https://bugzilla.redhat.com/show_bug.cgi?id=1027096#c8 There are two ways in which security model can make it way into <seclabel/>. One is as the @model attribute, the second one is via security_driver knob in qemu.conf. Then, while parsing <seclabel/> several checks and fix ups of old, stale combinations are performed. However, iff @model is specified. They are not done in the latter case. So it's still possible to feed libvirt with senseless combinations (if qemu.conf is adjusted correctly). One example of a seclabel that needs some adjustment (in case security_driver=none in qemu.conf) is: <seclabel type='dynamic' relabel='yes'/> The fixup code is copied from virSecurityLabelDefParseXML (covering the former case) into virSecurityLabelDefsParseXML (which handles the latter case). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> --- src/conf/domain_conf.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 53ef694..4a74f2a 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4974,6 +4974,13 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, host->secModels[0].model); if (VIR_STRDUP(def->seclabels[0]->model, host->secModels[0].model) < 0) goto error; + + if (STREQ(def->seclabels[0]->model, "none") && + flags & VIR_DOMAIN_XML_INACTIVE) { + /* Fix older configurations */ + def->seclabels[0]->type = VIR_DOMAIN_SECLABEL_NONE; + def->seclabels[0]->relabel = false; + } } else { virReportError(VIR_ERR_XML_ERROR, "%s", _("missing security model in domain seclabel")); -- 1.8.5.5

This commit is rather big. Firstly, the in memory config representation is adjusted like if security_driver was set to "none". The rest is then just adaptation to the new code that will generate different seclabels. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> --- .../qemuhotplug-hotplug-base+disk-scsi.xml | 2 +- .../qemuhotplug-hotplug-base+disk-usb.xml | 2 +- .../qemuhotplug-hotplug-base+disk-virtio.xml | 2 +- .../qemuxml2argvdata/qemuxml2argv-hotplug-base.xml | 2 +- .../qemuxml2argv-seclabel-dynamic-none-relabel.xml | 53 ++++++++++++++++++++++ ...emuxml2xmlout-seclabel-dynamic-none-relabel.xml | 53 ++++++++++++++++++++++ .../qemuxml2xmlout-seclabel-dynamic-relabel.xml | 28 ++++++++++++ .../qemuxml2xmlout-seclabel-none.xml | 28 ++++++++++++ tests/qemuxml2xmltest.c | 5 +- tests/testutilsqemu.c | 10 ++++ 10 files changed, 179 insertions(+), 6 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-seclabel-dynamic-none-relabel.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-none-relabel.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-relabel.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-none.xml diff --git a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-scsi.xml b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-scsi.xml index a06158b..ca46e5a 100644 --- a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-scsi.xml +++ b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-scsi.xml @@ -42,5 +42,5 @@ </controller> <memballoon model='none'/> </devices> - <seclabel type='none'/> + <seclabel type='none' model='none'/> </domain> diff --git a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-usb.xml b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-usb.xml index 1ea0f88..7904c4f 100644 --- a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-usb.xml +++ b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-usb.xml @@ -41,5 +41,5 @@ </controller> <memballoon model='none'/> </devices> - <seclabel type='none'/> + <seclabel type='none' model='none'/> </domain> diff --git a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-virtio.xml b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-virtio.xml index e96055c..f3d0351 100644 --- a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-virtio.xml +++ b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base+disk-virtio.xml @@ -42,5 +42,5 @@ </controller> <memballoon model='none'/> </devices> - <seclabel type='none'/> + <seclabel type='none' model='none'/> </domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-hotplug-base.xml b/tests/qemuxml2argvdata/qemuxml2argv-hotplug-base.xml index bfb0167..f1a5500 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-hotplug-base.xml +++ b/tests/qemuxml2argvdata/qemuxml2argv-hotplug-base.xml @@ -34,5 +34,5 @@ </controller> <memballoon model='none'/> </devices> - <seclabel type='none'/> + <seclabel type='none' model='none'/> </domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-seclabel-dynamic-none-relabel.xml b/tests/qemuxml2argvdata/qemuxml2argv-seclabel-dynamic-none-relabel.xml new file mode 100644 index 0000000..47f253b --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-seclabel-dynamic-none-relabel.xml @@ -0,0 +1,53 @@ +<domain type='kvm'> + <name>migt10</name> + <uuid>0d73c5c3-43d0-f75b-31de-6aa919b0176b</uuid> + <memory unit='KiB'>262144</memory> + <currentMemory unit='KiB'>262144</currentMemory> + <memoryBacking> + <hugepages> + <page size='2048' unit='KiB' nodeset='0'/> + </hugepages> + </memoryBacking> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='x86_64' machine='pc-i440fx-2.1'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='virtio-serial' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <channel type='spicevmc'> + <target type='virtio' name='com.redhat.spice.