[libvirt] Re: [et-mgmt-tools] Re: Patch to python-virtinst to allow it to choose svirt labels

Daniel J Walsh wrote:

Updated patch attached, I'll reply with patch specific comments later. Thanks, Cole

diff -r 026a37ccd417 virtinst/Guest.py --- a/virtinst/Guest.py Sat Feb 21 14:36:07 2009 -0500 +++ b/virtinst/Guest.py Sat Feb 21 15:09:49 2009 -0500 @@ -27,6 +27,8 @@ import libvirt import CapabilitiesParser import VirtualGraphics +import selinux

+import random import osdict from virtinst import _virtinst as _ @@ -71,6 +73,8 @@ self._cpuset = None self._graphics_dev = None self._consolechild = None + self._seclabel = None + self._imagelabel = None self._os_type = None self._os_variant = None @@ -101,6 +105,16 @@ self._caps = CapabilitiesParser.parse(self.conn.getCapabilities()) + (self.default_seclabel, + self.default_imagelabel) = self._default_seclabels() + + while self._seclabel == None: + seclabel, imagelabel = self.gen_seclabels() + if self.is_conflict_seclabel(self.conn, seclabel): + continue + self.set_seclabel(seclabel) + self.set_imagelabel(imagelabel) + def get_installer(self): return self._installer @@ -110,6 +124,20 @@ self._installer = val installer = property(get_installer, set_installer) + # Security context used to secure guest image + def get_imagelabel(self): + return self._imagelabel + def set_imagelabel(self, val): + self._imagelabel = val + imagelabel = property(get_imagelabel, set_imagelabel) + + # Security context used to secure guest process + def get_seclabel(self): + return self._seclabel + def set_seclabel(self, val): + self._seclabel = val + seclabel = property(get_seclabel, set_seclabel) + # Domain name of the guest def get_name(self): return self._name @@ -407,6 +435,19 @@ xml = _util.xml_append(xml, sound_dev.get_xml_config()) return xml + def _get_seclabel_xml(self): + xml = "" + if self._seclabel != None: + xml = """ + <seclabel model='selinux'> + <label>%s</label> + <image>%s</image> + </seclabel> +""" % ( self._seclabel, self._imagelabel) + print xml + return xml + +

def _get_device_xml(self, install=True): xml = "" @@ -494,6 +535,7 @@ <devices> %(devices)s </devices> + %(secxml)s </domain> """ % { "type": self.type, "name": self.name, \ @@ -504,7 +546,8 @@ "maxramkb": self.maxmemory * 1024, \ "devices": self._get_device_xml(install), \ "osblob": osblob, \ - "action": action } + "action": action, + "secxml": self._get_seclabel_xml()} def start_install(self, consolecb=None, meter=None, removeOld=False, @@ -537,6 +580,8 @@ """Ensure that devices are setup""" for disk in self._install_disks: disk.setup(progresscb) + # Not sure of this, might want to put this in VirtualDisk class + selinux.setfilecon(disk.path, self._imagelabel)

for nic in self._install_nics: nic.setup(self.conn) @@ -631,6 +676,80 @@ if self.domain is not None: raise RuntimeError, _("Domain has already been started!") + def _default_seclabels(self): + try: + fd = open(selinux.selinux_virtual_domain_context_path(), 'r') + except OSError, (err_no, msg): + raise RuntimeError(_("Failed to find SELinux virtual domains " + "context: %s: %s %s" % + (selinux.selinux_virtual_domain_context_path(), + err_no, msg))) + + label = fd.read() + fd.close() + try: + fd = open(selinux.selinux_virtual_image_context_path(), 'r') + except OSError, (err_no, msg): + raise RuntimeError(_("Failed to find SELinux virtual image " + "context: %s: %s %s" % + (selinux.selinux_virtual_domain_context_path(), + err_no, msg))) +