mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-10-02 04:15:46 +00:00
907a39e735
There are many aspects of the guest XML which result in the SELinux driver applying file labelling. With the increasing configuration options it is desirable to test this behaviour. It is not possible to assume that the test suite has the ability to set SELinux labels. Most filesystems though will support extended attributes. Thus for the purpose of testing, it is possible to extend the existing LD_PRELOAD hack to override setfilecon() and getfilecon() to simply use the 'user.libvirt.selinux' attribute for the sake of testing. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
100 lines
2.5 KiB
C
100 lines
2.5 KiB
C
/*
|
|
* Copyright (C) 2011-2012 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*
|
|
*/
|
|
|
|
#include <config.h>
|
|
|
|
#include <selinux/selinux.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <attr/xattr.h>
|
|
|
|
|
|
/*
|
|
* The kernel policy will not allow us to arbitrarily change
|
|
* test process context. This helper is used as an LD_PRELOAD
|
|
* so that the libvirt code /thinks/ it is changing/reading
|
|
* the process context, where as in fact we're faking it all
|
|
*/
|
|
|
|
int getcon_raw(security_context_t *context)
|
|
{
|
|
if (getenv("FAKE_CONTEXT") == NULL) {
|
|
*context = NULL;
|
|
errno = EINVAL;
|
|
return -1;
|
|
}
|
|
if (!(*context = strdup(getenv("FAKE_CONTEXT"))))
|
|
return -1;
|
|
return 0;
|
|
}
|
|
|
|
int getpidcon_raw(pid_t pid, security_context_t *context)
|
|
{
|
|
if (pid != getpid()) {
|
|
*context = NULL;
|
|
errno = ESRCH;
|
|
return -1;
|
|
}
|
|
if (getenv("FAKE_CONTEXT") == NULL) {
|
|
*context = NULL;
|
|
errno = EINVAL;
|
|
return -1;
|
|
}
|
|
if (!(*context = strdup(getenv("FAKE_CONTEXT"))))
|
|
return -1;
|
|
return 0;
|
|
}
|
|
|
|
int setcon_raw(security_context_t context)
|
|
{
|
|
return setenv("FAKE_CONTEXT", context, 1);
|
|
}
|
|
|
|
|
|
#if WITH_ATTR
|
|
int setfilecon(const char *path, security_context_t con)
|
|
{
|
|
const char *constr = con;
|
|
return setxattr(path, "user.libvirt.selinux",
|
|
constr, strlen(constr), 0);
|
|
}
|
|
|
|
|
|
int getfilecon(const char *path, security_context_t *con)
|
|
{
|
|
char *constr = NULL;
|
|
ssize_t len = getxattr(path, "user.libvirt.selinux",
|
|
NULL, 0);
|
|
if (len < 0)
|
|
return -1;
|
|
if (!(constr = malloc(len+1)))
|
|
return -1;
|
|
memset(constr, 0, len);
|
|
if (getxattr(path, "user.libvirt.selinux", constr, len) < 0) {
|
|
free(constr);
|
|
return -1;
|
|
}
|
|
*con = constr;
|
|
constr[len] = '\0';
|
|
return 0;
|
|
}
|
|
#endif
|