Commit Graph

7 Commits

Author SHA1 Message Date
Michal Privoznik
e60b9783e1 Adapt to VIR_STRDUP and VIR_STRNDUP in tests/* 2013-05-10 11:54:29 +02:00
John Ferlan
7ae3f2d53d securityselinuxhelper.c: Don't try to include xattr.h if not available
Commit 907a39e7 missed adding the WITH_ATTR around #include <attr/xattr.h>
resulting in a build failure:

  CC     libsecurityselinuxhelper_la-securityselinuxhelper.lo
  securityselinuxhelper.c:27:24: fatal error: attr/xattr.h: No such file or directory
  compilation terminated.
  make[2]: *** [libsecurityselinuxhelper_la-securityselinuxhelper.lo] Error 1
  make[2]: Leaving directory `/home/jferlan/libvirt.work/tests'
  make[1]: *** [all-recursive] Error 1
  make[1]: Leaving directory `/home/jferlan/libvirt.work'
  make: *** [all] Error 2
2013-01-14 21:00:51 +01:00
Daniel P. Berrange
7184af1364 Add missing stubs to securityselinuxhelper.c
Make sure we override both the raw and non-raw stubs in
securityselinuxhelper.c. Also add diagnostics if
securityselinuxlabeltest fails a test item
2013-01-14 18:34:49 +00:00
Daniel P. Berrange
907a39e735 Add a test suite for validating SELinux labelling
There are many aspects of the guest XML which result in the
SELinux driver applying file labelling. With the increasing
configuration options it is desirable to test this behaviour.
It is not possible to assume that the test suite has the
ability to set SELinux labels. Most filesystems though will
support extended attributes. Thus for the purpose of testing,
it is possible to extend the existing LD_PRELOAD hack to
override setfilecon() and getfilecon() to simply use the
'user.libvirt.selinux' attribute for the sake of testing.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-01-14 13:40:04 +00:00
Martin Kletzander
9674f2c637 selinux: Use raw contexts
We are currently able to work only with non-translated SELinux
contexts, but we are using functions that work with translated
contexts throughout the code.  This patch swaps all SELinux context
translation relative calls with their raw sisters to avoid parsing
problems.

The problems can be experienced with mcstrans for example.  The
difference is that if you have translations enabled (yum install
mcstrans; service mcstrans start), fgetfilecon_raw() will get you
something like 'system_u:object_r:virt_image_t:s0', whereas
fgetfilecon() will return 'system_u:object_r:virt_image_t:SystemLow'
that we cannot parse.

I was trying to confirm that the _raw variants were here since the dawn of
time, but the only thing I see now is that it was imported together in
the upstream repo [1] from svn, so before 2008.

Thanks Laurent Bigonville for finding this out.

[1] http://oss.tresys.com/git/selinux.git
2012-10-12 17:54:09 +02:00
Eric Blake
4ecb723b9e maint: fix up copyright notice inconsistencies
https://www.gnu.org/licenses/gpl-howto.html recommends that
the 'If not, see <url>.' phrase be a separate sentence.

* tests/securityselinuxhelper.c: Remove doubled line.
* tests/securityselinuxtest.c: Likewise.
* globally: s/;  If/.  If/
2012-09-20 16:30:55 -06:00
Daniel P. Berrange
9136032a66 Add test case for SELinux label generation
This test case validates the correct generation of SELinux labels
for VMs, wrt the current process label. Since we can't actually
change the label of the test program process, we create a shared
library libsecurityselinuxhelper.so which overrides the getcon()
and setcon() libselinux.so functions. When started the test case
will check to see if LD_PRELOAD is set, and if not, it will
re-exec() itself setting LD_PRELOAD=libsecurityselinuxhelper.so

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-08-21 11:37:57 +01:00