Trying to disable <seclabel> for the whole <domain> and _also_ disable <seclabel> at the <disk> level will fail with: error: unsupported configuration: label overrides require relabeling to be enabled at the domain level which seems wrong. Instead skip the validation when disk seclabel has relabel='no', that config should always be valid. Signed-off-by: Cole Robinson <crobinso@redhat.com> --- src/conf/domain_validate.c | 5 +++ ...l-selinux-none-override.x86_64-latest.args | 35 +++++++++++++++ ...el-selinux-none-override.x86_64-latest.xml | 43 +++++++++++++++++++ .../seclabel-selinux-none-override.xml | 30 +++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 114 insertions(+) create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.xml diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 93a2bc9b01..eea9b38b21 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -303,6 +303,11 @@ virSecurityDeviceLabelDefValidate(virSecurityDeviceLabelDef **seclabels, for (i = 0; i < nseclabels; i++) { seclabel = seclabels[i]; + /* relabel='no' is always valid to request, regardless of + * domain level <seclabel> config */ + if (!seclabel->relabel) + continue; + /* find the security label that it's being overridden */ for (j = 0; j < nvmSeclabels; j++) { if (STRNEQ_NULLABLE(vmSeclabels[j]->model, seclabel->model)) diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args new file mode 100644 index 0000000000..23beb54806 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ +-accel tcg \ +-cpu qemu64 \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml new file mode 100644 index 0000000000..15049a8a32 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml @@ -0,0 +1,43 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'> + <seclabel model='selinux' relabel='no'/> + </source> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </memballoon> + </devices> + <seclabel type='none' model='selinux'/> +</domain> diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml new file mode 100644 index 0000000000..2a174e8495 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml @@ -0,0 +1,30 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'> + <seclabel model='selinux' relabel='no'/> + </source> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <memballoon model='virtio'/> + </devices> + <seclabel type='none' model='selinux'/> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 55c622176a..cdcab3fa5d 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2609,6 +2609,7 @@ mymain(void) DO_TEST_CAPS_LATEST("seclabel-static-labelskip"); DO_TEST_CAPS_LATEST("seclabel-none"); DO_TEST_CAPS_LATEST("seclabel-dac-none"); + DO_TEST_CAPS_LATEST("seclabel-selinux-none-override"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-multiple"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-duplicates"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-relabel-invalid"); -- 2.51.0