3:52 a.m.
This code depends on new API in libvirt-gconfig to extract the
secmodels handled by the host.
---
Diff to v1:
* Adapted the naming change from libvirt-gconfig
libvirt-sandbox/libvirt-sandbox-builder.c | 68 ++++++++++++++++++++-----------
1 file changed, 45 insertions(+), 23 deletions(-)
diff --git a/libvirt-sandbox/libvirt-sandbox-builder.c
b/libvirt-sandbox/libvirt-sandbox-builder.c
index 48b3acc..327f144 100644
--- a/libvirt-sandbox/libvirt-sandbox-builder.c
+++ b/libvirt-sandbox/libvirt-sandbox-builder.c
@@ -323,38 +323,60 @@ static gboolean
gvir_sandbox_builder_construct_devices(GVirSandboxBuilder *build
}
-static gboolean gvir_sandbox_builder_construct_security(GVirSandboxBuilder *builder
G_GNUC_UNUSED,
+static gboolean gvir_sandbox_builder_construct_security(GVirSandboxBuilder *builder,
GVirSandboxConfig *config
G_GNUC_UNUSED,
const gchar *statedir
G_GNUC_UNUSED,
GVirConfigDomain *domain,
- GError **error G_GNUC_UNUSED)
+ GError **error)
{
GVirConfigDomainSeclabel *sec = gvir_config_domain_seclabel_new();
const char *label = gvir_sandbox_config_get_security_label(config);
+ GVirConnection *connection = gvir_sandbox_builder_get_connection(builder);
+ GVirConfigCapabilities *configCapabilities;
+ GVirConfigCapabilitiesHost *hostCapabilities;
+ GList *secmodels, *iter;
+ gboolean supportsSelinux = FALSE;
+
+ /* What security models are available on the host? */
+ if (!(configCapabilities = gvir_connection_get_capabilities(connection, error))) {
+ g_object_unref(sec);
+ return FALSE;
+ }
+
+ hostCapabilities = gvir_config_capabilities_get_host(configCapabilities);
- gvir_config_domain_seclabel_set_model(sec, "selinux");
- if (gvir_sandbox_config_get_security_dynamic(config)) {
- gvir_config_domain_seclabel_set_type(sec,
- GVIR_CONFIG_DOMAIN_SECLABEL_DYNAMIC);
- if (label)
- gvir_config_domain_seclabel_set_baselabel(sec, label);
- else if (gvir_config_domain_get_virt_type(domain) ==
- GVIR_CONFIG_DOMAIN_VIRT_LXC)
- gvir_config_domain_seclabel_set_baselabel(sec,
"system_u:system_r:svirt_lxc_net_t:s0");
- else if (gvir_config_domain_get_virt_type(domain) ==
- GVIR_CONFIG_DOMAIN_VIRT_QEMU)
- gvir_config_domain_seclabel_set_baselabel(sec,
"system_u:system_r:svirt_tcg_t:s0");
- else if (gvir_config_domain_get_virt_type(domain) ==
- GVIR_CONFIG_DOMAIN_VIRT_KVM)
- gvir_config_domain_seclabel_set_baselabel(sec,
"system_u:system_r:svirt_t:s0");
- } else {
- gvir_config_domain_seclabel_set_type(sec,
- GVIR_CONFIG_DOMAIN_SECLABEL_STATIC);
- if (label)
- gvir_config_domain_seclabel_set_label(sec, label);
+ secmodels = gvir_config_capabilities_host_get_secmodels(hostCapabilities);
+ for (iter = secmodels; iter != NULL; iter = iter->next) {
+ supportsSelinux = g_str_equal(gvir_config_capabilities_host_secmodel_get_model(
+ GVIR_CONFIG_CAPABILITIES_HOST_SECMODEL(iter->data)),
"selinux");
+ g_object_unref(iter->data);
}
- gvir_config_domain_set_seclabel(domain, sec);
+ if (supportsSelinux) {
+ gvir_config_domain_seclabel_set_model(sec, "selinux");
+ if (gvir_sandbox_config_get_security_dynamic(config)) {
+ gvir_config_domain_seclabel_set_type(sec,
+ GVIR_CONFIG_DOMAIN_SECLABEL_DYNAMIC);
+ if (label)
+ gvir_config_domain_seclabel_set_baselabel(sec, label);
+ else if (gvir_config_domain_get_virt_type(domain) ==
+ GVIR_CONFIG_DOMAIN_VIRT_LXC)
+ gvir_config_domain_seclabel_set_baselabel(sec,
"system_u:system_r:svirt_lxc_net_t:s0");
+ else if (gvir_config_domain_get_virt_type(domain) ==
+ GVIR_CONFIG_DOMAIN_VIRT_QEMU)
+ gvir_config_domain_seclabel_set_baselabel(sec,
"system_u:system_r:svirt_tcg_t:s0");
+ else if (gvir_config_domain_get_virt_type(domain) ==
+ GVIR_CONFIG_DOMAIN_VIRT_KVM)
+ gvir_config_domain_seclabel_set_baselabel(sec,
"system_u:system_r:svirt_t:s0");
+ } else {
+ gvir_config_domain_seclabel_set_type(sec,
+ GVIR_CONFIG_DOMAIN_SECLABEL_STATIC);
+ if (label)
+ gvir_config_domain_seclabel_set_label(sec, label);
+ }
+
+ gvir_config_domain_set_seclabel(domain, sec);
+ }
g_object_unref(sec);
return TRUE;
--
1.8.4.5