[PATCH 05/23] Skip bulk relabelling of resources in SELinux driver when used with LXC

["Daniel P. Berrange" <berrange@xxxxxxxxxx>]

From: "Daniel P. Berrange" <berrange@xxxxxxxxxx>

The virSecurityManager{Set,Restore}AllLabel methods are invoked
at domain startup/shutdown to relabel resources associated with
a domain. This works fine with QEMU, but with LXC they are in
fact both currently no-ops since LXC does not support disks,
hostdevs, or kernel/initrd files. Worse, when LXC gains support
for disks/hostdevs, they will do the wrong thing, since they
run in host context, not container context. Thus this patch
turns then into a formal no-op when used with LXC. The LXC
controller will call out to specific security manager labelling
APIs as required during startup.

Signed-off-by: Daniel P. Berrange <berrange@xxxxxxxxxx>
---
 src/security/security_selinux.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 5409e32..ddf3da3 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -61,6 +61,7 @@ struct _virSecuritySELinuxData {
     char *file_context;
     char *content_context;
     virHashTablePtr mcs;
+    bool skipAllLabel;
 };
 
 struct _virSecuritySELinuxCallbackData {
@@ -363,6 +364,8 @@ virSecuritySELinuxLXCInitialize(virSecurityManagerPtr mgr)
     virConfPtr selinux_conf;
     virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
 
+    data->skipAllLabel = true;
+
     selinux_conf = virConfReadFile(selinux_lxc_contexts_path(), 0);
     if (!selinux_conf) {
         virReportSystemError(errno,
@@ -438,6 +441,8 @@ virSecuritySELinuxQEMUInitialize(virSecurityManagerPtr mgr)
     char *ptr;
     virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
 
+    data->skipAllLabel = false;
+
     if (virFileReadAll(selinux_virtual_domain_context_path(), MAX_CONTEXT, &(data->domain_context)) < 0) {
         virReportSystemError(errno,
                              _("cannot read SELinux virtual domain context file '%s'"),
@@ -1438,11 +1443,12 @@ virSecuritySELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def,
 
 
 static int
-virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
+virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr,
                                           virDomainDefPtr def,
                                           int migrated ATTRIBUTE_UNUSED)
 {
     virSecurityLabelDefPtr secdef;
+    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
     int i;
     int rc = 0;
 
@@ -1452,7 +1458,7 @@ virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UN
     if (secdef == NULL)
         return -1;
 
-    if (secdef->norelabel)
+    if (secdef->norelabel || data->skipAllLabel)
         return 0;
 
     for (i = 0 ; i < def->nhostdevs ; i++) {
@@ -1810,7 +1816,7 @@ virSecuritySELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr,
     if (secdef == NULL)
         return -1;
 
-    if (secdef->norelabel)
+    if (secdef->norelabel || data->skipAllLabel)
         return 0;
 
     for (i = 0 ; i < def->ndisks ; i++) {
-- 
1.8.0.1

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list