Re: [libvirt] [PATCH v3 06/14] security: Add DAC and SELinux security for tpm-emulator
On 05/08/2018 04:01 PM, John Ferlan wrote:
On 05/04/2018 04:21 PM, Stefan Berger wrote:
> Extend the DAC and SELinux modules with support for the
> tpm-emulator.
>
> Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com>
> ---
> src/security/security_dac.c | 4 ++++
> src/security/security_selinux.c | 5 +++++
> 2 files changed, 9 insertions(+)
>
> diff --git a/src/security/security_dac.c b/src/security/security_dac.c
> index 5efbc27..351f6f4 100644
> --- a/src/security/security_dac.c
> +++ b/src/security/security_dac.c
> @@ -1373,6 +1373,10 @@ virSecurityDACSetTPMFileLabel(virSecurityManagerPtr mgr,
> false);
> break;
> case VIR_DOMAIN_TPM_TYPE_EMULATOR:
> + ret = virSecurityDACSetChardevLabel(mgr, def,
> + &tpm->data.emulator.source,
> + false);
> + break;
> case VIR_DOMAIN_TPM_TYPE_LAST:
> break;
> }
virSecurityDACRestoreTPMFileLabel doesn't need to be changed? e.g.:
Hm, this is setting the DAC label for the Unix socket so that QEMU can
connect to it. swtpm creates it but then also removes it upon
termination. So basically restoring the security label is not need.
Maybe I should add a comment in the code why it's not there. The same is
true for the SELinux label below.
ret = virSecurityDACRestoreChardevLabel(mgr, def,
&tpm->data.emulator.source,
false);
> diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
> index f5ba877..17bc07a 100644
> --- a/src/security/security_selinux.c
> +++ b/src/security/security_selinux.c
> @@ -1473,6 +1473,11 @@ virSecuritySELinuxSetTPMFileLabel(virSecurityManagerPtr mgr,
> }
> break;
> case VIR_DOMAIN_TPM_TYPE_EMULATOR:
> + tpmdev = tpm->data.emulator.source.data.nix.path;
> + rc = virSecuritySELinuxSetFilecon(mgr, tpmdev, seclabel->imagelabel);
> + if (rc < 0)
> + return -1;
> + break;
> case VIR_DOMAIN_TPM_TYPE_LAST:
> break;
> }
>
Similarly for virSecuritySELinuxRestoreTPMFileLabelInt:
tpmdev = tpm->data.emulator.source.data.nix.path;
rc = virSecuritySELinuxRestoreFileLabel(mgr, tpmdev);
?
With the adjustments or at least an explanation in the commit message
why they cannot be Restored,
Reviewed-by: John Ferlan <jferlan(a)redhat.com>
John