1:51 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
lxc-enter-namespace allows a process from outside a container to start a
process inside a container. One problem with the current code is the process
running within the container would run with the label of the process that
created it.
For example if the admin process is running as unconfined_t and executes the
following command
# virsh -c lxc:/// lxc-enter-namespace --nolabel dan -- /bin/ps -eZ
LABEL PID TTY TIME CMD
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 1 pts/0 00:00:00 systemd
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 3 pts/1 00:00:00 sh
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 24 ? 00:00:00 systemd-journal
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 29 ? 00:00:00 dhclient
staff_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 47 ? 00:00:00 ps
Note the ps command is running as unconfined_t, After this patch,
virsh -c lxc:/// lxc-enter-namespace dan -- /bin/ps -eZ
LABEL PID TTY TIME CMD
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 1 pts/0 00:00:00 systemd
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 3 pts/1 00:00:00 sh
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 24 ? 00:00:00 systemd-journal
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 32 ? 00:00:00 dhclient
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 38 ? 00:00:00 ps
I also add a --nolabel command to virsh, which can go back to the original
behaviour.
virsh -c lxc:/// lxc-enter-namespace --nolabel dan -- /bin/ps -eZ
LABEL PID TTY TIME CMD
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 1 pts/0 00:00:00 systemd
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 3 pts/1 00:00:00 sh
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 24 ? 00:00:00 systemd-journal
system_u:system_r:svirt_lxc_net_t:s0:c0.c1023 32 ? 00:00:00 dhclient
staff_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 37 ? 00:00:00 ps
One problem I had when I originally did the patch is
lxcDomainGetSecurityLabel was returning the incorrect label, I needed the
label of the initpid within the container not its parent process, so I
changed this function to match OpenNamespaces function.
One last strangeness, about half the time I run this, virsh hangs and never
returns.
Seems like
if (conn->driver->domainGetSecurityLabel(domain,
seclabel) == 0) {
Gets hung up. I have attached the strace in out1.gz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlE476kACgkQrlYvE4MpobMW8QCeMwkx5uzMgQdJbNqnyiOa62+Y
JNIAnA8ZZRhjlqMIRAy5/RbMc1g3Wxv1
=cSsv
-----END PGP SIGNATURE-----
12:30 p.m.
On Thu, Mar 07, 2013 at 02:51:05PM -0500, Daniel J Walsh wrote:
One last strangeness, about half the time I run this, virsh hangs and
never
returns.
Seems like
if (conn->driver->domainGetSecurityLabel(domain,
seclabel) == 0) {
Gets hung up. I have attached the strace in out1.gz
This is because you are trying to invoke libvirt RPC calls in the
fork()d child process. Now you have both the child & parent trying
to use the same libvirt socket FD, which means it is random which
will see the incoming I/O.
+static int
+virDomainSetDefaultSecurityLabel(virDomainPtr domain)
+{
+ int rc = 0;
+ virSecurityLabelPtr seclabel;
+ if (VIR_ALLOC(seclabel) < 0)
+ return -1;
+
+ if (virDomainGetSecurityLabel(domain, seclabel))
+ return -1;
This causes libvirt todo RPC calls
@@ -135,7 +168,12 @@ virDomainLxcEnterNamespace(virDomainPtr domain,
{
int i;
- virCheckFlags(0, -1);
+ virCheckFlags(SECURITY_LABEL, -1);
+
+ if (flags & SECURITY_LABEL) {
+ if (virDomainSetDefaultSecurityLabel(domain) < 0)
+ goto error;
+ }
And this is running in the child process.
As with the enter namespace code, we need to split the functionality.
virsh needs to call virDomainGetSecurityLabel before fork, and then
invoke an API to apply the security label after fork.
I've CC'd you on a patch which takes that approach.
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
4274
days inactive
4279
days old
1 comments
2 participants
participants (2)
-
Daniel J Walsh -
Daniel P. Berrange