Re: [libvirt] [PATCH 4/6] Support relabelling of USB and PCI devices

Apart from DV's comments, ACK to patches 1-3 On Tue, 2009-09-01 at 16:28 +0100, Daniel P. Berrange wrote: > * src/security.h: Driver API for relabelling host devices > * src/security_selinux.c: Implement relabelling of PCI and USB > devices > * src/qemu_driver.c: Relabel USB/PCI devices before hotplug > --- > src/qemu_driver.c | 12 ++- > src/security.h | 7 ++ > src/security_selinux.c | 175 +++++++++++++++++++++++++++++++++++++++++++----- > 3 files changed, 174 insertions(+), 20 deletions(-) > > diff --git a/src/qemu_driver.c b/src/qemu_driver.c > index e9a09df..d75e28e 100644 > --- a/src/qemu_driver.c > +++ b/src/qemu_driver.c > @@ -5498,6 +5498,9 @@ static int qemudDomainAttachHostDevice(virConnectPtr conn, > > if (qemuDomainSetDeviceOwnership(conn, driver, dev, 0) < 0) > return -1; > + if (driver->securityDriver && > + driver->securityDriver->domainSetSecurityHostdevLabel(conn, vm, dev->data.hostdev) < 0) > + return -1; > > switch (hostdev->source.subsys.type) { > case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: > @@ -5566,9 +5569,6 @@ static int qemudDomainAttachDevice(virDomainPtr dom, > } > } > > - if (driver->securityDriver) > - driver->securityDriver->domainSetSecurityImageLabel(dom->conn, vm, dev->data.disk); What's this about?

> diff --git a/src/security_selinux.c b/src/security_selinux.c > index 3b2e88f..5b7b038 100644 > --- a/src/security_selinux.c > +++ b/src/security_selinux.c ... > @@ -414,6 +427,126 @@ SELinuxSetSecurityImageLabel(virConnectPtr conn, > return 0; > } > > + > +static int > +SELinuxSetSecurityPCILabel(virConnectPtr conn, > + pciDevice *dev ATTRIBUTE_UNUSED, > + const char *file, void *opaque) > +{ > + virDomainObjPtr vm = opaque; > + const virSecurityLabelDefPtr secdef = &vm->def->seclabel; > + > + return SELinuxSetFilecon(conn, file, secdef->imagelabel); > +} > + > +static int > +SELinuxSetSecurityHostdevLabel(virConnectPtr conn, > + virDomainObjPtr vm, > + virDomainHostdevDefPtr dev) > + > +{ > + int ret = -1; > + > + if (dev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS) > + return 0; > + > + switch (dev->source.subsys.type) { > + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: > + break; Either you're missing some code here, or I'm missing some understanding :-)