openkylin
/
libvirt
mirror of https://gitee.com/openkylin/libvirt.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

m4: virt-selinux: remove obsolete checks 

All OSes that we support have libselinux >= 2.5 except for Ubuntu 16.04
where the version is 2.4.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
Pavel Hrdina 2019-10-09 16:43:53 +02:00
parent 3365cdf8a8
commit 5f92046b77
4 changed files with 11 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
m4/virt-selinux.m4
View File

@ -27,20 +27,8 @@ AC_DEFUN([LIBVIRT_CHECK_SELINUX],[
[fgetfilecon_raw], [selinux/selinux.h])
if test "$with_selinux" = "yes"; then
# libselinux changed signatures between 2.2 and 2.3
AC_CACHE_CHECK([for selinux setcon parameter type], [lv_cv_setcon_const],
[AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM(
[[
#include <selinux/selinux.h>
int setcon(char *context);
]])],
[lv_cv_setcon_const=''],
[lv_cv_setcon_const='const'])])
AC_DEFINE_UNQUOTED([VIR_SELINUX_CTX_CONST], [$lv_cv_setcon_const],
[Define to empty or 'const' depending on how SELinux qualifies its
security context parameters])
# ...and again for 2.5
# libselinux changed signatures for 2.5
# TODO: Drop once we don't support Ubuntu 16.04
AC_CACHE_CHECK([for selinux selabel_open parameter type],
[lv_cv_selabel_open_const],
[AC_COMPILE_IFELSE(
@ -68,10 +56,6 @@ struct selabel_handle *selabel_open(unsigned, struct selinux_opt *, unsigned);
fi
AC_MSG_RESULT([$SELINUX_MOUNT])
AC_DEFINE_UNQUOTED([SELINUX_MOUNT], ["$SELINUX_MOUNT"], [SELinux mount point])
dnl We prefer to use <selinux/label.h> and selabel_open, but can fall
dnl back to matchpathcon for the sake of RHEL 5's version of libselinux.
AC_CHECK_HEADERS([selinux/label.h])
fi
])

4
src/qemu/qemu_domain.c
View File

@ -13276,7 +13276,7 @@ qemuDomainCreateDeviceRecursive(const char *device,
}
if (tcon &&
lsetfilecon_raw(devicePath, (VIR_SELINUX_CTX_CONST char *)tcon) < 0) {
lsetfilecon_raw(devicePath, (const char *)tcon) < 0) {
VIR_WARNINGS_NO_WLOGICALOP_EQUAL_EXPR
if (errno != EOPNOTSUPP && errno != ENOTSUP) {
VIR_WARNINGS_RESET
@ -14074,7 +14074,7 @@ qemuDomainAttachDeviceMknodHelper(pid_t pid G_GNUC_UNUSED,
# ifdef WITH_SELINUX
if (data->tcon &&
lsetfilecon_raw(data->file, (VIR_SELINUX_CTX_CONST char *)data->tcon) < 0) {
lsetfilecon_raw(data->file, (const char *)data->tcon) < 0) {
VIR_WARNINGS_NO_WLOGICALOP_EQUAL_EXPR
if (errno != EOPNOTSUPP && errno != ENOTSUP) {
VIR_WARNINGS_RESET

