From nobody Wed May 14 16:47:41 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1520952167844875.1299345076746; Tue, 13 Mar 2018 07:42:47 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6D0C1C04C273; Tue, 13 Mar 2018 14:42:46 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id EB6BF89E80; Tue, 13 Mar 2018 14:42:45 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 1A1EC4CA9C; Tue, 13 Mar 2018 14:42:45 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w2DEcPuQ003422 for ; Tue, 13 Mar 2018 10:38:25 -0400 Received: by smtp.corp.redhat.com (Postfix) id 77D752166BAE; Tue, 13 Mar 2018 14:38:25 +0000 (UTC) Received: from angien.brq.redhat.com (unknown [10.43.2.136]) by smtp.corp.redhat.com (Postfix) with ESMTP id 02A9A2166BDA; Tue, 13 Mar 2018 14:38:24 +0000 (UTC) From: Peter Krempa To: libvir-list@redhat.com Date: Tue, 13 Mar 2018 15:37:33 +0100 Message-Id: <3fa0ca51264bed70191c62ebe3cb27e62066046b.1520951803.git.pkrempa@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-loop: libvir-list@redhat.com Cc: Peter Krempa Subject: [libvirt] [PATCH 07/10] conf: Separate seclabel validation from parsing X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Tue, 13 Mar 2018 14:42:47 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Rather than checking that the security label is legal when parsing it move the code into a separate function. Signed-off-by: Peter Krempa --- src/conf/domain_conf.c | 68 ++++++++++++++++++++++++++++++++--------------= ---- 1 file changed, 44 insertions(+), 24 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 8cd41edb5e..6c2a2f3a75 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -8214,8 +8214,7 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, static int virSecurityDeviceLabelDefParseXML(virSecurityDeviceLabelDefPtr **seclabels= _rtn, size_t *nseclabels_rtn, - virSecurityLabelDefPtr *vmSeclabels, - int nvmSeclabels, xmlXPathContextPtr ctx= t, + xmlXPathContextPtr ctxt, unsigned int flags) { virSecurityDeviceLabelDefPtr *seclabels =3D NULL; @@ -8223,7 +8222,6 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceLa= belDefPtr **seclabels_rtn, int n; size_t i, j; xmlNodePtr *list =3D NULL; - virSecurityLabelDefPtr vmDef =3D NULL; char *model, *relabel, *label, *labelskip; if ((n =3D virXPathNodeSet("./seclabel", ctxt, &list)) < 0) @@ -8243,14 +8241,6 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceL= abelDefPtr **seclabels_rtn, /* get model associated to this override */ model =3D virXMLPropString(list[i], "model"); if (model) { - /* find the security label that it's being overridden */ - for (j =3D 0; j < nvmSeclabels; j++) { - if (STREQ(vmSeclabels[j]->model, model)) { - vmDef =3D vmSeclabels[j]; - break; - } - } - /* check for duplicate seclabels */ for (j =3D 0; j < i; j++) { if (STREQ_NULLABLE(model, seclabels[j]->model)) { @@ -8262,14 +8252,6 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceL= abelDefPtr **seclabels_rtn, seclabels[i]->model =3D model; } - /* Can't use overrides if top-level doesn't allow relabeling. */ - if (vmDef && !vmDef->relabel) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("label overrides require relabeling to be " - "enabled at the domain level")); - goto error; - } - relabel =3D virXMLPropString(list[i], "relabel"); if (relabel !=3D NULL) { if (STREQ(relabel, "yes")) { @@ -8324,6 +8306,37 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceL= abelDefPtr **seclabels_rtn, } +static int +virSecurityDeviceLabelDefValidateXML(virSecurityDeviceLabelDefPtr *seclabe= ls, + size_t nseclabels, + virSecurityLabelDefPtr *vmSeclabels, + size_t nvmSeclabels) +{ + virSecurityDeviceLabelDefPtr seclabel; + size_t i; + size_t j; + + for (i =3D 0; i < nseclabels; i++) { + seclabel =3D seclabels[i]; + + /* find the security label that it's being overridden */ + for (j =3D 0; j < nvmSeclabels; j++) { + if (STRNEQ_NULLABLE(vmSeclabels[j]->model, seclabel->model)) + continue; + + if (!vmSeclabels[j]->relabel) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("label overrides require relabeling to be= " + "enabled at the domain level")); + return -1; + } + } + } + + return 0; +} + + /* Parse the XML definition for a lease */ static virDomainLeaseDefPtr @@ -9453,11 +9466,16 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlo= pt, ctxt->node =3D sourceNode; if (virSecurityDeviceLabelDefParseXML(&def->src->seclabels, &def->src->nseclabels, - vmSeclabels, - nvmSeclabels, ctxt, flags) < 0) goto error; + + if (virSecurityDeviceLabelDefValidateXML(def->src->seclabels, + def->src->nseclabels, + vmSeclabels, + nvmSeclabels) < 0) + goto error; + ctxt->node =3D saved_node; } @@ -12133,10 +12151,12 @@ virDomainChrSourceDefParseXML(virDomainChrSourceD= efPtr def, ctxt->node =3D cur; if (virSecurityDeviceLabelDefParseXML(&def->seclabels, &def->nseclabels, - vmSeclabels, - nvmSeclabels, ctxt, - flags) < 0) { + flags) < 0 || + virSecurityDeviceLabelDefValidateXML(def->seclabels, + def->nseclabels, + vmSeclabels, + nvmSeclabels) < 0= ) { ctxt->node =3D saved_node; goto error; } --=20 2.16.2 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list