Re: [libvirt] [PATCH 4/7] security: Label parent directories of character devices

On Fri, Aug 14, 2015 at 11:58:54AM +0200, Martin Kletzander wrote: > On Thu, Aug 13, 2015 at 04:59:47PM +0100, Daniel P. Berrange wrote: > >On Thu, Aug 13, 2015 at 05:47:42PM +0200, Martin Kletzander wrote: > >>We are currently unable to label parent directories for some paths. > >>However, we will need to have per-domain directories that we would like > >>to have labelled, but we can't label all of them. So let's add a > >>boolean variable that will determine whether parent directory for such > >>chardev should be labelled as well as that character device itself. > >> > >>Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com&gt; > >>--- > >> src/conf/domain_conf.h | 1 + > >> src/security/security_dac.c | 13 ++++++++++++- > >> src/security/security_selinux.c | 13 ++++++++++++- > >> 3 files changed, 25 insertions(+), 2 deletions(-) > >> > >>diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h > >>index e1872bca002c..9d549a395e29 100644 > >>--- a/src/conf/domain_conf.h > >>+++ b/src/conf/domain_conf.h > >>@@ -1191,6 +1191,7 @@ struct _virDomainChrSourceDef { > >> } udp; > >> struct { > >> char *path; > >>+ bool autopath; > >> bool listen; > >> } nix; > >> int spicevmc; > > > >I don't think we need this - it seems we can just pass a 'bool labelParent' > >parameter into virSecurityManagerSetChardevLabel() when calling it for > >the monitor socket. > > > > It's not used only for the monitor socket, but mainly for virtio > channel's target's unix socket as well and maybe more in the future. > But I agree it could be named 'labelParent' as well. Should I resend > it with that changed? In the non-monitor cases how will we decide whether it is appropriate to set labelParent or not ? Those paths are broadly user specified, so we can't assume the parent is per-VM

Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|