[libvirt] Resend with corrected error handling
[PATCH] Change label of fusefs mounted at /proc/meminfo in lxc
From: Dan Walsh <dwalsh@redhat.com> We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t. Fix checking of error codes --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8e1d10a..8c0edb0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif +#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -761,6 +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret; +#if WITH_SELINUX + if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + } +#endif if ((ret = mount(meminfo_path, "/proc/meminfo", NULL, MS_BIND, NULL)) < 0) { virReportSystemError(errno, -- 1.8.2.1
On Wed, May 15, 2013 at 10:35:48AM -0400, dwalsh@redhat.com wrote:
From: Dan Walsh <dwalsh@redhat.com>
We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t.
Fix checking of error codes --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8e1d10a..8c0edb0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif
+#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -761,6 +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret;
+#if WITH_SELINUX + if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + } +#endif
ACK, though check it passes "make syntax-check" before pushing Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
On 15.05.2013 16:35, dwalsh@redhat.com wrote:
From: Dan Walsh <dwalsh@redhat.com>
We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t.
Fix checking of error codes --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8e1d10a..8c0edb0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif
+#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -761,6 +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret;
+#if WITH_SELINUX
indent
+ if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + } +#endif
indent
if ((ret = mount(meminfo_path, "/proc/meminfo", NULL, MS_BIND, NULL)) < 0) { virReportSystemError(errno,
Ran 'syntax-check' and pushed now with this squashed in: diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index cefa18d..461eb5f 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -760,7 +760,7 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def) def->name)) < 0) return ret; -#if WITH_SELINUX +# if WITH_SELINUX if (is_selinux_enabled() > 0) { security_context_t scon; ret = getfilecon("/proc/meminfo", &scon); @@ -779,7 +779,7 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def) return ret; } } -#endif +# endif if ((ret = mount(meminfo_path, "/proc/meminfo", NULL, MS_BIND, NULL)) < 0) { virReportSystemError(errno, Michal
On Wed, May 15, 2013 at 10:35:48AM -0400, dwalsh@redhat.com wrote:
From: Dan Walsh <dwalsh@redhat.com>
We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t.
Fix checking of error codes --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8e1d10a..8c0edb0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif
+#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -761,6 +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret;
+#if WITH_SELINUX + if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path);
So I'm not unable to start any containers with this patch applied: 2013-05-16 16:01:47.835+0000: 1: error : lxcContainerMountProcFuse:787 : Failed to set security context of /.oldroot//run/libvirt/lxc/busy.fuse/meminfo for /proc/meminfo mount point: Operation not supported What distro + kernel version did you test this with ? I'm using current F19 with kernel 3.9.0-0.rc8.git0.2.fc19.x86_64 when I see the failure Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
On Thu, May 16, 2013 at 05:04:06PM +0100, Daniel P. Berrange wrote:
On Wed, May 15, 2013 at 10:35:48AM -0400, dwalsh@redhat.com wrote:
From: Dan Walsh <dwalsh@redhat.com>
We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t.
Fix checking of error codes --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8e1d10a..8c0edb0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif
+#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -761,6 +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret;
+#if WITH_SELINUX + if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path);
So I'm not unable to start any containers with this patch applied:
2013-05-16 16:01:47.835+0000: 1: error : lxcContainerMountProcFuse:787 : Failed to set security context of /.oldroot//run/libvirt/lxc/busy.fuse/meminfo for /proc/meminfo mount point: Operation not supported
What distro + kernel version did you test this with ? I'm using current F19 with kernel 3.9.0-0.rc8.git0.2.fc19.x86_64 when I see the failure
Indeed, even trying to change it manually fails # chcon system_u:object_r:proc_t:s0 /proc/8180/root/proc/meminfo chcon: failed to change context of ‘/proc/8180/root/proc/meminfo’ to ‘system_u:object_r:proc_t:s0’: Operation not supported Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/16/2013 12:09 PM, Daniel P. Berrange wrote:
On Thu, May 16, 2013 at 05:04:06PM +0100, Daniel P. Berrange wrote:
On Wed, May 15, 2013 at 10:35:48AM -0400, dwalsh@redhat.com wrote:
From: Dan Walsh <dwalsh@redhat.com>
We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t.
Fix checking of error codes --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8e1d10a..8c0edb0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif
+#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -761,6 +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret;
+#if WITH_SELINUX + if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret < 0) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path);
So I'm not unable to start any containers with this patch applied:
2013-05-16 16:01:47.835+0000: 1: error : lxcContainerMountProcFuse:787 : Failed to set security context of /.oldroot//run/libvirt/lxc/busy.fuse/meminfo for /proc/meminfo mount point: Operation not supported
What distro + kernel version did you test this with ? I'm using current F19 with kernel 3.9.0-0.rc8.git0.2.fc19.x86_64 when I see the failure
Indeed, even trying to change it manually fails
# chcon system_u:object_r:proc_t:s0 /proc/8180/root/proc/meminfo chcon: failed to change context of ‘/proc/8180/root/proc/meminfo’ to ‘system_u:object_r:proc_t:s0’: Operation not supported
Daniel
Revert the patch, I could swear this was working before, but it is not now. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlGVSSYACgkQrlYvE4MpobMxAQCgwgqT48d06kj5pnndBcAB+FHn 0TkAn3bBKSduOnIIrNTcTkAOLBtpWjje =gVQV -----END PGP SIGNATURE-----
participants (4)
-
Daniel J Walsh -
Daniel P. Berrange -
dwalsh＠redhat.com
-
Michal Privoznik