[libvirt] [PATCH v4 04/11] security: Add DAC and SELinux security for tpm-emulator

Extend the DAC and SELinux modules with support for the tpm-emulator. We label the Unix socket that QEMU connects to after starting swtmp with DAC and SELinux labels. We do not have to restore the labels in this case since the tpm-emulator will remove the Unix socket when it terminates. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; Reviewed-by: John Ferlan <jferlan(a)redhat.com&gt; --- src/security/security_dac.c | 5 +++++ src/security/security_selinux.c | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 3ab2299..4b623dc 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1373,6 +1373,10 @@ virSecurityDACSetTPMFileLabel(virSecurityManagerPtr mgr, false); break; case VIR_DOMAIN_TPM_TYPE_EMULATOR: + ret = virSecurityDACSetChardevLabel(mgr, def, + &tpm->data.emulator.source, + false); + break; case VIR_DOMAIN_TPM_TYPE_LAST: break; } @@ -1395,6 +1399,7 @@ virSecurityDACRestoreTPMFileLabel(virSecurityManagerPtr mgr, false); break; case VIR_DOMAIN_TPM_TYPE_EMULATOR: + /* swtpm will have removed the Unix socket upon termination */ case VIR_DOMAIN_TPM_TYPE_LAST: break; } diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 5d20fda..92e8415 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1473,6 +1473,11 @@ virSecuritySELinuxSetTPMFileLabel(virSecurityManagerPtr mgr, } break; case VIR_DOMAIN_TPM_TYPE_EMULATOR: + tpmdev = tpm->data.emulator.source.data.nix.path; + rc = virSecuritySELinuxSetFilecon(mgr, tpmdev, seclabel->imagelabel); + if (rc < 0) + return -1; + break; case VIR_DOMAIN_TPM_TYPE_LAST: break; } @@ -1507,6 +1512,7 @@ virSecuritySELinuxRestoreTPMFileLabelInt(virSecurityManagerPtr mgr, } break; case VIR_DOMAIN_TPM_TYPE_EMULATOR: + /* swtpm will have removed the Unix socket upon termination */ case VIR_DOMAIN_TPM_TYPE_LAST: break; } -- 2.5.5