Re: [libvirt] [PATCH 05/12] Introduce a stacked security driver impl for QEMU

* qemu/qemu_conf.h: Add securityPrimaryDriver and securitySecondaryDriver fields to 'struct qemud_driver' * Makefile.am: Add new files * qemu/qemu_security_stacked.c, qemu/qemu_security_stacked.h: A simple stacked security driver --- src/Makefile.am | 4 +- src/qemu/qemu_conf.h | 2 + src/qemu/qemu_security_stacked.c | 353 ++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_security_stacked.h | 22 +++ 4 files changed, 380 insertions(+), 1 deletions(-) create mode 100644 src/qemu/qemu_security_stacked.c create mode 100644 src/qemu/qemu_security_stacked.h

+++ b/src/qemu/qemu_security_stacked.c @@ -0,0 +1,353 @@ +/* + * Copyright (C) 2010 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * QEMU stacked security driver + */ + +#include <config.h> +#include <selinux/selinux.h> +#include <selinux/context.h>

+static int +qemuSecurityStackedGenLabel(virConnectPtr conn, + virDomainObjPtr vm) +{ + int rc = 0; + + if (driver->securitySecondaryDriver && + driver->securitySecondaryDriver->domainGenSecurityLabel && + driver->securitySecondaryDriver->domainGenSecurityLabel(conn, vm) < 0) + rc = -1; + + if (driver->securityPrimaryDriver && + driver->securityPrimaryDriver->domainGenSecurityLabel && + driver->securityPrimaryDriver->domainGenSecurityLabel(conn, vm) < 0) + rc = -1; + + return rc; +}

+virSecurityDriver qemuStackedSecurityDriver = { + .name = "qemuStacked", + .domainSecurityVerify = qemuSecurityStackedVerify, + + .domainGenSecurityLabel = qemuSecurityStackedGenLabel, + .domainReleaseSecurityLabel = qemuSecurityStackedReleaseLabel, + .domainReserveSecurityLabel = qemuSecurityStackedReserveLabel, + + .domainGetSecurityProcessLabel = qemuSecurityStackedGetProcessLabel, + .domainSetSecurityProcessLabel = qemuSecurityStackedSetProcessLabel, + + .domainSetSecurityImageLabel = qemuSecurityStackedSetSecurityImageLabel, + .domainRestoreSecurityImageLabel = qemuSecurityStackedRestoreSecurityImageLabel, + + .domainSetSecurityAllLabel = qemuSecurityStackedSetSecurityAllLabel, + .domainRestoreSecurityAllLabel = qemuSecurityStackedRestoreSecurityAllLabel, + + .domainSetSecurityHostdevLabel = qemuSecurityStackedSetSecurityHostdevLabel, + .domainRestoreSecurityHostdevLabel = qemuSecurityStackedRestoreSecurityHostdevLabel, + + .domainSetSavedStateLabel = qemuSecurityStackedSetSavedStateLabel, + .domainRestoreSavedStateLabel = qemuSecurityStackedRestoreSavedStateLabel, +};