External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-24 14:45:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
a71680fe92
libvirt/tools
History
Daniel P. Berrange e4e69e899e Apply security label when entering LXC namespaces 
Add a new virDomainLxcEnterSecurityLabel() function as a
counterpart to virDomainLxcEnterNamespaces(), which can
change the current calling process to have a new security
context. This call runs client side, not in libvirtd
so we can't use the security driver infrastructure.

When entering a namespace, the process spawned from virsh
will default to running with the security label of virsh.
The actual desired behaviour is to run with the security
label of the container most of the time. So this changes
virsh lxc-enter-namespace command to invoke the
virDomainLxcEnterSecurityLabel method.

The current behaviour is:

LABEL                             PID TTY          TIME CMD
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 1 pts/0 00:00:00 systemd
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 3 pts/1 00:00:00 sh
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 24 ? 00:00:00 systemd-journal
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 29 ? 00:00:00 dhclient
staff_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 47 ? 00:00:00 ps

Note the ps command is running as unconfined_t,  After this patch,

The new behaviour is this:

virsh -c lxc:/// lxc-enter-namespace dan -- /bin/ps -eZ
LABEL                             PID TTY          TIME CMD
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 1 pts/0 00:00:00 systemd
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 3 pts/1 00:00:00 sh
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 24 ? 00:00:00 systemd-journal
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 32 ? 00:00:00 dhclient
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 38 ? 00:00:00 ps

The '--noseclabel' flag can be used to skip security labelling.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-03-13 15:16:37 +00:00
..
console.c virCondDestroy: Lose attribute RETURN_CHECK 2013-02-08 09:12:11 +01:00
console.h virsh: Fix usage of header termios.h 2012-12-07 14:21:25 +01:00
libvirt_win_icon_16x16.ico Move virsh into tools/ directory 2009-09-21 14:41:45 +01:00
libvirt_win_icon_32x32.ico Move virsh into tools/ directory 2009-09-21 14:41:45 +01:00
libvirt_win_icon_48x48.ico Move virsh into tools/ directory 2009-09-21 14:41:45 +01:00
libvirt_win_icon_64x64.ico Move virsh into tools/ directory 2009-09-21 14:41:45 +01:00
libvirt-guests.init.in tools: Only install guests init script if --with-init=script=redhat 2012-12-11 19:54:37 -05:00
libvirt-guests.service.in tools: Only install guests init script if --with-init=script=redhat 2012-12-11 19:54:37 -05:00
libvirt-guests.sh.in tools: Only install guests init script if --with-init=script=redhat 2012-12-11 19:54:37 -05:00
libvirt-guests.sysconf libvirt-guests: Add parallel startup and shutdown of guests 2012-03-05 13:18:24 +01:00
Makefile.am build: Regenerate man pages on version bump 2013-01-29 13:23:19 +01:00
virsh_win_icon.rc Move virsh into tools/ directory 2009-09-21 14:41:45 +01:00
virsh-domain-monitor.c virsh-domain-monitor.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:21 +01:00
virsh-domain-monitor.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-domain.c Apply security label when entering LXC namespaces 2013-03-13 15:16:37 +00:00
virsh-domain.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-edit.c Remove spurious whitespace between function name & open brackets 2012-11-02 13:36:49 +00:00
virsh-host.c virsh-host.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:21 +01:00
virsh-host.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-interface.c virsh-interface.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:21 +01:00
virsh-interface.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-network.c virsh-network.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:22 +01:00
virsh-network.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-nodedev.c virsh-nodedev.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:22 +01:00
virsh-nodedev.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-nwfilter.c virsh-nwfilter.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:22 +01:00
virsh-nwfilter.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-pool.c virsh-pool.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:22 +01:00
virsh-pool.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-secret.c virsh-secret.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:22 +01:00
virsh-secret.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-snapshot.c virsh: fix snapshot-create with no xmlfile 2013-03-11 13:39:11 +01:00
virsh-snapshot.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-volume.c virsh-volume.c: Switch to c99 initialization of vshCmdInfo 2013-02-12 17:50:22 +01:00
virsh-volume.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh.c virsh: distinguish errors between missing argument and wrong option 2013-02-20 10:14:25 +08:00
virsh.h virsh: Add helper to request string arguments with error reporting 2013-02-04 14:17:39 +01:00
virsh.pod virsh-snapshot: Add ability to print only snapshot names 2013-03-05 08:34:48 +01:00
virt-host-validate-common.c Rename util.{c,h} to virutil.{c,h} 2012-12-21 11:19:49 +00:00
virt-host-validate-common.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virt-host-validate-lxc.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virt-host-validate-lxc.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virt-host-validate-qemu.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virt-host-validate-qemu.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virt-host-validate.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virt-pki-validate.in build: use common .in replacement mechanism 2013-01-07 08:56:36 -07:00
virt-sanlock-cleanup.in build: use common .in replacement mechanism 2013-01-07 08:56:36 -07:00
virt-xml-validate.in build: use common .in replacement mechanism 2013-01-07 08:56:36 -07:00