From nobody Wed Jul 16 02:56:46 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1525989510188653.3797349377235; Thu, 10 May 2018 14:58:30 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C31D0267F8; Thu, 10 May 2018 21:58:28 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 83DCD5ED48; Thu, 10 May 2018 21:58:28 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 3BA3A180B5AA; Thu, 10 May 2018 21:58:28 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w4ALvusT028587 for ; Thu, 10 May 2018 17:57:56 -0400 Received: by smtp.corp.redhat.com (Postfix) id BDF3127BA0; Thu, 10 May 2018 21:57:56 +0000 (UTC) Received: from mx1.redhat.com (ext-mx03.extmail.prod.ext.phx2.redhat.com [10.5.110.27]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B518E16EF1 for ; Thu, 10 May 2018 21:57:55 +0000 (UTC) Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8FB027EBAB for ; Thu, 10 May 2018 21:57:53 +0000 (UTC) Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w4ALrkwG132738 for ; Thu, 10 May 2018 17:57:53 -0400 Received: from e18.ny.us.ibm.com (e18.ny.us.ibm.com [129.33.205.208]) by mx0b-001b2d01.pphosted.com with ESMTP id 2hvx2w8r1q-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 10 May 2018 17:57:52 -0400 Received: from localhost by e18.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 10 May 2018 17:57:52 -0400 Received: from b01cxnp23034.gho.pok.ibm.com (9.57.198.29) by e18.ny.us.ibm.com (146.89.104.205) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Thu, 10 May 2018 17:57:49 -0400 Received: from b01ledav005.gho.pok.ibm.com (b01ledav005.gho.pok.ibm.com [9.57.199.110]) by b01cxnp23034.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id w4ALvm7S51511512 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Thu, 10 May 2018 21:57:48 GMT Received: from b01ledav005.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7CD22AE043; Thu, 10 May 2018 17:59:46 -0400 (EDT) Received: from sbct-3.watson.ibm.com (unknown [9.47.158.153]) by b01ledav005.gho.pok.ibm.com (Postfix) with ESMTP id 64D3DAE034; Thu, 10 May 2018 17:59:46 -0400 (EDT) From: Stefan Berger To: libvir-list@redhat.com Date: Thu, 10 May 2018 17:57:35 -0400 In-Reply-To: <1525989457-29715-1-git-send-email-stefanb@linux.vnet.ibm.com> References: <1525989457-29715-1-git-send-email-stefanb@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 18051021-0044-0000-0000-00000412A52C X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00009002; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000259; SDB=6.01030432; UDB=6.00526618; IPR=6.00809563; MB=3.00021037; MTD=3.00000008; XFM=3.00000015; UTC=2018-05-10 21:57:50 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18051021-0045-0000-0000-00000844B495 Message-Id: <1525989457-29715-10-git-send-email-stefanb@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-05-10_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=3 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1805100201 X-Greylist: Sender passed SPF test, Sender IP whitelisted by DNSRBL, ACL 207 matched, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Thu, 10 May 2018 21:57:53 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Thu, 10 May 2018 21:57:53 +0000 (UTC) for IP:'148.163.158.5' DOMAIN:'mx0b-001b2d01.pphosted.com' HELO:'mx0a-001b2d01.pphosted.com' FROM:'stefanb@linux.vnet.ibm.com' RCPT:'' X-RedHat-Spam-Score: -0.7 (RCVD_IN_DNSWL_LOW) 148.163.158.5 mx0b-001b2d01.pphosted.com 148.163.158.5 mx0b-001b2d01.pphosted.com X-Scanned-By: MIMEDefang 2.78 on 10.5.110.27 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v4 09/11] security: Label the external swtpm with SELinux labels X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 10 May 2018 21:58:29 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" In this patch we label the swtpm process with SELinux labels. We give it the same label as the QEMU process has. We label its state directory and files as well. We restore the old security labels once the swtpm has terminated. The file and process labels now look as follows: Directory: /var/lib/libvirt/swtpm [root@localhost swtpm]# ls -lZ total 4 rwx------. 