Since vm->def->os.kernel (the normal place the path is found) is null during a domain restore, use the stdin_path that is passed into SELinuxSetSecurityAllLabel instead. Also restore the label to its original value after qemu is finished with the file. Prior to this patch, qemu domain restore did not function properly if selinux was set to enforce. --- src/qemu/qemu_driver.c | 6 +++++- src/security/security_selinux.c | 12 ++++++++---- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9f4e082..9140b50 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6208,7 +6208,6 @@ error: return -1; } -/* TODO: check seclabel restore */ static int ATTRIBUTE_NONNULL(6) qemudDomainSaveImageStartVM(virConnectPtr conn, struct qemud_driver *driver, @@ -6320,6 +6319,11 @@ qemudDomainSaveImageStartVM(virConnectPtr conn, ret = 0; out: + if (driver->securityDriver && + driver->securityDriver->domainRestoreSavedStateLabel && + driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1) + VIR_WARN("failed to restore save state label on %s", path); + return ret; } diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 2b43f2d..7500f1d 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -859,7 +859,7 @@ SELinuxClearSecuritySocketLabel(virSecurityDriverPtr drv, } static int -SELinuxSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path ATTRIBUTE_UNUSED) +SELinuxSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; int i; @@ -882,9 +882,13 @@ SELinuxSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path ATTRIBUTE_ return -1; } - if (vm->def->os.kernel && - SELinuxSetFilecon(vm->def->os.kernel, default_content_context) < 0) - return -1; + if (vm->def->os.kernel) { + if (SELinuxSetFilecon(vm->def->os.kernel, default_content_context) < 0) + return -1; + } else if (stdin_path) { + if (SELinuxSetFilecon(stdin_path, default_content_context) < 0) + return -1; + } if (vm->def->os.initrd && SELinuxSetFilecon(vm->def->os.initrd, default_content_context) < 0) -- 1.7.1

This code was previously used inline during qemudDomainSaveFlag. This patch moves it into a utility function in preparation for it to be used elsewhere. --- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 83 +++++++++++++--------------------------------- src/util/util.c | 67 +++++++++++++++++++++++++++++++++++++ src/util/util.h | 2 + 4 files changed, 93 insertions(+), 60 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 4e61e55..06fa319 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -672,6 +672,7 @@ virParseMacAddr; virFileDeletePid; virFindFileInPath; virFileExists; +virFileIsOnNetworkShare; virFileHasSuffix; virFileLinkPointsTo; virFileMakePath; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9140b50..6bbc94b 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -46,13 +46,6 @@ #include <sys/ioctl.h> #include <sys/un.h> -#ifdef __linux__ -# include <sys/vfs.h> -# ifndef NFS_SUPER_MAGIC -# define NFS_SUPER_MAGIC 0x6969 -# endif /* NFS_SUPER_MAGIC */ -#endif /* __linux__ */ - #include "virterror_internal.h" #include "logging.h" #include "datatypes.h" @@ -5069,62 +5062,32 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, goto endjob; } -#ifdef __linux__ /* On Linux we can also verify the FS-type of the directory. */ - char *dirpath, *p; - struct statfs st; - int statfs_ret; - - if ((dirpath = strdup(path)) == NULL) { - virReportOOMError(); - goto endjob; - } - - do { - // Try less and less of the path until we get to a - // directory we can stat. Even if we don't have 'x' - // permission on any directory in the path on the NFS - // server (assuming it's NFS), we will be able to stat the - // mount point, and that will properly tell us if the - // fstype is NFS. - - if ((p = strrchr(dirpath, '/')) == NULL) { - qemuReportError(VIR_ERR_INVALID_ARG, - _("Invalid relative path '%s' for domain save file"), - path); - VIR_FREE(dirpath); - goto endjob; - } - - if (p == dirpath) - *(p+1) = '\0'; - else - *p = '\0'; - - statfs_ret = statfs(dirpath, &st); - - } while ((statfs_ret == -1) && (p != dirpath)); - - if (statfs_ret == -1) { - virReportSystemError(errno, - _("Failed to create domain save file " - "'%s': statfs of all elements of path " - "failed"), - path); - VIR_FREE(dirpath); - goto endjob; - } + switch (virFileIsOnNetworkShare(path)) { + case 1: + /* it was on a network share, so we'll continue + * as outlined above + */ + break; + + case -1: + virReportSystemError(errno, + _("Failed to create domain save file " + "'%s': couldn't determine fs type"), + path); + goto endjob; + break; + + case 0: + default: + /* local file - log the error returned by virFileOperation */ + virReportSystemError(rc, + _("Failed to create domain save file '%s'"), + path); + goto endjob; + break; - if (st.f_type != NFS_SUPER_MAGIC) { - virReportSystemError(rc, - _("Failed to create domain save file '%s'" - " (fstype of '%s' is 0x%X"), - path, dirpath, (unsigned int) st.f_type); - VIR_FREE(dirpath); - goto endjob; } - VIR_FREE(dirpath); -#endif /* Retry creating the file as driver->user */ diff --git a/src/util/util.c b/src/util/util.c index 445fd4e..bf6ea30 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -48,6 +48,13 @@ #endif #include "c-ctype.h" +#ifdef __linux__ +# include <sys/vfs.h> +# ifndef NFS_SUPER_MAGIC +# define NFS_SUPER_MAGIC 0x6969 +# endif /* NFS_SUPER_MAGIC */ +#endif /* __linux__ */ + #ifdef HAVE_PATHS_H # include <paths.h> #endif @@ -1258,6 +1265,66 @@ int virFileExists(const char *path) return(0); } +int virFileIsOnNetworkShare(const char *path) +{ +#ifdef __linux__ + char *dirpath, *p; + struct statfs st; + int ret = -1, statfs_ret; + + if ((dirpath = strdup(path)) == NULL) { + virReportOOMError(); + goto error; + } + + do { + /* Try less and less of the path until we get to a + * directory we can stat. Even if we don't have 'x' + * permission on any directory in the path on the NFS + * server (assuming it's NFS), we will be able to stat the + * mount point, and that will properly tell us if the + * fstype is NFS. + */ + + if ((p = strrchr(dirpath, '/')) == NULL) { + virUtilError(VIR_ERR_INVALID_ARG, + _("Invalid relative path '%s'"), path); + goto error; + } + + if (p == dirpath) + *(p+1) = '\0'; + else + *p = '\0'; + + statfs_ret = statfs(dirpath, &st); + + } while ((statfs_ret == -1) && (p != dirpath)); + + if (statfs_ret == -1) { + virReportSystemError(errno, + _("statfs of all elements of path %s failed"), + path); + goto error; + } + + if (st.f_type == NFS_SUPER_MAGIC) { + ret = 1; + } else { + VIR_WARN("fstype of '%s' unrecognized (0x%X)", + dirpath, (unsigned int) st.f_type); + ret = 0; + } + +error: + VIR_FREE(dirpath); + return ret; + +#else + return 1; +#endif +} + # ifndef WIN32 static int virFileOperationNoFork(const char *path, int openflags, mode_t mode, uid_t uid, gid_t gid, diff --git a/src/util/util.h b/src/util/util.h index 476eac4..494c88a 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -118,6 +118,8 @@ char *virFindFileInPath(const char *file); int virFileExists(const char *path); +int virFileIsOnNetworkShare(const char *path); + char *virFileSanitizePath(const char *path); enum { -- 1.7.1

When the saved domain image is on an NFS share, at least some part of domainSetSecurityAllLabel will fail (for example, selinux labels can't be modified). To allow domain restore to still work in this case, just ignore the errors. --- src/qemu/qemu_driver.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6bbc94b..6dbcf6e 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -3368,8 +3368,10 @@ static int qemudStartVMDaemon(virConnectPtr conn, DEBUG0("Generating setting domain security labels (if required)"); if (driver->securityDriver && driver->securityDriver->domainSetSecurityAllLabel && - driver->securityDriver->domainSetSecurityAllLabel(vm, stdin_path) < 0) - goto cleanup; + driver->securityDriver->domainSetSecurityAllLabel(vm, stdin_path) < 0) { + if (virFileIsOnNetworkShare(stdin_path) != 1) + goto cleanup; + } /* Ensure no historical cgroup for this VM is lying around bogus * settings */ -- 1.7.1