mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-11-02 11:21:12 +00:00
d89608f994
A need was found to set the SELinux context label on an open fd (a pipe, as a matter of fact). This patch adds a function to the security driver API that will set the label on an open fd to secdef.label. For all drivers other than the SELinux driver, it's a NOP. For the SElinux driver, it calls fsetfilecon(). If the return is a failure, it only returns error up to the caller if 1) the desired label is different from the existing label, 2) the destination fd is of a type that supports setting the selinux context, and 3) selinux is in enforcing mode. Otherwise it will return success. This follows the pattern of the existing function SELinuxSetFilecon().
99 lines
4.8 KiB
C
99 lines
4.8 KiB
C
/*
|
|
* security_manager.h: Internal security manager API
|
|
*
|
|
* Copyright (C) 2010-2011 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*
|
|
* Author: Daniel P. Berrange <berrange@redhat.com>
|
|
*/
|
|
|
|
#ifndef VIR_SECURITY_MANAGER_H__
|
|
# define VIR_SECURITY_MANAGER_H__
|
|
|
|
# define virSecurityReportError(code, ...) \
|
|
virReportErrorHelper(NULL, VIR_FROM_SECURITY, code, __FILE__, \
|
|
__FUNCTION__, __LINE__, __VA_ARGS__)
|
|
|
|
|
|
typedef struct _virSecurityManager virSecurityManager;
|
|
typedef virSecurityManager *virSecurityManagerPtr;
|
|
|
|
virSecurityManagerPtr virSecurityManagerNew(const char *name,
|
|
bool allowDiskFormatProbing);
|
|
|
|
virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary,
|
|
virSecurityManagerPtr secondary);
|
|
|
|
virSecurityManagerPtr virSecurityManagerNewDAC(uid_t user,
|
|
gid_t group,
|
|
bool allowDiskFormatProbing,
|
|
bool dynamicOwnership);
|
|
|
|
void *virSecurityManagerGetPrivateData(virSecurityManagerPtr mgr);
|
|
|
|
void virSecurityManagerFree(virSecurityManagerPtr mgr);
|
|
|
|
const char *virSecurityManagerGetDOI(virSecurityManagerPtr mgr);
|
|
const char *virSecurityManagerGetModel(virSecurityManagerPtr mgr);
|
|
bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr);
|
|
|
|
int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
virDomainDiskDefPtr disk);
|
|
int virSecurityManagerSetSocketLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm);
|
|
int virSecurityManagerClearSocketLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm);
|
|
int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
virDomainDiskDefPtr disk);
|
|
int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
virDomainHostdevDefPtr dev);
|
|
int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
virDomainHostdevDefPtr dev);
|
|
int virSecurityManagerSetSavedStateLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
const char *savefile);
|
|
int virSecurityManagerRestoreSavedStateLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
const char *savefile);
|
|
int virSecurityManagerGenLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr sec);
|
|
int virSecurityManagerReserveLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr sec);
|
|
int virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr sec);
|
|
int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr sec,
|
|
const char *stdin_path);
|
|
int virSecurityManagerRestoreAllLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
int migrated);
|
|
int virSecurityManagerGetProcessLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
virSecurityLabelPtr sec);
|
|
int virSecurityManagerSetProcessLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm);
|
|
int virSecurityManagerVerify(virSecurityManagerPtr mgr,
|
|
virDomainDefPtr def);
|
|
int virSecurityManagerSetFDLabel(virSecurityManagerPtr mgr,
|
|
virDomainObjPtr vm,
|
|
int fd);
|
|
|
|
#endif /* VIR_SECURITY_MANAGER_H__ */
|