mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-10-13 09:39:17 +00:00
13eb6c1468
When preparing images for block jobs we modify their seclabels so that QEMU can open them. However, as mentioned in the previous commit, secdrivers base some it their decisions whether the image they are working on is top of of the backing chain. Fortunately, in places where we call secdrivers we know this and the information can be passed to secdrivers. The problem is the following: after the first blockcommit from the base to one of the parents the XATTRs on the base image are not cleared and therefore the second attempt to do another blockcommit fails. This is caused by blockcommit code calling qemuSecuritySetImageLabel() over the base image, possibly multiple times (to ensure RW/RO access). A naive fix would be to call the restore function. But this is not possible, because that would deny QEMU the access to the base image. Fortunately, we can use the fact that seclabels are remembered only for the top of the backing chain and not for the rest of the backing chain. And thanks to the previous commit we can tell secdrivers which images are top of the backing chain. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803551 Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
146 lines
6.3 KiB
C
146 lines
6.3 KiB
C
/*
|
|
* qemu_security.h: QEMU security management
|
|
*
|
|
* Copyright (C) 2016 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include "qemu_conf.h"
|
|
#include "domain_conf.h"
|
|
#include "security/security_manager.h"
|
|
|
|
int qemuSecuritySetAllLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
const char *stdin_path,
|
|
bool migrated);
|
|
|
|
void qemuSecurityRestoreAllLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
bool migrated);
|
|
|
|
int qemuSecuritySetImageLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virStorageSourcePtr src,
|
|
bool backingChain,
|
|
bool chainTop);
|
|
|
|
int qemuSecurityRestoreImageLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virStorageSourcePtr src,
|
|
bool backingChain);
|
|
|
|
int qemuSecurityMoveImageMetadata(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virStorageSourcePtr src,
|
|
virStorageSourcePtr dst);
|
|
|
|
int qemuSecuritySetHostdevLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virDomainHostdevDefPtr hostdev);
|
|
|
|
int qemuSecurityRestoreHostdevLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virDomainHostdevDefPtr hostdev);
|
|
|
|
int qemuSecuritySetMemoryLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virDomainMemoryDefPtr mem);
|
|
|
|
int qemuSecurityRestoreMemoryLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virDomainMemoryDefPtr mem);
|
|
|
|
int qemuSecuritySetInputLabel(virDomainObjPtr vm,
|
|
virDomainInputDefPtr input);
|
|
|
|
int qemuSecurityRestoreInputLabel(virDomainObjPtr vm,
|
|
virDomainInputDefPtr input);
|
|
|
|
int qemuSecuritySetChardevLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virDomainChrDefPtr chr);
|
|
|
|
int qemuSecurityRestoreChardevLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virDomainChrDefPtr chr);
|
|
|
|
int qemuSecurityStartVhostUserGPU(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virCommandPtr cmd,
|
|
int *exitstatus,
|
|
int *cmdret);
|
|
|
|
int qemuSecurityStartTPMEmulator(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virCommandPtr cmd,
|
|
uid_t uid,
|
|
gid_t gid,
|
|
int *exitstatus,
|
|
int *cmdret);
|
|
|
|
void qemuSecurityCleanupTPMEmulator(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm);
|
|
|
|
int qemuSecurityDomainSetPathLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
const char *path,
|
|
bool allowSubtree);
|
|
|
|
int qemuSecuritySetSavedStateLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
const char *savefile);
|
|
|
|
int qemuSecurityRestoreSavedStateLabel(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
const char *savefile);
|
|
|
|
int qemuSecurityCommandRun(virQEMUDriverPtr driver,
|
|
virDomainObjPtr vm,
|
|
virCommandPtr cmd,
|
|
uid_t uid,
|
|
gid_t gid,
|
|
int *exitstatus,
|
|
int *cmdret);
|
|
|
|
/* Please note that for these APIs there is no wrapper yet. Do NOT blindly add
|
|
* new APIs here. If an API can touch a file add a proper wrapper instead.
|
|
*/
|
|
#define qemuSecurityCheckAllLabel virSecurityManagerCheckAllLabel
|
|
#define qemuSecurityClearSocketLabel virSecurityManagerClearSocketLabel
|
|
#define qemuSecurityGenLabel virSecurityManagerGenLabel
|
|
#define qemuSecurityGetBaseLabel virSecurityManagerGetBaseLabel
|
|
#define qemuSecurityGetDOI virSecurityManagerGetDOI
|
|
#define qemuSecurityGetModel virSecurityManagerGetModel
|
|
#define qemuSecurityGetMountOptions virSecurityManagerGetMountOptions
|
|
#define qemuSecurityGetNested virSecurityManagerGetNested
|
|
#define qemuSecurityGetProcessLabel virSecurityManagerGetProcessLabel
|
|
#define qemuSecurityNew virSecurityManagerNew
|
|
#define qemuSecurityNewDAC virSecurityManagerNewDAC
|
|
#define qemuSecurityNewStack virSecurityManagerNewStack
|
|
#define qemuSecurityPostFork virSecurityManagerPostFork
|
|
#define qemuSecurityPreFork virSecurityManagerPreFork
|
|
#define qemuSecurityReleaseLabel virSecurityManagerReleaseLabel
|
|
#define qemuSecurityReserveLabel virSecurityManagerReserveLabel
|
|
#define qemuSecuritySetChildProcessLabel virSecurityManagerSetChildProcessLabel
|
|
#define qemuSecuritySetDaemonSocketLabel virSecurityManagerSetDaemonSocketLabel
|
|
#define qemuSecuritySetImageFDLabel virSecurityManagerSetImageFDLabel
|
|
#define qemuSecuritySetSocketLabel virSecurityManagerSetSocketLabel
|
|
#define qemuSecuritySetTapFDLabel virSecurityManagerSetTapFDLabel
|
|
#define qemuSecurityStackAddNested virSecurityManagerStackAddNested
|
|
#define qemuSecurityVerify virSecurityManagerVerify
|