External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-27 16:15:23 +00:00
Code Issues Packages Projects Releases Wiki Activity
Libvirt provides a portable, long term stable C API for managing the virtualization technologies provided by many operating systems. It includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER Hypervisor.
10,981 Commits 67 Branches 629 Tags 866 MiB
C 94.8%
Python 2%
Meson 0.9%
Shell 0.8%
Dockerfile 0.6%
Other 0.8%
0dd956b9c3
Go to file
Guannan Ren 0dd956b9c3 selinux: add security selinux function to label tapfd 
BZ:https://bugzilla.redhat.com/show_bug.cgi?id=851981
When using macvtap, a character device gets first created by
kernel with name /dev/tapN, its selinux context is:
system_u:object_r:device_t:s0

Shortly, when udev gets notification when new file is created
in /dev, it will then jump in and relabel this file back to the
expected default context:
system_u:object_r:tun_tap_device_t:s0

There is a time gap happened.
Sometimes, it will have migration failed, AVC error message:
type=AVC msg=audit(1349858424.233:42507): avc:  denied  { read write } for
pid=19926 comm="qemu-kvm" path="/dev/tap33" dev=devtmpfs ino=131524
scontext=unconfined_u:system_r:svirt_t:s0:c598,c908
tcontext=system_u:object_r:device_t:s0 tclass=chr_file

This patch will label the tapfd device before qemu process starts:
system_u:object_r:tun_tap_device_t:MCS(MCS from seclabel->label)
(cherry picked from commit ae368ebfcc)
2012-10-27 14:55:11 -04:00
.gnulib@440a1dbe52 build: improved handling of <execinfo.h>, BSD <net/if.h> 2012-09-06 10:08:47 -06:00
build-aux maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
daemon Move virProcess{Kill,Abort,TranslateStatus} into virprocess.{c,h} 2012-10-17 16:41:06 -04:00
docs Correct name of domain/pm/suspend-to-mem in docs 2012-10-18 13:16:54 -04:00
examples maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
gnulib build: fix fresh checkout on RHEL5 2012-04-19 17:11:43 -06:00
include maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
m4 build: avoid -Wno-format on new-enough gcc 2012-10-18 13:11:29 -04:00
po Move virProcess{Kill,Abort,TranslateStatus} into virprocess.{c,h} 2012-10-17 16:41:06 -04:00
python Properly parse (unsigned) long long 2012-10-18 13:19:51 -04:00
src selinux: add security selinux function to label tapfd 2012-10-27 14:55:11 -04:00
tests selinux: Use raw contexts 2012-10-27 14:54:30 -04:00
tools Add note about numeric domain names to manpage 2012-10-18 13:09:55 -04:00
.dir-locals.el build: avoid tabs that failed syntax-check 2012-09-06 09:43:46 -06:00
.gitignore Add a ./run script for running programs from the local directory. 2012-09-18 10:59:16 +01:00
.gitmodules make .gnulib a submodule 2009-07-08 16:17:51 +02:00
.mailmap network: fix dnsmasq/radvd binding to IPv6 on recent kernels 2012-10-23 18:00:14 -04:00
AUTHORS ARMHF: implement /proc/cpuinfo parsing 2012-10-18 13:00:00 -04:00
autobuild.sh Switch automated builds to use Mingw64 toolchain instead of Mingw32 2012-06-25 10:41:10 +01:00
autogen.sh Ensure autogen.sh exists if bootstrap fails 2012-09-20 15:58:29 +01:00
bootstrap maint: regenerate bootstrap 2012-07-27 09:34:04 -06:00
bootstrap.conf maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
cfg.mk syntax-check: fix run.in 2012-09-18 13:59:53 +02:00
ChangeLog-old virterror.c: Fix several spelling mistakes 2012-02-03 11:32:51 -07:00
configure.ac selinux: Use raw contexts 2012-10-27 14:54:30 -04:00
COPYING.LIB remove all trailing blank lines 2009-07-16 15:06:42 +02:00
HACKING Update how to compile with -Werror 2012-10-17 16:18:22 -04:00
libvirt.pc.in build: silence warning from autoconf 2012-05-30 09:22:02 -06:00
libvirt.spec.in spec: Add runtime requirement for libssh2 2012-10-18 13:32:10 -04:00
Makefile.am Add a ./run script for running programs from the local directory. 2012-09-18 10:59:16 +01:00
Makefile.nonreentrant Ban use of all inet_* functions 2010-10-22 11:59:23 +01:00
mingw-libvirt.spec.in parallels: add driver skeleton 2012-08-01 11:44:26 +08:00
README Correct typos in the documentation (Atsushi SAKAI) 2008-01-24 10:15:13 +00:00
README-hacking maint: relax git minimum version 2010-02-24 14:29:27 -05:00
run.in syntax-check: fix run.in 2012-09-18 13:59:53 +02:00
TODO Update todo list file to point at bugzilla/website 2010-10-13 16:45:26 +01:00

README 

         LibVirt : simple API for virtualization

  Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). It is free software
available under the GNU Lesser General Public License. Virtualization of
the Linux Operating System means the ability to run multiple instances of
Operating Systems concurrently on a single hardware system where the basic
resources are driven by a Linux instance. The library aim at providing
long term stable C API initially for the Xen paravirtualization but
should be able to integrate other virtualization mechanisms if needed.

Daniel Veillard <veillard@redhat.com>