On Mon, Apr 15, 2019 at 05:52:50PM +0200, Michal Privoznik wrote:
We're setting seclabels on unix sockets but never restoring them. Surprisingly, we are in SELinux driver.
s/we are/we are doing so/ would be clearer
Signed-off-by: Michal Privoznik <mprivozn@xxxxxxxxxx> --- src/security/security_dac.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 6f8ca8cd54..0adf71bed6 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1457,13 +1457,25 @@ virSecurityDACRestoreChardevLabel(virSecurityManagerPtr mgr, ret = 0; break; + case VIR_DOMAIN_CHR_TYPE_UNIX: + if (!dev_source->data.nix.listen ||
+ (dev_source->data.nix.path && + virFileExists(dev_source->data.nix.path))) { + /* Also label mode='bind' sockets if they exist, + * e.g. because they were created by libvirt + * and passed via FD */
This condition does not really work after the domain startup - all listen sockets should exist at this point. Fortunately they will get unlinked by qemuProcessCleanupChardevDevice through qemuProcessStop anyway. So all we need to check here is if (!dev_source->data.nix.listen)
+ if (virSecurityDACRestoreFileLabel(mgr, dev_source->data.nix.path) < 0) + goto done; + } + ret = 0; + break; +
Reviewed-by: Ján Tomko <jtomko@xxxxxxxxxx> Jano
Attachment:
signature.asc
Description: Digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list