From: Michal Privoznik <mprivozn@redhat.com> Specifically tailored for AppArmor, so that generating a seclabel and producing profile can be separated. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> --- src/libvirt_private.syms | 1 + src/security/security_driver.h | 4 ++++ src/security/security_manager.c | 13 +++++++++++++ src/security/security_manager.h | 2 ++ src/security/security_stack.c | 15 +++++++++++++++ 5 files changed, 35 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 4e57e4a8f6..64152c3bbb 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1822,6 +1822,7 @@ virSecurityManagerGetModel; virSecurityManagerGetMountOptions; virSecurityManagerGetNested; virSecurityManagerGetProcessLabel; +virSecurityManagerLoadProfile; virSecurityManagerMoveImageMetadata; virSecurityManagerNew; virSecurityManagerNewDAC; diff --git a/src/security/security_driver.h b/src/security/security_driver.h index b8c5b416e3..d81662dab4 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -81,6 +81,8 @@ typedef int (*virSecurityDomainReserveLabel) (virSecurityManager *mgr, pid_t pid); typedef int (*virSecurityDomainReleaseLabel) (virSecurityManager *mgr, virDomainDef *sec); +typedef int (*virSecurityDomainLoadProfile) (virSecurityManager *mgr, + virDomainDef *def); typedef int (*virSecurityDomainSetAllLabel) (virSecurityManager *mgr, char *const *sharedFilesystems, virDomainDef *sec, @@ -211,6 +213,8 @@ struct _virSecurityDriver { virSecurityDomainReserveLabel domainReserveSecurityLabel; virSecurityDomainReleaseLabel domainReleaseSecurityLabel; + virSecurityDomainLoadProfile domainLoadProfile; + virSecurityDomainGetProcessLabel domainGetSecurityProcessLabel; virSecurityDomainSetProcessLabel domainSetSecurityProcessLabel; virSecurityDomainSetChildProcessLabel domainSetSecurityChildProcessLabel; diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 5fc4eb4872..87c8b9f3c1 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -726,6 +726,19 @@ virSecurityManagerReleaseLabel(virSecurityManager *mgr, } +int +virSecurityManagerLoadProfile(virSecurityManager *mgr, + virDomainDef *def) +{ + VIR_LOCK_GUARD lock = virObjectLockGuard(mgr); + + if (!mgr->drv->domainLoadProfile) + return 0; + + return mgr->drv->domainLoadProfile(mgr, def); +} + + static int virSecurityManagerCheckModel(virSecurityManager *mgr, char *secmodel) { diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 068ca4e290..381b614ec1 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -128,6 +128,8 @@ int virSecurityManagerReserveLabel(virSecurityManager *mgr, pid_t pid); int virSecurityManagerReleaseLabel(virSecurityManager *mgr, virDomainDef *sec); +int virSecurityManagerLoadProfile(virSecurityManager *mgr, + virDomainDef *def); int virSecurityManagerCheckAllLabel(virSecurityManager *mgr, virDomainDef *sec); int virSecurityManagerSetAllLabel(virSecurityManager *mgr, diff --git a/src/security/security_stack.c b/src/security/security_stack.c index 99a68a6053..96b59d159b 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -280,6 +280,19 @@ virSecurityStackReserveLabel(virSecurityManager *mgr, } +static int +virSecurityStackLoadProfile(virSecurityManager *mgr, + virDomainDef *vm) +{ + int rc = 0; + + if (virSecurityManagerLoadProfile(virSecurityStackGetPrimary(mgr), vm) < 0) + rc = -1; + + return rc; +} + + static int virSecurityStackSetHostdevLabel(virSecurityManager *mgr, virDomainDef *vm, @@ -1070,6 +1083,8 @@ virSecurityDriver virSecurityDriverStack = { .domainReserveSecurityLabel = virSecurityStackReserveLabel, .domainReleaseSecurityLabel = virSecurityStackReleaseLabel, + .domainLoadProfile = virSecurityStackLoadProfile, + .domainGetSecurityProcessLabel = virSecurityStackGetProcessLabel, .domainSetSecurityProcessLabel = virSecurityStackSetProcessLabel, .domainSetSecurityChildProcessLabel = virSecurityStackSetChildProcessLabel, -- 2.52.0