11:53 a.m.
The code took into account only the global permissions. The domains now
support per-vm DAC lables and per-image DAC labels. Use the most
specific label available.
---
src/qemu/qemu_domain.c | 35 +++++++++++++++++++++++++++++++++--
src/qemu/qemu_domain.h | 1 +
src/qemu/qemu_driver.c | 8 ++++----
src/qemu/qemu_hotplug.c | 2 +-
src/qemu/qemu_process.c | 2 +-
5 files changed, 40 insertions(+), 8 deletions(-)
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index c947e2e..d45210b 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -2210,7 +2210,7 @@ qemuDomainCheckDiskPresence(virQEMUDriverPtr driver,
if (!disk->src)
continue;
- if (qemuDomainDetermineDiskChain(driver, disk, false) >= 0 &&
+ if (qemuDomainDetermineDiskChain(driver, vm, disk, false) >= 0 &&
qemuDiskChainCheckBroken(disk) >= 0)
continue;
@@ -2319,13 +2319,41 @@ qemuDiskChainCheckBroken(virDomainDiskDefPtr disk)
return 0;
}
+static void
+qemuDomainGetImageIds(virQEMUDriverConfigPtr cfg,
+ virDomainObjPtr vm,
+ virDomainDiskDefPtr disk,
+ uid_t *uid, gid_t *gid)
+{
+ virSecurityLabelDefPtr vmlabel;
+ virSecurityDeviceLabelDefPtr disklabel;
+
+ if (cfg) {
+ if (uid)
+ *uid = cfg->user;
+
+ if (gid)
+ *gid = cfg->group;
+ }
+
+ if (vm && (vmlabel = virDomainDefGetSecurityLabelDef(vm->def,
"dac")))
+ virParseOwnershipIds(vmlabel->label, uid, gid);
+
+ if ((disklabel = virDomainDiskDefGetSecurityLabelDef(disk, "dac")))
+ virParseOwnershipIds(disklabel->label, uid, gid);
+}
+
+
int
qemuDomainDetermineDiskChain(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
virDomainDiskDefPtr disk,
bool force)
{
virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver);
int ret = 0;
+ uid_t uid;
+ gid_t gid;
if (!disk->src ||
disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK ||
@@ -2340,8 +2368,11 @@ qemuDomainDetermineDiskChain(virQEMUDriverPtr driver,
goto cleanup;
}
}
+
+ qemuDomainGetImageIds(cfg, vm, disk, &uid, &gid);
+
disk->backingChain = virStorageFileGetMetadata(disk->src, disk->format,
- cfg->user, cfg->group,
+ uid, gid,
cfg->allowDiskFormatProbing);
if (!disk->backingChain)
ret = -1;
diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
index 84624f9..3826d0b 100644
--- a/src/qemu/qemu_domain.h
+++ b/src/qemu/qemu_domain.h
@@ -353,6 +353,7 @@ int qemuDomainCheckDiskPresence(virQEMUDriverPtr driver,
int qemuDiskChainCheckBroken(virDomainDiskDefPtr disk);
int qemuDomainDetermineDiskChain(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
virDomainDiskDefPtr disk,
bool force);
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 944facb..94844df 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -6499,7 +6499,7 @@ qemuDomainChangeDiskMediaLive(virConnectPtr conn,
if (qemuTranslateDiskSourcePool(conn, disk) < 0)
goto end;
- if (qemuDomainDetermineDiskChain(driver, disk, false) < 0)
+ if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0)
goto end;
if (qemuSetupDiskCgroup(vm, disk) < 0)
@@ -14632,7 +14632,7 @@ qemuDomainBlockPivot(virConnectPtr conn,
disk->src = disk->mirror;
disk->format = disk->mirrorFormat;
disk->backingChain = NULL;
- if (qemuDomainDetermineDiskChain(driver, disk, false) < 0) {
+ if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0) {
disk->src = oldsrc;
disk->format = oldformat;
disk->backingChain = oldchain;
@@ -14983,7 +14983,7 @@ qemuDomainBlockCopy(virDomainObjPtr vm,
goto endjob;
}
- if (qemuDomainDetermineDiskChain(driver, disk, false) < 0)
+ if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0)
goto endjob;
if ((flags & VIR_DOMAIN_BLOCK_REBASE_SHALLOW) &&
@@ -15190,7 +15190,7 @@ qemuDomainBlockCommit(virDomainPtr dom, const char *path, const
char *base,
disk->dst);
goto endjob;
}
- if (qemuDomainDetermineDiskChain(driver, disk, false) < 0)
+ if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0)
goto endjob;
if (!top) {
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 4a885d2..7066be6 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -719,7 +719,7 @@ qemuDomainAttachDeviceDiskLive(virConnectPtr conn,
if (qemuSetUnprivSGIO(dev) < 0)
goto end;
- if (qemuDomainDetermineDiskChain(driver, disk, false) < 0)
+ if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0)
goto end;
if (qemuSetupDiskCgroup(vm, disk) < 0)
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index 8bcd98e..c1f60cd 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -997,7 +997,7 @@ qemuProcessHandleBlockJob(qemuMonitorPtr mon ATTRIBUTE_UNUSED,
if ((type == VIR_DOMAIN_BLOCK_JOB_TYPE_PULL ||
type == VIR_DOMAIN_BLOCK_JOB_TYPE_COMMIT) &&
status == VIR_DOMAIN_BLOCK_JOB_COMPLETED)
- qemuDomainDetermineDiskChain(driver, disk, true);
+ qemuDomainDetermineDiskChain(driver, vm, disk, true);
if (disk->mirror && type == VIR_DOMAIN_BLOCK_JOB_TYPE_COPY &&
status == VIR_DOMAIN_BLOCK_JOB_READY)
disk->mirroring = true;
--
1.8.5.3