Re: [libvirt] [sandbox PATCH] virt-sandbox patch to launch containers with proper label

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 09/30/2013 08:07 AM, Daniel P. Berrange wrote: > On Wed, Sep 25, 2013 at 04:50:23PM -0400, Dan Walsh wrote: >> virt-sandbox should be launching containers based off the lxc_context >> file from selinux-policy. I changed the hard coded paths to match the >> latest fedora assigned labels. >> >> Fedora 20 SELinux Policy and beyond will have proper SELinux labels in >> its lxc_contexts file. --- bin/virt-sandbox-service | 2 >> +- bin/virt-sandbox-service-clone.pod | 5 ++- >> bin/virt-sandbox-service-create.pod | 7 ++-- bin/virt-sandbox.c >> | 5 ++- libvirt-sandbox/libvirt-sandbox-builder.c | 58 >> +++++++++++++++++++++++++------ 5 files changed, 55 insertions(+), 22 >> deletions(-) >> >> diff --git a/bin/virt-sandbox-service b/bin/virt-sandbox-service index >> c4c4f54..b42fe08 100755 --- a/bin/virt-sandbox-service +++ >> b/bin/virt-sandbox-service @@ -101,7 +101,7 @@ def copydirtree(src, >> dst): class Container: DEFAULT_PATH = >> "/var/lib/libvirt/filesystems" DEFAULT_IMAGE = >> "/var/lib/libvirt/images/%s.raw" - SELINUX_FILE_TYPE = >> "svirt_lxc_file_t" + SELINUX_FILE_TYPE = "svirt_sandbox_file_t" > > This change will make it impossible to use the new release on existing > distros since they won't have this new policy type. We need this to be > conditionally changed. > Well we could put the code into check if the type exists else use svirt_lxc_file_t. (BTW Aliased in latest code.) >> diff --git a/libvirt-sandbox/libvirt-sandbox-builder.c >> b/libvirt-sandbox/libvirt-sandbox-builder.c index 1335042..613161a >> 100644 --- a/libvirt-sandbox/libvirt-sandbox-builder.c +++ >> b/libvirt-sandbox/libvirt-sandbox-builder.c @@ -67,6 +67,48 @@ >> gvir_sandbox_builder_error_quark(void) { return >> g_quark_from_static_string("gvir-sandbox-builder"); } +#include >> <selinux/selinux.h> +#include <errno.h> +static char line[1024]; + >> +static const char *get_label(int type) { + const char *path = >> selinux_lxc_contexts_path(); + + FILE *fp = fopen(path, "r"); + if >> (fp) { + GType gt = gvir_config_domain_virt_type_get_type (); + >> GEnumClass *cls = g_type_class_ref (gt); + GEnumValue *val = >> g_enum_get_value (cls, type); + + while (val && fgets(line, sizeof >> line, fp)) { + int len = strlen(line); + if (len > >> 2) + continue; + if (line[len-1] == '\n') + >> line[len-1] = '\0'; + char *name = line; + char >> *value = strchr(name, '='); + if (!value) + >> continue; + *value = '\0'; + value++; + >> if (strcmp(name,val->value_nick)) + continue; + >> return value; + } + fclose(fp);

> > I'm not sure I really understand what this code is doing. You seem to be > opening /etc/selinux/targetted/context/lxc_contexts and then searching for > the type for LXC, QEMU or KVM. This doesn't really make sense to me. I > wonder what the point of any of this code us, when the switch statement > below looks to be sufficient. > Well the idea is to allow other policy writers to write policy that would use different types, rather then hard code them into programs. Dominick Grift is experimenting with other types of SELinux Policy, and any time he has a hard coded type, it breaks his code. Obviously we need to move more types out of this code to make it fully functional.