From nobody Thu May 15 12:47:58 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1508510508621527.5929698963138; Fri, 20 Oct 2017 07:41:48 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id EBB2A3E2D3; Fri, 20 Oct 2017 13:49:01 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B5C67614CC; Fri, 20 Oct 2017 13:49:01 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 78EEB1800C92; Fri, 20 Oct 2017 13:49:01 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id v9KDm4sd020309 for ; Fri, 20 Oct 2017 09:48:04 -0400 Received: by smtp.corp.redhat.com (Postfix) id 54DD55D763; Fri, 20 Oct 2017 13:48:04 +0000 (UTC) Received: from angien.brq.redhat.com (unknown [10.43.2.136]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3040D5D761; Fri, 20 Oct 2017 13:48:03 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com EBB2A3E2D3 Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=libvir-list-bounces@redhat.com From: Peter Krempa To: libvir-list@redhat.com Date: Fri, 20 Oct 2017 15:47:30 +0200 Message-Id: <2e28573fb74d279d01c0c1eedfb81b8d5bc6159c.1508507145.git.pkrempa@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-loop: libvir-list@redhat.com Cc: Peter Krempa Subject: [libvirt] [PATCH 05/12] security: dac: Take parent security label into account X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Fri, 20 Oct 2017 13:49:02 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Until now we ignored user-provided backing chains and while detecting the code inherited labels of the parent device. With user provided chains we should keep this functionality, so label of the parent image in the backing chain will be applied if an image-specific label is not present. Reviewed-by: John Ferlan --- src/security/security_dac.c | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 244b300a9..54120890f 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -688,12 +688,14 @@ virSecurityDACRestoreFileLabel(virSecurityDACDataPtr = priv, static int -virSecurityDACSetImageLabel(virSecurityManagerPtr mgr, - virDomainDefPtr def, - virStorageSourcePtr src) +virSecurityDACSetImageLabelInternal(virSecurityManagerPtr mgr, + virDomainDefPtr def, + virStorageSourcePtr src, + virStorageSourcePtr parent) { virSecurityLabelDefPtr secdef; virSecurityDeviceLabelDefPtr disk_seclabel; + virSecurityDeviceLabelDefPtr parent_seclabel =3D NULL; virSecurityDACDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); uid_t user; gid_t group; @@ -705,14 +707,24 @@ virSecurityDACSetImageLabel(virSecurityManagerPtr mgr, if (secdef && !secdef->relabel) return 0; - disk_seclabel =3D virStorageSourceGetSecurityLabelDef(src, - SECURITY_DAC_NAME); - if (disk_seclabel && !disk_seclabel->relabel) - return 0; + disk_seclabel =3D virStorageSourceGetSecurityLabelDef(src, SECURITY_DA= C_NAME); + if (parent) + parent_seclabel =3D virStorageSourceGetSecurityLabelDef(parent, + SECURITY_DAC= _NAME); + + if (disk_seclabel && (!disk_seclabel->relabel || disk_seclabel->label)= ) { + if (!disk_seclabel->relabel) + return 0; - if (disk_seclabel && disk_seclabel->label) { if (virParseOwnershipIds(disk_seclabel->label, &user, &group) < 0) return -1; + } else if (parent_seclabel && + (!parent_seclabel->relabel || parent_seclabel->label)) { + if (!parent_seclabel->relabel) + return 0; + + if (virParseOwnershipIds(parent_seclabel->label, &user, &group) < = 0) + return -1; } else { if (virSecurityDACGetImageIds(secdef, priv, &user, &group)) return -1; @@ -722,6 +734,14 @@ virSecurityDACSetImageLabel(virSecurityManagerPtr mgr, } +static int +virSecurityDACSetImageLabel(virSecurityManagerPtr mgr, + virDomainDefPtr def, + virStorageSourcePtr src) +{ + return virSecurityDACSetImageLabelInternal(mgr, def, src, NULL); +} + static int virSecurityDACSetDiskLabel(virSecurityManagerPtr mgr, virDomainDefPtr def, @@ -731,7 +751,7 @@ virSecurityDACSetDiskLabel(virSecurityManagerPtr mgr, virStorageSourcePtr next; for (next =3D disk->src; virStorageSourceIsBacking(next); next =3D nex= t->backingStore) { - if (virSecurityDACSetImageLabel(mgr, def, next) < 0) + if (virSecurityDACSetImageLabelInternal(mgr, def, next, disk->src)= < 0) return -1; } --=20 2.14.1 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list