->next) {
if (virSecurityManagerSetHostdevLabel(item->securityManager, vm, dev) < 0)
if (virSecurityManagerSetHostdevLabel(item->securityManager,
vm,
dev,
vroot) < 0)
rc = -1;
}
@ -255,14 +259,18 @@ virSecurityStackSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
static int
virSecurityStackRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr vm,
virDomainHostdevDefPtr dev)
virDomainHostdevDefPtr dev,
const char *vroot)
{
virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr);
virSecurityStackItemPtr item = priv->itemsHead;
int rc = 0;
for (; item; item = item->next) {
if (virSecurityManagerRestoreHostdevLabel(item->securityManager, vm, dev) < 0)
if (virSecurityManagerRestoreHostdevLabel(item->securityManager,
vm,
dev,
vroot) < 0)
rc = -1;
}

17
src/util/hostusb.c
View File

@ -101,6 +101,7 @@ usbDeviceSearch(unsigned int vendor,
unsigned int product,
unsigned int bus,
unsigned int devno,
const char *vroot,
unsigned int flags)
{
DIR *dir = NULL;
@ -160,7 +161,7 @@ usbDeviceSearch(unsigned int vendor,
found = true;
}
usb = usbGetDevice(found_bus, found_devno);
usb = usbGetDevice(found_bus, found_devno, vroot);
if (!usb)
goto cleanup;
@ -189,6 +190,7 @@ cleanup:
int
usbFindDeviceByVendor(unsigned int vendor,
unsigned product,
const char *vroot,
bool mandatory,
usbDeviceList **devices)
{
@ -196,6 +198,7 @@ usbFindDeviceByVendor(unsigned int vendor,
int count;
if (!(list = usbDeviceSearch(vendor, product, 0 , 0,
vroot,
USB_DEVICE_FIND_BY_VENDOR)))
return -1;
@ -226,12 +229,14 @@ usbFindDeviceByVendor(unsigned int vendor,
int
usbFindDeviceByBus(unsigned int bus,
unsigned devno,
const char *vroot,
bool mandatory,
usbDevice **usb)
{
usbDeviceList *list;
if (!(list = usbDeviceSearch(0, 0, bus, devno,
vroot,
USB_DEVICE_FIND_BY_BUS)))
return -1;
@ -265,13 +270,15 @@ usbFindDevice(unsigned int vendor,
unsigned int product,
unsigned int bus,
unsigned int devno,
const char *vroot,
bool mandatory,
usbDevice **usb)
{
usbDeviceList *list;
unsigned int flags = USB_DEVICE_FIND_BY_VENDOR|USB_DEVICE_FIND_BY_BUS;
if (!(list = usbDeviceSearch(vendor, product, bus, devno, flags)))
if (!(list = usbDeviceSearch(vendor, product, bus, devno,
vroot, flags)))
return -1;
if (list->count == 0) {
@ -301,7 +308,8 @@ usbFindDevice(unsigned int vendor,
usbDevice *
usbGetDevice(unsigned int bus,
unsigned int devno)
unsigned int devno,
const char *vroot)
{
usbDevice *dev;
@ -321,7 +329,8 @@ usbGetDevice(unsigned int bus,
usbFreeDevice(dev);
return NULL;
}
if (virAsprintf(&dev->path, USB_DEVFS "%03d/%03d",
if (virAsprintf(&dev->path, "%s" USB_DEVFS "%03d/%03d",
vroot ? vroot : "",
dev->bus, dev->dev) < 0) {
virReportOOMError();
usbFreeDevice(dev);

6
src/util/hostusb.h
View File

@ -29,15 +29,18 @@ typedef struct _usbDevice usbDevice;
typedef struct _usbDeviceList usbDeviceList;
usbDevice *usbGetDevice(unsigned int bus,
unsigned int devno);
unsigned int devno,
const char *vroot);
int usbFindDeviceByBus(unsigned int bus,
unsigned int devno,
const char *vroot,
bool mandatory,
usbDevice **usb);
int usbFindDeviceByVendor(unsigned int vendor,
unsigned int product,
const char *vroot,
bool mandatory,
usbDeviceList **devices);
@ -45,6 +48,7 @@ int usbFindDevice(unsigned int vendor,
unsigned int product,
unsigned int bus,
unsigned int devno,
const char *vroot,
bool mandatory,
usbDevice **usb);