[libvirt] [PATCH] security: Skip labeling resources when seclabel defaults to none

[Daniel P. Berrange]

On Wed, Jul 25, 2012 at 03:30:28PM +0200, Jiri Denemark wrote:
> If a domain is explicitly configured with <seclabel type="none"/> we
> correctly ensure that no labeling will be done by setting
> norelabel=true. However, if no seclabel element is present in domain XML
> and hypervisor is configured not to confine domains by default, we only
> set type to "none" without turning off relabeling. Thus if such a domain
> is being started, security driver wants to relabel resources with
> default label, which doesn't make any sense.
> 
> Moreover, with SELinux security driver, the generated image label lacks
> "s0" sensitivity, which causes setfilecon() fail with EINVAL in
> enforcing mode.
> ---
>  src/security/security_manager.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/src/security/security_manager.c b/src/security/security_manager.c
> index 2e1be4d..44ab6fb 100644
> --- a/src/security/security_manager.c
> +++ b/src/security/security_manager.c
> @@ -309,10 +309,12 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr,
>                                 virDomainDefPtr vm)
>  {
>      if (vm->seclabel.type == VIR_DOMAIN_SECLABEL_DEFAULT) {
> -        if (mgr->defaultConfined)
> +        if (mgr->defaultConfined) {
>              vm->seclabel.type = VIR_DOMAIN_SECLABEL_DYNAMIC;
> -        else
> +        } else {
>              vm->seclabel.type = VIR_DOMAIN_SECLABEL_NONE;
> +            vm->seclabel.norelabel = true;
> +        }
>      }
>  
>      if ((vm->seclabel.type == VIR_DOMAIN_SECLABEL_NONE) &&

ACK, I see if the user requested type=none in the XML, then we
have already set norelabel = true, in the XML parser.


Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|