2 tss tss system_u:object_r:svirt_image_t:s0:c254,c932 4096 Ap= r 5 16:46 testvm [root@localhost testvm]# ls -lZ total 8 -rw-r--r--. 1 tss tss system_u:object_r:svirt_image_t:s0:c254,c932 3648 Apr= 5 16:46 tpm-00.permall The log in /var/log/swtpm/libvirt/qemu is labeled as follows: -rw-r--r--. 1 tss tss system_u:object_r:svirt_image_t:s0:c254,c932 2237 Apr= 5 16:46 vtpm.log [root@localhost 485d0004-a48f-436a-8457-8a3b73e28567]# ps auxZ | grep swtpm= | grep ctrl | grep -v grep system_u:system_r:svirt_t:s0:c254,c932 tss 25664 0.0 0.0 28172 3892 ? = Ss 16:57 0:00 /usr/bin/swtpm socket --daemon --ctrl type=3Dunixio,p= ath=3D/var/run/libvirt/qemu/swtpm/testvm-swtpm.sock,mode=3D0660 --tpmstate = dir=3D/var/lib/libvirt/swtpm/testvm/tpm1.2 --log file=3D/var/log/swtpm/libv= irt/qemu/testvm-swtpm.log [root@localhost 485d0004-a48f-436a-8457-8a3b73e28567]# ps auxZ | grep qemu = | grep tpm | grep -v grep system_u:system_r:svirt_t:s0:c254,c932 qemu 25669 99.0 0.0 3096704 48500 ?= Sl 16:57 3:28 /bin/qemu-system-x86_64 [..] Signed-off-by: Stefan Berger --- src/libvirt_private.syms | 2 + src/qemu/qemu_tpm.c | 24 +++++- src/security/security_driver.h | 7 ++ src/security/security_manager.c | 36 +++++++++ src/security/security_manager.h | 6 ++ src/security/security_selinux.c | 164 ++++++++++++++++++++++++++++++++++++= ++++ src/security/security_stack.c | 40 ++++++++++ 7 files changed, 278 insertions(+), 1 deletion(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 75b8932..2ce67e7 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1319,6 +1319,7 @@ virSecurityManagerRestoreImageLabel; virSecurityManagerRestoreInputLabel; virSecurityManagerRestoreMemoryLabel; virSecurityManagerRestoreSavedStateLabel; +virSecurityManagerRestoreTPMLabels; virSecurityManagerSetAllLabel; virSecurityManagerSetChardevLabel; virSecurityManagerSetChildProcessLabel; @@ -1333,6 +1334,7 @@ virSecurityManagerSetProcessLabel; virSecurityManagerSetSavedStateLabel; virSecurityManagerSetSocketLabel; virSecurityManagerSetTapFDLabel; +virSecurityManagerSetTPMLabels; virSecurityManagerStackAddNested; virSecurityManagerTransactionAbort; virSecurityManagerTransactionCommit; diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 024d24d..62f0146 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -684,7 +684,26 @@ qemuExtTPMStartEmulator(virQEMUDriverPtr driver, =20 virCommandSetErrorBuffer(cmd, &errbuf); =20 - if (virCommandRun(cmd, &exitstatus) < 0 || exitstatus !=3D 0) { + if (virSecurityManagerSetTPMLabels(driver->securityManager, + def) < 0) + goto cleanup; + + if (virSecurityManagerSetChildProcessLabel(driver->securityManager, + def, cmd) < 0) + goto cleanup; + + if (virSecurityManagerPreFork(driver->securityManager) < 0) + goto cleanup; + + /* make sure we run this with the appropriate user */ + virCommandSetUID(cmd, cfg->swtpm_user); + virCommandSetGID(cmd, cfg->swtpm_group); + + ret =3D virCommandRun(cmd, &exitstatus); + + virSecurityManagerPostFork(driver->securityManager); + + if (ret < 0 || exitstatus !=3D 0) { VIR_ERROR(_("Could not start 'swtpm'. exitstatus: %d " "stderr: %s"), exitstatus, errbuf); virReportError(VIR_ERR_INTERNAL_ERROR, @@ -696,6 +715,8 @@ qemuExtTPMStartEmulator(virQEMUDriverPtr driver, ret =3D 0; =20 cleanup: + if (ret < 0) + virSecurityManagerRestoreTPMLabels(driver->securityManager, def); VIR_FREE(shortName); VIR_FREE(errbuf); virCommandFree(cmd); @@ -741,6 +762,7 @@ qemuExtTPMStop(virQEMUDriverPtr driver, goto cleanup; =20 qemuTPMEmulatorStop(cfg->swtpmStateDir, shortName); + virSecurityManagerRestoreTPMLabels(driver->securityManager, def); break; case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: case VIR_DOMAIN_TPM_TYPE_LAST: diff --git a/src/security/security_driver.h b/src/security/security_driver.h index 95e7c4d..cbf0ecf 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -149,6 +149,10 @@ typedef int (*virSecurityDomainRestoreChardevLabel) (v= irSecurityManagerPtr mgr, virDomainDefPtr