Hi, I was discussing with Jiri Denemark about the current behavior of none seclabels with multiple security drivers and I'd like to hear more opinions about how this should work. Currently, a none security label can be defined specifically to each enabled security driver. For example, using a default configuration (in which SELinux is enabled as default driver and DAC is enabled due to privileged mode), a guest definition can contain the following seclabel: <seclabel type='none' model='selinux'/> This will disable SELinux labeling and will keep labeling enabled for any other security drivers (DAC in this case). So, my question is: should none seclabels affect specific drivers (as done now) or just one none seclabel should be accepted affecting all security drivers in use?

On Tue, Sep 04, 2012 at 10:22:56 +0100, Daniel P. Berrange wrote: > On Mon, Sep 03, 2012 at 12:57:50PM -0300, Marcelo Cerri wrote: > > Hi, > > > > I was discussing with Jiri Denemark about the current behavior of > > none seclabels with multiple security drivers and I'd like to hear > > more opinions about how this should work. > > > > Currently, a none security label can be defined specifically to each > > enabled security driver. For example, using a default configuration > > (in which SELinux is enabled as default driver and DAC is enabled > > due to privileged mode), a guest definition can contain the > > following seclabel: > > > > <seclabel type='none' model='selinux'/> > > > > This will disable SELinux labeling and will keep labeling enabled > > for any other security drivers (DAC in this case). > > > > So, my question is: should none seclabels affect specific drivers > > (as done now) or just one none seclabel should be accepted affecting > > all security drivers in use? > > No, as with your example above, the type=none is scoped to a specific > driver. And what happens if you have older libvirt and a domain configured with <seclabel type='none'/> and upgrade libvirt to the state when it actually enables more than one security driver at a time. Shouldn't such generic <seclabel type='none'/> actually turn off any labeling, that is, affect all the enabled drivers?

On Tue, Sep 04, 2012 at 10:31:54 +0100, Daniel P. Berrange wrote: > On Tue, Sep 04, 2012 at 11:28:19AM +0200, Jiri Denemark wrote: > > On Tue, Sep 04, 2012 at 10:22:56 +0100, Daniel P. Berrange wrote: > > > On Mon, Sep 03, 2012 at 12:57:50PM -0300, Marcelo Cerri wrote: > > > > > > > > So, my question is: should none seclabels affect specific drivers > > > > (as done now) or just one none seclabel should be accepted affecting > > > > all security drivers in use? > > > > > > No, as with your example above, the type=none is scoped to a specific > > > driver. > > > > And what happens if you have older libvirt and a domain configured with > > <seclabel type='none'/> and upgrade libvirt to the state when it actually > > enables more than one security driver at a time. Shouldn't such generic > > <seclabel type='none'/> actually turn off any labeling, that is, affect all > > the enabled drivers? > > IMHO with the old libvirt, if no model=XXXX was set, this was implicitly > refering to the current model. Yes, but there was just one model, thus it trivially affected all enabled models. Also its semantics can be understood as "do no labeling no matter what security model is used". I'm mainly concerned about libvirt upgrades while domains with <seclabel type='none'/> are running.

On Tue, Sep 04, 2012 at 11:14:35 +0100, Daniel P. Berrange wrote: > On Tue, Sep 04, 2012 at 12:00:33PM +0200, Jiri Denemark wrote: > > I don't think that description of existing behaviour is accurate. With old > libvirt you have one <seclabel> (for SELinux/AppArmour), but secretly there > are 2 security drivers (SELinux/AppArmour + DAC). Setting type=none for > the seclabel only meant that the SELinux/AppArmour drivers ran the guest > unconfined. The second (DAC) driver would still be applied to the guest > making it run unprivileged/confined. Isn't DAC still applied in the same way? > What actual problem have you seen with upgrades ? I don't see any actual problem, I'm just trying to think about them :-) Let's say there's a domain running with <seclabel type='none'/> while libvirtd is upgraded and reconfigured to enable more seclabels by default (a very theoretical example could be [ "selinux", "apparmor" ]. I think neither selinux nor apparmor labeling should be applied for that domain. Or am I wrong?