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <graphics type='spice' autoport='yes' listen='0.0.0.0'> + <listen type='address' address='0.0.0.0'/> + </graphics> + <video> + <model type='cirrus' vram='8192' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </memballoon> + </devices> + <seclabel type='dynamic' relabel='yes'/> +</domain> diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-none-relabel.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-none-relabel.xml new file mode 100644 index 0000000..1b36533 --- /dev/null +++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-none-relabel.xml @@ -0,0 +1,53 @@ +<domain type='kvm'> + <name>migt10</name> + <uuid>0d73c5c3-43d0-f75b-31de-6aa919b0176b</uuid> + <memory unit='KiB'>262144</memory> + <currentMemory unit='KiB'>262144</currentMemory> + <memoryBacking> + <hugepages> + <page size='2048' unit='KiB' nodeset='0'/> + </hugepages> + </memoryBacking> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='x86_64' machine='pc-i440fx-2.1'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='virtio-serial' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <channel type='spicevmc'> + <target type='virtio' name='com.redhat.spice.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <graphics type='spice' autoport='yes' listen='0.0.0.0'> + <listen type='address' address='0.0.0.0'/> + </graphics> + <video> + <model type='cirrus' vram='8192' heads='1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </memballoon> + </devices> + <seclabel type='none' model='none'/> +</domain> diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-relabel.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-relabel.xml new file mode 100644 index 0000000..cec59f8 --- /dev/null +++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-dynamic-relabel.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <memballoon model='virtio'/> + </devices> + <seclabel type='none' model='none'/> +</domain> diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-none.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-none.xml new file mode 100644 index 0000000..cec59f8 --- /dev/null +++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-none.xml @@ -0,0 +1,28 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <memballoon model='virtio'/> + </devices> + <seclabel type='none' model='none'/> +</domain> diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c index b4ab671..03c05da 100644 --- a/tests/qemuxml2xmltest.c +++ b/tests/qemuxml2xmltest.c @@ -315,12 +315,13 @@ mymain(void) DO_TEST_FULL("seclabel-dynamic-baselabel", false, WHEN_INACTIVE); DO_TEST_FULL("seclabel-dynamic-override", false, WHEN_INACTIVE); DO_TEST_FULL("seclabel-dynamic-labelskip", true, WHEN_INACTIVE); - DO_TEST_FULL("seclabel-dynamic-relabel", false, WHEN_INACTIVE); + DO_TEST_FULL("seclabel-dynamic-relabel", true, WHEN_INACTIVE); DO_TEST("seclabel-static"); DO_TEST_FULL("seclabel-static-labelskip", false, WHEN_ACTIVE); - DO_TEST("seclabel-none"); + DO_TEST_DIFFERENT("seclabel-none"); DO_TEST("seclabel-dac-none"); DO_TEST("seclabel-dynamic-none"); + DO_TEST_FULL("seclabel-dynamic-none-relabel", true, WHEN_INACTIVE); DO_TEST("numad-static-vcpu-no-numatune"); DO_TEST("disk-scsi-lun-passthrough-sgio"); diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index 52abb8c..7b26e50 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -252,6 +252,16 @@ virCapsPtr testQemuCapsInit(void) false, false)) == NULL) return NULL; + /* Add dummy 'none' security_driver. This is equal to setting + * security_driver = "none" in qemu.conf. */ + if (VIR_ALLOC_N(caps->host.secModels, 1) < 0) + goto cleanup; + caps->host.nsecModels = 1; + + if (VIR_STRDUP(caps->host.secModels[0].model, "none") < 0 || + VIR_STRDUP(caps->host.secModels[0].doi, "0") < 0) + goto cleanup; + if ((caps->host.cpu = virCPUDefCopy(&host_cpu)) == NULL || (machines = testQemuAllocMachines(&nmachines)) == NULL) goto cleanup; -- 1.8.5.5