On Tue, Jan 25, 2011 at 05:36:57PM -0700, Eric Blake wrote:
> * src/security/security_selinux.c
> (SELinuxRestoreSecuritySmartcardCallback)
> (SELinuxSetSecuritySmartcardCallback): New helper functions.
> (SELinuxRestoreSecurityAllLabel, SELinuxSetSecurityAllLabel): Use
> them.
>
> Notes:
> v3: new patch
> ---
> src/security/security_selinux.c | 94 +++++++++++++++++++++++++++++++++++++++
> 1 files changed, 94 insertions(+), 0 deletions(-)
>
> diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
> index 7b71fd9..678b7ff 100644
> --- a/src/security/security_selinux.c
> +++ b/src/security/security_selinux.c
> @@ -770,6 +770,46 @@ SELinuxRestoreSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
>
>
> static int
> +SELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
> + virDomainSmartcardDefPtr dev,
> + void *opaque)
> +{
> + virDomainObjPtr vm = opaque;
> + int i;
> + int ret = 0;
> +
> + switch (dev->type) {
> + case VIR_DOMAIN_SMARTCARD_TYPE_HOST:
> + if (dev->data.host.dev)
> + return SELinuxRestoreSecurityFileLabel(dev->data.host.dev);
> + break;
This can be removed I think
> +
> + case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
> + for (i = 0; i < VIR_DOMAIN_SMARTCARD_NUM_CERTIFICATES; i++) {
> + if (SELinuxRestoreSecurityFileLabel(dev->data.cert.file[i]) < 0)
> + ret = -1;
> + }
> + if (dev->data.cert.database) {
> + if (SELinuxRestoreSecurityFileLabel(dev->data.cert.database) < 0)
> + ret = -1;
> + }
> + break;
> +
> + case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH:
> + return SELinuxRestoreSecurityChardevLabel(vm, &dev->data.passthru);
> +
> + default:
> + virSecurityReportError(VIR_ERR_INTERNAL_ERROR,
> + _("unknown smartcard type %d"),
> + dev->type);
> + return -1;
> + }
> +
> + return ret;
> +}
> +
> +
> +static int
> SELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
> virDomainObjPtr vm,
> int migrated ATTRIBUTE_UNUSED)
> @@ -803,6 +843,12 @@ SELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
> vm) < 0)
> rc = -1;
>
> + if (virDomainSmartcardDefForeach(vm->def,
> + false,
> + SELinuxRestoreSecuritySmartcardCallback,
> + vm) < 0)
> + rc = -1;
> +
> if (vm->def->os.kernel &&
> SELinuxRestoreSecurityFileLabel(vm->def->os.kernel) < 0)
> rc = -1;
> @@ -1035,6 +1081,48 @@ SELinuxSetSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
>
>
> static int
> +SELinuxSetSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
> + virDomainSmartcardDefPtr dev,
> + void *opaque)
> +{
> + virDomainObjPtr vm = opaque;
> + int i;
> +
> + switch (dev->type) {
> + case VIR_DOMAIN_SMARTCARD_TYPE_HOST:
> + if (dev->data.host.dev)
> + return SELinuxSetFilecon(dev->data.host.dev,
> + default_content_context);
> + break;
And this one.
> +
> + case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
> + for (i = 0; i < VIR_DOMAIN_SMARTCARD_NUM_CERTIFICATES; i++) {
> + if (SELinuxSetFilecon(dev->data.cert.file[i],
> + default_content_context) < 0)
> + return -1;
> + }
> + if (dev->data.cert.database) {
> + if (SELinuxSetFilecon(dev->data.cert.database,
> + default_content_context) < 0)
> + return -1;
> + }
> + break;
> +
> + case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH:
> + return SELinuxSetSecurityChardevLabel(vm, &dev->data.passthru);
> +
> + default:
> + virSecurityReportError(VIR_ERR_INTERNAL_ERROR,
> + _("unknown smartcard type %d"),
> + dev->type);
> + return -1;
> + }
> +
> + return 0;
> +}
> +
> +
> +static int
> SELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr,
> virDomainObjPtr vm,
> const char *stdin_path)
> @@ -1069,6 +1157,12 @@ SELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr,
> vm) < 0)
> return -1;
>
> + if (virDomainSmartcardDefForeach(vm->def,
> + true,
> + SELinuxSetSecuritySmartcardCallback,
> + vm) < 0)
> + return -1;
> +
> if (vm->def->os.kernel &&
> SELinuxSetFilecon(vm->def->os.kernel, default_content_context) < 0)
> return -1;
ACK
Daniel
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list