openkylin
/
libvirt
mirror of https://gitee.com/openkylin/libvirt.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

virt-aa-helper: handle 9pfs 

Make virt-aa-helper create rules to allow VMs access to filesystem
mounts from the host.

Signed-off-by: Felix Geyer <debfx@fobos.de>
Signed-off-by: Hiroshi Miura <miurahr@linux.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Guido Günther <agx@sigxcpu.org>
This commit is contained in:
Felix Geyer 2014-03-09 16:03:20 +01:00 committed by Guido Günther
parent 7d949aa9c2
commit 29ea8a9b64
1 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
src/security/virt-aa-helper.c
View File

@ -606,9 +606,6 @@ valid_path(const char *path, const bool readonly)
return -1;
switch (sb.st_mode & S_IFMT) {
case S_IFDIR:
return 1;
break;
case S_IFSOCK:
return 1;
break;
@ -775,7 +772,7 @@ get_definition(vahControl * ctl, const char *xmlStr)
}
static int
vah_add_file(virBufferPtr buf, const char *path, const char *perms)
vah_add_path(virBufferPtr buf, const char *path, const char *perms, bool recursive)
{
char *tmp = NULL;
int rc = -1;
@ -816,10 +813,14 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms)
goto cleanup;
}
virBufferAsprintf(buf, " \"%s\" %s,\n", tmp, perms);
virBufferAsprintf(buf, " \"%s%s\" %s,\n", tmp, recursive ? "/**" : "", perms);
if (readonly) {
virBufferAddLit(buf, " # don't audit writes to readonly files\n");
virBufferAsprintf(buf, " deny \"%s\" w,\n", tmp);
virBufferAsprintf(buf, " deny \"%s%s\" w,\n", tmp, recursive ? "/**" : "");
}
if (recursive) {
/* allow reading (but not creating) the dir */
virBufferAsprintf(buf, " \"%s/\" r,\n", tmp);
}
cleanup:
@ -828,6 +829,12 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms)
return rc;
}
static int
vah_add_file(virBufferPtr buf, const char *path, const char *perms)
{
return vah_add_path(buf, path, perms, false);
}
static int
vah_add_file_chardev(virBufferPtr buf,
const char *path,
@ -1077,6 +1084,19 @@ get_files(vahControl * ctl)
} /* switch */
}
for (i = 0; i < ctl->def->nfss; i++) {
if (ctl->def->fss[i] &&
ctl->def->fss[i]->type == VIR_DOMAIN_FS_TYPE_MOUNT &&
(ctl->def->fss[i]->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_PATH ||
ctl->def->fss[i]->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_DEFAULT) &&
ctl->def->fss[i]->src){
virDomainFSDefPtr fs = ctl->def->fss[i];
if (vah_add_path(&buf, fs->src, fs->readonly ? "r" : "rw", true) != 0)
goto cleanup;
}
}
if (ctl->newfile)
if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
goto cleanup;