def, virDomainChrSourceDef= Ptr dev_source, bool chardevStdioLogd= ); +typedef int (*virSecurityDomainSetTPMLabels) (virSecurityManagerPtr mgr, + virDomainDefPtr def); +typedef int (*virSecurityDomainRestoreTPMLabels) (virSecurityManagerPtr mg= r, + virDomainDefPtr def); =20 =20 struct _virSecurityDriver { @@ -213,6 +217,9 @@ struct _virSecurityDriver { =20 virSecurityDomainSetChardevLabel domainSetSecurityChardevLabel; virSecurityDomainRestoreChardevLabel domainRestoreSecurityChardevLabel; + + virSecurityDomainSetTPMLabels domainSetSecurityTPMLabels; + virSecurityDomainRestoreTPMLabels domainRestoreSecurityTPMLabels; }; =20 virSecurityDriverPtr virSecurityDriverLookup(const char *name, diff --git a/src/security/security_manager.c b/src/security/security_manage= r.c index 71f7f59..8683ad7 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -1204,3 +1204,39 @@ virSecurityManagerRestoreChardevLabel(virSecurityMan= agerPtr mgr, virReportUnsupportedError(); return -1; } + + +int +virSecurityManagerSetTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr vm) +{ + int ret; + + if (mgr->drv->domainSetSecurityTPMLabels) { + virObjectLock(mgr); + ret =3D mgr->drv->domainSetSecurityTPMLabels(mgr, vm); + virObjectUnlock(mgr); + + return ret; + } + + return 0; +} + + +int +virSecurityManagerRestoreTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr vm) +{ + int ret; + + if (mgr->drv->domainRestoreSecurityTPMLabels) { + virObjectLock(mgr); + ret =3D mgr->drv->domainRestoreSecurityTPMLabels(mgr, vm); + virObjectUnlock(mgr); + + return ret; + } + + return 0; +} diff --git a/src/security/security_manager.h b/src/security/security_manage= r.h index c36a8b4..e772b61 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -194,4 +194,10 @@ int virSecurityManagerRestoreChardevLabel(virSecurityM= anagerPtr mgr, virDomainChrSourceDefPtr dev_sou= rce, bool chardevStdioLogd); =20 +int virSecurityManagerSetTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr vm); + +int virSecurityManagerRestoreTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr vm); + #endif /* VIR_SECURITY_MANAGER_H__ */ diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index 92e8415..6377fb7 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -3048,6 +3048,167 @@ virSecuritySELinuxDomainSetPathLabel(virSecurityMan= agerPtr mgr, return virSecuritySELinuxSetFilecon(mgr, path, seclabel->imagelabel); } =20 + +/* + * _virSecuritySELinuxSetFileLabels: + * + * @mgr: the virSecurityManager + * @path: path to a directory or a file + * @seclabel: the security label + * + * Set the file labels on the given path; if the path is a directory + * we label all files found there, including the directory itself, + * otherwise we just label the file. + */ +static int +_virSecuritySELinuxSetFileLabels(virSecurityManagerPtr mgr, + const char *path, + virSecurityLabelDefPtr seclabel) +{ + int ret =3D 0; + struct dirent *ent; + char *filename =3D NULL; + DIR *dir; + + if ((ret =3D virSecuritySELinuxSetFilecon(mgr, path, seclabel->imagela= bel))) + return ret; + + if (!virFileIsDir(path)) + return 0; + + if (virDirOpen(&dir, path) < 0) + return -1; + + while ((ret =3D virDirRead(dir, &ent, path)) > 0) { + if (ent->d_type !=3D DT_REG) + continue; + + if (virAsprintf(&filename, "%s/%s", path, ent->d_name) < 0) { + ret =3D -1; + break; + } + ret =3D virSecuritySELinuxSetFilecon(mgr, filename, + seclabel->imagelabel); + VIR_FREE(filename); + if (ret < 0) + break; + } + if (ret < 0) + virReportSystemError(errno, _("Unable to label files under %s"), + path); + + virDirClose(&dir); + + return ret; +} + + +/* + * _virSecuritySELinuxRestoreFileLabels: + * + * @mgr: the virSecurityManager + * @path: path to a directory or a file + * + * Restore the file labels on the given path; if the path is a directory + * we restore all file labels found there, including the label of the + * directory itself, otherwise we just restore the label on the file. + */ +static int +_virSecuritySELinuxRestoreFileLabels(virSecurityManagerPtr mgr, + const char *path) +{ + int ret =3D 0; + struct dirent *ent; + char *filename =3D NULL; + DIR *dir; + + if ((ret =3D virSecuritySELinuxRestoreFileLabel(mgr, path))) + return ret; + + if (!virFileIsDir(path)) + return 0; + + if (virDirOpen(&dir, path) < 0) + return -1; + + while ((ret =3D virDirRead(dir, &ent, path)) > 0) { + if (ent->d_type !