On Thu, Mar 14, 2013 at 08:00:21PM -0400, Stefan Berger wrote: > On 03/14/2013 06:34 PM, Daniel P. Berrange wrote: > >On Thu, Mar 14, 2013 at 04:24:27PM -0400, Stefan Berger wrote: > >>On 03/14/2013 10:29 AM, Daniel P. Berrange wrote: > >>>On Wed, Mar 13, 2013 at 12:03:52PM -0400, Stefan Berger wrote: > >>>>Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx> > >>>> > >>>>--- > >>>> src/security/security_selinux.c | 90 ++++++++++++++++++++++++++++++++++++++++ > >>>> 1 file changed, 90 insertions(+) > >>>I imagine we also need to update security_apparmour.c and > >>>security_dac.c. > >>DAC: this seems to only be necessary if the the owner of the device > >>is not root. Typically it is owned by root. I added support for it > >>anyway now. > >>AppArmour: it looks like no other character devices are being > >>labeled so I may not have to do this for the TPM, either (?) > >> > >> > >>>Also src/conf/domain_audit.c will need to emit an audit event when the > >>>TPM is configured to use a host device. > >>type=VIRT_RESOURCE msg=audit(1363292411.635:499): pid=23365 uid=0 > >>auid=4294967295 ses=4294967295 > >>subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm > >>resrc=cgroup reason=allow vm="TPM-PT" > >>uuid=a4d7cd22-da89-3094-6212-079a48a309a1 > >>cgroup="/sys/fs/cgroup/devices/libvirt/qemu/TPM-PT/" class=path > >>path=/dev/tpm0 rdev=0A:E0 acl=rw exe="/usr/sbin/libvirtd" hostname=? > >>addr=? terminal=? res=success' > >> > >>Is this message type sufficient for a host device? > >No, this is just a generic message related to cgroups setup. > >We need to emit explicit audit log for each device in addition > >to this, since we cannot assume cgroups is enabled. > > > >We need to extend the virDomainAuditStart method to include > >this new device type. > > Ok, so now libvirt is also printing this one here: > > type=VIRT_RESOURCE msg=audit(1363305463.181:1302): pid=17807 uid=0 > auid=0 ses=1 > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > msg='virt=kvm resrc=dev reason=start vm="TPM-PT" > uuid=a4d7cd22-da89-3094-6212-079a48a309a1 device="/dev/tpm0" > exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=pts/20 > res=success' > > I suppose the msg='' part is somewhat device specific. So above > really only shows /dev/tpm0 and I don't think there's much else > worth mentioning. Yep, that's fine - people using these are just interested in the name of the device / file on the host being used by the VM. > The last thing is now in which patch to put this :-) I would keep it > in a separate patch after the one touching the SELinux and DAC > labeling... Sure, separate patch is fine. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :| -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list