From nobody Thu May 15 06:21:49 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 151127678447921.85245270748544; Tue, 21 Nov 2017 07:06:24 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 12B7F1A4083; Tue, 21 Nov 2017 15:06:23 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E12C76F13B; Tue, 21 Nov 2017 15:06:22 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id A96D43D38B; Tue, 21 Nov 2017 15:06:22 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id vALF6LZG010372 for ; Tue, 21 Nov 2017 10:06:21 -0500 Received: by smtp.corp.redhat.com (Postfix) id 708FB60C99; Tue, 21 Nov 2017 15:06:21 +0000 (UTC) Received: from icr.brq.redhat.com (unknown [10.43.2.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id C40DA60C9D for ; Tue, 21 Nov 2017 15:06:20 +0000 (UTC) From: =?UTF-8?q?J=C3=A1n=20Tomko?= To: libvir-list@redhat.com Date: Tue, 21 Nov 2017 16:05:40 +0100 Message-Id: <17e6e2ae4527dd7c88ca325d9d2e19715dfcf92b.1511276654.git.jtomko@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 2/5] security: Introduce functions for input device hot(un)plug X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 21 Nov 2017 15:06:23 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Export the existing DAC and SELinux for separate use and introduce functions for stack, nop and the security manager. --- src/libvirt_private.syms | 2 ++ src/security/security_dac.c | 3 +++ src/security/security_driver.h | 9 +++++++++ src/security/security_manager.c | 36 ++++++++++++++++++++++++++++++++++++ src/security/security_manager.h | 8 ++++++++ src/security/security_nop.c | 11 +++++++++++ src/security/security_selinux.c | 3 +++ src/security/security_stack.c | 38 ++++++++++++++++++++++++++++++++++++++ 8 files changed, 110 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 2997a469d..31969a092 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1274,6 +1274,7 @@ virSecurityManagerRestoreAllLabel; virSecurityManagerRestoreDiskLabel; virSecurityManagerRestoreHostdevLabel; virSecurityManagerRestoreImageLabel; +virSecurityManagerRestoreInputLabel; virSecurityManagerRestoreMemoryLabel; virSecurityManagerRestoreSavedStateLabel; virSecurityManagerSetAllLabel; @@ -1283,6 +1284,7 @@ virSecurityManagerSetDiskLabel; virSecurityManagerSetHostdevLabel; virSecurityManagerSetImageFDLabel; virSecurityManagerSetImageLabel; +virSecurityManagerSetInputLabel; virSecurityManagerSetMemoryLabel; virSecurityManagerSetProcessLabel; virSecurityManagerSetSavedStateLabel; diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 54120890f..52ca07a10 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -2123,6 +2123,9 @@ virSecurityDriver virSecurityDriverDAC =3D { .domainSetSecurityMemoryLabel =3D virSecurityDACSetMemoryLabel, .domainRestoreSecurityMemoryLabel =3D virSecurityDACRestoreMemoryLab= el, =20 + .domainSetSecurityInputLabel =3D virSecurityDACSetInputLabel, + .domainRestoreSecurityInputLabel =3D virSecurityDACRestoreInputLabe= l, + .domainSetSecurityDaemonSocketLabel =3D virSecurityDACSetDaemonSocketL= abel, .domainSetSecuritySocketLabel =3D virSecurityDACSetSocketLabel, .domainClearSecuritySocketLabel =3D virSecurityDACClearSocketLabel, diff --git a/src/security/security_driver.h b/src/security/security_driver.h index 0b3b45248..1b3070d06 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -131,6 +131,12 @@ typedef int (*virSecurityDomainSetMemoryLabel) (virSec= urityManagerPtr mgr, typedef int (*virSecurityDomainRestoreMemoryLabel) (virSecurityManagerPtr = mgr, virDomainDefPtr def, virDomainMemoryDefPtr = mem); +typedef int (*virSecurityDomainSetInputLabel) (virSecurityManagerPtr mgr, + virDomainDefPtr def, + virDomainInputDefPtr input); +typedef int (*virSecurityDomainRestoreInputLabel) (virSecurityManagerPtr m= gr, + virDomainDefPtr def, + virDomainInputDefPtr in= put); typedef int (*virSecurityDomainSetPathLabel) (virSecurityManagerPtr mgr, virDomainDefPtr def, const char *path); @@ -163,6 +169,9 @@ struct _virSecurityDriver { virSecurityDomainSetMemoryLabel domainSetSecurityMemoryLabel; virSecurityDomainRestoreMemoryLabel domainRestoreSecurityMemoryLabel; =20 + virSecurityDomainSetInputLabel domainSetSecurityInputLabel; + virSecurityDomainRestoreInputLabel domainRestoreSecurityInputLabel; + virSecurityDomainSetDaemonSocketLabel domainSetSecurityDaemonSocketLab= el; virSecurityDomainSetSocketLabel domainSetSecuritySocketLabel; virSecurityDomainClearSocketLabel domainClearSecuritySocketLabel; diff --git a/src/security/security_manager.c b/src/security/security_manage= r.c index 60cfc92e7..3cf12188a 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -1116,3 +1116,39 @@ virSecurityManagerRestoreMemoryLabel(virSecurityMana= gerPtr mgr, virReportUnsupportedError(); return -1; } + + +int +virSecurityManagerSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + if (mgr->drv->domainSetSecurityInputLabel) { + int ret; + virObjectLock(mgr); + ret =3D mgr->drv->domainSetSecurityInputLabel(mgr, vm, input); + virObjectUnlock(mgr); + return ret; + } + + virReportUnsupportedError(); + return -1; +} + + +int +virSecurityManagerRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + if (mgr->drv->domainRestoreSecurityInputLabel) { + int ret; + virObjectLock(mgr); + ret =3D mgr->drv->domainRestoreSecurityInputLabel(mgr, vm, input); + virObjectUnlock(mgr); + return ret; + } + + virReportUnsupportedError(); + return -1; +} diff --git a/src/security/security_manager.h b/src/security/security_manage= r.h index 6712112e7..834c7f159 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -172,6 +172,14 @@ int virSecurityManagerRestoreMemoryLabel(virSecurityMa= nagerPtr mgr, virDomainDefPtr vm, virDomainMemoryDefPtr mem); =20 +int virSecurityManagerSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input); +int virSecurityManagerRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input); + + int virSecurityManagerDomainSetPathLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, const char *path); diff --git a/src/security/security_nop.c b/src/security/security_nop.c index 527be11e5..cfb032c68 100644 --- a/src/security/security_nop.c +++ b/src/security/security_nop.c @@ -254,6 +254,14 @@ virSecurityDomainRestoreMemoryLabelNop(virSecurityMana= gerPtr mgr ATTRIBUTE_UNUSE return 0; } =20 +static int +virSecurityDomainInputLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainInputDefPtr input ATTRIBUTE_UNUSED) +{ + return 0; +} + =20 virSecurityDriver virSecurityDriverNop =3D { .privateDataLen =3D 0, @@ -276,6 +284,9 @@ virSecurityDriver virSecurityDriverNop =3D { .domainSetSecurityMemoryLabel =3D virSecurityDomainSetMemoryLabe= lNop, .domainRestoreSecurityMemoryLabel =3D virSecurityDomainRestoreMemory= LabelNop, =20 + .domainSetSecurityInputLabel =3D virSecurityDomainInputLabelNop, + .domainRestoreSecurityInputLabel =3D virSecurityDomainInputLabelNop, + .domainSetSecurityDaemonSocketLabel =3D virSecurityDomainSetDaemonSock= etLabelNop, .domainSetSecuritySocketLabel =3D virSecurityDomainSetSocketLabe= lNop, .domainClearSecuritySocketLabel =3D virSecurityDomainClearSocketLa= belNop, diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index ed1828a12..b677fbcda 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -3064,6 +3064,9 @@ virSecurityDriver virSecurityDriverSELinux =3D { .domainSetSecurityMemoryLabel =3D virSecuritySELinuxSetMemoryLab= el, .domainRestoreSecurityMemoryLabel =3D virSecuritySELinuxRestoreMemor= yLabel, =20 + .domainSetSecurityInputLabel =3D virSecuritySELinuxSetInputLabe= l, + .domainRestoreSecurityInputLabel =3D virSecuritySELinuxRestoreInput= Label, + .domainSetSecurityDaemonSocketLabel =3D virSecuritySELinuxSetDaemonSoc= ketLabel, .domainSetSecuritySocketLabel =3D virSecuritySELinuxSetSocketLab= el, .domainClearSecuritySocketLabel =3D virSecuritySELinuxClearSocketL= abel, diff --git a/src/security/security_stack.c b/src/security/security_stack.c index 53eee1692..cd916382b 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -667,6 +667,41 @@ virSecurityStackRestoreMemoryLabel(virSecurityManagerP= tr mgr, } =20 static int +virSecurityStackSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + virSecurityStackDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item =3D priv->itemsHead; + int rc =3D 0; + + for (; item; item =3D item->next) { + if (virSecurityManagerSetInputLabel(item->securityManager, vm, inp= ut) < 0) + rc =3D -1; + } + + return rc; +} + +static int +virSecurityStackRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + virSecurityStackDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item =3D priv->itemsHead; + int rc =3D 0; + + for (; item; item =3D item->next) { + if (virSecurityManagerRestoreInputLabel(item->securityManager, + vm, input) < 0) + rc =3D -1; + } + + return rc; +} + +static int virSecurityStackDomainSetPathLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, const char *path) @@ -711,6 +746,9 @@ virSecurityDriver virSecurityDriverStack =3D { .domainSetSecurityMemoryLabel =3D virSecurityStackSetMemoryLabel, .domainRestoreSecurityMemoryLabel =3D virSecurityStackRestoreMemoryL= abel, =20 + .domainSetSecurityInputLabel =3D virSecurityStackSetInputLabel, + .domainRestoreSecurityInputLabel =3D virSecurityStackRestoreInputLa= bel, + .domainSetSecurityDaemonSocketLabel =3D virSecurityStackSetDaemonSocke= tLabel, .domainSetSecuritySocketLabel =3D virSecurityStackSetSocketLabel, .domainClearSecuritySocketLabel =3D virSecurityStackClearSocketLab= el, --=20 2.13.6 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list