=3D DT_REG) + continue; + + if (virAsprintf(&filename, "%s/%s", path, ent->d_name) < 0) { + ret =3D -1; + break; + } + ret =3D virSecuritySELinuxRestoreFileLabel(mgr, filename); + VIR_FREE(filename); + if (ret < 0) + break; + } + if (ret < 0) + virReportSystemError(errno, _("Unable to restore file labels under= %s"), + path); + + virDirClose(&dir); + + return ret; +} + + +static int +virSecuritySELinuxSetTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr def) +{ + int ret =3D 0; + virSecurityLabelDefPtr seclabel; + + seclabel =3D virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAM= E); + if (seclabel =3D=3D NULL) + return 0; + + switch (def->tpm->type) { + case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: + break; + case VIR_DOMAIN_TPM_TYPE_EMULATOR: + ret =3D _virSecuritySELinuxSetFileLabels( + mgr, def->tpm->data.emulator.storagepath, + seclabel); + if (ret =3D=3D 0 && def->tpm->data.emulator.logfile) + ret =3D _virSecuritySELinuxSetFileLabels( + mgr, def->tpm->data.emulator.logfile, + seclabel); + break; + case VIR_DOMAIN_TPM_TYPE_LAST: + break; + } + + return ret; +} + + +static int +virSecuritySELinuxRestoreTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr def) +{ + int ret =3D 0; + + switch (def->tpm->type) { + case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: + break; + case VIR_DOMAIN_TPM_TYPE_EMULATOR: + ret =3D _virSecuritySELinuxRestoreFileLabels( + mgr, def->tpm->data.emulator.storagepath); + if (ret =3D=3D 0 && def->tpm->data.emulator.logfile) + ret =3D _virSecuritySELinuxRestoreFileLabels( + mgr, def->tpm->data.emulator.logfile); + break; + case VIR_DOMAIN_TPM_TYPE_LAST: + break; + } + + return ret; +} + + virSecurityDriver virSecurityDriverSELinux =3D { .privateDataLen =3D sizeof(virSecuritySELinuxData), .name =3D SECURITY_SELINUX_NAME, @@ -3107,4 +3268,7 @@ virSecurityDriver virSecurityDriverSELinux =3D { =20 .domainSetSecurityChardevLabel =3D virSecuritySELinuxSetChardevLa= bel, .domainRestoreSecurityChardevLabel =3D virSecuritySELinuxRestoreChard= evLabel, + + .domainSetSecurityTPMLabels =3D virSecuritySELinuxSetTPMLabels, + .domainRestoreSecurityTPMLabels =3D virSecuritySELinuxRestoreTPMLa= bels, }; diff --git a/src/security/security_stack.c b/src/security/security_stack.c index 9615f9f..e37a681 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -760,6 +760,43 @@ virSecurityStackDomainRestoreChardevLabel(virSecurityM= anagerPtr mgr, return rc; } =20 + +static int +virSecurityStackSetTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr vm) +{ + virSecurityStackDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item =3D priv->itemsHead; + int rc =3D 0; + + for (; item; item =3D item->next) { + if (virSecurityManagerSetTPMLabels(item->securityManager, + vm) < 0) + rc =3D -1; + } + + return rc; +} + + +static int +virSecurityStackRestoreTPMLabels(virSecurityManagerPtr mgr, + virDomainDefPtr vm) +{ + virSecurityStackDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item =3D priv->itemsHead; + int rc =3D 0; + + for (; item; item =3D item->next) { + if (virSecurityManagerRestoreTPMLabels(item->securityManager, + vm) < 0) + rc =3D -1; + } + + return rc; +} + + virSecurityDriver virSecurityDriverStack =3D { .privateDataLen =3D sizeof(virSecurityStackData), .name =3D "stack", @@ -822,4 +859,7 @@ virSecurityDriver virSecurityDriverStack =3D { =20 .domainSetSecurityChardevLabel =3D virSecurityStackDomainSetChard= evLabel, .domainRestoreSecurityChardevLabel =3D virSecurityStackDomainRestoreC= hardevLabel, + + .domainSetSecurityTPMLabels =3D virSecurityStackSetTPMLabels, + .domainRestoreSecurityTPMLabels =3D virSecurityStackRestoreTPMLabe= ls, }; --=20 2.5.5 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list