mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-07-07 18:35:46 +00:00
75056f61f1
Normally when a child process is started by libvirt, the SELinux label of that process is set to virtd_t (plus an MCS range). In at least one case (passt) we need for the SELinux label of a child process label to match the label that the binary would have transitioned to automatically if it had been run standalone (in the case of passt, that label is passt_t). This patch modifies virSecuritySELinuxSetChildProcessLabel() (and all the functions above it in the call chain) so that the toplevel function can set a new argument "useBinarySpecificLabel" to true. If it is true, then virSecuritySELinuxSetChildProcessLabel() will call the new function virSecuritySELinuxContextSetFromFile(), which uses the selinux library function security_compute_create() to determine what would be the label of the new process if it had been run standalone (rather than being run by libvirt) - the MCS range from the normally-used label is added to this newly derived label, and that is what is used for the new process rather than whatever is in the domain's security label (which will usually be virtd_t). In order to easily verify that nothing was broken by these changes to the call chain, all callers currently set useBinarySpecificPath = false, so all behavior should be completely unchanged. (The next patch will set it to true only for the case of running passt.) https://bugzilla.redhat.com/2172267 Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Andrea Bolognani <abologna@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
149 lines
6.4 KiB
C
149 lines
6.4 KiB
C
/*
|
|
* qemu_security.h: QEMU security management
|
|
*
|
|
* Copyright (C) 2016 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include "qemu_conf.h"
|
|
|
|
int qemuSecuritySetAllLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
const char *incomingPath,
|
|
bool migrated);
|
|
|
|
void qemuSecurityRestoreAllLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
bool migrated);
|
|
|
|
int qemuSecuritySetImageLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virStorageSource *src,
|
|
bool backingChain,
|
|
bool chainTop);
|
|
|
|
int qemuSecurityRestoreImageLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virStorageSource *src,
|
|
bool backingChain);
|
|
|
|
int qemuSecurityMoveImageMetadata(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virStorageSource *src,
|
|
virStorageSource *dst);
|
|
|
|
int qemuSecuritySetHostdevLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainHostdevDef *hostdev);
|
|
|
|
int qemuSecurityRestoreHostdevLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainHostdevDef *hostdev);
|
|
|
|
int qemuSecuritySetMemoryLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainMemoryDef *mem);
|
|
|
|
int qemuSecurityRestoreMemoryLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainMemoryDef *mem);
|
|
|
|
int qemuSecuritySetInputLabel(virDomainObj *vm,
|
|
virDomainInputDef *input);
|
|
|
|
int qemuSecurityRestoreInputLabel(virDomainObj *vm,
|
|
virDomainInputDef *input);
|
|
|
|
int qemuSecuritySetChardevLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainChrDef *chr);
|
|
|
|
int qemuSecurityRestoreChardevLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainChrDef *chr);
|
|
|
|
int qemuSecuritySetNetdevLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainNetDef *net);
|
|
|
|
int qemuSecurityRestoreNetdevLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virDomainNetDef *net);
|
|
|
|
int qemuSecuritySetTPMLabels(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
bool setTPMStateLabel);
|
|
|
|
int qemuSecurityRestoreTPMLabels(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
bool restoreTPMStateLabel);
|
|
|
|
int qemuSecuritySetSavedStateLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
const char *savefile);
|
|
|
|
int qemuSecurityRestoreSavedStateLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
const char *savefile);
|
|
|
|
int qemuSecurityDomainSetPathLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
const char *path,
|
|
bool allowSubtree);
|
|
|
|
int qemuSecurityDomainRestorePathLabel(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
const char *path);
|
|
|
|
int qemuSecurityCommandRun(virQEMUDriver *driver,
|
|
virDomainObj *vm,
|
|
virCommand *cmd,
|
|
uid_t uid,
|
|
gid_t gid,
|
|
bool useBinarySpecificLabel,
|
|
int *exitstatus);
|
|
|
|
/* Please note that for these APIs there is no wrapper yet. Do NOT blindly add
|
|
* new APIs here. If an API can touch a file add a proper wrapper instead.
|
|
*/
|
|
#define qemuSecurityCheckAllLabel virSecurityManagerCheckAllLabel
|
|
#define qemuSecurityClearSocketLabel virSecurityManagerClearSocketLabel
|
|
#define qemuSecurityGenLabel virSecurityManagerGenLabel
|
|
#define qemuSecurityGetBaseLabel virSecurityManagerGetBaseLabel
|
|
#define qemuSecurityGetDOI virSecurityManagerGetDOI
|
|
#define qemuSecurityGetModel virSecurityManagerGetModel
|
|
#define qemuSecurityGetMountOptions virSecurityManagerGetMountOptions
|
|
#define qemuSecurityGetNested virSecurityManagerGetNested
|
|
#define qemuSecurityGetProcessLabel virSecurityManagerGetProcessLabel
|
|
#define qemuSecurityNew virSecurityManagerNew
|
|
#define qemuSecurityNewDAC virSecurityManagerNewDAC
|
|
#define qemuSecurityNewStack virSecurityManagerNewStack
|
|
#define qemuSecurityPostFork virSecurityManagerPostFork
|
|
#define qemuSecurityPreFork virSecurityManagerPreFork
|
|
#define qemuSecurityReleaseLabel virSecurityManagerReleaseLabel
|
|
#define qemuSecurityReserveLabel virSecurityManagerReserveLabel
|
|
#define qemuSecurityRestoreSavedStateLabel virSecurityManagerRestoreSavedStateLabel
|
|
#define qemuSecuritySetChildProcessLabel virSecurityManagerSetChildProcessLabel
|
|
#define qemuSecuritySetDaemonSocketLabel virSecurityManagerSetDaemonSocketLabel
|
|
#define qemuSecuritySetImageFDLabel virSecurityManagerSetImageFDLabel
|
|
#define qemuSecuritySetSavedStateLabel virSecurityManagerSetSavedStateLabel
|
|
#define qemuSecuritySetSocketLabel virSecurityManagerSetSocketLabel
|
|
#define qemuSecuritySetTapFDLabel virSecurityManagerSetTapFDLabel
|
|
#define qemuSecurityStackAddNested virSecurityManagerStackAddNested
|
|
#define qemuSecurityVerify virSecurityManagerVerify
|