On 21.05.2012 15:39, Marcelo Cerri wrote:
> ---
> src/lxc/lxc_conf.c | 8 ++++++--
> src/lxc/lxc_driver.c | 35 ++++++++++++++++++++---------------
> 2 files changed, 26 insertions(+), 17 deletions(-)
>
> diff --git a/src/lxc/lxc_conf.c b/src/lxc/lxc_conf.c
> index 72547c4..807c704 100644
> --- a/src/lxc/lxc_conf.c
> +++ b/src/lxc/lxc_conf.c
> @@ -134,9 +134,13 @@ virCapsPtr lxcCapsInit(lxc_driver_t *driver)
> doi = virSecurityManagerGetDOI(driver->securityManager);
> model = virSecurityManagerGetModel(driver->securityManager);
> if (STRNEQ(model, "none")) {
> - if (!(caps->host.secModel.model = strdup(model)))
> + /* Allocate just the primary security driver for LXC. */
> + if (VIR_ALLOC(caps->host.secModels) < 0)
> goto no_memory;
> - if (!(caps->host.secModel.doi = strdup(doi)))
> + caps->host.nsecModels = 1;
> + if (!(caps->host.secModels[0].model = strdup(model)))
> + goto no_memory;
> + if (!(caps->host.secModels[0].doi = strdup(doi)))
> goto no_memory;
> }
>
> diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
> index 4cccd53..ffd3c9c 100644
> --- a/src/lxc/lxc_driver.c
> +++ b/src/lxc/lxc_driver.c
> @@ -1479,10 +1479,12 @@ static int lxcVmTerminate(lxc_driver_t *driver,
> vm->def, false);
> virSecurityManagerReleaseLabel(driver->securityManager, vm->def);
> /* Clear out dynamically assigned labels */
> - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
> - VIR_FREE(vm->def->seclabel.model);
> - VIR_FREE(vm->def->seclabel.label);
> - VIR_FREE(vm->def->seclabel.imagelabel);
> + /* Manages just the primary sec driver for lxc */
> + if (vm->def->nseclabels
> + && vm->def->seclabels[0]->type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
> + VIR_FREE(vm->def->seclabels[0]->model);
> + VIR_FREE(vm->def->seclabels[0]->label);
> + VIR_FREE(vm->def->seclabels[0]->imagelabel);
> }
I guess we want to VIR_FREE(vm->def->seclabels) and m->def->nseclabels =
0; ...
>
> if (virCgroupForDomain(driver->cgroup, vm->def->name, &group, 0) == 0) {
> @@ -1818,8 +1820,10 @@ static int lxcVmStart(virConnectPtr conn,
> /* If you are using a SecurityDriver with dynamic labelling,
> then generate a security label for isolation */
> VIR_DEBUG("Generating domain security label (if required)");
> - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DEFAULT)
> - vm->def->seclabel.type = VIR_DOMAIN_SECLABEL_NONE;
> + if (vm->def->nseclabels
> + && vm->def->seclabels[0]->type == VIR_DOMAIN_SECLABEL_DEFAULT) {
> + vm->def->seclabels[0]->type = VIR_DOMAIN_SECLABEL_NONE;
> + }
>
> if (virSecurityManagerGenLabel(driver->securityManager, vm->def) < 0) {
> virDomainAuditSecurityLabel(vm, false);
> @@ -1990,10 +1994,11 @@ cleanup:
> vm->def, false);
> virSecurityManagerReleaseLabel(driver->securityManager, vm->def);
> /* Clear out dynamically assigned labels */
> - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
> - VIR_FREE(vm->def->seclabel.model);
> - VIR_FREE(vm->def->seclabel.label);
> - VIR_FREE(vm->def->seclabel.imagelabel);
> + if (vm->def->nseclabels
> + && vm->def->seclabels[0]->type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
> + VIR_FREE(vm->def->seclabels[0]->model);
> + VIR_FREE(vm->def->seclabels[0]->label);
> + VIR_FREE(vm->def->seclabels[0]->imagelabel);
... and here as well.
> }
> }
> for (i = 0 ; i < nttyFDs ; i++)
> @@ -2233,12 +2238,12 @@ static int lxcNodeGetSecurityModel(virConnectPtr conn,
> lxcDriverLock(driver);
> memset(secmodel, 0, sizeof(*secmodel));
>
> - /* NULL indicates no driver, which we treat as
> - * success, but simply return no data in *secmodel */
> - if (driver->caps->host.secModel.model == NULL)
> + /* we treat no driver as success, but simply return no data in *secmodel */
> + if (driver->caps->host.nsecModels == 0
> + || driver->caps->host.secModels[0].model == NULL)
> goto cleanup;
>
> - if (!virStrcpy(secmodel->model, driver->caps->host.secModel.model,
> + if (!virStrcpy(secmodel->model, driver->caps->host.secModels[0].model,
> VIR_SECURITY_MODEL_BUFLEN)) {
> lxcError(VIR_ERR_INTERNAL_ERROR,
> _("security model string exceeds max %d bytes"),
> @@ -2247,7 +2252,7 @@ static int lxcNodeGetSecurityModel(virConnectPtr conn,
> goto cleanup;
> }
>
> - if (!virStrcpy(secmodel->doi, driver->caps->host.secModel.doi,
> + if (!virStrcpy(secmodel->doi, driver->caps->host.secModels[0].doi,
> VIR_SECURITY_DOI_BUFLEN)) {
> lxcError(VIR_ERR_INTERNAL_ERROR,
> _("security DOI string exceeds max %d bytes"),
Otherwise looking good.
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list