On Wed, May 15, 2013 at 09:46:29AM -0400, dwalsh@xxxxxxxxxx wrote:
> From: Dan Walsh <dwalsh@xxxxxxxxxx>
>
> We do not want to allow contained applications to be able to read fusefs_t.
> So we want /proc/meminfo label to match the system default proc_t.
> ---
> src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
> index ac0f69c..bba2e3a 100644
> --- a/src/lxc/lxc_container.c
> +++ b/src/lxc/lxc_container.c
> @@ -52,6 +52,10 @@
> # include <blkid/blkid.h>
> #endif
>
> +#if WITH_SELINUX
> +# include <selinux/selinux.h>
> +#endif
> +
> #include "virerror.h"
> #include "virlog.h"
> #include "lxc_container.h"
> @@ -763,6 +767,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def,
> def->name)) < 0)
> return ret;
>
> +#if WITH_SELINUX
> + if (is_selinux_enabled() > 0) {
> + security_context_t scon;
> + ret = getfilecon("/proc/meminfo", &scon);
> + if (ret) {
This error handling is broken. The man page says
'On success, a positive number is returned indicating the size of the
extended attribute value. On failure, -1 is returned and errno is set
appropriately.'
so you must use 'if (ret < 0) {' for detecting errors.
> + virReportSystemError(errno,
> + _("Failed to get security context of %s for /proc/meminfo mount point"),
> + meminfo_path);
> + return ret;
Return -1;
> + }
> + ret = setfilecon(meminfo_path, scon);
> + freecon(scon);
> + if (ret) {
And again here.
> + virReportSystemError(errno,
> + _("Failed to set security context of %s for /proc/meminfo mount point"),
> + meminfo_path);
> + return ret;
Return -1;
> + }
> + }
> +#endif
> if ((ret = mount(meminfo_path, "/proc/meminfo",
> NULL, MS_BIND, NULL)) < 0) {
> virReportSystemError(errno,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list