openkylin
/
libvirt
mirror of https://gitee.com/openkylin/libvirt.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

security, apparmor: add (Set|Restore)ChardevLabel 

Since 1b4f66e "security: introduce virSecurityManager
(Set|Restore)ChardevLabel" this is a public API of security manager.

Implementing this in apparmor avoids miss any rules that should be
added for devices labeled via these calls.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
This commit is contained in:
Christian Ehrhardt 2018-01-09 16:04:04 +01:00 committed by Michal Privoznik
parent a5486e57f5
commit 14b52bb765
1 changed files with 74 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
src/security/security_apparmor.c
View File

@ -945,6 +945,77 @@ AppArmorRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr,
return reload_profile(mgr, def, NULL, false); return reload_profile(mgr, def, NULL, false);
} }
static int
AppArmorSetChardevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainChrSourceDefPtr dev_source,
bool chardevStdioLogd ATTRIBUTE_UNUSED)
{
char *in = NULL, *out = NULL;
int ret = -1;
virSecurityLabelDefPtr secdef;
secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME);
if (!secdef)
return 0;
switch ((virDomainChrType) dev_source->type) {
case VIR_DOMAIN_CHR_TYPE_DEV:
case VIR_DOMAIN_CHR_TYPE_FILE:
case VIR_DOMAIN_CHR_TYPE_UNIX:
case VIR_DOMAIN_CHR_TYPE_PTY:
ret = reload_profile(mgr, def, dev_source->data.file.path, true);
break;
case VIR_DOMAIN_CHR_TYPE_PIPE:
if (virAsprintf(&in, "%s.in", dev_source->data.file.path) < 0 ||
virAsprintf(&out, "%s.out", dev_source->data.file.path) < 0)
goto done;
if (virFileExists(in)) {
if (reload_profile(mgr, def, in, true) < 0)
goto done;
}
if (virFileExists(out)) {
if (reload_profile(mgr, def, out, true) < 0)
goto done;
}
ret = reload_profile(mgr, def, dev_source->data.file.path, true);
break;
case VIR_DOMAIN_CHR_TYPE_SPICEPORT:
case VIR_DOMAIN_CHR_TYPE_NULL:
case VIR_DOMAIN_CHR_TYPE_VC:
case VIR_DOMAIN_CHR_TYPE_STDIO:
case VIR_DOMAIN_CHR_TYPE_UDP:
case VIR_DOMAIN_CHR_TYPE_TCP:
case VIR_DOMAIN_CHR_TYPE_SPICEVMC:
case VIR_DOMAIN_CHR_TYPE_NMDM:
case VIR_DOMAIN_CHR_TYPE_LAST:
ret = 0;
break;
}
done:
VIR_FREE(in);
VIR_FREE(out);
return ret;
}
static int
AppArmorRestoreChardevLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
virDomainChrSourceDefPtr dev_source ATTRIBUTE_UNUSED,
bool chardevStdioLogd ATTRIBUTE_UNUSED)
{
virSecurityLabelDefPtr secdef;
secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME);
if (!secdef)
return 0;
return reload_profile(mgr, def, NULL, false);
}
static int static int
AppArmorSetSavedStateLabel(virSecurityManagerPtr mgr, AppArmorSetSavedStateLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def, virDomainDefPtr def,
@ -1067,6 +1138,9 @@ virSecurityDriver virAppArmorSecurityDriver = {
.domainSetPathLabel = AppArmorSetPathLabel, .domainSetPathLabel = AppArmorSetPathLabel,
.domainSetSecurityChardevLabel = AppArmorSetChardevLabel,
.domainRestoreSecurityChardevLabel = AppArmorRestoreChardevLabel,
.domainSetSecurityImageFDLabel = AppArmorSetFDLabel, .domainSetSecurityImageFDLabel = AppArmorSetFDLabel,
.domainSetSecurityTapFDLabel = AppArmorSetFDLabel, .domainSetSecurityTapFDLabel = AppArmorSetFDLabel,