Re: [PATCH 05/23] Skip bulk relabelling of resources in SELinux driver when used with LXC

[Osier Yang <jyang@xxxxxxxxxx>]

On 2012年12月01日 04:26, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange"<berrange@xxxxxxxxxx>
>
> The virSecurityManager{Set,Restore}AllLabel methods are invoked
> at domain startup/shutdown to relabel resources associated with
> a domain. This works fine with QEMU, but with LXC they are in
> fact both currently no-ops since LXC does not support disks,
> hostdevs, or kernel/initrd files. Worse, when LXC gains support
> for disks/hostdevs, they will do the wrong thing, since they
> run in host context, not container context. Thus this patch
> turns then into a formal no-op when used with LXC. The LXC
> controller will call out to specific security manager labelling
> APIs as required during startup.
>
> Signed-off-by: Daniel P. Berrange<berrange@xxxxxxxxxx>
> ---
>   src/security/security_selinux.c | 12 +++++++++---
>   1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
> index 5409e32..ddf3da3 100644
> --- a/src/security/security_selinux.c
> +++ b/src/security/security_selinux.c
> @@ -61,6 +61,7 @@ struct _virSecuritySELinuxData {
>       char *file_context;
>       char *content_context;
>       virHashTablePtr mcs;
> +    bool skipAllLabel;
>   };
>
>   struct _virSecuritySELinuxCallbackData {
> @@ -363,6 +364,8 @@ virSecuritySELinuxLXCInitialize(virSecurityManagerPtr mgr)
>       virConfPtr selinux_conf;
>       virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
>
> +    data->skipAllLabel = true;
> +
>       selinux_conf = virConfReadFile(selinux_lxc_contexts_path(), 0);
>       if (!selinux_conf) {
>           virReportSystemError(errno,
> @@ -438,6 +441,8 @@ virSecuritySELinuxQEMUInitialize(virSecurityManagerPtr mgr)
>       char *ptr;
>       virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
>
> +    data->skipAllLabel = false;
> +
>       if (virFileReadAll(selinux_virtual_domain_context_path(), MAX_CONTEXT,&(data->domain_context))<  0) {
>           virReportSystemError(errno,
>                                _("cannot read SELinux virtual domain context file '%s'"),
> @@ -1438,11 +1443,12 @@ virSecuritySELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def,
>
>
>   static int
> -virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
> +virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr,
>                                             virDomainDefPtr def,
>                                             int migrated ATTRIBUTE_UNUSED)
>   {
>       virSecurityLabelDefPtr secdef;
> +    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
>       int i;
>       int rc = 0;
>
> @@ -1452,7 +1458,7 @@ virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UN
>       if (secdef == NULL)
>           return -1;
>
> -    if (secdef->norelabel)
> +    if (secdef->norelabel || data->skipAllLabel)
>           return 0;
>
>       for (i = 0 ; i<  def->nhostdevs ; i++) {
> @@ -1810,7 +1816,7 @@ virSecuritySELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr,
>       if (secdef == NULL)
>           return -1;
>
> -    if (secdef->norelabel)
> +    if (secdef->norelabel || data->skipAllLabel)
>           return 0;
>
>       for (i = 0 ; i<  def->ndisks ; i++) {

ACK

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list