[libvirt] [PATCH] security: don't try to label network disks
Network disks don't have paths to be resolved or files to be checked
for ownership. ee3efc41e6233e625aa03003bf3127319ccd546f checked this
for some image label functions, but was partially reverted in a
refactor. This finishes adding the check to each security driver's
set and restore label methods for images.
Signed-off-by: Josh Durgin <josh.durgin(a)dreamhost.com>
---
src/security/security_apparmor.c | 3 +++
src/security/security_dac.c | 6 ++++++
src/security/security_selinux.c | 3 +++
3 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
index db7e7dc..3a01a21 100644
--- a/src/security/security_apparmor.c
+++ b/src/security/security_apparmor.c
@@ -606,6 +606,9 @@ AppArmorRestoreSecurityImageLabel(virSecurityManagerPtr mgr,
virDomainObjPtr vm,
virDomainDiskDefPtr disk ATTRIBUTE_UNUSED)
{
+ if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK)
+ return 0;
+
return reload_profile(mgr, vm, NULL, false);
}
diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index 0e75319..9f8a320 100644
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -180,6 +180,9 @@ virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr,
if (!priv->dynamicOwnership)
return 0;
+ if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK)
+ return 0;
+
return virDomainDiskDefForeachPath(disk,
virSecurityManagerGetAllowDiskFormatProbing(mgr),
false,
@@ -199,6 +202,9 @@ virSecurityDACRestoreSecurityImageLabelInt(virSecurityManagerPtr mgr,
if (!priv->dynamicOwnership)
return 0;
+ if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK)
+ return 0;
+
/* Don't restore labels on readoly/shared disks, because
* other VMs may still be accessing these
* Alternatively we could iterate over all running
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 78c0d45..6ef61c7 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -636,6 +636,9 @@ SELinuxSetSecurityImageLabel(virSecurityManagerPtr mgr,
if (secdef->norelabel)
return 0;
+ if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK)
+ return 0;
+
return virDomainDiskDefForeachPath(disk,
allowDiskFormatProbing,
true,
--
1.7.1