22
src/security/security_selinux.c
View File

@ -23,9 +23,7 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#if HAVE_SELINUX_LABEL_H
# include <selinux/label.h>
#endif
#include <selinux/label.h>
#include "security_driver.h"
#include "security_selinux.h"
@ -62,9 +60,7 @@ struct _virSecuritySELinuxData {
char *content_context;
virHashTablePtr mcs;
bool skipAllLabel;
#if HAVE_SELINUX_LABEL_H
struct selabel_handle *label_handle;
#endif
};
/* Data structure to pass to various callbacks so we have everything we need */
@ -640,14 +636,12 @@ virSecuritySELinuxLXCInitialize(virSecurityManagerPtr mgr)
data->skipAllLabel = true;
# if HAVE_SELINUX_LABEL_H
data->label_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0);
if (!data->label_handle) {
virReportSystemError(errno, "%s",
_("cannot open SELinux label_handle"));
return -1;
}
# endif
if (!(selinux_conf = virConfReadFile(selinux_lxc_contexts_path(), 0)))
goto error;
@ -688,10 +682,8 @@ virSecuritySELinuxLXCInitialize(virSecurityManagerPtr mgr)
return 0;
error:
# if HAVE_SELINUX_LABEL_H
selabel_close(data->label_handle);
data->label_handle = NULL;
# endif
VIR_FREE(data->domain_context);
VIR_FREE(data->file_context);
VIR_FREE(data->content_context);
@ -717,14 +709,12 @@ virSecuritySELinuxQEMUInitialize(virSecurityManagerPtr mgr)
data->skipAllLabel = false;
#if HAVE_SELINUX_LABEL_H
data->label_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0);
if (!data->label_handle) {
virReportSystemError(errno, "%s",
_("cannot open SELinux label_handle"));
return -1;
}
#endif
if (virFileReadAll(selinux_virtual_domain_context_path(), MAX_CONTEXT, &(data->domain_context)) < 0) {
virReportSystemError(errno,
@ -773,10 +763,8 @@ virSecuritySELinuxQEMUInitialize(virSecurityManagerPtr mgr)
return 0;
error:
#if HAVE_SELINUX_LABEL_H
selabel_close(data->label_handle);
data->label_handle = NULL;
#endif
VIR_FREE(data->domain_context);
VIR_FREE(data->alt_domain_context);
VIR_FREE(data->file_context);
@ -1046,10 +1034,8 @@ virSecuritySELinuxDriverClose(virSecurityManagerPtr mgr)
if (!data)
return 0;
#if HAVE_SELINUX_LABEL_H
if (data->label_handle)
selabel_close(data->label_handle);
#endif
virHashFree(data->mcs);
@ -1272,7 +1258,7 @@ virSecuritySELinuxSetFileconImpl(const char *path,
VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon);
if (setfilecon_raw(path, (VIR_SELINUX_CTX_CONST char *)tcon) < 0) {
if (setfilecon_raw(path, (const char *)tcon) < 0) {
int setfilecon_errno = errno;
if (getfilecon_raw(path, &econ) >= 0) {
@ -1458,13 +1444,9 @@ static int
getContext(virSecurityManagerPtr mgr G_GNUC_UNUSED,
const char *newpath, mode_t mode, security_context_t *fcon)
{
#if HAVE_SELINUX_LABEL_H
virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
return selabel_lookup_raw(data->label_handle, fcon, newpath, mode);
#else
return matchpathcon(newpath, mode, fcon);
#endif
}

19
tests/securityselinuxhelper.c
View File

@ -27,9 +27,7 @@
# include <linux/magic.h>
#endif
#include <selinux/selinux.h>
#if HAVE_SELINUX_LABEL_H
# include <selinux/label.h>
#endif
#include <selinux/label.h>
#include <sys/vfs.h>
#include <unistd.h>
#include <sys/xattr.h>
@ -54,7 +52,6 @@ static const char *(*real_selinux_virtual_image_context_path)(void);
static const char *(*real_selinux_lxc_contexts_path)(void);
#endif
#if HAVE_SELINUX_LABEL_H
static struct selabel_handle *(*real_selabel_open)(unsigned int backend,
VIR_SELINUX_OPEN_CONST
struct selinux_opt *opts,
@ -64,7 +61,6 @@ static int (*real_selabel_lookup_raw)(struct selabel_handle *handle,
security_context_t *con,
const char *key,
int type);
#endif
static void init_syms(void)
{
@ -82,11 +78,9 @@ static void init_syms(void)
VIR_MOCK_REAL_INIT(selinux_lxc_contexts_path);
#endif
#if HAVE_SELINUX_LABEL_H
VIR_MOCK_REAL_INIT(selabel_open);
VIR_MOCK_REAL_INIT(selabel_close);
VIR_MOCK_REAL_INIT(selabel_lookup_raw);
#endif
}
@ -145,7 +139,7 @@ int getpidcon(pid_t pid, security_context_t *context)
return getpidcon_raw(pid, context);
}
int setcon_raw(VIR_SELINUX_CTX_CONST char *context)
int setcon_raw(const char *context)
{
if (!is_selinux_enabled()) {
errno = EINVAL;
@ -154,13 +148,13 @@ int setcon_raw(VIR_SELINUX_CTX_CONST char *context)
return setenv("FAKE_SELINUX_CONTEXT", context, 1);
}
int setcon(VIR_SELINUX_CTX_CONST char *context)
int setcon(const char *context)
{
return setcon_raw(context);
}
int setfilecon_raw(const char *path, VIR_SELINUX_CTX_CONST char *con)
int setfilecon_raw(const char *path, const char *con)
{
const char *constr = con;
if (STRPREFIX(path, abs_builddir "/securityselinuxlabeldata/nfs/")) {
@ -171,7 +165,7 @@ int setfilecon_raw(const char *path, VIR_SELINUX_CTX_CONST char *con)
constr, strlen(constr), 0);
}
int setfilecon(const char *path, VIR_SELINUX_CTX_CONST char *con)
int setfilecon(const char *path, const char *con)
{
return setfilecon_raw(path, con);
}
@ -292,7 +286,6 @@ const char *selinux_lxc_contexts_path(void)
}
#endif
#if HAVE_SELINUX_LABEL_H
struct selabel_handle *
selabel_open(unsigned int backend,
VIR_SELINUX_OPEN_CONST struct selinux_opt *opts,
@ -335,5 +328,3 @@ int selabel_lookup_raw(struct selabel_handle *handle,
errno = ENOENT;
return -1;
}
#endif