[PATCH v4 6/7] qemu: tpm: Avoid security labels on incoming migration with shared storage

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



When using shared storage there is no need to apply security labels on the
storage since the files have to have been labeled already on the source
side and we must assume that the source and destination side have been
setup to use the same uid and gid for running swtpm as well as share the
same security labels. Whether the security labels can be used at all
depends on the shared storage and whether and how it supports them.

Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
---
 src/qemu/qemu_tpm.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
index cffa77cfa3..5a0d298052 100644
--- a/src/qemu/qemu_tpm.c
+++ b/src/qemu/qemu_tpm.c
@@ -932,10 +932,19 @@ qemuTPMEmulatorStart(virQEMUDriver *driver,
     virCommandSetPidFile(cmd, pidfile);
     virCommandSetErrorFD(cmd, &errfd);
 
-    if (qemuSecurityStartTPMEmulator(driver, vm, cmd,
-                                     cfg->swtpm_user, cfg->swtpm_group,
-                                     NULL, &cmdret) < 0)
-        return -1;
+    if (incomingMigration &&
+        virFileIsSharedFS(tpm->data.emulator.storagepath) == 1) {
+        /* security labels must have been set up on source already */
+        if (qemuSecurityCommandRun(driver, vm, cmd,
+                                   cfg->swtpm_user, cfg->swtpm_group,
+                                   NULL, &cmdret) < 0) {
+            goto error;
+        }
+    } else if (qemuSecurityStartTPMEmulator(driver, vm, cmd,
+                                            cfg->swtpm_user, cfg->swtpm_group,
+                                            NULL, &cmdret) < 0) {
+        goto error;
+    }
 
     if (cmdret < 0) {
         /* virCommandRun() hidden in qemuSecurityStartTPMEmulator()
-- 
2.37.3




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux