From: "Daniel P. Berrange" <berrange@redhat.com> This patch introduces the virAccessManagerPtr class as the interface between virtualization drivers and the access control drivers. The viraccessperm.h file defines the various permissions that will be used for each type of object libvirt manages Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- include/libvirt/virterror.h | 4 + po/POTFILES.in | 1 + src/Makefile.am | 16 + src/access/viraccessdriver.h | 89 ++++++ src/access/viraccessdrivernop.c | 118 +++++++ src/access/viraccessdrivernop.h | 28 ++ src/access/viraccessdriverstack.c | 285 +++++++++++++++++ src/access/viraccessdriverstack.h | 32 ++ src/access/viraccessmanager.c | 340 ++++++++++++++++++++ src/access/viraccessmanager.h | 91 ++++++ src/access/viraccessperm.c | 84 +++++ src/access/viraccessperm.h | 647 ++++++++++++++++++++++++++++++++++++++ src/libvirt.c | 6 +- src/libvirt_private.syms | 37 +++ src/util/virerror.c | 8 + 15 files changed, 1784 insertions(+), 2 deletions(-) create mode 100644 src/access/viraccessdriver.h create mode 100644 src/access/viraccessdrivernop.c create mode 100644 src/access/viraccessdrivernop.h create mode 100644 src/access/viraccessdriverstack.c create mode 100644 src/access/viraccessdriverstack.h create mode 100644 src/access/viraccessmanager.c create mode 100644 src/access/viraccessmanager.h create mode 100644 src/access/viraccessperm.c create mode 100644 src/access/viraccessperm.h diff --git a/include/libvirt/virterror.h b/include/libvirt/virterror.h index 3864a31..7a582f5 100644 --- a/include/libvirt/virterror.h +++ b/include/libvirt/virterror.h @@ -118,6 +118,8 @@ typedef enum { VIR_FROM_IDENTITY = 53, /* Error from identity code */ VIR_FROM_CGROUP = 54, /* Error from cgroups */ + VIR_FROM_ACCESS = 55, /* Error from access control manager */ + # ifdef VIR_ENUM_SENTINELS VIR_ERR_DOMAIN_LAST # endif @@ -290,6 +292,8 @@ typedef enum { VIR_ERR_AGENT_UNRESPONSIVE = 86, /* guest agent is unresponsive, not running or not usable */ VIR_ERR_RESOURCE_BUSY = 87, /* resource is already in use */ + VIR_ERR_ACCESS_DENIED = 88, /* operation on the object/resource + was denied */ } virErrorNumber; /** diff --git a/po/POTFILES.in b/po/POTFILES.in index bf5a864..37c6019 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -6,6 +6,7 @@ daemon/remote_dispatch.h daemon/stream.c gnulib/lib/gai_strerror.c gnulib/lib/regcomp.c +src/access/viraccessmanager.c src/conf/cpu_conf.c src/conf/device_conf.c src/conf/domain_conf.c diff --git a/src/Makefile.am b/src/Makefile.am index 6175b84..babd019 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -772,6 +772,13 @@ SECURITY_DRIVER_APPARMOR_SOURCES = \ security/security_apparmor.h security/security_apparmor.c +ACCESS_DRIVER_SOURCES = \ + access/viraccessperm.h access/viraccessperm.c \ + access/viraccessmanager.h access/viraccessmanager.c \ + access/viraccessdriver.h \ + access/viraccessdrivernop.h access/viraccessdrivernop.c \ + access/viraccessdriverstack.h access/viraccessdriverstack.c + NODE_DEVICE_DRIVER_SOURCES = \ node_device/node_device_driver.c \ node_device/node_device_driver.h \ @@ -1344,6 +1351,15 @@ libvirt_security_manager_la_SOURCES += $(SECURITY_DRIVER_APPARMOR_SOURCES) libvirt_security_manager_la_CFLAGS += $(APPARMOR_CFLAGS) endif +libvirt_driver_access_la_SOURCES = $(ACCESS_DRIVER_SOURCES) +noinst_LTLIBRARIES += libvirt_driver_access.la +libvirt_la_BUILT_LIBADD += libvirt_driver_access.la +libvirt_driver_access_la_CFLAGS = \ + -I$(top_srcdir)/src/conf $(AM_CFLAGS) +libvirt_driver_access_la_LDFLAGS = $(AM_LDFLAGS) +libvirt_driver_access_la_LIBADD = + + # Add all conditional sources just in case... EXTRA_DIST += \ $(TEST_DRIVER_SOURCES) \ diff --git a/src/access/viraccessdriver.h b/src/access/viraccessdriver.h new file mode 100644 index 0000000..e3050b6 --- /dev/null +++ b/src/access/viraccessdriver.h @@ -0,0 +1,89 @@ +/* + * viraccessdriver.h: access control driver + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#ifndef __VIR_ACCESS_DRIVER_H__ +# define __VIR_ACCESS_DRIVER_H__ + +# include "conf/domain_conf.h" +# include "access/viraccessmanager.h" + +typedef int (*virAccessDriverCheckConnectDrv)(virAccessManagerPtr manager, + const char *driverName, + virAccessPermConnect av); +typedef int (*virAccessDriverCheckDomainDrv)(virAccessManagerPtr manager, + const char *driverName, + virDomainDefPtr domain, + virAccessPermDomain av); +typedef int (*virAccessDriverCheckInterfaceDrv)(virAccessManagerPtr manager, + const char *driverName, + virInterfaceDefPtr iface, + virAccessPermInterface av); +typedef int (*virAccessDriverCheckNetworkDrv)(virAccessManagerPtr manager, + const char *driverName, + virNetworkDefPtr network, + virAccessPermNetwork av); +typedef int (*virAccessDriverCheckNodeDeviceDrv)(virAccessManagerPtr manager, + const char *driverName, + virNodeDeviceDefPtr nodedev, + virAccessPermNodeDevice av); +typedef int (*virAccessDriverCheckNWFilterDrv)(virAccessManagerPtr manager, + const char *driverName, + virNWFilterDefPtr nwfilter, + virAccessPermNWFilter av); +typedef int (*virAccessDriverCheckSecretDrv)(virAccessManagerPtr manager, + const char *driverName, + virSecretDefPtr secret, + virAccessPermSecret av); +typedef int (*virAccessDriverCheckStoragePoolDrv)(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virAccessPermStoragePool av); +typedef int (*virAccessDriverCheckStorageVolDrv)(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virStorageVolDefPtr vol, + virAccessPermStorageVol av); + +typedef int (*virAccessDriverSetupDrv)(virAccessManagerPtr manager); +typedef void (*virAccessDriverCleanupDrv)(virAccessManagerPtr manager); + +typedef struct _virAccessDriver virAccessDriver; +typedef virAccessDriver *virAccessDriverPtr; + +struct _virAccessDriver { + size_t privateDataLen; + const char *name; + + virAccessDriverSetupDrv setup; + virAccessDriverCleanupDrv cleanup; + + virAccessDriverCheckConnectDrv checkConnect; + virAccessDriverCheckDomainDrv checkDomain; + virAccessDriverCheckInterfaceDrv checkInterface; + virAccessDriverCheckNetworkDrv checkNetwork; + virAccessDriverCheckNodeDeviceDrv checkNodeDevice; + virAccessDriverCheckNWFilterDrv checkNWFilter; + virAccessDriverCheckSecretDrv checkSecret; + virAccessDriverCheckStoragePoolDrv checkStoragePool; + virAccessDriverCheckStorageVolDrv checkStorageVol; +}; + + +#endif /* __VIR_ACCESS_DRIVER_H__ */ diff --git a/src/access/viraccessdrivernop.c b/src/access/viraccessdrivernop.c new file mode 100644 index 0000000..86ceef3 --- /dev/null +++ b/src/access/viraccessdrivernop.c @@ -0,0 +1,118 @@ +/* + * viraccessdrivernop.c: no-op access control driver + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> + +#include "access/viraccessdrivernop.h" + +static int +virAccessDriverNopCheckConnect(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virAccessPermConnect perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckDomain(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virDomainDefPtr domain ATTRIBUTE_UNUSED, + virAccessPermDomain perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckInterface(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virInterfaceDefPtr iface ATTRIBUTE_UNUSED, + virAccessPermInterface perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckNetwork(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virNetworkDefPtr network ATTRIBUTE_UNUSED, + virAccessPermNetwork perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckNodeDevice(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virNodeDeviceDefPtr nodedev ATTRIBUTE_UNUSED, + virAccessPermNodeDevice perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckNWFilter(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virNWFilterDefPtr nwfilter ATTRIBUTE_UNUSED, + virAccessPermNWFilter perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckSecret(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virSecretDefPtr secret ATTRIBUTE_UNUSED, + virAccessPermSecret perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckStoragePool(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virStoragePoolDefPtr pool ATTRIBUTE_UNUSED, + virAccessPermStoragePool perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + +static int +virAccessDriverNopCheckStorageVol(virAccessManagerPtr manager ATTRIBUTE_UNUSED, + const char *driverName ATTRIBUTE_UNUSED, + virStoragePoolDefPtr pool ATTRIBUTE_UNUSED, + virStorageVolDefPtr vol ATTRIBUTE_UNUSED, + virAccessPermStorageVol perm ATTRIBUTE_UNUSED) +{ + return 1; /* Allow */ +} + + +virAccessDriver accessDriverNop = { + .name = "none", + .checkConnect = virAccessDriverNopCheckConnect, + .checkDomain = virAccessDriverNopCheckDomain, + .checkInterface = virAccessDriverNopCheckInterface, + .checkNetwork = virAccessDriverNopCheckNetwork, + .checkNodeDevice = virAccessDriverNopCheckNodeDevice, + .checkNWFilter = virAccessDriverNopCheckNWFilter, + .checkSecret = virAccessDriverNopCheckSecret, + .checkStoragePool = virAccessDriverNopCheckStoragePool, + .checkStorageVol = virAccessDriverNopCheckStorageVol, +}; diff --git a/src/access/viraccessdrivernop.h b/src/access/viraccessdrivernop.h new file mode 100644 index 0000000..0b5d413 --- /dev/null +++ b/src/access/viraccessdrivernop.h @@ -0,0 +1,28 @@ +/* + * viraccessdrivernop.h: no-op access control driver + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#ifndef __VIR_ACCESS_DRIVER_NOP_H__ +# define __VIR_ACCESS_DRIVER_NOP_H__ + +# include "access/viraccessdriver.h" + +extern virAccessDriver accessDriverNop; + +#endif /* __VIR_ACCESS_DRIVER_NOP_H__ */ diff --git a/src/access/viraccessdriverstack.c b/src/access/viraccessdriverstack.c new file mode 100644 index 0000000..4c9f0c4 --- /dev/null +++ b/src/access/viraccessdriverstack.c @@ -0,0 +1,285 @@ +/* + * viraccessdriverstack.c: stacked access control driver + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> + +#include "viraccessdriverstack.h" +#include "viralloc.h" +#include "virerror.h" + +#define VIR_FROM_THIS VIR_FROM_ACCESS + +typedef struct _virAccessDriverStackPrivate virAccessDriverStackPrivate; +typedef virAccessDriverStackPrivate *virAccessDriverStackPrivatePtr; + +struct _virAccessDriverStackPrivate { + virAccessManagerPtr *managers; + size_t managersLen; +}; + + +int virAccessDriverStackAppend(virAccessManagerPtr manager, + virAccessManagerPtr child) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + if (VIR_EXPAND_N(priv->managers, priv->managersLen, 1) < 0) { + virReportOOMError(); + return -1; + } + + priv->managers[priv->managersLen-1] = child; + + return 0; +} + + +static void virAccessDriverStackCleanup(virAccessManagerPtr manager) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + virObjectUnref(priv->managers[i]); + } + VIR_FREE(priv->managers); +} + + +static int +virAccessDriverStackCheckConnect(virAccessManagerPtr manager, + const char *driverName, + virAccessPermConnect perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckConnect(priv->managers[i], driverName, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckDomain(virAccessManagerPtr manager, + const char *driverName, + virDomainDefPtr domain, + virAccessPermDomain perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckDomain(priv->managers[i], driverName, domain, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckInterface(virAccessManagerPtr manager, + const char *driverName, + virInterfaceDefPtr iface, + virAccessPermInterface perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckInterface(priv->managers[i], driverName, iface, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckNetwork(virAccessManagerPtr manager, + const char *driverName, + virNetworkDefPtr network, + virAccessPermNetwork perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckNetwork(priv->managers[i], driverName, network, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckNodeDevice(virAccessManagerPtr manager, + const char *driverName, + virNodeDeviceDefPtr nodedev, + virAccessPermNodeDevice perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckNodeDevice(priv->managers[i], driverName, nodedev, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckNWFilter(virAccessManagerPtr manager, + const char *driverName, + virNWFilterDefPtr nwfilter, + virAccessPermNWFilter perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckNWFilter(priv->managers[i], driverName, nwfilter, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckSecret(virAccessManagerPtr manager, + const char *driverName, + virSecretDefPtr secret, + virAccessPermSecret perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckSecret(priv->managers[i], driverName, secret, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckStoragePool(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virAccessPermStoragePool perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckStoragePool(priv->managers[i], driverName, pool, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +static int +virAccessDriverStackCheckStorageVol(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virStorageVolDefPtr vol, + virAccessPermStorageVol perm) +{ + virAccessDriverStackPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int ret = 1; + size_t i; + + for (i = 0 ; i < priv->managersLen ; i++) { + int rv; + /* We do not short-circuit on first denial - always check all drivers */ + rv = virAccessManagerCheckStorageVol(priv->managers[i], driverName, pool, vol, perm); + if (rv == 0 && ret != -1) + ret = 0; + else if (rv == -1) + ret = -1; + } + + return ret; +} + +virAccessDriver accessDriverStack = { + .name = "stack", + .cleanup = virAccessDriverStackCleanup, + .checkConnect = virAccessDriverStackCheckConnect, + .checkDomain = virAccessDriverStackCheckDomain, + .checkInterface = virAccessDriverStackCheckInterface, + .checkNetwork = virAccessDriverStackCheckNetwork, + .checkNodeDevice = virAccessDriverStackCheckNodeDevice, + .checkNWFilter = virAccessDriverStackCheckNWFilter, + .checkSecret = virAccessDriverStackCheckSecret, + .checkStoragePool = virAccessDriverStackCheckStoragePool, + .checkStorageVol = virAccessDriverStackCheckStorageVol, +}; diff --git a/src/access/viraccessdriverstack.h b/src/access/viraccessdriverstack.h new file mode 100644 index 0000000..4e34d5f --- /dev/null +++ b/src/access/viraccessdriverstack.h @@ -0,0 +1,32 @@ +/* + * viraccessdriverstack.h: stacked access control driver + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#ifndef __VIR_ACCESS_DRIVER_STACK_H__ +# define __VIR_ACCESS_DRIVER_STACK_H__ + +# include "access/viraccessdriver.h" + + +int virAccessDriverStackAppend(virAccessManagerPtr manager, + virAccessManagerPtr child); + +extern virAccessDriver accessDriverStack; + +#endif /* __VIR_ACCESS_DRIVER_STACK_H__ */ diff --git a/src/access/viraccessmanager.c b/src/access/viraccessmanager.c new file mode 100644 index 0000000..ff1a538 --- /dev/null +++ b/src/access/viraccessmanager.c @@ -0,0 +1,340 @@ +/* + * viraccessmanager.c: access control manager + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> + +#include "viraccessmanager.h" +#include "viraccessdrivernop.h" +#include "viraccessdriverstack.h" +#include "viralloc.h" +#include "virerror.h" +#include "virobject.h" +#include "virthread.h" +#include "virlog.h" + +#define VIR_FROM_THIS VIR_FROM_ACCESS +#define virAccessError(code, ...) \ + virReportErrorHelper(VIR_FROM_THIS, code, __FILE__, \ + __FUNCTION__, __LINE__, __VA_ARGS__) + +struct _virAccessManager { + virObjectLockable parent; + + virAccessDriverPtr drv; + void *privateData; +}; + +static virClassPtr virAccessManagerClass; +static virAccessManagerPtr virAccessManagerDefault; + +static void virAccessManagerDispose(void *obj); + +static int virAccessManagerOnceInit(void) +{ + if (!(virAccessManagerClass = virClassNew(virClassForObjectLockable(), + "virAccessManagerClass", + sizeof(virAccessManager), + virAccessManagerDispose))) + return -1; + + return 0; +} + +VIR_ONCE_GLOBAL_INIT(virAccessManager); + + +virAccessManagerPtr virAccessManagerGetDefault(void) +{ + return virObjectRef(virAccessManagerDefault); +} + + +void virAccessManagerSetDefault(virAccessManagerPtr mgr) +{ + virObjectUnref(virAccessManagerDefault); + + virAccessManagerDefault = virObjectRef(mgr); +} + + +static virAccessManagerPtr virAccessManagerNewDriver(virAccessDriverPtr drv) +{ + virAccessManagerPtr mgr; + char *privateData; + + if (virAccessManagerInitialize() < 0) + return NULL; + + if (VIR_ALLOC_N(privateData, drv->privateDataLen) < 0) { + virReportOOMError(); + return NULL; + } + + if (!(mgr = virObjectLockableNew(virAccessManagerClass))) { + VIR_FREE(privateData); + return NULL; + } + + mgr->drv = drv; + mgr->privateData = privateData; + + if (mgr->drv->setup && + mgr->drv->setup(mgr) < 0) { + virObjectUnref(mgr); + return NULL; + } + + VIR_DEBUG("Initialized with %s", mgr->drv->name); + return mgr; +} + + +static virAccessDriverPtr accessDrivers[] = { + &accessDriverNop, +}; + + +static virAccessDriverPtr virAccessManagerFindDriver(const char *name) +{ + size_t i; + for (i = 0 ; i < ARRAY_CARDINALITY(accessDrivers) ; i++) { + if (STREQ(name, accessDrivers[i]->name)) + return accessDrivers[i]; + } + + return NULL; +} + + +virAccessManagerPtr virAccessManagerNew(const char *name) +{ + virAccessDriverPtr drv; + + if (virAccessManagerInitialize() < 0) + return NULL; + + if (!(drv = virAccessManagerFindDriver(name))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot find security driver '%s'"), + name); + return NULL; + } + + return virAccessManagerNewDriver(drv); +} + + +virAccessManagerPtr virAccessManagerNewStack(const char **names) +{ + virAccessManagerPtr manager = virAccessManagerNewDriver(&accessDriverStack); + size_t i; + + if (!manager) + return NULL; + + for (i = 0 ; names[i] != NULL ; i++) { + virAccessManagerPtr child = virAccessManagerNew(names[i]); + + if (!child) + goto error; + + if (virAccessDriverStackAppend(manager, child) < 0) { + virObjectUnref(child); + goto error; + } + } + + return manager; + +error: + virObjectUnref(manager); + return NULL; +} + + +void *virAccessManagerGetPrivateData(virAccessManagerPtr mgr) +{ + return mgr->privateData; +} + + +static void virAccessManagerDispose(void *object) +{ + virAccessManagerPtr mgr = object; + + if (mgr->drv->cleanup) + mgr->drv->cleanup(mgr); + VIR_FREE(mgr->privateData); +} + + +/* Standard security practice is to not tell the caller *why* + * they were denied access. So this method takes the real + * libvirt errors & replaces it with a generic error. Fortunately + * the daemon logs will still contain the original error message + * should the admin need to debug things + */ +static int +virAccessManagerSanitizeError(int ret) +{ + if (ret < 0) { + virResetLastError(); + virAccessError(VIR_ERR_ACCESS_DENIED, NULL); + } + + return ret; +} + +int virAccessManagerCheckConnect(virAccessManagerPtr manager, + const char *driverName, + virAccessPermConnect perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s perm=%d", + manager, manager->drv->name, driverName, perm); + + if (manager->drv->checkConnect) + ret = manager->drv->checkConnect(manager, driverName, perm); + + return virAccessManagerSanitizeError(ret); +} + + +int virAccessManagerCheckDomain(virAccessManagerPtr manager, + const char *driverName, + virDomainDefPtr domain, + virAccessPermDomain perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s domain=%p perm=%d", + manager, manager->drv->name, driverName, domain, perm); + + if (manager->drv->checkDomain) + ret = manager->drv->checkDomain(manager, driverName, domain, perm); + + return virAccessManagerSanitizeError(ret); +} + +int virAccessManagerCheckInterface(virAccessManagerPtr manager, + const char *driverName, + virInterfaceDefPtr iface, + virAccessPermInterface perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s iface=%p perm=%d", + manager, manager->drv->name, driverName, iface, perm); + + if (manager->drv->checkInterface) + ret = manager->drv->checkInterface(manager, driverName, iface, perm); + + return virAccessManagerSanitizeError(ret); +} + +int virAccessManagerCheckNetwork(virAccessManagerPtr manager, + const char *driverName, + virNetworkDefPtr network, + virAccessPermNetwork perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s network=%p perm=%d", + manager, manager->drv->name, driverName, network, perm); + + if (manager->drv->checkNetwork) + ret = manager->drv->checkNetwork(manager, driverName, network, perm); + + return virAccessManagerSanitizeError(ret); +} + +int virAccessManagerCheckNodeDevice(virAccessManagerPtr manager, + const char *driverName, + virNodeDeviceDefPtr nodedev, + virAccessPermNodeDevice perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s nodedev=%p perm=%d", + manager, manager->drv->name, driverName, nodedev, perm); + + if (manager->drv->checkNodeDevice) + ret = manager->drv->checkNodeDevice(manager, driverName, nodedev, perm); + + return virAccessManagerSanitizeError(ret); +} + +int virAccessManagerCheckNWFilter(virAccessManagerPtr manager, + const char *driverName, + virNWFilterDefPtr nwfilter, + virAccessPermNWFilter perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s nwfilter=%p perm=%d", + manager, manager->drv->name, driverName, nwfilter, perm); + + if (manager->drv->checkNWFilter) + ret = manager->drv->checkNWFilter(manager, driverName, nwfilter, perm); + + return virAccessManagerSanitizeError(ret); +} + +int virAccessManagerCheckSecret(virAccessManagerPtr manager, + const char *driverName, + virSecretDefPtr secret, + virAccessPermSecret perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s secret=%p perm=%d", + manager, manager->drv->name, driverName, secret, perm); + + if (manager->drv->checkSecret) + ret = manager->drv->checkSecret(manager, driverName, secret, perm); + + return virAccessManagerSanitizeError(ret); +} + +int virAccessManagerCheckStoragePool(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virAccessPermStoragePool perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s pool=%p perm=%d", + manager, manager->drv->name, driverName, pool, perm); + + if (manager->drv->checkStoragePool) + ret = manager->drv->checkStoragePool(manager, driverName, pool, perm); + + return virAccessManagerSanitizeError(ret); +} + +int virAccessManagerCheckStorageVol(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virStorageVolDefPtr vol, + virAccessPermStorageVol perm) +{ + int ret = 0; + VIR_DEBUG("manager=%p(name=%s) driver=%s pool=%p vol=%p perm=%d", + manager, manager->drv->name, driverName, pool, vol, perm); + + if (manager->drv->checkStorageVol) + ret = manager->drv->checkStorageVol(manager, driverName, pool, vol, perm); + + return virAccessManagerSanitizeError(ret); +} + diff --git a/src/access/viraccessmanager.h b/src/access/viraccessmanager.h new file mode 100644 index 0000000..e7eb15d --- /dev/null +++ b/src/access/viraccessmanager.h @@ -0,0 +1,91 @@ +/* + * viraccessmanager.h: access control manager + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#ifndef __VIR_ACCESS_MANAGER_H__ +# define __VIR_ACCESS_MANAGER_H__ + +# include "viridentity.h" +# include "conf/domain_conf.h" +# include "conf/network_conf.h" +# include "conf/nwfilter_conf.h" +# include "conf/node_device_conf.h" +# include "conf/storage_conf.h" +# include "conf/secret_conf.h" +# include "conf/interface_conf.h" +# include "access/viraccessperm.h" + +typedef struct _virAccessManager virAccessManager; +typedef virAccessManager *virAccessManagerPtr; + +virAccessManagerPtr virAccessManagerGetDefault(void); +void virAccessManagerSetDefault(virAccessManagerPtr manager); + +virAccessManagerPtr virAccessManagerNew(const char *name); +virAccessManagerPtr virAccessManagerNewStack(const char **names); + + +void *virAccessManagerGetPrivateData(virAccessManagerPtr manager); + + +/* + * The virAccessManagerCheckXXX functions will + * Return -1 on error + * Return 0 on auth deny + * Return 1 on auth allow + */ +int virAccessManagerCheckConnect(virAccessManagerPtr manager, + const char *driverName, + virAccessPermConnect perm); +int virAccessManagerCheckDomain(virAccessManagerPtr manager, + const char *driverName, + virDomainDefPtr domain, + virAccessPermDomain perm); +int virAccessManagerCheckInterface(virAccessManagerPtr manager, + const char *driverName, + virInterfaceDefPtr iface, + virAccessPermInterface perm); +int virAccessManagerCheckNetwork(virAccessManagerPtr manager, + const char *driverName, + virNetworkDefPtr network, + virAccessPermNetwork perm); +int virAccessManagerCheckNodeDevice(virAccessManagerPtr manager, + const char *driverName, + virNodeDeviceDefPtr nodedev, + virAccessPermNodeDevice perm); +int virAccessManagerCheckNWFilter(virAccessManagerPtr manager, + const char *driverName, + virNWFilterDefPtr nwfilter, + virAccessPermNWFilter perm); +int virAccessManagerCheckSecret(virAccessManagerPtr manager, + const char *driverName, + virSecretDefPtr secret, + virAccessPermSecret perm); +int virAccessManagerCheckStoragePool(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virAccessPermStoragePool perm); +int virAccessManagerCheckStorageVol(virAccessManagerPtr manager, + const char *driverName, + virStoragePoolDefPtr pool, + virStorageVolDefPtr vol, + virAccessPermStorageVol perm); + + +#endif /* __VIR_ACCESS_MANAGER_H__ */ diff --git a/src/access/viraccessperm.c b/src/access/viraccessperm.c new file mode 100644 index 0000000..17f6243 --- /dev/null +++ b/src/access/viraccessperm.c @@ -0,0 +1,84 @@ +/* + * viraccessperm.c: access control permissions + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> + +#include "viraccessperm.h" + + +VIR_ENUM_IMPL(virAccessPermConnect, + VIR_ACCESS_PERM_CONNECT_LAST, + "getattr", "read", "write", + "search_domains", "search_networks", + "search_storage_pools", "search_node_devices", + "search_interfaces", "search_secrets", + "search_nwfilters", + "detect_storage_pool", "pm_control", + "interface_transaction"); + +VIR_ENUM_IMPL(virAccessPermDomain, + VIR_ACCESS_PERM_DOMAIN_LAST, + "getattr", "read", "write", "read_secure", + "start", "stop", "reset", + "save", "delete", + "migrate", "snapshot", "suspend", "hibernate", "core_dump", "pm_control", + "init_control", "inject_nmi", "send_input", "send_signal", "fs_trim", + "block_read", "block_write", "mem_read", + "open_graphics", "open_device", "screenshot", + "open_namespace"); + +VIR_ENUM_IMPL(virAccessPermInterface, + VIR_ACCESS_PERM_INTERFACE_LAST, + "getattr", "read", "write", "save", + "delete", "start", "stop"); + +VIR_ENUM_IMPL(virAccessPermNetwork, + VIR_ACCESS_PERM_NETWORK_LAST, + "getattr", "read", "write", + "save", "delete", "start", "stop"); + +VIR_ENUM_IMPL(virAccessPermNodeDevice, + VIR_ACCESS_PERM_NODE_DEVICE_LAST, + "getattr", "read", "write", + "start", "stop", + "dettach"); + +VIR_ENUM_IMPL(virAccessPermNWFilter, + VIR_ACCESS_PERM_NWFILTER_LAST, + "getattr", "read", "write", + "save", "delete"); + +VIR_ENUM_IMPL(virAccessPermSecret, + VIR_ACCESS_PERM_SECRET_LAST, + "getattr", "read", "write", + "read_secure", "save", "delete"); + +VIR_ENUM_IMPL(virAccessPermStoragePool, + VIR_ACCESS_PERM_STORAGE_POOL_LAST, + "getattr", "read", "write", + "save", "delete", "start", "stop", + "refresh", "search_storage_vols", + "format"); + +VIR_ENUM_IMPL(virAccessPermStorageVol, + VIR_ACCESS_PERM_STORAGE_VOL_LAST, + "getattr", "read", "create", "delete", + "format", "resize", "data_read", + "data_write"); diff --git a/src/access/viraccessperm.h b/src/access/viraccessperm.h new file mode 100644 index 0000000..6f171f9 --- /dev/null +++ b/src/access/viraccessperm.h @@ -0,0 +1,647 @@ +/* + * viraccessperm.h: access control permissions + * + * Copyright (C) 2012-2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#ifndef __VIR_ACCESS_PERM_H__ +# define __VIR_ACCESS_PERM_H__ + +# include "internal.h" +# include "virutil.h" + +typedef enum { + /** + * @desc: Access connection + * @message: Accessing the connection requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_GETATTR, + + /** + * @desc: Read host + * @message: Reading the host configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_READ, + + /** + * @desc: Write host + * @message: Writing the host configuration requires authorization + */ + VIR_ACCESS_PERM_CONNECT_WRITE, + + /** + * @desc: List domains + * @message: Listing domains requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_SEARCH_DOMAINS, + + /** + * @desc: List networks + * @message: Listing networks requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_SEARCH_NETWORKS, + + /** + * @desc: List storage pools + * @message: Listing storage pools requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_SEARCH_STORAGE_POOLS, + + /** + * @desc: List node devices + * @message: Listing node devices requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_SEARCH_NODE_DEVICES, + + /** + * @desc: List interfaces + * @message: Listing interfaces requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_SEARCH_INTERFACES, + + /** + * @desc: List secrets + * @message: Listing secrets requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_SEARCH_SECRETS, + + /** + * @desc: List network filters + * @message: Listing network filters requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_CONNECT_SEARCH_NWFILTERS, + + + /** + * @desc: Detect storage pools + * @message: Detecting storage pools requires authorization + */ + VIR_ACCESS_PERM_CONNECT_DETECT_STORAGE_POOLS, + + /** + * @desc: Use host power management + * @message: Using host power management requires authorization + */ + VIR_ACCESS_PERM_CONNECT_PM_CONTROL, + + /** + * @desc: Interface transactions + * @message: Using interface transactions requires authorization + */ + VIR_ACCESS_PERM_CONNECT_INTERFACE_TRANSACTION, + + VIR_ACCESS_PERM_CONNECT_LAST, +} virAccessPermConnect; + +typedef enum { + /** + * @desc: Access domain + * @message: Accessing the domain requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_DOMAIN_GETATTR, /* Name/ID/UUID access */ + + /** + * @desc: Read domain + * @message: Reading domain configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_DOMAIN_READ, /* Config view */ + + /** + * @desc: Write domain + * @message: Writing domain configuration requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_WRITE, /* Config change */ + + /** + * @desc: Read secure domain + * @message: Reading secure domain configuration requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_READ_SECURE, /* Config access of passwords */ + + /** + * @desc: Start domain + * @message: Starting the domain requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_START, /* Power on */ + + /** + * @desc: Stop domain + * @message: Stopping the domain requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_STOP, /* Power off */ + + /** + * @desc: Reset domain + * @message: Resetting the domain requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_RESET, /* Power reset */ + + /** + * @desc: Save domain + * @message: Saving domain configuration requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_SAVE, /* Write out persistent config */ + + /** + * @desc: Delete domain + * @message: Deleting domain configuration requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_DELETE, /* Remove persistent config */ + + + /** + * @desc: Migrate domain + * @message: Migrating domain requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_MIGRATE, /* Host migration */ + + /** + * @desc: Snapshot domain + * @message: Snapshotting domain requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_SNAPSHOT, /* Snapshot disks/memory */ + + /** + * @desc: Suspend domain + * @message: Suspending domain CPUs requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_SUSPEND, /* Pause/resume CPUs */ + + /** + * @desc: Hibernate domain + * @message: Saving domain state requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_HIBERNATE, /* Save state to host */ + + /** + * @desc: Dump domain + * @message: Dumping domain corefile requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_CORE_DUMP, /* Dump guest core */ + + /** + * @desc: Use domain power management + * @message: Using domain power management requires authoriation + */ + VIR_ACCESS_PERM_DOMAIN_PM_CONTROL, /* S3/S5 suspend/wakeup */ + + /* Interactions with guest OS */ + + /** + * @desc: Domain init control + * @message: Controlling domain init process requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_INIT_CONTROL, /* Init shutdown/reboot request */ + + /** + * @desc: Inject domain NMI + * @message: Injecting interrupt requries authoriation + */ + VIR_ACCESS_PERM_DOMAIN_INJECT_NMI, /* Trigger interrupts */ + + /** + * @desc: Send domain input + * @message: Sending input events to domain requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_SEND_INPUT, /* Send guest input device (key/mouse) events */ + + /** + * @desc: Send domain signal + * @message: Sending signals to processes in domain requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_SEND_SIGNAL, /* Send a signal to processes inside */ + + /** + * @desc: Trim domain filesystems + * @message: Trimming domain filesystems require authorization + */ + VIR_ACCESS_PERM_DOMAIN_FS_TRIM, /* Issue TRIM to guest filesystems */ + + /* Peeking at guest */ + + /** + * @desc: Read domain block + * @message: Reading domain block devices requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_BLOCK_READ, /* Read data from block devices */ + + /** + * @desc: Write domain block + * @message: Writing domain block devices requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_BLOCK_WRITE, /* resize/pull/rebase/commit */ + + /** + * @desc: Read domain memory + * @message: Reading domain memory requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_MEM_READ, /* Read data from guest memory */ + + /* Device interaction */ + + /** + * @desc: Open domain graphics + * @message: Opening domain graphics console requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_OPEN_GRAPHICS, /* Open graphical console */ + + /** + * @desc: Open domain device + * @message: Opening domain devices requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_OPEN_DEVICE, /* Open a guest console/channel */ + + /** + * @desc: Take domain screenshot + * @message: Taking domain screenshots requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_SCREENSHOT, /* Trigger a screen shot */ + + + /** + * @desc: Open domain namespace + * @message: Opening domain namespaces requires authorization + */ + VIR_ACCESS_PERM_DOMAIN_OPEN_NAMESPACE, + + VIR_ACCESS_PERM_DOMAIN_LAST, +} virAccessPermDomain; + +typedef enum { + + /** + * @desc: Access interface + * @message: Accessing interface requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_INTERFACE_GETATTR, + + /** + * @desc: Read interface + * @message: Reading interface configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_INTERFACE_READ, + + /** + * @desc: Write interface + * @message: Writing interface configuration requires authorization + */ + VIR_ACCESS_PERM_INTERFACE_WRITE, + + /** + * @desc: Save interface + * @message: Saving interface configuration requires authorization + */ + VIR_ACCESS_PERM_INTERFACE_SAVE, + + /** + * @desc: Delete interface + * @message: Deleting interface configuration requires authorization + */ + VIR_ACCESS_PERM_INTERFACE_DELETE, + + /** + * @desc: Start interface + * @message: Starting interface requires authorization + */ + VIR_ACCESS_PERM_INTERFACE_START, + + /** + * @desc: Stop interface + * @message: Stopping interface requires authorization + */ + VIR_ACCESS_PERM_INTERFACE_STOP, + + VIR_ACCESS_PERM_INTERFACE_LAST +} virAccessPermInterface; + +typedef enum { + + /** + * @desc: Access network + * @message: Accessing network requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_NETWORK_GETATTR, + + /** + * @desc: Read network + * @message: Reading network configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_NETWORK_READ, + + /** + * @desc: Write network + * @message: Writing network configuration requries authorization + */ + VIR_ACCESS_PERM_NETWORK_WRITE, + + /** + * @desc: Save network + * @message: Saving network configuration requires authorization + */ + VIR_ACCESS_PERM_NETWORK_SAVE, + + /** + * @desc: Delete network + * @message: Deleting network configuration requires authorization + */ + VIR_ACCESS_PERM_NETWORK_DELETE, + + /** + * @desc: Start network + * @message: Starting network requires authorization + */ + VIR_ACCESS_PERM_NETWORK_START, + + /** + * @desc: Stop network + * @message: Stopping network requires authorization + */ + VIR_ACCESS_PERM_NETWORK_STOP, + + VIR_ACCESS_PERM_NETWORK_LAST +} virAccessPermNetwork; + +typedef enum { + + /** + * @desc: Access node device + * @message: Accesing node device requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_NODE_DEVICE_GETATTR, + + /** + * @desc: Read node device + * @message: Reading node device configuration requires authorization + */ + VIR_ACCESS_PERM_NODE_DEVICE_READ, + + /** + * @desc: Write node device + * @message: Writing node device configuration requires authorization + */ + VIR_ACCESS_PERM_NODE_DEVICE_WRITE, + + /** + * @desc: Start node device + * @message: Starting node device requires authorization + */ + VIR_ACCESS_PERM_NODE_DEVICE_START, + + /** + * @desc: Stop node device + * @message: Stopping node device requires authorization + */ + VIR_ACCESS_PERM_NODE_DEVICE_STOP, + + /** + * @desc: Detach node device + * @message: Detaching node device driver requires authorization + */ + VIR_ACCESS_PERM_NODE_DEVICE_DETTACH, + + VIR_ACCESS_PERM_NODE_DEVICE_LAST +} virAccessPermNodeDevice; + +typedef enum { + + /** + * @desc: Access network filter + * @message: Accessing network filter requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_NWFILTER_GETATTR, + + /** + * @desc: Read network filter + * @message: Reading network filter configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_NWFILTER_READ, + + /** + * @desc: Write network filter + * @message: Writing network filter configuration requires authorization + */ + VIR_ACCESS_PERM_NWFILTER_WRITE, + + /** + * @desc: Save network filter + * @message: Saving network filter configuration requires authorization + */ + VIR_ACCESS_PERM_NWFILTER_SAVE, + + /** + * @desc: Delete network filter + * @message: Deleting network filter configuration requires authorization + */ + VIR_ACCESS_PERM_NWFILTER_DELETE, + + VIR_ACCESS_PERM_NWFILTER_LAST +} virAccessPermNWFilter; + +typedef enum { + + /** + * @desc: Access secret + * @message: Accessing secret requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_SECRET_GETATTR, + + /** + * @desc: Read secret + * @message: Reading secret configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_SECRET_READ, + + /** + * @desc: Write secret + * @message: Writing secret configuration requires authorization + */ + VIR_ACCESS_PERM_SECRET_WRITE, + + /** + * @desc: Read secure secret + * @message: Reading secure secret configuration requires authorization + */ + VIR_ACCESS_PERM_SECRET_READ_SECURE, + + /** + * @desc: Save secret + * @message: Saving secret configuration requires authorization + */ + VIR_ACCESS_PERM_SECRET_SAVE, + + /** + * @desc: Delete secret + * @message: Deleting secret configuration requires authorization + */ + VIR_ACCESS_PERM_SECRET_DELETE, + + VIR_ACCESS_PERM_SECRET_LAST +} virAccessPermSecret; + +typedef enum { + + /** + * @desc: Access storage pool + * @message: Accessing storage pool requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_STORAGE_POOL_GETATTR, + + /** + * @desc: Read storage pool + * @message: Reading storage pool configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_STORAGE_POOL_READ, + + /** + * @desc: Write storage pool + * @message: Writing storage pool configuration requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_WRITE, + + /** + * @desc: Save storage pool + * @message: Saving storage pool configuration requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_SAVE, + + /** + * @desc: Delete storage pool + * @message: Deleting storage pool configuration requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_DELETE, + + /** + * @desc: Start storage pool + * @message: Starting storage pool configuration requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_START, + + /** + * @desc: Stop storage pool + * @message: Stopping storage pool configuration requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_STOP, + + /** + * @desc: Refresh storage pool + * @message: Refreshing storage pool volumes requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_REFRESH, + + /** + * @desc: List storage pool volumes + * @message: Listing storage pool volumes requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_SEARCH_STORAGE_VOLS, + + /** + * @desc: Format storage pool + * @message: Formatting storage pool data requires authorization + */ + VIR_ACCESS_PERM_STORAGE_POOL_FORMAT, + + VIR_ACCESS_PERM_STORAGE_POOL_LAST +} virAccessPermStoragePool; + +typedef enum { + + /** + * @desc: Access storage volume + * @message: Acceessing storage volume requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_STORAGE_VOL_GETATTR, + + /** + * @desc: Read storage volume + * @message: Reading storage volume configuration requires authorization + * @anonymous: 1 + */ + VIR_ACCESS_PERM_STORAGE_VOL_READ, + + /** + * @desc: Create storage volume + * @message: Creating storage volume requires authorization + */ + VIR_ACCESS_PERM_STORAGE_VOL_CREATE, + + /** + * @desc: Delete storage volume + * @message: Deleting storage volume requires authorization + */ + VIR_ACCESS_PERM_STORAGE_VOL_DELETE, + + /** + * @desc: Format storage volume + * @message: Formatting storage volume data requires authorization + */ + VIR_ACCESS_PERM_STORAGE_VOL_FORMAT, + + /** + * @desc: Resize storage volume + * @message: Resizing storage volume requires authorization + */ + VIR_ACCESS_PERM_STORAGE_VOL_RESIZE, + + /** + * @desc: Read storage volume data + * @message: Reading storage volume data requires authorization + */ + VIR_ACCESS_PERM_STORAGE_VOL_DATA_READ, + + /** + * @desc: Write storage volume data + * @message: Writing storage volume data requires authorization + */ + VIR_ACCESS_PERM_STORAGE_VOL_DATA_WRITE, + + VIR_ACCESS_PERM_STORAGE_VOL_LAST +} virAccessPermStorageVol; + +VIR_ENUM_DECL(virAccessPermConnect); +VIR_ENUM_DECL(virAccessPermDomain); +VIR_ENUM_DECL(virAccessPermInterface); +VIR_ENUM_DECL(virAccessPermNetwork); +VIR_ENUM_DECL(virAccessPermNodeDevice); +VIR_ENUM_DECL(virAccessPermNWFilter); +VIR_ENUM_DECL(virAccessPermSecret); +VIR_ENUM_DECL(virAccessPermStoragePool); +VIR_ENUM_DECL(virAccessPermStorageVol); + +#endif /* __VIR_ACCESS_PERM_H__ */ diff --git a/src/libvirt.c b/src/libvirt.c index 4087b5a..eee67d9 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -835,8 +835,10 @@ int virStateInitialize(bool privileged, if (virStateDriverTab[i]->stateInitialize(privileged, callback, opaque) < 0) { - VIR_ERROR(_("Initialization of %s state driver failed"), - virStateDriverTab[i]->name); + virErrorPtr err = virGetLastError(); + VIR_ERROR(_("Initialization of %s state driver failed: %s"), + virStateDriverTab[i]->name, + err && err->message ? err->message : _("Unknown problem")); return -1; } } diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index d2f5827..0edb68d 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -5,6 +5,43 @@ # Keep this file sorted by header name, then by symbols with each header. # +# access/viraccessmanager.h +virAccessManagerCheckConnect; +virAccessManagerCheckDomain; +virAccessManagerCheckInterface; +virAccessManagerCheckNetwork; +virAccessManagerCheckNodeDevice; +virAccessManagerCheckNWFilter; +virAccessManagerCheckSecret; +virAccessManagerCheckStoragePool; +virAccessManagerCheckStorageVol; +virAccessManagerGetDefault; +virAccessManagerNew; +virAccessManagerNewStack; +virAccessManagerSetDefault; + + +# access/viraccessperm.h +virAccessPermConnectTypeFromString; +virAccessPermConnectTypeToString; +virAccessPermDomainTypeFromString; +virAccessPermDomainTypeToString; +virAccessPermInterfaceTypeFromString; +virAccessPermInterfaceTypeToString; +virAccessPermNetworkTypeFromString; +virAccessPermNetworkTypeToString; +virAccessPermNodeDeviceTypeFromString; +virAccessPermNodeDeviceTypeToString; +virAccessPermNWFilterTypeFromString; +virAccessPermNWFilterTypeToString; +virAccessPermSecretTypeFromString; +virAccessPermSecretTypeToString; +virAccessPermStoragePoolTypeFromString; +virAccessPermStoragePoolTypeToString; +virAccessPermStorageVolTypeFromString; +virAccessPermStorageVolTypeToString; + + # conf/capabilities.h virCapabilitiesAddGuest; virCapabilitiesAddGuestDomain; diff --git a/src/util/virerror.c b/src/util/virerror.c index af4da8c..ec30a69 100644 --- a/src/util/virerror.c +++ b/src/util/virerror.c @@ -121,6 +121,8 @@ VIR_ENUM_IMPL(virErrorDomain, VIR_ERR_DOMAIN_LAST, "Init control", "Identity", "Cgroup", + + "Access Manager", /* 55 */ ) @@ -1216,6 +1218,12 @@ virErrorMsg(virErrorNumber error, const char *info) else errmsg = _("resource busy %s"); break; + case VIR_ERR_ACCESS_DENIED: + if (info == NULL) + errmsg = _("access denied"); + else + errmsg = _("access denied: %s"); + break; } return errmsg; } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Add a new 'access_drivers' config parameter to the libvirtd.conf configuration file. This allows admins to setup the default access control drivers to use for API authorization. The same driver is to be used by all internal drivers & APIs Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- daemon/Makefile.am | 1 + daemon/libvirtd-config.c | 4 ++++ daemon/libvirtd-config.h | 2 ++ daemon/libvirtd.aug | 1 + daemon/libvirtd.c | 27 +++++++++++++++++++++++++++ daemon/libvirtd.conf | 9 +++++++++ daemon/test_libvirtd.aug.in | 4 ++++ 7 files changed, 48 insertions(+) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 64126e5..201369a 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -11,6 +11,7 @@ INCLUDES = \ -I$(top_srcdir)/src/conf \ -I$(top_srcdir)/src/rpc \ -I$(top_srcdir)/src/remote \ + -I$(top_srcdir)/src/access \ $(GETTEXT_CPPFLAGS) CLEANFILES = diff --git a/daemon/libvirtd-config.c b/daemon/libvirtd-config.c index 1c57475..d56e09b 100644 --- a/daemon/libvirtd-config.c +++ b/daemon/libvirtd-config.c @@ -379,6 +379,10 @@ daemonConfigLoadOptions(struct daemonConfig *data, if (remoteConfigGetAuth(conf, "auth_tls", &data->auth_tls, filename) < 0) goto error; + if (remoteConfigGetStringList(conf, "access_drivers", + &data->access_drivers, filename) < 0) + goto error; + GET_CONF_STR(conf, filename, unix_sock_group); GET_CONF_STR(conf, filename, unix_sock_ro_perms); GET_CONF_STR(conf, filename, unix_sock_rw_perms); diff --git a/daemon/libvirtd-config.h b/daemon/libvirtd-config.h index 07118de..973e0ea 100644 --- a/daemon/libvirtd-config.h +++ b/daemon/libvirtd-config.h @@ -45,6 +45,8 @@ struct daemonConfig { int auth_tcp; int auth_tls; + char **access_drivers; + int mdns_adv; char *mdns_name; diff --git a/daemon/libvirtd.aug b/daemon/libvirtd.aug index f32b3a1..7c56a41 100644 --- a/daemon/libvirtd.aug +++ b/daemon/libvirtd.aug @@ -51,6 +51,7 @@ module Libvirtd = | bool_entry "tls_no_sanity_certificate" | str_array_entry "tls_allowed_dn_list" | str_array_entry "sasl_allowed_username_list" + | str_array_entry "access_drivers" let processing_entry = int_entry "min_workers" | int_entry "max_workers" diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 1ac8e30..e2ff750 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -52,8 +52,10 @@ #include "remote.h" #include "virhook.h" #include "viraudit.h" +#include "virstring.h" #include "locking/lock_manager.h" #include "virstring.h" +#include "viraccessmanager.h" #ifdef WITH_DRIVER_MODULES # include "driver.h" @@ -719,6 +721,26 @@ error: } +static int +daemonSetupAccessManager(struct daemonConfig *config) +{ + virAccessManagerPtr mgr; + const char *none[] = { "none", NULL }; + const char **driver = (const char **)config->access_drivers; + + if (!driver || + !driver[0]) + driver = none; + + if (!(mgr = virAccessManagerNewStack(driver))) + return -1; + + virAccessManagerSetDefault(mgr); + virObjectUnref(mgr); + return 0; +} + + /* Display version information. */ static void daemonVersion(const char *argv0) @@ -1251,6 +1273,11 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } + if (daemonSetupAccessManager(config) < 0) { + VIR_ERROR(_("Can't initialize access manager")); + exit(EXIT_FAILURE); + } + if (!pid_file && daemonPidFilePath(privileged, &pid_file) < 0) { diff --git a/daemon/libvirtd.conf b/daemon/libvirtd.conf index 47da520..75196a0 100644 --- a/daemon/libvirtd.conf +++ b/daemon/libvirtd.conf @@ -155,6 +155,15 @@ #auth_tls = "none" +# Change the API access control scheme +# +# By default an authenticated user is allowed access +# to all APIs. Access drivers can place restrictions +# on this. By default the 'nop' driver is enabled, +# meaning no access control checks are done once a +# client has authenticated with libvirtd +# +#access_drivers = [ "polkit", "selinux" ] ################################################################# # diff --git a/daemon/test_libvirtd.aug.in b/daemon/test_libvirtd.aug.in index 455b74a..9215337 100644 --- a/daemon/test_libvirtd.aug.in +++ b/daemon/test_libvirtd.aug.in @@ -17,6 +17,10 @@ module Test_libvirtd = { "auth_unix_rw" = "none" } { "auth_tcp" = "sasl" } { "auth_tls" = "none" } + { "access_drivers" + { "1" = "polkit" } + { "2" = "selinux" } + } { "key_file" = "/etc/pki/libvirt/private/serverkey.pem" } { "cert_file" = "/etc/pki/libvirt/servercert.pem" } { "ca_file" = "/etc/pki/CA/cacert.pem" } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Introduce an access control driver that uses the SELinux framework for validating API authorization. Each libvirt object is represented as a new class in SELinux policy, along with all permissions. The actual policy is not included here, it has to be part of the core SELinux policy dist, since you can't define new object classes/permissions in external loadable modules As well as going to the audit system, all SELinux AVC denials also get reported in libvirtd system logs Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- m4/virt-compile-warnings.m4 | 1 + m4/virt-selinux.m4 | 2 + po/POTFILES.in | 1 + src/Makefile.am | 9 + src/access/viraccessdriverselinux.c | 565 ++++++++++++++++++++++++++++++++++++ src/access/viraccessdriverselinux.h | 28 ++ src/access/viraccessmanager.c | 6 + src/internal.h | 4 + src/util/virlog.c | 3 +- src/util/virlog.h | 1 + 10 files changed, 619 insertions(+), 1 deletion(-) create mode 100644 src/access/viraccessdriverselinux.c create mode 100644 src/access/viraccessdriverselinux.h diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index e054913..05798d3 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -94,6 +94,7 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ dontwarn="$dontwarn -Wmissing-prototypes" dontwarn="$dontwarn -Wmissing-declarations" dontwarn="$dontwarn -Wcast-align" + dontwarn="$dontwarn -Wmissing-format-attribute" fi dnl Check whether strchr(s, char variable) causes a bogus compile diff --git a/m4/virt-selinux.m4 b/m4/virt-selinux.m4 index abb0d12..f849858 100644 --- a/m4/virt-selinux.m4 +++ b/m4/virt-selinux.m4 @@ -43,6 +43,8 @@ AC_DEFUN([LIBVIRT_CHECK_SELINUX],[ dnl We prefer to use <selinux/label.h> and selabel_open, but can fall dnl back to matchpathcon for the sake of RHEL 5's version of libselinux. AC_CHECK_HEADERS([selinux/label.h]) + + AC_CHECK_FUNCS([security_deny_unknown]) fi ]) diff --git a/po/POTFILES.in b/po/POTFILES.in index 02713c1..5723a0f 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -7,6 +7,7 @@ daemon/stream.c gnulib/lib/gai_strerror.c gnulib/lib/regcomp.c src/access/viraccessdriverpolkit.c +src/access/viraccessdriverselinux.c src/access/viraccessmanager.c src/conf/cpu_conf.c src/conf/device_conf.c diff --git a/src/Makefile.am b/src/Makefile.am index 3e6c3df..20ce083 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -782,6 +782,9 @@ ACCESS_DRIVER_SOURCES = \ ACCESS_DRIVER_POLKIT_SOURCES = \ access/viraccessdriverpolkit.h access/viraccessdriverpolkit.c +ACCESS_DRIVER_SELINUX_SOURCES = \ + access/viraccessdriverselinux.h access/viraccessdriverselinux.c + ACCESS_DRIVER_POLKIT_POLICY = \ access/org.libvirt.api.policy @@ -1368,6 +1371,12 @@ libvirt_driver_access_la_LIBADD = EXTRA_DIST += access/genpolkit.pl +if WITH_SELINUX +libvirt_driver_access_la_SOURCES += $(ACCESS_DRIVER_SELINUX_SOURCES) +else +EXTRA_DIST += $(ACCESS_DRIVER_SELINUX_SOURCES) +endif + if WITH_POLKIT1 libvirt_driver_access_la_SOURCES += $(ACCESS_DRIVER_POLKIT_SOURCES) diff --git a/src/access/viraccessdriverselinux.c b/src/access/viraccessdriverselinux.c new file mode 100644 index 0000000..235760d --- /dev/null +++ b/src/access/viraccessdriverselinux.c @@ -0,0 +1,565 @@ +/* + * viraccessdriverselinux.c: selinuxed access control driver + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> + +#include "viraccessdriverselinux.h" +#include "viralloc.h" +#include "vircommand.h" +#include "virlog.h" +#include "virthread.h" +#include "virerror.h" +#include "virutil.h" + +#include <selinux/selinux.h> +#include <selinux/avc.h> +#include <selinux/av_permissions.h> +#include <selinux/flask.h> + + +#define VIR_FROM_THIS VIR_FROM_ACCESS +#define virAccessError(code, ...) \ + virReportErrorHelper(VIR_FROM_THIS, code, __FILE__, \ + __FUNCTION__, __LINE__, __VA_ARGS__) + +typedef enum { + VIR_ACCESS_DRIVER_SELINUX_CLASS_CONNECT, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + + VIR_ACCESS_DRIVER_SELINUX_CLASS_LAST +} virAccessDriverSELinuxClass; + +VIR_ENUM_DECL(virAccessDriverSELinuxClass) +VIR_ENUM_IMPL(virAccessDriverSELinuxClass, + VIR_ACCESS_DRIVER_SELINUX_CLASS_LAST, + "vir_connect", + "vir_domain") + +static void virAccessDriverSELinuxAVCLog(const char *fmt, ...) ATTRIBUTE_FMT_PRINTF(1, 2); +static void virAccessDriverSELinuxAVCLogAudit(void *data, security_class_t class, char *buf, size_t bufleft); +static void *virAccessDriverSELinuxAVCCreateThread(void (*run)(void)); +static void virAccessDriverSELinuxAVCStopThread(void *thread); +static void *virAccessDriverSELinuxAVCAllocLock(void); +static void virAccessDriverSELinuxAVCGetLock(void *lock); +static void virAccessDriverSELinuxAVCReleaseLock(void *lock); +static void virAccessDriverSELinuxAVCFreeLock(void *lock); + + +/* AVC callback structures for use in avc_init. */ +static const struct avc_memory_callback virAccessDriverSELinuxAVCMemCallbacks = +{ + .func_malloc = malloc, + .func_free = free, +}; + +VIR_WARNINGS_NO_MISSING_FORMAT +static const struct avc_log_callback virAccessDriverSELinuxAVCLogCallbacks = +{ + .func_log = virAccessDriverSELinuxAVCLog, + .func_audit = virAccessDriverSELinuxAVCLogAudit, +}; +VIR_WARNINGS_RESET + +static const struct avc_thread_callback virAccessDriverSELinuxAVCThreadCallbacks = +{ + .func_create_thread = virAccessDriverSELinuxAVCCreateThread, + .func_stop_thread = virAccessDriverSELinuxAVCStopThread, +}; +static const struct avc_lock_callback virAccessDriverSELinuxAVCLockCallbacks = +{ + .func_alloc_lock = virAccessDriverSELinuxAVCAllocLock, + .func_get_lock = virAccessDriverSELinuxAVCGetLock, + .func_release_lock = virAccessDriverSELinuxAVCReleaseLock, + .func_free_lock = virAccessDriverSELinuxAVCFreeLock, +}; + + +typedef struct _virAccessDriverSELinuxPrivate virAccessDriverSELinuxPrivate; +typedef virAccessDriverSELinuxPrivate *virAccessDriverSELinuxPrivatePtr; + +struct _virAccessDriverSELinuxPrivate { + bool enabled; + + /* Cache for AVCs */ + struct avc_entry_ref aeref; + + /* SID of the daemon */ + security_id_t selfSid; +}; + + +static int virAccessDriverSELinuxSetup(virAccessManagerPtr manager) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int r; + security_context_t localCon; + int ret = -1; + + if ((r = is_selinux_enabled()) < 0) { + virReportSystemError(errno, "%s", + _("Unable to determine if SELinux is enabled")); + return -1; + } + priv->enabled = r != 0; + priv->selfSid = SECSID_WILD; + + avc_entry_ref_init(&priv->aeref); + + if (avc_init("avc", + &virAccessDriverSELinuxAVCMemCallbacks, + &virAccessDriverSELinuxAVCLogCallbacks, + &virAccessDriverSELinuxAVCThreadCallbacks, + &virAccessDriverSELinuxAVCLockCallbacks) < 0) { + virReportSystemError(errno, "%s", + _("Unable to initialize AVC system")); + goto cleanup; + } + + if (getcon(&localCon) < 0) { + virReportSystemError(errno, "%s", + _("Unable to get context of daemon")); + goto cleanup; + } + + if (avc_context_to_sid(localCon, &priv->selfSid) < 0) { + virReportSystemError(errno, + _("Unable to convert context %s to SID"), + (char*)localCon); + goto cleanup; + } + VIR_FREE(localCon); + + ret = 0; +cleanup: + if (ret < 0) + priv->selfSid = SECSID_WILD; + freecon(localCon); + return ret; +} + + +static void virAccessDriverSELinuxCleanup(virAccessManagerPtr manager) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + priv->selfSid = SECSID_WILD; +} + + +static security_id_t +virAccessDriverSELinuxGetClientSID(void) +{ + virIdentityPtr identity = virIdentityGetCurrent(); + const char *seccon = NULL; + security_id_t sid = SECSID_WILD; + + if (!identity) { + virAccessError(VIR_ERR_ACCESS_DENIED, "%s", + _("SELinux denying due to lack of identity")); + return NULL; + } + if (virIdentityGetAttr(identity, VIR_IDENTITY_ATTR_SELINUX_CONTEXT, &seccon) < 0) + goto cleanup; + + if (!seccon) { + virAccessError(VIR_ERR_INTERNAL_ERROR, "%s", + _("No security context available")); + goto cleanup; + } + + if (avc_context_to_sid((security_context_t)seccon, &sid) < 0) { + virReportSystemError(errno, + _("Unable to convert context %s to SID"), + seccon); + sid = SECSID_WILD; + goto cleanup; + } + +cleanup: + virObjectUnref(identity); + return sid; +} + + +static security_class_t +virAccessDriverSELinuxGetObjectClass(const char *klassname) +{ + security_class_t ret; + + if ((ret = string_to_security_class(klassname)) == 0) { + virReportSystemError(errno, + _("Unable to find security class '%s'"), klassname); + return 0; + } + + return ret; +} + + +static access_vector_t +virAccessDriverSELinuxGetObjectPerm(const char *permname, + const char *klassname, + security_class_t objectClass) +{ + access_vector_t ret; + + if (objectClass == 0) + return 0; + + if ((ret = string_to_av_perm(objectClass, permname)) == 0) { + virReportSystemError(errno, + _("Unable to lookup permission '%s' for class '%s'"), + permname, klassname); + return 0; + } + + return ret; +} + +static int +virAccessDriverSELinuxCheck(virAccessManagerPtr manager, + security_id_t objectSid, + virAccessDriverSELinuxClass klass, + const char *permname) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + const char *klassname = virAccessDriverSELinuxClassTypeToString(klass); + security_id_t clientSid = virAccessDriverSELinuxGetClientSID(); + security_class_t klassId = virAccessDriverSELinuxGetObjectClass(klassname); + access_vector_t perm = virAccessDriverSELinuxGetObjectPerm(permname, klassname, klassId); + int ret; + + if (clientSid == SECSID_WILD || + klassId == 0 || + perm == 0) { +#ifdef HAVE_SECURITY_DENY_UNKNOWN + if (security_deny_unknown() == 0) { + VIR_WARN("Allow access, because policy does not deny unknown objects"); + ret = 1; /* Allow */ + } else { + ret = 0; /* Deny */ + } +#else + ret = 0; /* Deny */ +#endif + goto cleanup; + } + + if (avc_has_perm(clientSid, objectSid, + klassId, perm, + &priv->aeref, NULL) < 0) { + int save_errno = errno; + if (security_getenforce() == 0) { + char ebuf[1024]; + VIR_WARN("Ignoring denial in non-enforcing mode: %s", + virStrerror(save_errno, ebuf, sizeof(ebuf))); + ret = 1; /* Allow */ + goto cleanup; + } + switch (save_errno) { + case EACCES: + ret = 0; /* Deny */ + break; + case EINVAL: + ret = -1; /* Error */ + virAccessError(VIR_ERR_ACCESS_DENIED, "%s", + _("SELinux denying due to invalid security context")); + break; + default: + ret = -1; /* Error */ + virReportSystemError(errno, "%s", + _("SELinux denying")); + break; + } + goto cleanup; + } + + ret = 1; + +cleanup: + return ret; +} + + +static int +virAccessDriverSELinuxCheckConnect(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virAccessPermConnect perm) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + /* There's no object to use for targetSid here, so we + * instead use the daemon's context as the targetSid */ + return virAccessDriverSELinuxCheck(manager, + priv->selfSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_CONNECT, + virAccessPermConnectTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckDomain(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virDomainDefPtr domain ATTRIBUTE_UNUSED, + virAccessPermDomain perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermDomainTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckInterface(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virInterfaceDefPtr iface ATTRIBUTE_UNUSED, + virAccessPermInterface perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermInterfaceTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckNetwork(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virNetworkDefPtr network ATTRIBUTE_UNUSED, + virAccessPermNetwork perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermNetworkTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckNodeDevice(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virNodeDeviceDefPtr nodedev ATTRIBUTE_UNUSED, + virAccessPermNodeDevice perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermNodeDeviceTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckNWFilter(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virNWFilterDefPtr nwfilter ATTRIBUTE_UNUSED, + virAccessPermNWFilter perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermNWFilterTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckSecret(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virSecretDefPtr secret ATTRIBUTE_UNUSED, + virAccessPermSecret perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermSecretTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckStoragePool(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virStoragePoolDefPtr pool ATTRIBUTE_UNUSED, + virAccessPermStoragePool perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermStoragePoolTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckStorageVol(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virStoragePoolDefPtr pool ATTRIBUTE_UNUSED, + virStorageVolDefPtr vol ATTRIBUTE_UNUSED, + virAccessPermStorageVol perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermStorageVolTypeToString(perm)); +} + + +static void virAccessDriverSELinuxAVCLog(const char *fmt, ...) +{ + va_list ap; + va_start(ap, fmt); + virLogVMessage(VIR_LOG_FROM_ACCESS, VIR_LOG_WARN, + __FILE__, __LINE__ ,__func__, + NULL, fmt, ap); + va_end(ap); +} + + +static void virAccessDriverSELinuxAVCLogAudit(void *data ATTRIBUTE_UNUSED, + security_class_t class ATTRIBUTE_UNUSED, + char *buf ATTRIBUTE_UNUSED, + size_t bufleft ATTRIBUTE_UNUSED) +{ +} + + +static void *virAccessDriverSELinuxAVCCreateThread(void (*run)(void)) +{ + virThreadPtr thread; + + if (VIR_ALLOC(thread) < 0) { + virReportOOMError(); + return NULL; + } + + if (virThreadCreate(thread, false, (virThreadFunc)run, NULL) < 0) { + virReportSystemError(errno, "%s", + _("Unable to create thread")); + VIR_FREE(thread); + } + + return thread; +} + + +static void virAccessDriverSELinuxAVCStopThread(void *thread) +{ + virThreadCancel(thread); + VIR_FREE(thread); +} + + +static void *virAccessDriverSELinuxAVCAllocLock(void) +{ + virMutexPtr lock; + if (VIR_ALLOC(lock) < 0) { + virReportOOMError(); + return NULL; + } + if (virMutexInit(lock) < 0) { + virReportSystemError(errno, "%s", + _("Unable to initialize mutex")); + VIR_FREE(lock); + return NULL; + } + return lock; +} + + +static void virAccessDriverSELinuxAVCGetLock(void *lock) +{ + virMutexLock(lock); +} + + +static void virAccessDriverSELinuxAVCReleaseLock(void *lock) +{ + virMutexUnlock(lock); +} + + +static void virAccessDriverSELinuxAVCFreeLock(void *lock) +{ + virMutexDestroy(lock); + VIR_FREE(lock); +} + + +virAccessDriver accessDriverSELinux = { + .privateDataLen = sizeof(virAccessDriverSELinuxPrivate), + .name = "selinux", + .setup = virAccessDriverSELinuxSetup, + .cleanup = virAccessDriverSELinuxCleanup, + .checkConnect = virAccessDriverSELinuxCheckConnect, + .checkDomain = virAccessDriverSELinuxCheckDomain, + .checkInterface = virAccessDriverSELinuxCheckInterface, + .checkNetwork = virAccessDriverSELinuxCheckNetwork, + .checkNodeDevice = virAccessDriverSELinuxCheckNodeDevice, + .checkNWFilter = virAccessDriverSELinuxCheckNWFilter, + .checkSecret = virAccessDriverSELinuxCheckSecret, + .checkStoragePool = virAccessDriverSELinuxCheckStoragePool, + .checkStorageVol = virAccessDriverSELinuxCheckStorageVol, +}; diff --git a/src/access/viraccessdriverselinux.h b/src/access/viraccessdriverselinux.h new file mode 100644 index 0000000..e2b26e2 --- /dev/null +++ b/src/access/viraccessdriverselinux.h @@ -0,0 +1,28 @@ +/* + * viraccessdriverselinux.h: selinuxed access control driver + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#ifndef __VIR_ACCESS_DRIVER_SELINUX_H__ +# define __VIR_ACCESS_DRIVER_SELINUX_H__ + +# include "viraccessdriver.h" + +extern virAccessDriver accessDriverSELinux; + +#endif /* __VIR_ACCESS_DRIVER_SELINUX_H__ */ diff --git a/src/access/viraccessmanager.c b/src/access/viraccessmanager.c index f8c0cae..71c3470 100644 --- a/src/access/viraccessmanager.c +++ b/src/access/viraccessmanager.c @@ -26,6 +26,9 @@ #if WITH_POLKIT1 # include "viraccessdriverpolkit.h" #endif +#if WITH_SELINUX +# include "viraccessdriverselinux.h" +#endif #include "viralloc.h" #include "virerror.h" #include "virobject.h" @@ -114,6 +117,9 @@ static virAccessDriverPtr accessDrivers[] = { #if WITH_POLKIT1 &accessDriverPolkit, #endif +#if WITH_SELINUX + &accessDriverSELinux, +#endif }; diff --git a/src/internal.h b/src/internal.h index d819aa3..9b56fa2 100644 --- a/src/internal.h +++ b/src/internal.h @@ -219,11 +219,15 @@ # define VIR_WARNINGS_NO_CAST_ALIGN \ _Pragma ("GCC diagnostic push") \ _Pragma ("GCC diagnostic ignored \"-Wcast-align\"") +# define VIR_WARNINGS_NO_MISSING_FORMAT \ + _Pragma ("GCC diagnostic push") \ + _Pragma ("GCC diagnostic ignored \"-Wmissing-format-attribute\"") # define VIR_WARNINGS_RESET \ _Pragma ("GCC diagnostic pop") # else # define VIR_WARNINGS_NO_CAST_ALIGN +# define VIR_WARNINGS_NO_MISSING_FORMAT # define VIR_WARNINGS_RESET # endif diff --git a/src/util/virlog.c b/src/util/virlog.c index 62ff838..152191c 100644 --- a/src/util/virlog.c +++ b/src/util/virlog.c @@ -66,7 +66,8 @@ VIR_ENUM_IMPL(virLogSource, VIR_LOG_FROM_LAST, "error", "audit", "trace", - "library"); + "library", + "access"); /* * A logging buffer to keep some history over logs diff --git a/src/util/virlog.h b/src/util/virlog.h index 6b83245..08d12c0 100644 --- a/src/util/virlog.h +++ b/src/util/virlog.h @@ -50,6 +50,7 @@ typedef enum { VIR_LOG_FROM_AUDIT, VIR_LOG_FROM_TRACE, VIR_LOG_FROM_LIBRARY, + VIR_LOG_FROM_ACCESS, VIR_LOG_FROM_LAST, } virLogSource; -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Extend the 'gendispatch.pl' script to be able to generate three new types of file. - 'aclheader' - defines signatures of helper APIs for doing authorization checks. There is one helper API for each API requiring an auth check. Any @acl annotations result in a method being generated with a suffix of 'EnsureACL'. If the ACL check requires examination of flags, an extra 'flags' param will be present. Some examples extern int virConnectBaselineCPUEnsureACL(void); extern int virConnectDomainEventDeregisterEnsureACL(virDomainDefPtr domain); extern int virDomainAttachDeviceFlagsEnsureACL(virDomainDefPtr domain, unsigned int flags); Any @aclfilter annotations resuilt in a method being generated with a suffix of 'CheckACL'. extern int virConnectListAllDomainsCheckACL(virDomainDefPtr domain); These are used for filtering individual objects from APIs which return a list of objects - 'aclbody' - defines the actual implementation of the methods described above. This calls into the access manager APIs. A complex example: /* Returns: -1 on error (denied==error), 0 on allowed */ int virDomainAttachDeviceFlagsEnsureACL(virConnectPtr conn, virDomainDefPtr domain, unsigned int flags) { virAccessManagerPtr mgr; int rv; if (!(mgr = virAccessManagerGetDefault())) return -1; if ((rv = virAccessManagerCheckDomain(mgr, conn->driver->name, domain, VIR_ACCESS_PERM_DOMAIN_WRITE)) <= 0) { if (rv == 0) virReportError(VIR_ERR_ACCESS_DENIED, NULL); return -1; } if (((flags & (VIR_DOMAIN_AFFECT_CONFIG|VIR_DOMAIN_AFFECT_LIVE)) == 0) && (rv = virAccessManagerCheckDomain(mgr, conn->driver->name, domain, VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) { if (rv == 0) virReportError(VIR_ERR_ACCESS_DENIED, NULL); return -1; } if (((flags & (VIR_DOMAIN_AFFECT_CONFIG)) == (VIR_DOMAIN_AFFECT_CONFIG)) && (rv = virAccessManagerCheckDomain(mgr, conn->driver->name, domain, VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) { if (rv == 0) virReportError(VIR_ERR_ACCESS_DENIED, NULL); return -1; } return 0; } - 'aclsyms' - generates a linker script to export the APIs to drivers. Some examples virConnectBaselineCPUEnsureACL; virConnectCompareCPUEnsureACL; Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- .gitignore | 9 +++ src/Makefile.am | 55 ++++++++++++- src/rpc/gendispatch.pl | 210 ++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 269 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 76ee420..2deeccf 100644 --- a/.gitignore +++ b/.gitignore @@ -105,10 +105,19 @@ /sc_* /src/.*.stamp /src/access/org.libvirt.api.policy +/src/access/viraccessapicheck.c +/src/access/viraccessapicheck.h +/src/access/viraccessapichecklxc.c +/src/access/viraccessapichecklxc.h +/src/access/viraccessapicheckqemu.c +/src/access/viraccessapicheckqemu.h /src/esx/*.generated.* /src/hyperv/*.generated.* /src/libvirt*.def /src/libvirt.syms +/src/libvirt_access.syms +/src/libvirt_access_lxc.syms +/src/libvirt_access_qemu.syms /src/libvirt_*.stp /src/libvirt_*helper /src/libvirt_*probes.h diff --git a/src/Makefile.am b/src/Makefile.am index 20ce083..93af8fd 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -771,6 +771,15 @@ SECURITY_DRIVER_SELINUX_SOURCES = \ SECURITY_DRIVER_APPARMOR_SOURCES = \ security/security_apparmor.h security/security_apparmor.c +ACCESS_DRIVER_GENERATED = \ + access/viraccessapicheck.h access/viraccessapicheck.c \ + access/viraccessapicheckqemu.h access/viraccessapicheckqemu.c \ + access/viraccessapichecklxc.h access/viraccessapichecklxc.c + +ACCESS_DRIVER_SYMFILES = \ + libvirt_access.syms \ + libvirt_access_qemu.syms \ + libvirt_access_lxc.syms ACCESS_DRIVER_SOURCES = \ access/viraccessperm.h access/viraccessperm.c \ @@ -1361,7 +1370,7 @@ libvirt_security_manager_la_SOURCES += $(SECURITY_DRIVER_APPARMOR_SOURCES) libvirt_security_manager_la_CFLAGS += $(APPARMOR_CFLAGS) endif -libvirt_driver_access_la_SOURCES = $(ACCESS_DRIVER_SOURCES) +libvirt_driver_access_la_SOURCES = $(ACCESS_DRIVER_SOURCES) $(ACCESS_DRIVER_GENERATED) noinst_LTLIBRARIES += libvirt_driver_access.la libvirt_la_BUILT_LIBADD += libvirt_driver_access.la libvirt_driver_access_la_CFLAGS = \ @@ -1394,6 +1403,50 @@ EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) endif +USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) +BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) +CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) + +libvirt_access.syms: $(srcdir)/rpc/gendispatch.pl \ + $(REMOTE_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ + remote REMOTE $(REMOTE_PROTOCOL) > $@ +libvirt_access_qemu.syms: $(srcdir)/rpc/gendispatch.pl \ + $(QEMU_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ + qemu QEMU $(QEMU_PROTOCOL) > $@ +libvirt_access_lxc.syms: $(srcdir)/rpc/gendispatch.pl \ + $(LXC_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ + lxc LXC $(LXC_PROTOCOL) > $@ + +access/viraccessapicheck.h: $(srcdir)/rpc/gendispatch.pl \ + $(REMOTE_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ + remote REMOTE $(REMOTE_PROTOCOL) > $@ +access/viraccessapicheck.c: $(srcdir)/rpc/gendispatch.pl \ + $(REMOTE_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ + remote REMOTE $(REMOTE_PROTOCOL) access/viraccessapicheck.h > $@ + +access/viraccessapicheckqemu.h: $(srcdir)/rpc/gendispatch.pl \ + $(QEMU_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ + qemu QEMU $(QEMU_PROTOCOL) > $@ +access/viraccessapicheckqemu.c: $(srcdir)/rpc/gendispatch.pl \ + $(QEMU_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ + qemu QEMU $(QEMU_PROTOCOL) access/viraccessapicheckqemu.h > $@ + +access/viraccessapichecklxc.h: $(srcdir)/rpc/gendispatch.pl \ + $(LXC_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ + lxc LXC $(LXC_PROTOCOL) > $@ +access/viraccessapichecklxc.c: $(srcdir)/rpc/gendispatch.pl \ + $(LXC_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ + lxc LXC $(LXC_PROTOCOL) access/viraccessapichecklxc.h > $@ + # Add all conditional sources just in case... EXTRA_DIST += \ $(TEST_DRIVER_SOURCES) \ diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl index 0bf76da..1179420 100755 --- a/src/rpc/gendispatch.pl +++ b/src/rpc/gendispatch.pl @@ -24,8 +24,9 @@ my $res = GetOptions("mode=s" => \$mode); die "cannot parse command line options" unless $res; -die "unknown mode '$mode', expecting 'client', 'server' or 'debug'" - unless $mode =~ /^(client|server|debug)$/; +die "unknown mode '$mode', expecting 'client', 'server', " . + "'aclheader', 'aclbody', 'aclsym' or 'debug'" + unless $mode =~ /^(client|server|aclheader|aclbody|aclsym|debug)$/; my $structprefix = shift or die "missing struct prefix argument"; my $procprefix = shift or die "missing procedure prefix argument"; @@ -108,7 +109,13 @@ while (<PROTOCOL>) { } } elsif ($collect_opts) { if (m,^\s*\*\s*\@(\w+)\s*:\s*((?:\w|:|\!|\|)+)\s*$,) { - $opts{$1} = $2; + if ($1 eq "acl" || + $1 eq "aclfilter") { + $opts{$1} = [] unless exists $opts{$1}; + push @{$opts{$1}}, $2; + } else { + $opts{$1} = $2; + } } elsif (m,^\s*\*/\s*$,) { $collect_opts = 0; } elsif (m,^\s*\*\s*$,) { @@ -235,6 +242,8 @@ while (<PROTOCOL>) { $calls{$name}->{streamflag} = "none"; } + $calls{$name}->{acl} = $opts{acl}; + $calls{$name}->{aclfilter} = $opts{aclfilter}; # for now, we distinguish only two levels of priority: # low (0) and high (1) @@ -321,11 +330,18 @@ sub hyper_to_long #---------------------------------------------------------------------- # Output -print <<__EOF__; +if ($mode eq "aclsym") { + print <<__EOF__; +# Automatically generated by gendispatch.pl. +# Do not edit this file. Any changes you make will be lost. +__EOF__ +} else { + print <<__EOF__; /* Automatically generated by gendispatch.pl. * Do not edit this file. Any changes you make will be lost. */ __EOF__ +} # Debugging. if ($mode eq "debug") { @@ -1617,4 +1633,190 @@ elsif ($mode eq "client") { print " return rv;\n"; print "}\n"; } +} elsif ($mode eq "aclheader" || + $mode eq "aclbody" || + $mode eq "aclsym") { + my %generate = map { $_ => 1 } @autogen; + my @keys = keys %calls; + + if ($mode eq "aclsym") { + @keys = sort { my $c = $a . "ensureacl"; + my $d = $b . "ensureacl"; + $c cmp $d } @keys; + } else { + @keys = sort { $a cmp $b } @keys; + } + + if ($mode eq "aclheader") { + my @headers = ( + "internal.h", + "domain_conf.h", + "network_conf.h", + "secret_conf.h", + "storage_conf.h", + "nwfilter_conf.h", + "node_device_conf.h", + "interface_conf.h" + ); + foreach my $hdr (@headers) { + print "#include \"$hdr\"\n"; + } + } elsif ($mode eq "aclbody") { + my $header = shift; + print "#include <config.h>\n"; + print "#include \"$header\"\n"; + print "#include \"access/viraccessmanager.h\"\n"; + print "#include \"datatypes.h\"\n"; + print "#include \"virerror.h\"\n"; + print "\n"; + print "#define VIR_FROM_THIS VIR_FROM_ACCESS\n"; + } + print "\n"; + + foreach (@keys) { + my $call = $calls{$_}; + + die "missing 'acl' option for $call->{ProcName}" + unless exists $call->{acl} && + $#{$call->{acl}} != -1; + + next if $call->{acl}->[0] eq "none"; + + if ($mode eq "aclsym") { + my $apiname = "vir" . $call->{ProcName}; + if ($structprefix eq "qemu") { + $apiname =~ s/virDomain/virDomainQemu/; + } elsif ($structprefix eq "lxc") { + $apiname =~ s/virDomain/virDomainLxc/; + } + if (defined $call->{aclfilter}) { + print $apiname . "CheckACL;\n"; + } + print $apiname . "EnsureACL;\n"; + } else { + &generate_acl($call, $call->{acl}, "Ensure"); + if (defined $call->{aclfilter}) { + &generate_acl($call, $call->{aclfilter}, "Check"); + } + } + + sub generate_acl { + my $call = shift; + my $acl = shift; + my $action = shift; + + my @acl; + foreach (@{$acl}) { + my @bits = split /:/; + push @acl, { object => $bits[0], perm => $bits[1], flags => $bits[2] } + } + + my $checkflags = 0; + for (my $i = 1 ; $i <= $#acl ; $i++) { + if ($acl[$i]->{object} ne $acl[0]->{object}) { + die "acl for '$call->{ProcName}' cannot check different objects"; + } + if (defined $acl[$i]->{flags}) { + $checkflags = 1; + } + } + + my $apiname = "vir" . $call->{ProcName}; + if ($structprefix eq "qemu") { + $apiname =~ s/virDomain/virDomainQemu/; + } elsif ($structprefix eq "lxc") { + $apiname =~ s/virDomain/virDomainLxc/; + } + + my $object = $acl[0]->{object}; + my $arg = $acl[0]->{object}; + $arg =~ s/^.*_(\w+)$/$1/; + $object =~ s/^(\w)/uc $1/e; + $object =~ s/_(\w)/uc $1/e; + $object =~ s/Nwfilter/NWFilter/; + my $objecttype = "vir" . $object . "DefPtr"; + $apiname .= $action . "ACL"; + + if ($arg eq "interface") { + $arg = "iface"; + } + + my @argdecls; + push @argdecls, "virConnectPtr conn"; + if ($object ne "Connect") { + if ($object eq "StorageVol") { + push @argdecls, "virStoragePoolDefPtr pool"; + } + push @argdecls, "$objecttype $arg"; + } + if ($checkflags) { + push @argdecls, "unsigned int flags"; + } + + if ($mode eq "aclheader") { + print "extern int $apiname(" . join(", ", @argdecls) . ");\n"; + } else { + my @argvars; + push @argvars, "mgr"; + push @argvars, "conn->driver->name"; + if ($object ne "Connect") { + if ($object eq "StorageVol") { + push @argvars, "pool"; + } + push @argvars, $arg; + } + + if ($action eq "Check") { + print "/* Returns: -1 on error, 0 on denied, 1 on allowed */\n"; + } else { + print "/* Returns: -1 on error (denied==error), 0 on allowed */\n"; + } + print "int $apiname(" . join(", ", @argdecls) . ")\n"; + print "{\n"; + print " virAccessManagerPtr mgr;\n"; + print " int rv;\n"; + print "\n"; + print " if (!(mgr = virAccessManagerGetDefault()))\n"; + print " return -1;\n"; + print "\n"; + + foreach my $acl (@acl) { + my $perm = "vir_access_perm_" . $acl->{object} . "_" . $acl->{perm}; + $perm =~ tr/a-z/A-Z/; + + my $method = "virAccessManagerCheck" . $object; + my $space = ' ' x length($method); + print " if ("; + if (defined $acl->{flags}) { + my $flags = $acl->{flags}; + if ($flags =~ /^\!/) { + $flags = substr $flags, 1; + print "((flags & ($flags)) == 0) &&\n"; + } else { + print "((flags & ($flags)) == ($flags)) &&\n"; + } + print " "; + } + print "(rv = $method(" . join(", ", @argvars, $perm) . ")) <= 0) {\n"; + if ($action eq "Ensure") { + print " if (rv == 0)\n"; + print " virReportError(VIR_ERR_ACCESS_DENIED, NULL);\n"; + print " return -1;\n"; + } else { + print " return rv;\n"; + } + print " }"; + print "\n"; + } + + if ($action eq "Check") { + print " return 1;\n"; + } else { + print " return 0;\n"; + } + print "}\n\n"; + } + } + } } + -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Insert calls to the ACL checking APIs in all LXC driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/lxc/lxc_driver.c | 219 ++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 207 insertions(+), 12 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 997f81d..e590612 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -68,6 +68,8 @@ #include "virtypedparam.h" #include "viruri.h" #include "virstring.h" +#include "access/viraccessapicheck.h" +#include "access/viraccessapichecklxc.h" #define VIR_FROM_THIS VIR_FROM_LXC @@ -148,6 +150,9 @@ static virDrvOpenStatus lxcConnectOpen(virConnectPtr conn, } } + if (virConnectOpenEnsureACL(conn) < 0) + return VIR_DRV_OPEN_ERROR; + conn->privateData = lxc_driver; return VIR_DRV_OPEN_SUCCESS; @@ -190,6 +195,9 @@ static char *lxcConnectGetCapabilities(virConnectPtr conn) { virLXCDriverPtr driver = conn->privateData; char *xml; + if (virConnectGetCapabilitiesEnsureACL(conn) < 0) + return NULL; + lxcDriverLock(driver); if ((xml = virCapabilitiesFormatXML(driver->caps)) == NULL) virReportOOMError(); @@ -216,6 +224,9 @@ static virDomainPtr lxcDomainLookupByID(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -245,6 +256,9 @@ static virDomainPtr lxcDomainLookupByUUID(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByUUIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -271,6 +285,9 @@ static virDomainPtr lxcDomainLookupByName(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByNameEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -298,6 +315,10 @@ static int lxcDomainIsActive(virDomainPtr dom) _("No domain with matching uuid '%s'"), uuidstr); goto cleanup; } + + if (virDomainIsActiveEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = virDomainObjIsActive(obj); cleanup: @@ -323,6 +344,10 @@ static int lxcDomainIsPersistent(virDomainPtr dom) _("No domain with matching uuid '%s'"), uuidstr); goto cleanup; } + + if (virDomainIsPersistentEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = obj->persistent; cleanup: @@ -347,6 +372,10 @@ static int lxcDomainIsUpdated(virDomainPtr dom) _("No domain with matching uuid '%s'"), uuidstr); goto cleanup; } + + if (virDomainIsUpdatedEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = obj->updated; cleanup: @@ -359,6 +388,9 @@ static int lxcConnectListDomains(virConnectPtr conn, int *ids, int nids) { virLXCDriverPtr driver = conn->privateData; int n; + if (virConnectListDomainsEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); n = virDomainObjListGetActiveIDs(driver->domains, ids, nids); lxcDriverUnlock(driver); @@ -370,6 +402,9 @@ static int lxcConnectNumOfDomains(virConnectPtr conn) { virLXCDriverPtr driver = conn->privateData; int n; + if (virConnectNumOfDomainsEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); n = virDomainObjListNumOfDomains(driver->domains, 1); lxcDriverUnlock(driver); @@ -382,6 +417,9 @@ static int lxcConnectListDefinedDomains(virConnectPtr conn, virLXCDriverPtr driver = conn->privateData; int n; + if (virConnectListDefinedDomainsEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); n = virDomainObjListGetInactiveNames(driver->domains, names, nnames); lxcDriverUnlock(driver); @@ -394,6 +432,9 @@ static int lxcConnectNumOfDefinedDomains(virConnectPtr conn) { virLXCDriverPtr driver = conn->privateData; int n; + if (virConnectNumOfDefinedDomainsEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); n = virDomainObjListNumOfDomains(driver->domains, 0); lxcDriverUnlock(driver); @@ -418,6 +459,9 @@ static virDomainPtr lxcDomainDefineXML(virConnectPtr conn, const char *xml) VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; @@ -482,6 +526,9 @@ static int lxcDomainUndefineFlags(virDomainPtr dom, goto cleanup; } + if (virDomainUndefineFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Cannot undefine transient domain")); @@ -541,6 +588,9 @@ static int lxcDomainGetInfo(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + info->state = virDomainObjGetState(vm, NULL); if (!virDomainObjIsActive(vm)) { @@ -599,6 +649,9 @@ lxcDomainGetState(virDomainPtr dom, goto cleanup; } + if (virDomainGetStateEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *state = virDomainObjGetState(vm, reason); ret = 0; @@ -626,7 +679,11 @@ static char *lxcDomainGetOSType(virDomainPtr dom) goto cleanup; } - ignore_value(VIR_STRDUP(ret, vm->def->os.type)); + if (virDomainGetOSTypeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + + if (VIR_STRDUP(ret, vm->def->os.type) < 0) + goto cleanup; cleanup: if (vm) @@ -654,6 +711,9 @@ lxcDomainGetMaxMemory(virDomainPtr dom) goto cleanup; } + if (virDomainGetMaxMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = vm->def->mem.max_balloon; cleanup: @@ -679,6 +739,9 @@ static int lxcDomainSetMaxMemory(virDomainPtr dom, unsigned long newmax) { goto cleanup; } + if (virDomainSetMaxMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (newmax < vm->def->mem.cur_balloon) { virReportError(VIR_ERR_INVALID_ARG, "%s", _("Cannot set max memory lower than current memory")); @@ -712,6 +775,9 @@ static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) { } priv = vm->privateData; + if (virDomainSetMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (newmem > vm->def->mem.max_balloon) { virReportError(VIR_ERR_INVALID_ARG, "%s", _("Cannot set memory higher than max memory")); @@ -774,6 +840,9 @@ lxcDomainSetMemoryParameters(virDomainPtr dom, } priv = vm->privateData; + if (virDomainSetMemoryParametersEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + ret = 0; for (i = 0; i < nparams; i++) { virTypedParameterPtr param = ¶ms[i]; @@ -837,6 +906,9 @@ lxcDomainGetMemoryParameters(virDomainPtr dom, } priv = vm->privateData; + if (virDomainGetMemoryParametersEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if ((*nparams) == 0) { /* Current number of memory parameters supported by cgroups */ *nparams = LXC_NB_MEM_PARAM; @@ -923,6 +995,9 @@ static char *lxcDomainGetXMLDesc(virDomainPtr dom, goto cleanup; } + if (virDomainGetXMLDescEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + ret = virDomainDefFormat((flags & VIR_DOMAIN_XML_INACTIVE) && vm->newDef ? vm->newDef : vm->def, flags); @@ -961,6 +1036,9 @@ static int lxcDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainCreateWithFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if ((vm->def->nets != NULL) && !(driver->have_netns)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("System lacks NETNS support")); @@ -1036,6 +1114,9 @@ lxcDomainCreateXML(virConnectPtr conn, VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; @@ -1101,6 +1182,9 @@ static int lxcDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr secla goto cleanup; } + if (virDomainGetSecurityLabelEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainVirtTypeToString(vm->def->virtType)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("unknown virt type in domain definition '%d'"), @@ -1157,6 +1241,9 @@ static int lxcNodeGetSecurityModel(virConnectPtr conn, lxcDriverLock(driver); memset(secmodel, 0, sizeof(*secmodel)); + if (virNodeGetSecurityModelEnsureACL(conn) < 0) + goto cleanup; + /* we treat no driver as success, but simply return no data in *secmodel */ if (driver->caps->host.nsecModels == 0 || driver->caps->host.secModels[0].model == NULL) @@ -1195,6 +1282,9 @@ lxcConnectDomainEventRegister(virConnectPtr conn, virLXCDriverPtr driver = conn->privateData; int ret; + if (virConnectDomainEventRegisterEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); ret = virDomainEventStateRegister(conn, driver->domainEventState, @@ -1212,6 +1302,9 @@ lxcConnectDomainEventDeregister(virConnectPtr conn, virLXCDriverPtr driver = conn->privateData; int ret; + if (virConnectDomainEventDeregisterEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); ret = virDomainEventStateDeregister(conn, driver->domainEventState, @@ -1233,6 +1326,9 @@ lxcConnectDomainEventRegisterAny(virConnectPtr conn, virLXCDriverPtr driver = conn->privateData; int ret; + if (virConnectDomainEventRegisterAnyEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); if (virDomainEventStateRegisterID(conn, driver->domainEventState, @@ -1252,6 +1348,9 @@ lxcConnectDomainEventDeregisterAny(virConnectPtr conn, virLXCDriverPtr driver = conn->privateData; int ret; + if (virConnectDomainEventDeregisterAnyEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); ret = virDomainEventStateDeregisterID(conn, driver->domainEventState, @@ -1293,6 +1392,9 @@ lxcDomainDestroyFlags(virDomainPtr dom, goto cleanup; } + if (virDomainDestroyFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -1544,12 +1646,15 @@ static int lxcStateCleanup(void) } -static int lxcConnectGetVersion(virConnectPtr conn ATTRIBUTE_UNUSED, unsigned long *version) +static int lxcConnectGetVersion(virConnectPtr conn, unsigned long *version) { struct utsname ver; uname(&ver); + if (virConnectGetVersionEnsureACL(conn) < 0) + return -1; + if (virParseVersionString(ver.release, version, true) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Unknown release: %s"), ver.release); return -1; @@ -1559,8 +1664,11 @@ static int lxcConnectGetVersion(virConnectPtr conn ATTRIBUTE_UNUSED, unsigned lo } -static char *lxcConnectGetHostname(virConnectPtr conn ATTRIBUTE_UNUSED) +static char *lxcConnectGetHostname(virConnectPtr conn) { + if (virConnectGetHostnameEnsureACL(conn) < 0) + return NULL; + return virGetHostname(); } @@ -1617,6 +1725,9 @@ static char *lxcDomainGetSchedulerType(virDomainPtr dom, } priv = vm->privateData; + if (virDomainGetSchedulerTypeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_CPU)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cgroup CPU controller is not mounted")); @@ -1753,6 +1864,9 @@ lxcDomainSetSchedulerParametersFlags(virDomainPtr dom, } priv = vm->privateData; + if (virDomainSetSchedulerParametersFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainLiveConfigHelperMethod(driver->caps, driver->xmlopt, vm, &flags, &vmdef) < 0) goto cleanup; @@ -1882,6 +1996,9 @@ lxcDomainGetSchedulerParametersFlags(virDomainPtr dom, } priv = vm->privateData; + if (virDomainGetSchedulerParametersFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (*nparams > 1) { rc = lxcGetCpuBWStatus(priv->cgroup); if (rc < 0) @@ -1996,6 +2113,9 @@ lxcDomainSetBlkioParameters(virDomainPtr dom, } priv = vm->privateData; + if (virDomainSetBlkioParametersEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainLiveConfigHelperMethod(driver->caps, driver->xmlopt, vm, &flags, &persistentDef) < 0) goto cleanup; @@ -2088,6 +2208,9 @@ lxcDomainGetBlkioParameters(virDomainPtr dom, } priv = vm->privateData; + if (virDomainGetBlkioParametersEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if ((*nparams) == 0) { /* Current number of blkio parameters supported by cgroups */ *nparams = LXC_NB_BLKIO_PARAM; @@ -2184,6 +2307,9 @@ lxcDomainInterfaceStats(virDomainPtr dom, goto cleanup; } + if (virDomainInterfaceStatsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -2239,6 +2365,9 @@ static int lxcDomainGetAutostart(virDomainPtr dom, goto cleanup; } + if (virDomainGetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *autostart = vm->autostart; ret = 0; @@ -2266,6 +2395,9 @@ static int lxcDomainSetAutostart(virDomainPtr dom, goto cleanup; } + if (virDomainSetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Cannot set autostart for transient domain")); @@ -2427,6 +2559,9 @@ static int lxcDomainSuspend(virDomainPtr dom) goto cleanup; } + if (virDomainSuspendEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -2480,6 +2615,9 @@ static int lxcDomainResume(virDomainPtr dom) priv = vm->privateData; + if (virDomainResumeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -2537,6 +2675,9 @@ lxcDomainOpenConsole(virDomainPtr dom, goto cleanup; } + if (virDomainOpenConsoleEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -2617,6 +2758,9 @@ lxcDomainSendProcessSignal(virDomainPtr dom, } priv = vm->privateData; + if (virDomainSendProcessSignalEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -2672,6 +2816,9 @@ lxcConnectListAllDomains(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_DOMAINS_FILTERS_ALL, -1); + if (virConnectListAllDomainsEnsureACL(conn) < 0) + return -1; + lxcDriverLock(driver); ret = virDomainObjListExport(driver->domains, conn, domains, flags); lxcDriverUnlock(driver); @@ -2708,6 +2855,9 @@ lxcDomainShutdownFlags(virDomainPtr dom, priv = vm->privateData; + if (virDomainShutdownFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -2797,6 +2947,9 @@ lxcDomainReboot(virDomainPtr dom, priv = vm->privateData; + if (virDomainRebootEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -4153,6 +4306,9 @@ static int lxcDomainAttachDeviceFlags(virDomainPtr dom, goto cleanup; } + if (virDomainAttachDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (affect == VIR_DOMAIN_AFFECT_CURRENT) flags |= VIR_DOMAIN_AFFECT_LIVE; @@ -4278,6 +4434,9 @@ static int lxcDomainUpdateDeviceFlags(virDomainPtr dom, goto cleanup; } + if (virDomainUpdateDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (affect == VIR_DOMAIN_AFFECT_CURRENT) flags |= VIR_DOMAIN_AFFECT_LIVE; @@ -4387,6 +4546,9 @@ static int lxcDomainDetachDeviceFlags(virDomainPtr dom, goto cleanup; } + if (virDomainDetachDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (affect == VIR_DOMAIN_AFFECT_CURRENT) flags |= VIR_DOMAIN_AFFECT_LIVE; @@ -4510,6 +4672,9 @@ static int lxcDomainLxcOpenNamespace(virDomainPtr dom, } priv = vm->privateData; + if (virDomainLxcOpenNamespaceEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -4541,6 +4706,9 @@ lxcConnectGetSysinfo(virConnectPtr conn, unsigned int flags) virCheckFlags(0, NULL); + if (virConnectGetSysinfoEnsureACL(conn) < 0) + return NULL; + if (!driver->hostsysinfo) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("Host SMBIOS information is not available")); @@ -4558,88 +4726,115 @@ lxcConnectGetSysinfo(virConnectPtr conn, unsigned int flags) static int -lxcNodeGetInfo(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeGetInfo(virConnectPtr conn, virNodeInfoPtr nodeinfo) { + if (virNodeGetInfoEnsureACL(conn) < 0) + return -1; + return nodeGetInfo(nodeinfo); } static int -lxcNodeGetCPUStats(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeGetCPUStats(virConnectPtr conn, int cpuNum, virNodeCPUStatsPtr params, int *nparams, unsigned int flags) { + if (virNodeGetCPUStatsEnsureACL(conn) < 0) + return -1; + return nodeGetCPUStats(cpuNum, params, nparams, flags); } static int -lxcNodeGetMemoryStats(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeGetMemoryStats(virConnectPtr conn, int cellNum, virNodeMemoryStatsPtr params, int *nparams, unsigned int flags) { + if (virNodeGetMemoryStatsEnsureACL(conn) < 0) + return -1; + return nodeGetMemoryStats(cellNum, params, nparams, flags); } static int -lxcNodeGetCellsFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeGetCellsFreeMemory(virConnectPtr conn, unsigned long long *freeMems, int startCell, int maxCells) { + if (virNodeGetCellsFreeMemoryEnsureACL(conn) < 0) + return -1; + return nodeGetCellsFreeMemory(freeMems, startCell, maxCells); } static unsigned long long -lxcNodeGetFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED) +lxcNodeGetFreeMemory(virConnectPtr conn) { + if (virNodeGetFreeMemoryEnsureACL(conn) < 0) + return 0; + return nodeGetFreeMemory(); } static int -lxcNodeGetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeGetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int *nparams, unsigned int flags) { + if (virNodeGetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeGetMemoryParameters(params, nparams, flags); } static int -lxcNodeSetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeSetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int nparams, unsigned int flags) { + if (virNodeSetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeSetMemoryParameters(params, nparams, flags); } static int -lxcNodeGetCPUMap(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeGetCPUMap(virConnectPtr conn, unsigned char **cpumap, unsigned int *online, unsigned int flags) { + if (virNodeGetCPUMapEnsureACL(conn) < 0) + return -1; + return nodeGetCPUMap(cpumap, online, flags); } static int -lxcNodeSuspendForDuration(virConnectPtr conn ATTRIBUTE_UNUSED, +lxcNodeSuspendForDuration(virConnectPtr conn, unsigned int target, unsigned long long duration, unsigned int flags) { + if (virNodeSuspendForDurationEnsureACL(conn) < 0) + return -1; + return nodeSuspendForDuration(target, duration, flags); } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Insert calls to the ACL checking APIs in all Xen driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/xen/xen_driver.c | 217 +++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 209 insertions(+), 8 deletions(-) diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index a6c87ce..77f1fae 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -66,6 +66,7 @@ #include "nodeinfo.h" #include "configmake.h" #include "virstring.h" +#include "access/viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_XEN #define XEN_SAVE_DIR LOCALSTATEDIR "/lib/libvirt/xen/save" @@ -398,6 +399,9 @@ xenUnifiedConnectOpen(virConnectPtr conn, virConnectAuthPtr auth, unsigned int f /* We now know the URI is definitely for this driver, so beyond * here, don't return DECLINED, always use ERROR */ + if (virConnectOpenEnsureACL(conn) < 0) + return VIR_DRV_OPEN_ERROR; + /* Allocate per-connection private data. */ if (VIR_ALLOC(priv) < 0) { virReportOOMError(); @@ -544,15 +548,21 @@ unsigned long xenUnifiedVersion(void) static const char * -xenUnifiedConnectGetType(virConnectPtr conn ATTRIBUTE_UNUSED) +xenUnifiedConnectGetType(virConnectPtr conn) { + if (virConnectGetTypeEnsureACL(conn) < 0) + return NULL; + return "Xen"; } /* Which features are supported by this driver? */ static int -xenUnifiedConnectSupportsFeature(virConnectPtr conn ATTRIBUTE_UNUSED, int feature) +xenUnifiedConnectSupportsFeature(virConnectPtr conn, int feature) { + if (virConnectSupportsFeatureEnsureACL(conn) < 0) + return -1; + switch (feature) { case VIR_DRV_FEATURE_MIGRATION_V1: case VIR_DRV_FEATURE_MIGRATION_DIRECT: @@ -565,12 +575,18 @@ xenUnifiedConnectSupportsFeature(virConnectPtr conn ATTRIBUTE_UNUSED, int featur static int xenUnifiedConnectGetVersion(virConnectPtr conn, unsigned long *hvVer) { + if (virConnectGetVersionEnsureACL(conn) < 0) + return -1; + return xenHypervisorGetVersion(conn, hvVer); } -static char *xenUnifiedConnectGetHostname(virConnectPtr conn ATTRIBUTE_UNUSED) +static char *xenUnifiedConnectGetHostname(virConnectPtr conn) { + if (virConnectGetHostnameEnsureACL(conn) < 0) + return NULL; + return virGetHostname(); } @@ -605,6 +621,9 @@ xenUnifiedConnectIsAlive(virConnectPtr conn ATTRIBUTE_UNUSED) int xenUnifiedConnectGetMaxVcpus(virConnectPtr conn, const char *type) { + if (virConnectGetMaxVcpusEnsureACL(conn) < 0) + return -1; + if (type && STRCASENEQ(type, "Xen")) { virReportError(VIR_ERR_INVALID_ARG, __FUNCTION__); return -1; @@ -616,6 +635,9 @@ xenUnifiedConnectGetMaxVcpus(virConnectPtr conn, const char *type) static int xenUnifiedNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info) { + if (virNodeGetInfoEnsureACL(conn) < 0) + return -1; + return xenDaemonNodeGetInfo(conn, info); } @@ -625,6 +647,9 @@ xenUnifiedConnectGetCapabilities(virConnectPtr conn) xenUnifiedPrivatePtr priv = conn->privateData; char *xml; + if (virConnectGetCapabilitiesEnsureACL(conn) < 0) + return NULL; + if (!(xml = virCapabilitiesFormatXML(priv->caps))) { virReportOOMError(); return NULL; @@ -636,12 +661,18 @@ xenUnifiedConnectGetCapabilities(virConnectPtr conn) static int xenUnifiedConnectListDomains(virConnectPtr conn, int *ids, int maxids) { + if (virConnectListDomainsEnsureACL(conn) < 0) + return -1; + return xenStoreListDomains(conn, ids, maxids); } static int xenUnifiedConnectNumOfDomains(virConnectPtr conn) { + if (virConnectNumOfDomainsEnsureACL(conn) < 0) + return -1; + return xenStoreNumOfDomains(conn); } @@ -661,6 +692,9 @@ xenUnifiedDomainCreateXML(virConnectPtr conn, VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (xenDaemonCreateXML(conn, def) < 0) goto cleanup; @@ -682,6 +716,9 @@ xenUnifiedDomainLookupByID(virConnectPtr conn, int id) if (!(def = xenGetDomainDefForID(conn, id))) goto cleanup; + if (virDomainLookupByIDEnsureACL(conn, def) < 0) + goto cleanup; + if (!(ret = virGetDomain(conn, def->name, def->uuid))) goto cleanup; @@ -702,6 +739,9 @@ xenUnifiedDomainLookupByUUID(virConnectPtr conn, if (!(def = xenGetDomainDefForUUID(conn, uuid))) goto cleanup; + if (virDomainLookupByUUIDEnsureACL(conn, def) < 0) + goto cleanup; + if (!(ret = virGetDomain(conn, def->name, def->uuid))) goto cleanup; @@ -722,6 +762,9 @@ xenUnifiedDomainLookupByName(virConnectPtr conn, if (!(def = xenGetDomainDefForName(conn, name))) goto cleanup; + if (virDomainLookupByNameEnsureACL(conn, def) < 0) + goto cleanup; + if (!(ret = virGetDomain(conn, def->name, def->uuid))) goto cleanup; @@ -813,6 +856,9 @@ xenUnifiedDomainSuspend(virDomainPtr dom) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainSuspendEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainSuspend(dom->conn, def); cleanup: @@ -829,6 +875,9 @@ xenUnifiedDomainResume(virDomainPtr dom) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainResumeEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainResume(dom->conn, def); cleanup: @@ -848,6 +897,9 @@ xenUnifiedDomainShutdownFlags(virDomainPtr dom, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainShutdownFlagsEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainShutdown(dom->conn, def); cleanup: @@ -872,6 +924,9 @@ xenUnifiedDomainReboot(virDomainPtr dom, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainRebootEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainReboot(dom->conn, def); cleanup: @@ -891,6 +946,9 @@ xenUnifiedDomainDestroyFlags(virDomainPtr dom, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainDestroyFlagsEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainDestroy(dom->conn, def); cleanup: @@ -914,6 +972,9 @@ xenUnifiedDomainGetOSType(virDomainPtr dom) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetOSTypeEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (def->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -942,6 +1003,9 @@ xenUnifiedDomainGetMaxMemory(virDomainPtr dom) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetMaxMemoryEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (def->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainGetMaxMemory(dom->conn, def); @@ -966,6 +1030,9 @@ xenUnifiedDomainSetMaxMemory(virDomainPtr dom, unsigned long memory) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainSetMaxMemoryEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (def->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainSetMaxMemory(dom->conn, def, memory); @@ -990,6 +1057,9 @@ xenUnifiedDomainSetMemory(virDomainPtr dom, unsigned long memory) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainSetMemoryEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (def->id < 0 && priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainSetMemory(dom->conn, def, memory); else @@ -1010,6 +1080,9 @@ xenUnifiedDomainGetInfo(virDomainPtr dom, virDomainInfoPtr info) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetInfoEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (def->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainGetInfo(dom->conn, def, info); @@ -1039,6 +1112,9 @@ xenUnifiedDomainGetState(virDomainPtr dom, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetStateEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (def->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainGetState(dom->conn, def, state, reason); @@ -1071,6 +1147,9 @@ xenUnifiedDomainSaveFlags(virDomainPtr dom, const char *to, const char *dxml, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainSaveFlagsEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainSave(dom->conn, def, to); cleanup: @@ -1112,6 +1191,9 @@ xenUnifiedDomainManagedSave(virDomainPtr dom, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainManagedSaveEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (!(name = xenUnifiedDomainManagedSavePath(priv, def))) goto cleanup; @@ -1136,6 +1218,9 @@ xenUnifiedDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainHasManagedSaveImageEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (!(name = xenUnifiedDomainManagedSavePath(priv, def))) goto cleanup; @@ -1160,6 +1245,9 @@ xenUnifiedDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainManagedSaveRemoveEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (!(name = xenUnifiedDomainManagedSavePath(priv, def))) goto cleanup; @@ -1201,6 +1289,9 @@ xenUnifiedDomainCoreDump(virDomainPtr dom, const char *to, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainCoreDumpEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainCoreDump(dom->conn, def, to, flags); cleanup: @@ -1238,6 +1329,9 @@ xenUnifiedDomainSetVcpusFlags(virDomainPtr dom, unsigned int nvcpus, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainSetVcpusFlagsEnsureACL(dom->conn, def, flags) < 0) + goto cleanup; + /* Try non-hypervisor methods first, then hypervisor direct method * as a last resort. */ @@ -1277,6 +1371,9 @@ xenUnifiedDomainPinVcpu(virDomainPtr dom, unsigned int vcpu, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainPinVcpuEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainPinVcpu(dom->conn, def, vcpu, cpumap, maplen); @@ -1303,6 +1400,9 @@ xenUnifiedDomainGetVcpus(virDomainPtr dom, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetVcpusEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -1334,6 +1434,9 @@ xenUnifiedDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetVcpusFlagsEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainGetVcpusFlags(dom->conn, def, flags); @@ -1369,6 +1472,9 @@ xenUnifiedDomainGetXMLDesc(virDomainPtr dom, unsigned int flags) if (!(minidef = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetXMLDescEnsureACL(dom->conn, minidef, flags) < 0) + goto cleanup; + if (dom->id < 0 && priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { def = xenXMDomainGetXMLDesc(dom->conn, minidef); } else { @@ -1406,6 +1512,9 @@ xenUnifiedConnectDomainXMLFromNative(virConnectPtr conn, virCheckFlags(0, NULL); + if (virConnectDomainXMLFromNativeEnsureACL(conn) < 0) + return NULL; + if (STRNEQ(format, XEN_CONFIG_FORMAT_XM) && STRNEQ(format, XEN_CONFIG_FORMAT_SEXPR)) { virReportError(VIR_ERR_INVALID_ARG, @@ -1455,6 +1564,9 @@ xenUnifiedConnectDomainXMLToNative(virConnectPtr conn, virCheckFlags(0, NULL); + if (virConnectDomainXMLToNativeEnsureACL(conn) < 0) + return NULL; + if (STRNEQ(format, XEN_CONFIG_FORMAT_XM) && STRNEQ(format, XEN_CONFIG_FORMAT_SEXPR)) { virReportError(VIR_ERR_INVALID_ARG, @@ -1527,6 +1639,9 @@ xenUnifiedDomainMigratePerform(virDomainPtr dom, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainMigratePerformEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenDaemonDomainMigratePerform(dom->conn, def, cookie, cookielen, uri, flags, dname, resource); @@ -1554,6 +1669,9 @@ xenUnifiedDomainMigrateFinish(virConnectPtr dconn, if (!(minidef = xenGetDomainDefForName(dconn, dname))) goto cleanup; + if (virDomainMigrateFinishEnsureACL(dconn, minidef) < 0) + goto cleanup; + if (flags & VIR_MIGRATE_PERSIST_DEST) { if (!(def = xenDaemonDomainGetXMLDesc(dconn, minidef, NULL))) goto cleanup; @@ -1583,6 +1701,9 @@ xenUnifiedConnectListDefinedDomains(virConnectPtr conn, char **const names, { xenUnifiedPrivatePtr priv = conn->privateData; + if (virConnectListDefinedDomainsEnsureACL(conn) < 0) + return -1; + if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { return xenXMListDefinedDomains(conn, names, maxnames); } else { @@ -1595,6 +1716,9 @@ xenUnifiedConnectNumOfDefinedDomains(virConnectPtr conn) { xenUnifiedPrivatePtr priv = conn->privateData; + if (virConnectNumOfDefinedDomainsEnsureACL(conn) < 0) + return -1; + if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { return xenXMNumOfDefinedDomains(conn); } else { @@ -1615,6 +1739,9 @@ xenUnifiedDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainCreateWithFlagsEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (!(name = xenUnifiedDomainManagedSavePath(priv, def))) goto cleanup; @@ -1657,6 +1784,9 @@ xenUnifiedDomainDefineXML(virConnectPtr conn, const char *xml) VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { if (xenXMDomainDefineXML(conn, def) < 0) goto cleanup; @@ -1687,6 +1817,9 @@ xenUnifiedDomainUndefineFlags(virDomainPtr dom, unsigned int flags) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainUndefineFlagsEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainUndefine(dom->conn, def); else @@ -1721,6 +1854,9 @@ xenUnifiedDomainAttachDevice(virDomainPtr dom, const char *xml) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainAttachDeviceEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0 && priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainAttachDeviceFlags(dom->conn, def, xml, flags); else @@ -1742,6 +1878,9 @@ xenUnifiedDomainAttachDeviceFlags(virDomainPtr dom, const char *xml, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainAttachDeviceFlagsEnsureACL(dom->conn, def, flags) < 0) + goto cleanup; + if (dom->id < 0 && priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainAttachDeviceFlags(dom->conn, def, xml, flags); else @@ -1771,6 +1910,9 @@ xenUnifiedDomainDetachDevice(virDomainPtr dom, const char *xml) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainDetachDeviceEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0 && priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainDetachDeviceFlags(dom->conn, def, xml, flags); else @@ -1792,6 +1934,9 @@ xenUnifiedDomainDetachDeviceFlags(virDomainPtr dom, const char *xml, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainDetachDeviceFlagsEnsureACL(dom->conn, def, flags) < 0) + goto cleanup; + if (dom->id < 0 && priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainDetachDeviceFlags(dom->conn, def, xml, flags); else @@ -1812,6 +1957,9 @@ xenUnifiedDomainUpdateDeviceFlags(virDomainPtr dom, const char *xml, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainUpdateDeviceFlagsEnsureACL(dom->conn, def, flags) < 0) + goto cleanup; + ret = xenDaemonUpdateDeviceFlags(dom->conn, def, xml, flags); cleanup: @@ -1829,6 +1977,9 @@ xenUnifiedDomainGetAutostart(virDomainPtr dom, int *autostart) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetAutostartEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainGetAutostart(def, autostart); else @@ -1849,6 +2000,9 @@ xenUnifiedDomainSetAutostart(virDomainPtr dom, int autostart) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainSetAutostartEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainSetAutostart(def, autostart); else @@ -1869,6 +2023,9 @@ xenUnifiedDomainGetSchedulerType(virDomainPtr dom, int *nparams) if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetSchedulerTypeEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -1900,6 +2057,9 @@ xenUnifiedDomainGetSchedulerParametersFlags(virDomainPtr dom, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainGetSchedulerParametersEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -1940,6 +2100,9 @@ xenUnifiedDomainSetSchedulerParametersFlags(virDomainPtr dom, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainSetSchedulerParametersFlagsEnsureACL(dom->conn, def, flags) < 0) + goto cleanup; + if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -1975,6 +2138,9 @@ xenUnifiedDomainBlockStats(virDomainPtr dom, const char *path, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainBlockStatsEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenHypervisorDomainBlockStats(dom->conn, def, path, stats); cleanup: @@ -1992,6 +2158,9 @@ xenUnifiedDomainInterfaceStats(virDomainPtr dom, const char *path, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainInterfaceStatsEnsureACL(dom->conn, def) < 0) + goto cleanup; + ret = xenHypervisorDomainInterfaceStats(def, path, stats); cleanup: @@ -2013,6 +2182,9 @@ xenUnifiedDomainBlockPeek(virDomainPtr dom, const char *path, if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; + if (virDomainBlockPeekEnsureACL(dom->conn, def) < 0) + goto cleanup; + if (dom->id < 0 && priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainBlockPeek(dom->conn, def, path, offset, size, buffer); else @@ -2027,6 +2199,9 @@ static int xenUnifiedNodeGetCellsFreeMemory(virConnectPtr conn, unsigned long long *freeMems, int startCell, int maxCells) { + if (virNodeGetCellsFreeMemoryEnsureACL(conn) < 0) + return 0; + return xenHypervisorNodeGetCellsFreeMemory(conn, freeMems, startCell, maxCells); } @@ -2036,6 +2211,9 @@ xenUnifiedNodeGetFreeMemory(virConnectPtr conn) { unsigned long long freeMem = 0; + if (virNodeGetFreeMemoryEnsureACL(conn) < 0) + return 0; + if (xenHypervisorNodeGetCellsFreeMemory(conn, &freeMem, -1, 1) < 0) return 0; return freeMem; @@ -2049,8 +2227,11 @@ xenUnifiedConnectDomainEventRegister(virConnectPtr conn, virFreeCallback freefunc) { xenUnifiedPrivatePtr priv = conn->privateData; - int ret; + + if (virConnectDomainEventRegisterEnsureACL(conn) < 0) + return -1; + xenUnifiedLock(priv); if (priv->xsWatch == -1) { @@ -2073,6 +2254,10 @@ xenUnifiedConnectDomainEventDeregister(virConnectPtr conn, { int ret; xenUnifiedPrivatePtr priv = conn->privateData; + + if (virConnectDomainEventDeregisterEnsureACL(conn) < 0) + return -1; + xenUnifiedLock(priv); if (priv->xsWatch == -1) { @@ -2099,8 +2284,11 @@ xenUnifiedConnectDomainEventRegisterAny(virConnectPtr conn, virFreeCallback freefunc) { xenUnifiedPrivatePtr priv = conn->privateData; - int ret; + + if (virConnectDomainEventRegisterAnyEnsureACL(conn) < 0) + return -1; + xenUnifiedLock(priv); if (priv->xsWatch == -1) { @@ -2124,6 +2312,10 @@ xenUnifiedConnectDomainEventDeregisterAny(virConnectPtr conn, { int ret; xenUnifiedPrivatePtr priv = conn->privateData; + + if (virConnectDomainEventDeregisterAnyEnsureACL(conn) < 0) + return -1; + xenUnifiedLock(priv); if (priv->xsWatch == -1) { @@ -2399,31 +2591,40 @@ cleanup: } static int -xenUnifiedNodeGetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +xenUnifiedNodeGetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int *nparams, unsigned int flags) { + if (virNodeGetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeGetMemoryParameters(params, nparams, flags); } static int -xenUnifiedNodeSetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +xenUnifiedNodeSetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int nparams, unsigned int flags) { + if (virNodeSetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeSetMemoryParameters(params, nparams, flags); } static int -xenUnifiedNodeSuspendForDuration(virConnectPtr conn ATTRIBUTE_UNUSED, +xenUnifiedNodeSuspendForDuration(virConnectPtr conn, unsigned int target, unsigned long long duration, unsigned int flags) { + if (virNodeSuspendForDurationEnsureACL(conn) < 0) + return -1; + return nodeSuspendForDuration(target, duration, flags); } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Insert calls to the ACL checking APIs in all storage driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/storage/storage_driver.c | 155 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 151 insertions(+), 4 deletions(-) diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index 990f0b1..edbd94d 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -48,6 +48,7 @@ #include "fdstream.h" #include "configmake.h" #include "virstring.h" +#include "access/viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_STORAGE @@ -248,6 +249,9 @@ storagePoolLookupByUUID(virConnectPtr conn, goto cleanup; } + if (virStoragePoolLookupByUUIDEnsureACL(conn, pool->def) < 0) + goto cleanup; + ret = virGetStoragePool(conn, pool->def->name, pool->def->uuid, NULL, NULL); @@ -274,6 +278,9 @@ storagePoolLookupByName(virConnectPtr conn, goto cleanup; } + if (virStoragePoolLookupByNameEnsureACL(conn, pool->def) < 0) + goto cleanup; + ret = virGetStoragePool(conn, pool->def->name, pool->def->uuid, NULL, NULL); @@ -285,7 +292,30 @@ cleanup: static virStoragePoolPtr storagePoolLookupByVolume(virStorageVolPtr vol) { - return storagePoolLookupByName(vol->conn, vol->pool); + virStorageDriverStatePtr driver = vol->conn->storagePrivateData; + virStoragePoolObjPtr pool; + virStoragePoolPtr ret = NULL; + + storageDriverLock(driver); + pool = virStoragePoolObjFindByName(&driver->pools, vol->pool); + storageDriverUnlock(driver); + + if (!pool) { + virReportError(VIR_ERR_NO_STORAGE_POOL, + _("no storage pool with matching name '%s'"), vol->pool); + goto cleanup; + } + + if (virStoragePoolLookupByVolumeEnsureACL(vol->conn, pool->def) < 0) + goto cleanup; + + ret = virGetStoragePool(vol->conn, pool->def->name, pool->def->uuid, + NULL, NULL); + +cleanup: + if (pool) + virStoragePoolObjUnlock(pool); + return ret; } static virDrvOpenStatus @@ -313,6 +343,9 @@ storageConnectNumOfStoragePools(virConnectPtr conn) { virStorageDriverStatePtr driver = conn->storagePrivateData; unsigned int i, nactive = 0; + if (virConnectNumOfStoragePoolsEnsureACL(conn) < 0) + return -1; + storageDriverLock(driver); for (i = 0 ; i < driver->pools.count ; i++) { virStoragePoolObjLock(driver->pools.objs[i]); @@ -332,6 +365,9 @@ storageConnectListStoragePools(virConnectPtr conn, virStorageDriverStatePtr driver = conn->storagePrivateData; int got = 0, i; + if (virConnectListStoragePoolsEnsureACL(conn) < 0) + return -1; + storageDriverLock(driver); for (i = 0 ; i < driver->pools.count && got < nnames ; i++) { virStoragePoolObjLock(driver->pools.objs[i]); @@ -361,6 +397,9 @@ storageConnectNumOfDefinedStoragePools(virConnectPtr conn) { virStorageDriverStatePtr driver = conn->storagePrivateData; unsigned int i, nactive = 0; + if (virConnectNumOfDefinedStoragePoolsEnsureACL(conn) < 0) + return -1; + storageDriverLock(driver); for (i = 0 ; i < driver->pools.count ; i++) { virStoragePoolObjLock(driver->pools.objs[i]); @@ -380,6 +419,9 @@ storageConnectListDefinedStoragePools(virConnectPtr conn, virStorageDriverStatePtr driver = conn->storagePrivateData; int got = 0, i; + if (virConnectListDefinedStoragePoolsEnsureACL(conn) < 0) + return -1; + storageDriverLock(driver); for (i = 0 ; i < driver->pools.count && got < nnames ; i++) { virStoragePoolObjLock(driver->pools.objs[i]); @@ -417,6 +459,9 @@ storageConnectFindStoragePoolSources(virConnectPtr conn, virStorageBackendPtr backend; char *ret = NULL; + if (virConnectFindStoragePoolSourcesEnsureACL(conn) < 0) + return NULL; + backend_type = virStoragePoolTypeFromString(type); if (backend_type < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, @@ -455,6 +500,10 @@ static int storagePoolIsActive(virStoragePoolPtr pool) virReportError(VIR_ERR_NO_STORAGE_POOL, NULL); goto cleanup; } + + if (virStoragePoolIsActiveEnsureACL(pool->conn, obj->def) < 0) + goto cleanup; + ret = virStoragePoolObjIsActive(obj); cleanup: @@ -476,6 +525,10 @@ static int storagePoolIsPersistent(virStoragePoolPtr pool) virReportError(VIR_ERR_NO_STORAGE_POOL, NULL); goto cleanup; } + + if (virStoragePoolIsPersistentEnsureACL(pool->conn, obj->def) < 0) + goto cleanup; + ret = obj->configFile ? 1 : 0; cleanup: @@ -502,6 +555,9 @@ storagePoolCreateXML(virConnectPtr conn, if (!(def = virStoragePoolDefParseString(xml))) goto cleanup; + if (virStoragePoolCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (virStoragePoolObjIsDuplicate(&driver->pools, def, 1) < 0) goto cleanup; @@ -559,6 +615,9 @@ storagePoolDefineXML(virConnectPtr conn, if (!(def = virStoragePoolDefParseString(xml))) goto cleanup; + if (virStoragePoolDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (virStoragePoolObjIsDuplicate(&driver->pools, def, 0) < 0) goto cleanup; @@ -604,6 +663,9 @@ storagePoolUndefine(virStoragePoolPtr obj) { goto cleanup; } + if (virStoragePoolUndefineEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if (virStoragePoolObjIsActive(pool)) { virReportError(VIR_ERR_OPERATION_INVALID, _("storage pool '%s' is still active"), @@ -663,6 +725,9 @@ storagePoolCreate(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolCreateEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if ((backend = virStorageBackendForType(pool->def->type)) == NULL) goto cleanup; @@ -710,6 +775,9 @@ storagePoolBuild(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolBuildEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if ((backend = virStorageBackendForType(pool->def->type)) == NULL) goto cleanup; @@ -748,6 +816,9 @@ storagePoolDestroy(virStoragePoolPtr obj) { goto cleanup; } + if (virStoragePoolDestroyEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if ((backend = virStorageBackendForType(pool->def->type)) == NULL) goto cleanup; @@ -808,6 +879,9 @@ storagePoolDelete(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolDeleteEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if ((backend = virStorageBackendForType(pool->def->type)) == NULL) goto cleanup; @@ -862,6 +936,9 @@ storagePoolRefresh(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolRefreshEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if ((backend = virStorageBackendForType(pool->def->type)) == NULL) goto cleanup; @@ -918,6 +995,9 @@ storagePoolGetInfo(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolGetInfoEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if (virStorageBackendForType(pool->def->type) == NULL) goto cleanup; @@ -958,6 +1038,9 @@ storagePoolGetXMLDesc(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolGetXMLDescEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if ((flags & VIR_STORAGE_XML_INACTIVE) && pool->newDef) def = pool->newDef; else @@ -988,6 +1071,9 @@ storagePoolGetAutostart(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolGetAutostartEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if (!pool->configFile) { *autostart = 0; } else { @@ -1017,6 +1103,9 @@ storagePoolSetAutostart(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolSetAutostartEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if (!pool->configFile) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("pool has no config file")); @@ -1077,6 +1166,9 @@ storagePoolNumOfVolumes(virStoragePoolPtr obj) { goto cleanup; } + if (virStoragePoolNumOfVolumesEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if (!virStoragePoolObjIsActive(pool)) { virReportError(VIR_ERR_OPERATION_INVALID, _("storage pool '%s' is not active"), pool->def->name); @@ -1110,6 +1202,9 @@ storagePoolListVolumes(virStoragePoolPtr obj, goto cleanup; } + if (virStoragePoolListVolumesEnsureACL(obj->conn, pool->def) < 0) + goto cleanup; + if (!virStoragePoolObjIsActive(pool)) { virReportError(VIR_ERR_OPERATION_INVALID, _("storage pool '%s' is not active"), pool->def->name); @@ -1161,6 +1256,9 @@ storagePoolListAllVolumes(virStoragePoolPtr pool, goto cleanup; } + if (virStoragePoolListAllVolumesEnsureACL(pool->conn, obj->def) < 0) + goto cleanup; + if (!virStoragePoolObjIsActive(obj)) { virReportError(VIR_ERR_OPERATION_INVALID, _("storage pool '%s' is not active"), obj->def->name); @@ -1239,6 +1337,9 @@ storageVolLookupByName(virStoragePoolPtr obj, goto cleanup; } + if (virStorageVolLookupByNameEnsureACL(obj->conn, pool->def, vol) < 0) + goto cleanup; + ret = virGetStorageVol(obj->conn, pool->def->name, vol->name, vol->key, NULL, NULL); @@ -1263,21 +1364,27 @@ storageVolLookupByKey(virConnectPtr conn, virStorageVolDefPtr vol = virStorageVolDefFindByKey(driver->pools.objs[i], key); - if (vol) + if (vol) { + if (virStorageVolLookupByKeyEnsureACL(conn, driver->pools.objs[i]->def, vol) < 0) + goto cleanup; + ret = virGetStorageVol(conn, driver->pools.objs[i]->def->name, vol->name, vol->key, NULL, NULL); + goto cleanup; + } } virStoragePoolObjUnlock(driver->pools.objs[i]); } - storageDriverUnlock(driver); if (!ret) virReportError(VIR_ERR_NO_STORAGE_VOL, _("no storage vol with matching key %s"), key); +cleanup: + storageDriverUnlock(driver); return ret; } @@ -1317,12 +1424,17 @@ storageVolLookupByPath(virConnectPtr conn, stable_path); VIR_FREE(stable_path); - if (vol) + if (vol) { + if (virStorageVolLookupByPathEnsureACL(conn, driver->pools.objs[i]->def, vol) < 0) + goto cleanup; + ret = virGetStorageVol(conn, driver->pools.objs[i]->def->name, vol->name, vol->key, NULL, NULL); + goto cleanup; + } } virStoragePoolObjUnlock(driver->pools.objs[i]); } @@ -1331,6 +1443,7 @@ storageVolLookupByPath(virConnectPtr conn, virReportError(VIR_ERR_NO_STORAGE_VOL, _("no storage vol with matching path %s"), path); +cleanup: VIR_FREE(cleanpath); storageDriverUnlock(driver); return ret; @@ -1374,6 +1487,9 @@ storageVolCreateXML(virStoragePoolPtr obj, if (voldef == NULL) goto cleanup; + if (virStorageVolCreateXMLEnsureACL(obj->conn, pool->def, voldef) < 0) + goto cleanup; + if (virStorageVolDefFindByName(pool, voldef->name)) { virReportError(VIR_ERR_NO_STORAGE_VOL, _("storage vol '%s' already exists"), voldef->name); @@ -1525,6 +1641,9 @@ storageVolCreateXMLFrom(virStoragePoolPtr obj, if (newvol == NULL) goto cleanup; + if (virStorageVolCreateXMLFromEnsureACL(obj->conn, pool->def, newvol) < 0) + goto cleanup; + if (virStorageVolDefFindByName(pool, newvol->name)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("storage volume name '%s' already in use."), @@ -1666,6 +1785,9 @@ storageVolDownload(virStorageVolPtr obj, goto out; } + if (virStorageVolDownloadEnsureACL(obj->conn, pool->def, vol) < 0) + goto out; + if (vol->building) { virReportError(VIR_ERR_OPERATION_INVALID, _("volume '%s' is still being allocated."), @@ -1729,6 +1851,9 @@ storageVolUpload(virStorageVolPtr obj, goto out; } + if (virStorageVolUploadEnsureACL(obj->conn, pool->def, vol) < 0) + goto out; + if (vol->building) { virReportError(VIR_ERR_OPERATION_INVALID, _("volume '%s' is still being allocated."), @@ -1796,6 +1921,9 @@ storageVolResize(virStorageVolPtr obj, goto out; } + if (virStorageVolResizeEnsureACL(obj->conn, pool->def, vol) < 0) + goto out; + if (vol->building) { virReportError(VIR_ERR_OPERATION_INVALID, _("volume '%s' is still being allocated."), @@ -2088,6 +2216,9 @@ storageVolWipePattern(virStorageVolPtr obj, goto out; } + if (virStorageVolWipePatternEnsureACL(obj->conn, pool->def, vol) < 0) + goto out; + if (vol->building) { virReportError(VIR_ERR_OPERATION_INVALID, _("volume '%s' is still being allocated."), @@ -2156,6 +2287,9 @@ storageVolDelete(virStorageVolPtr obj, goto cleanup; } + if (virStorageVolDeleteEnsureACL(obj->conn, pool->def, vol) < 0) + goto cleanup; + if (vol->building) { virReportError(VIR_ERR_OPERATION_INVALID, _("volume '%s' is still being allocated."), @@ -2235,6 +2369,9 @@ storageVolGetInfo(virStorageVolPtr obj, goto cleanup; } + if (virStorageVolGetInfoEnsureACL(obj->conn, pool->def, vol) < 0) + goto cleanup; + if ((backend = virStorageBackendForType(pool->def->type)) == NULL) goto cleanup; @@ -2292,6 +2429,9 @@ storageVolGetXMLDesc(virStorageVolPtr obj, goto cleanup; } + if (virStorageVolGetXMLDescEnsureACL(obj->conn, pool->def, vol) < 0) + goto cleanup; + if ((backend = virStorageBackendForType(pool->def->type)) == NULL) goto cleanup; @@ -2340,6 +2480,9 @@ storageVolGetPath(virStorageVolPtr obj) { goto cleanup; } + if (virStorageVolGetPathEnsureACL(obj->conn, pool->def, vol) < 0) + goto cleanup; + ret = strdup(vol->target.path); if (ret == NULL) virReportOOMError(); @@ -2360,10 +2503,14 @@ storageConnectListAllStoragePools(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_STORAGE_POOLS_FILTERS_ALL, -1); + if (virConnectListAllStoragePoolsEnsureACL(conn) < 0) + goto cleanup; + storageDriverLock(driver); ret = virStoragePoolList(conn, driver->pools, pools, flags); storageDriverUnlock(driver); +cleanup: return ret; } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Insert calls to the ACL checking APIs in all interface driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/interface/interface_backend_netcf.c | 114 ++++++++++++++++++++++++++++++++ src/interface/interface_backend_udev.c | 85 +++++++++++++++++++++--- 2 files changed, 191 insertions(+), 8 deletions(-) diff --git a/src/interface/interface_backend_netcf.c b/src/interface/interface_backend_netcf.c index cbba4fd..4707e3e 100644 --- a/src/interface/interface_backend_netcf.c +++ b/src/interface/interface_backend_netcf.c @@ -31,6 +31,7 @@ #include "interface_conf.h" #include "viralloc.h" #include "virlog.h" +#include "access/viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_INTERFACE @@ -52,6 +53,36 @@ static void interfaceDriverUnlock(struct interface_driver *driver) virMutexUnlock(&driver->lock); } +/* + * Get a minimal virInterfaceDef containing enough metadata + * for access control checks to be performed. Currently + * this implies existance of name and mac address attributes + */ +static virInterfaceDef * ATTRIBUTE_NONNULL(1) +netcfGetMinimalDefForDevice(struct netcf_if *iface) +{ + virInterfaceDef *def; + + /* Allocate our interface definition structure */ + if (VIR_ALLOC(def) < 0) { + virReportOOMError(); + return NULL; + } + + if (VIR_STRDUP(def->name, ncf_if_name(iface)) < 0) + goto cleanup; + + if (VIR_STRDUP(def->mac, ncf_if_mac_string(iface)) < 0) + goto cleanup; + + return def; + +cleanup: + virInterfaceDefFree(def); + return NULL; +} + + static int netcf_to_vir_err(int netcf_errcode) { switch (netcf_errcode) @@ -182,6 +213,9 @@ static int netcfConnectNumOfInterfaces(virConnectPtr conn) int count; struct interface_driver *driver = conn->interfacePrivateData; + if (virConnectNumOfInterfacesEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); count = ncf_num_of_interfaces(driver->netcf, NETCF_IFACE_ACTIVE); if (count < 0) { @@ -201,6 +235,9 @@ static int netcfConnectListInterfaces(virConnectPtr conn, char **const names, in struct interface_driver *driver = conn->interfacePrivateData; int count; + if (virConnectListInterfacesEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); count = ncf_list_interfaces(driver->netcf, nnames, names, NETCF_IFACE_ACTIVE); @@ -223,6 +260,9 @@ static int netcfConnectNumOfDefinedInterfaces(virConnectPtr conn) int count; struct interface_driver *driver = conn->interfacePrivateData; + if (virConnectNumOfDefinedInterfacesEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); count = ncf_num_of_interfaces(driver->netcf, NETCF_IFACE_INACTIVE); if (count < 0) { @@ -243,6 +283,9 @@ static int netcfConnectListDefinedInterfaces(virConnectPtr conn, char **const na struct interface_driver *driver = conn->interfacePrivateData; int count; + if (virConnectListDefinedInterfacesEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); count = ncf_list_interfaces(driver->netcf, nnames, names, NETCF_IFACE_INACTIVE); @@ -279,6 +322,9 @@ netcfConnectListAllInterfaces(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_INTERFACES_ACTIVE | VIR_CONNECT_LIST_INTERFACES_INACTIVE, -1); + if (virConnectListAllInterfacesEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); /* List all interfaces, in case of we might support new filter flags @@ -413,6 +459,7 @@ static virInterfacePtr netcfInterfaceLookupByName(virConnectPtr conn, struct interface_driver *driver = conn->interfacePrivateData; struct netcf_if *iface; virInterfacePtr ret = NULL; + virInterfaceDefPtr def = NULL; interfaceDriverLock(driver); iface = ncf_lookup_by_name(driver->netcf, name); @@ -431,10 +478,17 @@ static virInterfacePtr netcfInterfaceLookupByName(virConnectPtr conn, goto cleanup; } + if (!(def = netcfGetMinimalDefForDevice(iface))) + goto cleanup; + + if (virInterfaceLookupByNameEnsureACL(conn, def) < 0) + goto cleanup; + ret = virGetInterface(conn, ncf_if_name(iface), ncf_if_mac_string(iface)); cleanup: ncf_if_free(iface); + virInterfaceDefFree(def); interfaceDriverUnlock(driver); return ret; } @@ -446,6 +500,7 @@ static virInterfacePtr netcfInterfaceLookupByMACString(virConnectPtr conn, struct netcf_if *iface; int niface; virInterfacePtr ret = NULL; + virInterfaceDefPtr def = NULL; interfaceDriverLock(driver); niface = ncf_lookup_by_mac_string(driver->netcf, macstr, 1, &iface); @@ -471,10 +526,18 @@ static virInterfacePtr netcfInterfaceLookupByMACString(virConnectPtr conn, goto cleanup; } + + if (!(def = netcfGetMinimalDefForDevice(iface))) + goto cleanup; + + if (virInterfaceLookupByMACStringEnsureACL(conn, def) < 0) + goto cleanup; + ret = virGetInterface(conn, ncf_if_name(iface), ncf_if_mac_string(iface)); cleanup: ncf_if_free(iface); + virInterfaceDefFree(def); interfaceDriverUnlock(driver); return ret; } @@ -519,6 +582,9 @@ static char *netcfInterfaceGetXMLDesc(virInterfacePtr ifinfo, goto cleanup; } + if (virInterfaceGetXMLDescEnsureACL(ifinfo->conn, ifacedef) < 0) + goto cleanup; + ret = virInterfaceDefFormat(ifacedef); if (!ret) { /* error was already reported */ @@ -553,6 +619,9 @@ static virInterfacePtr netcfInterfaceDefineXML(virConnectPtr conn, goto cleanup; } + if (virInterfaceDefineXMLEnsureACL(conn, ifacedef) < 0) + goto cleanup; + xmlstr = virInterfaceDefFormat(ifacedef); if (!xmlstr) { /* error was already reported */ @@ -583,6 +652,7 @@ cleanup: static int netcfInterfaceUndefine(virInterfacePtr ifinfo) { struct interface_driver *driver = ifinfo->conn->interfacePrivateData; struct netcf_if *iface = NULL; + virInterfaceDefPtr def = NULL; int ret = -1; interfaceDriverLock(driver); @@ -593,6 +663,13 @@ static int netcfInterfaceUndefine(virInterfacePtr ifinfo) { goto cleanup; } + + if (!(def = netcfGetMinimalDefForDevice(iface))) + goto cleanup; + + if (virInterfaceUndefineEnsureACL(ifinfo->conn, def) < 0) + goto cleanup; + ret = ncf_if_undefine(iface); if (ret < 0) { const char *errmsg, *details; @@ -606,6 +683,7 @@ static int netcfInterfaceUndefine(virInterfacePtr ifinfo) { cleanup: ncf_if_free(iface); + virInterfaceDefFree(def); interfaceDriverUnlock(driver); return ret; } @@ -615,6 +693,7 @@ static int netcfInterfaceCreate(virInterfacePtr ifinfo, { struct interface_driver *driver = ifinfo->conn->interfacePrivateData; struct netcf_if *iface = NULL; + virInterfaceDefPtr def = NULL; int ret = -1; virCheckFlags(0, -1); @@ -627,6 +706,13 @@ static int netcfInterfaceCreate(virInterfacePtr ifinfo, goto cleanup; } + + if (!(def = netcfGetMinimalDefForDevice(iface))) + goto cleanup; + + if (virInterfaceCreateEnsureACL(ifinfo->conn, def) < 0) + goto cleanup; + ret = ncf_if_up(iface); if (ret < 0) { const char *errmsg, *details; @@ -640,6 +726,7 @@ static int netcfInterfaceCreate(virInterfacePtr ifinfo, cleanup: ncf_if_free(iface); + virInterfaceDefFree(def); interfaceDriverUnlock(driver); return ret; } @@ -649,6 +736,7 @@ static int netcfInterfaceDestroy(virInterfacePtr ifinfo, { struct interface_driver *driver = ifinfo->conn->interfacePrivateData; struct netcf_if *iface = NULL; + virInterfaceDefPtr def = NULL; int ret = -1; virCheckFlags(0, -1); @@ -661,6 +749,13 @@ static int netcfInterfaceDestroy(virInterfacePtr ifinfo, goto cleanup; } + + if (!(def = netcfGetMinimalDefForDevice(iface))) + goto cleanup; + + if (virInterfaceDestroyEnsureACL(ifinfo->conn, def) < 0) + goto cleanup; + ret = ncf_if_down(iface); if (ret < 0) { const char *errmsg, *details; @@ -674,6 +769,7 @@ static int netcfInterfaceDestroy(virInterfacePtr ifinfo, cleanup: ncf_if_free(iface); + virInterfaceDefFree(def); interfaceDriverUnlock(driver); return ret; } @@ -683,6 +779,7 @@ static int netcfInterfaceIsActive(virInterfacePtr ifinfo) struct interface_driver *driver = ifinfo->conn->interfacePrivateData; struct netcf_if *iface = NULL; unsigned int flags = 0; + virInterfaceDefPtr def = NULL; int ret = -1; interfaceDriverLock(driver); @@ -693,6 +790,13 @@ static int netcfInterfaceIsActive(virInterfacePtr ifinfo) goto cleanup; } + + if (!(def = netcfGetMinimalDefForDevice(iface))) + goto cleanup; + + if (virInterfaceIsActiveEnsureACL(ifinfo->conn, def) < 0) + goto cleanup; + if (ncf_if_status(iface, &flags) < 0) { const char *errmsg, *details; int errcode = ncf_error(driver->netcf, &errmsg, &details); @@ -707,6 +811,7 @@ static int netcfInterfaceIsActive(virInterfacePtr ifinfo) cleanup: ncf_if_free(iface); + virInterfaceDefFree(def); interfaceDriverUnlock(driver); return ret; } @@ -719,6 +824,9 @@ static int netcfInterfaceChangeBegin(virConnectPtr conn, unsigned int flags) virCheckFlags(0, -1); /* currently flags must be 0 */ + if (virInterfaceChangeBeginEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); ret = ncf_change_begin(driver->netcf, 0); @@ -742,6 +850,9 @@ static int netcfInterfaceChangeCommit(virConnectPtr conn, unsigned int flags) virCheckFlags(0, -1); /* currently flags must be 0 */ + if (virInterfaceChangeCommitEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); ret = ncf_change_commit(driver->netcf, 0); @@ -765,6 +876,9 @@ static int netcfInterfaceChangeRollback(virConnectPtr conn, unsigned int flags) virCheckFlags(0, -1); /* currently flags must be 0 */ + if (virInterfaceChangeRollbackEnsureACL(conn) < 0) + return -1; + interfaceDriverLock(driver); ret = ncf_change_rollback(driver->netcf, 0); diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index f9a179f..a6e7bd5 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -31,6 +31,7 @@ #include "interface_conf.h" #include "viralloc.h" #include "virstring.h" +#include "access/viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_INTERFACE @@ -61,6 +62,36 @@ virUdevStatusString(virUdevStatus status) return ""; } +/* + * Get a minimal virInterfaceDef containing enough metadata + * for access control checks to be performed. Currently + * this implies existance of name and mac address attributes + */ +static virInterfaceDef * ATTRIBUTE_NONNULL(1) +udevGetMinimalDefForDevice(struct udev_device *dev) +{ + virInterfaceDef *def; + + /* Allocate our interface definition structure */ + if (VIR_ALLOC(def) < 0) { + virReportOOMError(); + return NULL; + } + + if (VIR_STRDUP(def->name, udev_device_get_sysname(dev)) < 0) + goto cleanup; + + if (VIR_STRDUP(def->mac, udev_device_get_sysattr_value(dev, "address")) < 0) + goto cleanup; + + return def; + +cleanup: + virInterfaceDefFree(def); + return NULL; +} + + static struct udev_enumerate * ATTRIBUTE_NONNULL(1) udevGetDevices(struct udev *udev, virUdevStatus status) { @@ -255,6 +286,9 @@ error: static int udevConnectNumOfInterfaces(virConnectPtr conn) { + if (virConnectNumOfInterfacesEnsureACL(conn) < 0) + return -1; + return udevNumOfInterfacesByStatus(conn, VIR_UDEV_IFACE_ACTIVE); } @@ -263,6 +297,9 @@ udevConnectListInterfaces(virConnectPtr conn, char **const names, int names_len) { + if (virConnectListInterfacesEnsureACL(conn) < 0) + return -1; + return udevListInterfacesByStatus(conn, names, names_len, VIR_UDEV_IFACE_ACTIVE); } @@ -270,6 +307,9 @@ udevConnectListInterfaces(virConnectPtr conn, static int udevConnectNumOfDefinedInterfaces(virConnectPtr conn) { + if (virConnectNumOfDefinedInterfacesEnsureACL(conn) < 0) + return -1; + return udevNumOfInterfacesByStatus(conn, VIR_UDEV_IFACE_INACTIVE); } @@ -278,6 +318,9 @@ udevConnectListDefinedInterfaces(virConnectPtr conn, char **const names, int names_len) { + if (virConnectListDefinedInterfacesEnsureACL(conn) < 0) + return -1; + return udevListInterfacesByStatus(conn, names, names_len, VIR_UDEV_IFACE_INACTIVE); } @@ -302,6 +345,9 @@ udevConnectListAllInterfaces(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_INTERFACES_ACTIVE | VIR_CONNECT_LIST_INTERFACES_INACTIVE, -1); + if (virConnectListAllInterfacesEnsureACL(conn) < 0) + return -1; + /* Grab a udev reference */ udev = udev_ref(driverState->udev); @@ -413,8 +459,8 @@ udevInterfaceLookupByName(virConnectPtr conn, const char *name) struct udev_iface_driver *driverState = conn->interfacePrivateData; struct udev *udev = udev_ref(driverState->udev); struct udev_device *dev; - const char *macaddr; virInterfacePtr ret = NULL; + virInterfaceDefPtr def = NULL; /* get a device reference based on the device name */ dev = udev_device_new_from_subsystem_sysname(udev, "net", name); @@ -425,12 +471,18 @@ udevInterfaceLookupByName(virConnectPtr conn, const char *name) goto cleanup; } - macaddr = udev_device_get_sysattr_value(dev, "address"); - ret = virGetInterface(conn, name, macaddr); + if (!(def = udevGetMinimalDefForDevice(dev))) + goto err; + + if (virInterfaceLookupByNameEnsureACL(conn, def) < 0) + goto err; + + ret = virGetInterface(conn, def->name, def->mac); udev_device_unref(dev); cleanup: udev_unref(udev); + virInterfaceDefFree(def); return ret; } @@ -443,7 +495,7 @@ udevInterfaceLookupByMACString(virConnectPtr conn, const char *macstr) struct udev_enumerate *enumerate = NULL; struct udev_list_entry *dev_entry; struct udev_device *dev; - const char *name; + virInterfaceDefPtr def = NULL; virInterfacePtr ret = NULL; enumerate = udevGetDevices(udev, VIR_UDEV_IFACE_ALL); @@ -481,14 +533,21 @@ udevInterfaceLookupByMACString(virConnectPtr conn, const char *macstr) } dev = udev_device_new_from_syspath(udev, udev_list_entry_get_name(dev_entry)); - name = udev_device_get_sysname(dev); - ret = virGetInterface(conn, name, macstr); + + if (!(def = udevGetMinimalDefForDevice(dev))) + goto err; + + if (virInterfaceLookupByMACStringEnsureACL(conn, def) < 0) + goto err; + + ret = virGetInterface(conn, def->name, def->mac); udev_device_unref(dev); cleanup: if (enumerate) udev_enumerate_unref(enumerate); udev_unref(udev); + virInterfaceDefFree(def); return ret; } @@ -1045,6 +1104,9 @@ udevInterfaceGetXMLDesc(virInterfacePtr ifinfo, if (!ifacedef) goto cleanup; + if (virInterfaceGetXMLDescEnsureACL(ifinfo->conn, ifacedef) < 0) + goto err; + xmlstr = virInterfaceDefFormat(ifacedef); virInterfaceDefFree(ifacedef); @@ -1062,7 +1124,8 @@ udevInterfaceIsActive(virInterfacePtr ifinfo) struct udev_iface_driver *driverState = ifinfo->conn->interfacePrivateData; struct udev *udev = udev_ref(driverState->udev); struct udev_device *dev; - int status; + virInterfaceDefPtr def = NULL; + int status = -1; dev = udev_device_new_from_subsystem_sysname(udev, "net", ifinfo->name); @@ -1070,10 +1133,15 @@ udevInterfaceIsActive(virInterfacePtr ifinfo) virReportError(VIR_ERR_NO_INTERFACE, _("couldn't find interface named '%s'"), ifinfo->name); - status = -1; goto cleanup; } + if (!(def = udevGetMinimalDefForDevice(dev))) + goto cleanup; + + if (virInterfaceIsActiveEnsureACL(ifinfo->conn, def) < 0) + goto cleanup; + /* Check if it's active or not */ status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up"); @@ -1081,6 +1149,7 @@ udevInterfaceIsActive(virInterfacePtr ifinfo) cleanup: udev_unref(udev); + virInterfaceDefFree(def); return status; } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Insert calls to the ACL checking APIs in all nwfilter driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/nwfilter/nwfilter_driver.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c index 64ea251..14c97a5 100644 --- a/src/nwfilter/nwfilter_driver.c +++ b/src/nwfilter/nwfilter_driver.c @@ -42,6 +42,7 @@ #include "nwfilter_gentech_driver.h" #include "configmake.h" #include "virstring.h" +#include "access/viraccessapicheck.h" #include "nwfilter_ipaddrmap.h" #include "nwfilter_dhcpsnoop.h" @@ -380,6 +381,9 @@ nwfilterLookupByUUID(virConnectPtr conn, goto cleanup; } + if (virNWFilterLookupByUUIDEnsureACL(conn, nwfilter->def) < 0) + goto cleanup; + ret = virGetNWFilter(conn, nwfilter->def->name, nwfilter->def->uuid); cleanup: @@ -406,6 +410,9 @@ nwfilterLookupByName(virConnectPtr conn, goto cleanup; } + if (virNWFilterLookupByNameEnsureACL(conn, nwfilter->def) < 0) + goto cleanup; + ret = virGetNWFilter(conn, nwfilter->def->name, nwfilter->def->uuid); cleanup: @@ -440,6 +447,10 @@ nwfilterClose(virConnectPtr conn) { static int nwfilterConnectNumOfNWFilters(virConnectPtr conn) { virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; + + if (virConnectNumOfNWFiltersEnsureACL(conn) < 0) + return -1; + return driver->nwfilters.count; } @@ -451,6 +462,9 @@ nwfilterConnectListNWFilters(virConnectPtr conn, virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; int got = 0, i; + if (virConnectListNWFiltersEnsureACL(conn) < 0) + return -1; + nwfilterDriverLock(driver); for (i = 0 ; i < driver->nwfilters.count && got < nnames ; i++) { virNWFilterObjLock(driver->nwfilters.objs[i]); @@ -487,6 +501,9 @@ nwfilterConnectListAllNWFilters(virConnectPtr conn, virCheckFlags(0, -1); + if (virConnectListAllNWFiltersEnsureACL(conn) < 0) + return -1; + nwfilterDriverLock(driver); if (!filters) { @@ -543,6 +560,9 @@ nwfilterDefineXML(virConnectPtr conn, if (!(def = virNWFilterDefParseString(conn, xml))) goto cleanup; + if (virNWFilterDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (!(nwfilter = virNWFilterObjAssignDef(conn, &driver->nwfilters, def))) goto cleanup; @@ -584,6 +604,9 @@ nwfilterUndefine(virNWFilterPtr obj) { goto cleanup; } + if (virNWFilterUndefineEnsureACL(obj->conn, nwfilter->def) < 0) + goto cleanup; + if (virNWFilterTestUnassignDef(obj->conn, nwfilter) < 0) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", @@ -632,6 +655,9 @@ nwfilterGetXMLDesc(virNWFilterPtr obj, goto cleanup; } + if (virNWFilterGetXMLDescEnsureACL(obj->conn, nwfilter->def) < 0) + goto cleanup; + ret = virNWFilterDefFormat(nwfilter->def); cleanup: -- 1.8.1.4

From: "Daniel P. Berrange" <berrange@redhat.com> Add a script which parses the driver API code and validates that every API registered in a virNNNDriverPtr table contains an ACL check matching the API name. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/Makefile.am | 22 +++++++- src/check-aclrules.pl | 144 ++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 164 insertions(+), 2 deletions(-) create mode 100644 src/check-aclrules.pl diff --git a/src/Makefile.am b/src/Makefile.am index 93af8fd..29fe5e9 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -462,15 +462,33 @@ DRIVER_SOURCE_FILES = \ $(XENAPI_DRIVER_SOURCES) \ $(NULL) +STATEFUL_DRIVER_SOURCE_FILES = \ + $(INTERFACE_DRIVER_SOURCES) \ + $(LIBXL_DRIVER_SOURCES) \ + $(LXC_DRIVER_SOURCES) \ + $(NETWORK_DRIVER_SOURCES) \ + $(NODE_DEVICE_DRIVER_SOURCES) \ + $(NWFILTER_DRIVER_SOURCES) \ + $(QEMU_DRIVER_SOURCES) \ + $(SECRET_DRIVER_SOURCES) \ + $(STORAGE_DRIVER_SOURCES) \ + $(UML_DRIVER_SOURCES) \ + $(XEN_DRIVER_SOURCES) \ + $(NULL) + check-driverimpls: $(AM_V_GEN)$(PERL) $(srcdir)/check-driverimpls.pl \ $(DRIVER_SOURCE_FILES) -EXTRA_DIST += check-driverimpls.pl +check-aclrules: + $(AM_V_GEN)$(PERL) $(srcdir)/check-aclrules.pl \ + $(STATEFUL_DRIVER_SOURCE_FILES) + +EXTRA_DIST += check-driverimpls.pl check-aclrules.pl check-local: check-protocol check-symfile check-symsorting \ - check-drivername check-driverimpls + check-drivername check-driverimpls check-aclrules .PHONY: check-protocol $(PROTOCOL_STRUCTS:structs=struct) # Mock driver, covering domains, storage, networks, etc diff --git a/src/check-aclrules.pl b/src/check-aclrules.pl new file mode 100644 index 0000000..62da2b7 --- /dev/null +++ b/src/check-aclrules.pl @@ -0,0 +1,144 @@ +#!/usr/bin/perl +# +# Copyright (C) 2013 Red Hat, Inc. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library. If not, see +# <http://www.gnu.org/licenses/>. +# +# This script validates that the driver implementation of any +# public APIs contain ACL checks. +# +# As the script reads each source file, it attempts to identify +# top level function names. +# +# When reading the body of the functions, it looks for anything +# that looks like an API called named XXXEnsureACL. It will +# validate that the XXX prefix matches the name of the function +# it occurs in. +# +# When it later finds the virDriverPtr table, for each entry +# point listed, it will validate if there was a previously +# detected EnsureACL call recorded. +# +use strict; +use warnings; + +my $status = 0; + +my $brace = 0; +my $maybefunc; +my $intable = 0; +my $table; + +my %acls; + +my %whitelist = ( + "connectClose" => 1, + "connectIsEncrypted" => 1, + "connectIsSecure" => 1, + "connectIsAlive" => 1, + "networkOpen" => 1, + "networkClose" => 1, + "nwfilterOpen" => 1, + "nwfilterClose" => 1, + "secretOpen" => 1, + "secretClose" => 1, + "storageOpen" => 1, + "storageClose" => 1, + "interfaceOpen" => 1, + "interfaceClose" => 1, + ); + +my $lastfile; + +while (<>) { + if (!defined $lastfile || + $lastfile ne $ARGV) { + %acls = (); + $brace = 0; + $maybefunc = undef; + $lastfile = $ARGV; + } + if ($brace == 0) { + # Looks for anything which appears to be a function + # body name. Doesn't matter if we pick up bogus stuff + # here, as long as we don't miss valid stuff + if (m,\b(\w+)\(,) { + $maybefunc = $1; + } + } elsif ($brace > 0) { + if (m,(\w+)EnsureACL,) { + # Record the fact that maybefunc contains an + # ACL call, and make sure it is the right call! + my $func = $1; + $func =~ s/^vir//; + if (!defined $maybefunc) { + print "$ARGV:$. Unexpected check '$func' outside function\n"; + $status = 1; + } else { + unless ($maybefunc =~ /$func$/i) { + print "$ARGV:$. Mismatch check 'vir${func}EnsureACL' for function '$maybefunc'\n"; + $status = 1; + } + } + $acls{$maybefunc} = 1; + } elsif (m,\b(\w+)\(,) { + # Handles case where we replaced an API with a new + # one which adds new parameters, and we're left with + # a simple stub calling the new API. + my $callfunc = $1; + if (exists $acls{$callfunc}) { + $acls{$maybefunc} = 1; + } + } + } + + # Pass the vir*DriverPtr tables and make sure that + # every func listed there, has an impl which calls + # an ACL function + if ($intable) { + if (/\}/) { + $intable = 0; + $table = undef; + } elsif (/\.(\w+)\s*=\s*(\w+),?/) { + my $api = $1; + my $impl = $2; + + if ($api ne "no" && + $api ne "name" && + $table ne "virStateDriver" && + !exists $acls{$impl} && + !exists $whitelist{$api}) { + print "$ARGV:$. Missing ACL check in function '$impl' for '$api'\n"; + $status = 1; + } + } + } elsif (/^(?:static\s+)?(vir(?:\w+)?Driver)\s+/) { + if ($1 ne "virNWFilterCallbackDriver" && + $1 ne "virNWFilterTechDriver" && + $1 ne "virDomainConfNWFilterDriver") { + $intable = 1; + $table = $1; + } + } + + + my $count; + $count = s/{//g; + $brace += $count; + $count = s/}//g; + $brace -= $count; +} + +exit $status; -- 1.8.1.4