[libvirt] This patch is needed for openshift domains to run ps command
I thought I sent this patch before, but I can not find a record of it, and do not see it in upstream. [PATCH] Change label of fusefs mounted at /proc/meminfo in lxc
From: Dan Walsh <dwalsh@redhat.com> We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t. --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index ac0f69c..bba2e3a 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif +#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -763,6 +767,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret; +#if WITH_SELINUX + if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + } +#endif if ((ret = mount(meminfo_path, "/proc/meminfo", NULL, MS_BIND, NULL)) < 0) { virReportSystemError(errno, -- 1.8.2.1
On Wed, May 15, 2013 at 09:46:29AM -0400, dwalsh@redhat.com wrote:
From: Dan Walsh <dwalsh@redhat.com>
We do not want to allow contained applications to be able to read fusefs_t. So we want /proc/meminfo label to match the system default proc_t. --- src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index ac0f69c..bba2e3a 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif
+#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -763,6 +767,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret;
+#if WITH_SELINUX + if (is_selinux_enabled() > 0) { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret) {
This error handling is broken. The man page says 'On success, a positive number is returned indicating the size of the extended attribute value. On failure, -1 is returned and errno is set appropriately.' so you must use 'if (ret < 0) {' for detecting errors.
+ virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret;
Return -1;
+ } + ret = setfilecon(meminfo_path, scon); + freecon(scon); + if (ret) {
And again here.
+ virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret;
Return -1;
+ } + } +#endif if ((ret = mount(meminfo_path, "/proc/meminfo", NULL, MS_BIND, NULL)) < 0) { virReportSystemError(errno,
Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
participants (2)
-
Daniel P. Berrange -
dwalsh＠redhat.com