Re: [libvirt] [PATCH 8/9] Support seclabels for volume type disk

"seclabels" is only valid for 'file' or 'block' type storage volume. --- docs/formatdomain.html.in | 31 ++++++++++++++++--------------- docs/schemas/domaincommon.rng | 3 +++ src/conf/domain_conf.c | 12 ++++++++++-- src/storage/storage_driver.c | 9 +++++++++ 4 files changed, 38 insertions(+), 17 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 8186f3b..93c56d8 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1434,24 +1434,25 @@ path to the file holding the disk. If the disk <code>type</code> is "block", then the <code>dev</code> attribute specifies the path to the host device to serve as - the disk. With both "file" and "block", one or more optional + the disk. With "file", "block" or "volume", one or more optional sub-elements <code>seclabel</code>, <a href="#seclabel">described below</a> (and <span class="since">since 0.9.9</span>), can be used to override the domain security labeling policy for just - that source file. If the disk <code>type</code> is "dir", then the - <code>dir</code> attribute specifies the fully-qualified path - to the directory to use as the disk. If the disk <code>type</code> - is "network", then the <code>protocol</code> attribute specifies - the protocol to access to the requested image; possible values - are "nbd", "rbd", "sheepdog" or "gluster". If the - <code>protocol</code> attribute is "rbd", "sheepdog" or "gluster", an - additional attribute <code>name</code> is mandatory to specify which - volume/image will be used. When the disk <code>type</code> is - "network", the <code>source</code> may have zero or - more <code>host</code> sub-elements used to specify the hosts - to connect. If the disk <code>type</code> is "volume", the underlying - disk source is represented by attributes <code>pool</code> and - <code>volume</code>. Attribute <code>pool</code> specifies the + that source file. (NB, <code>seclable</code> is not valid unless

+ the specified storage volume is of 'file' or 'block' type). + If the disk <code>type</code> is "dir", then the <code>dir</code> + attribute specifies the fully-qualified path to the directory to + use as the disk. If the disk <code>type</code> is "network", then + the <code>protocol</code> attribute specifies the protocol to access + to the requested image; possible values are "nbd", "rbd", "sheepdog" + or "gluster". If the <code>protocol</code> attribute is "rbd", + "sheepdog" or "gluster", an additional attribute <code>name</code> + is mandatory to specify which volume/image will be used. When the + disk <code>type</code> is "network", the <code>source</code> may + have zero or more <code>host</code> sub-elements used to specify + the hosts to connect. If the disk <code>type</code> is "volume", + the underlying disk source is represented by attributes <code>pool</code> + and <code>volume</code>. Attribute <code>pool</code> specifies the name of storage pool (managed by libvirt) where the disk source resides, and attribute <code>volume</code> specifies the name of storage volume (managed by libvirt) used as the disk source. diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 6d426ac..820f10d 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -1097,6 +1097,9 @@ <optional> <ref name="startupPolicy"/> </optional> + <optional> + <ref name='devSeclabel'/> + </optional> </element> </optional> <ref name="diskspec"/> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 7b08b69..00ddae3 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -12322,7 +12322,7 @@ virDomainDiskSourceDefFormat(virBufferPtr buf, } break; case VIR_DOMAIN_DISK_TYPE_VOLUME: - if (def->srcpool || def->startupPolicy) + if (def->srcpool || def->startupPolicy || def->nseclabels) virBufferAddLit(buf, " <source"); if (def->srcpool) @@ -12331,8 +12331,16 @@ virDomainDiskSourceDefFormat(virBufferPtr buf, if (def->startupPolicy) virBufferEscapeString(buf, " startupPolicy='%s'", startupPolicy); - if (def->srcpool || def->startupPolicy) + if (def->nseclabels) { + virBufferAddLit(buf, ">\n"); + virBufferAdjustIndent(buf, 8); + for (n = 0; n < def->nseclabels; n++) + virSecurityDeviceLabelDefFormat(buf, def->seclabels[n]); + virBufferAdjustIndent(buf, -8); + virBufferAddLit(buf, " </source>\n"); + } else if (def->srcpool || def->startupPolicy) { virBufferAddLit(buf, "/>\n"); + } break; default: virReportError(VIR_ERR_INTERNAL_ERROR, diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index 3e710ef..f2ca310 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -2433,6 +2433,15 @@ storageTranslateDomainDiskSourcePool(virConnectPtr conn, goto cleanup; } + if (disk->nseclabels && + vol->type != VIR_STORAGE_VOL_FILE && + vol->type != VIR_STORAGE_VOL_BLOCK) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("'seclabels' is only valid for 'file' or " + "'block' type volume")); + goto cleanup; + } + switch (vol->type) { case VIR_STORAGE_VOL_FILE: case VIR_STORAGE_VOL_BLOCK: