security_selinux.c 80.8 KB
Newer Older
1
/*
2
 * Copyright (C) 2008-2014 Red Hat, Inc.
3 4 5 6 7 8
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
O
Osier Yang 已提交
9 10 11 12 13 14
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
15
 * License along with this library.  If not, see
O
Osier Yang 已提交
16 17
 * <http://www.gnu.org/licenses/>.
 *
18 19
 * Authors:
 *     James Morris <jmorris@namei.org>
20
 *     Dan Walsh <dwalsh@redhat.com>
21 22 23 24 25 26 27 28 29
 *
 * SELinux security driver.
 */
#include <config.h>
#include <selinux/selinux.h>
#include <selinux/context.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
E
Eric Blake 已提交
30 31 32
#if HAVE_SELINUX_LABEL_H
# include <selinux/label.h>
#endif
33

34
#include "security_driver.h"
35
#include "security_selinux.h"
36
#include "virerror.h"
37
#include "viralloc.h"
38
#include "virlog.h"
39
#include "virpci.h"
40
#include "virusb.h"
41
#include "virscsi.h"
42
#include "virstoragefile.h"
E
Eric Blake 已提交
43
#include "virfile.h"
44
#include "virhash.h"
45
#include "virrandom.h"
46
#include "virconf.h"
47
#include "virtpm.h"
48
#include "virstring.h"
D
Daniel P. Berrange 已提交
49 50 51

#define VIR_FROM_THIS VIR_FROM_SECURITY

52 53
VIR_LOG_INIT("security.security_selinux");

54 55 56 57 58 59 60
#define MAX_CONTEXT 1024

typedef struct _virSecuritySELinuxData virSecuritySELinuxData;
typedef virSecuritySELinuxData *virSecuritySELinuxDataPtr;

struct _virSecuritySELinuxData {
    char *domain_context;
61
    char *alt_domain_context;
62 63
    char *file_context;
    char *content_context;
64
    virHashTablePtr mcs;
65
    bool skipAllLabel;
66 67 68
#if HAVE_SELINUX_LABEL_H
    struct selabel_handle *label_handle;
#endif
69 70
};

71 72 73
/* Data structure to pass to various callbacks so we have everything we need */
typedef struct _virSecuritySELinuxCallbackData virSecuritySELinuxCallbackData;
typedef virSecuritySELinuxCallbackData *virSecuritySELinuxCallbackDataPtr;
74

75
struct _virSecuritySELinuxCallbackData {
76 77 78 79
    virSecurityManagerPtr mgr;
    virDomainDefPtr def;
};

80 81 82
#define SECURITY_SELINUX_VOID_DOI       "0"
#define SECURITY_SELINUX_NAME "selinux"

83
static int
84 85 86
virSecuritySELinuxRestoreTPMFileLabelInt(virSecurityManagerPtr mgr,
                                         virDomainDefPtr def,
                                         virDomainTPMDefPtr tpm);
87 88


89 90 91
/*
 * Returns 0 on success, 1 if already reserved, or -1 on fatal error
 */
92
static int
93 94
virSecuritySELinuxMCSAdd(virSecurityManagerPtr mgr,
                         const char *mcs)
95
{
96
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
97

98 99 100 101
    if (virHashLookup(data->mcs, mcs))
        return 1;

    if (virHashAddEntry(data->mcs, mcs, (void*)0x1) < 0)
102
        return -1;
103

104 105 106
    return 0;
}

107 108 109
static void
virSecuritySELinuxMCSRemove(virSecurityManagerPtr mgr,
                            const char *mcs)
110
{
111 112 113
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);

    virHashRemoveEntry(data->mcs, mcs);
114 115
}

116 117

static char *
118 119 120 121
virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr,
                          const char *sens,
                          int catMin,
                          int catMax)
122 123
{
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
124
    int catRange;
125
    char *mcs = NULL;
126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146

    /* +1 since virRandomInt range is exclusive of the upper bound */
    catRange = (catMax - catMin) + 1;

    if (catRange < 8) {
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("Category range c%d-c%d too small"),
                       catMin, catMax);
        return NULL;
    }

    VIR_DEBUG("Using sensitivity level '%s' cat min %d max %d range %d",
              sens, catMin, catMax, catRange);

    for (;;) {
        int c1 = virRandomInt(catRange);
        int c2 = virRandomInt(catRange);

        VIR_DEBUG("Try cat %s:c%d,c%d", sens, c1 + catMin, c2 + catMin);

        if (c1 == c2) {
147
            if (virAsprintf(&mcs, "%s:c%d", sens, catMin + c1) < 0)
148 149 150 151 152 153 154
                return NULL;
        } else {
            if (c1 > c2) {
                int t = c1;
                c1 = c2;
                c2 = t;
            }
155
            if (virAsprintf(&mcs, "%s:c%d,c%d", sens, catMin + c1, catMin + c2) < 0)
156 157 158 159 160 161 162 163 164 165 166 167
                return NULL;
        }

        if (virHashLookup(data->mcs, mcs) == NULL)
            break;

        VIR_FREE(mcs);
    }

    return mcs;
}

168 169 170 171

/*
 * This needs to cope with several styles of range
 *
172
 * system_u:system_r:virtd_t
173 174 175 176
 * system_u:system_r:virtd_t:s0
 * system_u:system_r:virtd_t:s0-s0
 * system_u:system_r:virtd_t:s0-s0:c0.c1023
 *
177 178
 * In the first case we'll assume s0:c0.c1023 and
 * in the next two cases, we'll assume c0.c1023 for
179 180 181
 * the category part, since that's what we're really
 * interested in. This won't work in Enforcing mode,
 * but will prevent libvirtd breaking in Permissive
N
Nehal J Wani 已提交
182
 * mode when run with a weird process label.
183
 */
184 185 186 187 188
static int
virSecuritySELinuxMCSGetProcessRange(char **sens,
                                     int *catMin,
                                     int *catMax)
{
189 190
    security_context_t ourSecContext = NULL;
    context_t ourContext = NULL;
191 192
    char *cat = NULL;
    char *tmp;
193
    const char *contextRange;
194
    int ret = -1;
195

M
Martin Kletzander 已提交
196
    if (getcon_raw(&ourSecContext) < 0) {
197 198 199 200 201 202 203 204 205 206
        virReportSystemError(errno, "%s",
                             _("Unable to get current process SELinux context"));
        goto cleanup;
    }
    if (!(ourContext = context_new(ourSecContext))) {
        virReportSystemError(errno,
                             _("Unable to parse current SELinux context '%s'"),
                             ourSecContext);
        goto cleanup;
    }
207 208
    if (!(contextRange = context_range_get(ourContext)))
        contextRange = "s0";
209

210
    if (VIR_STRDUP(*sens, contextRange) < 0)
211 212
        goto cleanup;

213 214 215 216 217
    /* Find and blank out the category part (if any) */
    tmp = strchr(*sens, ':');
    if (tmp) {
        *tmp = '\0';
        cat = tmp + 1;
218 219
    }
    /* Find and blank out the sensitivity upper bound */
220
    if ((tmp = strchr(*sens, '-')))
221 222 223
        *tmp = '\0';
    /* sens now just contains the sensitivity lower bound */

224
    /* If there was no category part, just assume c0.c1023 */
225 226
    if (!cat) {
        *catMin = 0;
227
        *catMax = 1023;
228 229 230 231
        ret = 0;
        goto cleanup;
    }

232 233 234 235 236 237 238 239 240
    /* Find & extract category min */
    tmp = cat;
    if (tmp[0] != 'c') {
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("Cannot parse category in %s"),
                       cat);
        goto cleanup;
    }
    tmp++;
241
    if (virStrToLong_i(tmp, &tmp, 10, catMin) < 0) {
242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("Cannot parse category in %s"),
                       cat);
        goto cleanup;
    }

    /* We *must* have a pair of categories otherwise
     * there's no range to allocate VM categories from */
    if (!tmp[0]) {
        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                       _("No category range available"));
        goto cleanup;
    }

    /* Find & extract category max (if any) */
    if (tmp[0] != '.') {
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("Cannot parse category in %s"),
                       cat);
        goto cleanup;
    }
    tmp++;
    if (tmp[0] != 'c') {
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("Cannot parse category in %s"),
                       cat);
        goto cleanup;
    }
    tmp++;
271
    if (virStrToLong_i(tmp, &tmp, 10, catMax) < 0) {
272 273 274 275 276 277
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("Cannot parse category in %s"),
                       cat);
        goto cleanup;
    }

278
    ret = 0;
279

280
 cleanup:
281 282
    if (ret < 0)
        VIR_FREE(*sens);
283 284
    freecon(ourSecContext);
    context_free(ourContext);
285
    return ret;
286 287
}

288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317
static char *
virSecuritySELinuxContextAddRange(security_context_t src,
                                  security_context_t dst)
{
    char *str = NULL;
    char *ret = NULL;
    context_t srccon = NULL;
    context_t dstcon = NULL;

    if (!src || !dst)
        return ret;

    if (!(srccon = context_new(src)) || !(dstcon = context_new(dst))) {
        virReportSystemError(errno, "%s",
                             _("unable to allocate security context"));
        goto cleanup;
    }

    if (context_range_set(dstcon, context_range_get(srccon)) == -1) {
        virReportSystemError(errno,
                             _("unable to set security context range '%s'"), dst);
        goto cleanup;
    }

    if (!(str = context_str(dstcon))) {
        virReportSystemError(errno, "%s",
                             _("Unable to format SELinux context"));
        goto cleanup;
    }

318
    ignore_value(VIR_STRDUP(ret, str));
319

320
 cleanup:
321 322 323 324
    if (srccon) context_free(srccon);
    if (dstcon) context_free(dstcon);
    return ret;
}
325

326
static char *
327 328 329
virSecuritySELinuxGenNewContext(const char *basecontext,
                                const char *mcs,
                                bool isObjectContext)
330
{
331
    context_t context = NULL;
332 333
    char *ret = NULL;
    char *str;
334 335 336
    security_context_t ourSecContext = NULL;
    context_t ourContext = NULL;

337 338 339
    VIR_DEBUG("basecontext=%s mcs=%s isObjectContext=%d",
              basecontext, mcs, isObjectContext);

M
Martin Kletzander 已提交
340
    if (getcon_raw(&ourSecContext) < 0) {
341 342 343 344 345 346 347 348 349 350
        virReportSystemError(errno, "%s",
                             _("Unable to get current process SELinux context"));
        goto cleanup;
    }
    if (!(ourContext = context_new(ourSecContext))) {
        virReportSystemError(errno,
                             _("Unable to parse current SELinux context '%s'"),
                             ourSecContext);
        goto cleanup;
    }
351
    VIR_DEBUG("process=%s", ourSecContext);
352 353 354 355 356 357 358 359

    if (!(context = context_new(basecontext))) {
        virReportSystemError(errno,
                             _("Unable to parse base SELinux context '%s'"),
                             basecontext);
        goto cleanup;
    }

360 361 362 363 364 365 366 367
    if (context_user_set(context,
                         context_user_get(ourContext)) != 0) {
        virReportSystemError(errno,
                             _("Unable to set SELinux context user '%s'"),
                             context_user_get(ourContext));
        goto cleanup;
    }

368 369
    if (!isObjectContext &&
        context_role_set(context,
370 371
                         context_role_get(ourContext)) != 0) {
        virReportSystemError(errno,
372
                             _("Unable to set SELinux context role '%s'"),
373 374 375 376
                             context_role_get(ourContext));
        goto cleanup;
    }

377 378 379 380 381 382 383 384 385 386 387
    if (context_range_set(context, mcs) != 0) {
        virReportSystemError(errno,
                             _("Unable to set SELinux context MCS '%s'"),
                             mcs);
        goto cleanup;
    }
    if (!(str = context_str(context))) {
        virReportSystemError(errno, "%s",
                             _("Unable to format SELinux context"));
        goto cleanup;
    }
388
    if (VIR_STRDUP(ret, str) < 0)
389
        goto cleanup;
390
    VIR_DEBUG("Generated context '%s'",  ret);
391
 cleanup:
392 393
    freecon(ourSecContext);
    context_free(ourContext);
394 395
    context_free(context);
    return ret;
396 397
}

398

399
#ifdef HAVE_SELINUX_LXC_CONTEXTS_PATH
400
static int
401
virSecuritySELinuxLXCInitialize(virSecurityManagerPtr mgr)
402 403 404 405 406 407 408
{
    virConfValuePtr scon = NULL;
    virConfValuePtr tcon = NULL;
    virConfValuePtr dcon = NULL;
    virConfPtr selinux_conf;
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);

409 410
    data->skipAllLabel = true;

411
# if HAVE_SELINUX_LABEL_H
412 413 414 415 416 417
    data->label_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0);
    if (!data->label_handle) {
        virReportSystemError(errno, "%s",
                             _("cannot open SELinux label_handle"));
        return -1;
    }
418
# endif
419

420
    if (!(selinux_conf = virConfReadFile(selinux_lxc_contexts_path(), 0)))
421
        goto error;
422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446

    scon = virConfGetValue(selinux_conf, "process");
    if (! scon || scon->type != VIR_CONF_STRING || (! scon->str)) {
        virReportSystemError(errno,
                             _("cannot read 'process' value from selinux lxc contexts file '%s'"),
                             selinux_lxc_contexts_path());
        goto error;
    }

    tcon = virConfGetValue(selinux_conf, "file");
    if (! tcon || tcon->type != VIR_CONF_STRING || (! tcon->str)) {
        virReportSystemError(errno,
                             _("cannot read 'file' value from selinux lxc contexts file '%s'"),
                             selinux_lxc_contexts_path());
        goto error;
    }

    dcon = virConfGetValue(selinux_conf, "content");
    if (! dcon || dcon->type != VIR_CONF_STRING || (! dcon->str)) {
        virReportSystemError(errno,
                             _("cannot read 'file' value from selinux lxc contexts file '%s'"),
                             selinux_lxc_contexts_path());
        goto error;
    }

447 448 449
    if (VIR_STRDUP(data->domain_context, scon->str) < 0 ||
        VIR_STRDUP(data->file_context, tcon->str) < 0 ||
        VIR_STRDUP(data->content_context, dcon->str) < 0)
450
        goto error;
451 452 453 454

    if (!(data->mcs = virHashCreate(10, NULL)))
        goto error;

455 456 457
    virConfFree(selinux_conf);
    return 0;

458
 error:
459
# if HAVE_SELINUX_LABEL_H
460
    selabel_close(data->label_handle);
461
    data->label_handle = NULL;
462
# endif
463 464 465 466
    virConfFree(selinux_conf);
    VIR_FREE(data->domain_context);
    VIR_FREE(data->file_context);
    VIR_FREE(data->content_context);
467
    virHashFree(data->mcs);
468 469
    return -1;
}
470 471
#else
static int
472
virSecuritySELinuxLXCInitialize(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED)
473 474 475 476 477 478
{
    virReportSystemError(ENOSYS, "%s",
                         _("libselinux does not support LXC contexts path"));
    return -1;
}
#endif
479 480 481


static int
482
virSecuritySELinuxQEMUInitialize(virSecurityManagerPtr mgr)
483
{
484 485
    char *ptr;
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
486

487 488
    data->skipAllLabel = false;

489 490 491 492 493 494 495 496 497
#if HAVE_SELINUX_LABEL_H
    data->label_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0);
    if (!data->label_handle) {
        virReportSystemError(errno, "%s",
                             _("cannot open SELinux label_handle"));
        return -1;
    }
#endif

498
    if (virFileReadAll(selinux_virtual_domain_context_path(), MAX_CONTEXT, &(data->domain_context)) < 0) {
499
        virReportSystemError(errno,
500
                             _("cannot read SELinux virtual domain context file '%s'"),
501
                             selinux_virtual_domain_context_path());
502
        goto error;
503 504
    }

505
    ptr = strchrnul(data->domain_context, '\n');
506
    if (ptr && *ptr == '\n') {
507
        *ptr = '\0';
508 509
        ptr++;
        if (*ptr != '\0') {
510
            if (VIR_STRDUP(data->alt_domain_context, ptr) < 0)
511 512 513 514 515 516 517 518 519
                goto error;
            ptr = strchrnul(data->alt_domain_context, '\n');
            if (ptr && *ptr == '\n')
                *ptr = '\0';
        }
    }
    VIR_DEBUG("Loaded domain context '%s', alt domain context '%s'",
              data->domain_context, NULLSTR(data->alt_domain_context));

520

521
    if (virFileReadAll(selinux_virtual_image_context_path(), 2*MAX_CONTEXT, &(data->file_context)) < 0) {
522
        virReportSystemError(errno,
523 524
                             _("cannot read SELinux virtual image context file %s"),
                             selinux_virtual_image_context_path());
525
        goto error;
526 527
    }

528 529
    ptr = strchrnul(data->file_context, '\n');
    if (ptr && *ptr == '\n') {
530
        *ptr = '\0';
531
        if (VIR_STRDUP(data->content_context, ptr + 1) < 0)
532 533 534
            goto error;
        ptr = strchrnul(data->content_context, '\n');
        if (ptr && *ptr == '\n')
535 536
            *ptr = '\0';
    }
537

538 539 540
    VIR_DEBUG("Loaded file context '%s', content context '%s'",
              data->file_context, data->content_context);

541 542 543
    if (!(data->mcs = virHashCreate(10, NULL)))
        goto error;

544
    return 0;
545

546
 error:
547 548
#if HAVE_SELINUX_LABEL_H
    selabel_close(data->label_handle);
549
    data->label_handle = NULL;
550
#endif
551
    VIR_FREE(data->domain_context);
552
    VIR_FREE(data->alt_domain_context);
553 554
    VIR_FREE(data->file_context);
    VIR_FREE(data->content_context);
555
    virHashFree(data->mcs);
556
    return -1;
557 558
}

559 560

static int
561
virSecuritySELinuxInitialize(virSecurityManagerPtr mgr)
562 563 564
{
    VIR_DEBUG("SELinuxInitialize %s", virSecurityManagerGetDriver(mgr));
    if (STREQ(virSecurityManagerGetDriver(mgr),  "LXC")) {
565
        return virSecuritySELinuxLXCInitialize(mgr);
566
    } else {
567
        return virSecuritySELinuxQEMUInitialize(mgr);
568 569 570 571
    }
}


572
static int
573 574
virSecuritySELinuxGenLabel(virSecurityManagerPtr mgr,
                           virDomainDefPtr def)
575 576
{
    int rc = -1;
577
    char *mcs = NULL;
578
    char *scontext = NULL;
579
    context_t ctx = NULL;
580
    const char *range;
581 582
    virSecurityLabelDefPtr seclabel;
    virSecuritySELinuxDataPtr data;
583
    const char *baselabel;
584 585
    char *sens = NULL;
    int catMin, catMax;
586

587
    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
P
Peter Krempa 已提交
588
    if (seclabel == NULL)
589
        return 0;
590 591 592 593 594 595

    data = virSecurityManagerGetPrivateData(mgr);

    VIR_DEBUG("label=%s", virSecurityManagerGetDriver(mgr));
    if (seclabel->type == VIR_DOMAIN_SECLABEL_DYNAMIC &&
        seclabel->label) {
P
Peter Krempa 已提交
596 597
        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                       _("security label already defined for VM"));
598
        return rc;
D
Daniel P. Berrange 已提交
599
    }
600

601
    if (seclabel->imagelabel) {
P
Peter Krempa 已提交
602 603
        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                       _("security image label already defined for VM"));
604 605 606
        return rc;
    }

607 608
    if (seclabel->model &&
        STRNEQ(seclabel->model, SECURITY_SELINUX_NAME)) {
609 610
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label model %s is not supported with selinux"),
611
                       seclabel->model);
612 613 614
        return rc;
    }

615
    VIR_DEBUG("type=%d", seclabel->type);
616

617
    switch (seclabel->type) {
618
    case VIR_DOMAIN_SECLABEL_STATIC:
619
        if (!(ctx = context_new(seclabel->label))) {
620 621
            virReportSystemError(errno,
                                 _("unable to allocate socket security context '%s'"),
622
                                 seclabel->label);
623
            return rc;
624 625
        }

P
Peter Krempa 已提交
626
        if (!(range = context_range_get(ctx))) {
627
            virReportSystemError(errno, "%s", _("unable to get selinux context range"));
628 629
            goto cleanup;
        }
630 631
        if (VIR_STRDUP(mcs, range) < 0)
            goto cleanup;
632 633 634
        break;

    case VIR_DOMAIN_SECLABEL_DYNAMIC:
635 636 637 638 639 640 641 642 643
        if (virSecuritySELinuxMCSGetProcessRange(&sens,
                                                 &catMin,
                                                 &catMax) < 0)
            goto cleanup;

        if (!(mcs = virSecuritySELinuxMCSFind(mgr,
                                              sens,
                                              catMin,
                                              catMax)))
644 645 646 647
            goto cleanup;

        if (virSecuritySELinuxMCSAdd(mgr, mcs) < 0)
            goto cleanup;
648

649 650 651 652
        baselabel = seclabel->baselabel;
        if (!baselabel) {
            if (def->virtType == VIR_DOMAIN_VIRT_QEMU) {
                if (data->alt_domain_context == NULL) {
653
                    static bool warned;
654 655 656 657 658 659 660 661 662 663 664 665 666 667 668
                    if (!warned) {
                        VIR_WARN("SELinux policy does not define a domain type for QEMU TCG. "
                                 "Guest startup may be denied due to missing 'execmem' privilege "
                                 "unless the 'virt_use_execmem' policy boolean is enabled");
                        warned = true;
                    }
                    baselabel = data->domain_context;
                } else {
                    baselabel = data->alt_domain_context;
                }
            } else {
                baselabel = data->domain_context;
            }
        }

669 670
        seclabel->label = virSecuritySELinuxGenNewContext(baselabel, mcs, false);
        if (!seclabel->label)
671
            goto cleanup;
672

673 674 675
        break;

    case VIR_DOMAIN_SECLABEL_NONE:
676 677 678 679 680 681 682 683
        if (virSecuritySELinuxMCSGetProcessRange(&sens,
                                                 &catMin,
                                                 &catMax) < 0)
            goto cleanup;

        if (VIR_STRDUP(mcs, sens) < 0)
            goto cleanup;

684 685 686
        break;

    default:
687 688
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("unexpected security label type '%s'"),
689
                       virDomainSeclabelTypeToString(seclabel->type));
690
        goto cleanup;
D
Daniel P. Berrange 已提交
691
    }
692

693 694 695 696 697 698
    /* always generate a image label, needed to label new objects */
    seclabel->imagelabel = virSecuritySELinuxGenNewContext(data->file_context,
                                                           mcs,
                                                           true);
    if (!seclabel->imagelabel)
        goto cleanup;
699

700
    if (!seclabel->model &&
701
        VIR_STRDUP(seclabel->model, SECURITY_SELINUX_NAME) < 0)
702
        goto cleanup;
D
Daniel P. Berrange 已提交
703

704
    rc = 0;
705

706
 cleanup:
707
    if (rc != 0) {
708 709 710 711 712 713
        if (seclabel->type == VIR_DOMAIN_SECLABEL_DYNAMIC)
            VIR_FREE(seclabel->label);
        VIR_FREE(seclabel->imagelabel);
        if (seclabel->type == VIR_DOMAIN_SECLABEL_DYNAMIC &&
            !seclabel->baselabel)
            VIR_FREE(seclabel->model);
714 715 716 717
    }

    if (ctx)
        context_free(ctx);
D
Daniel P. Berrange 已提交
718
    VIR_FREE(scontext);
719
    VIR_FREE(mcs);
720
    VIR_FREE(sens);
721 722

    VIR_DEBUG("model=%s label=%s imagelabel=%s baselabel=%s",
723 724 725 726
              NULLSTR(seclabel->model),
              NULLSTR(seclabel->label),
              NULLSTR(seclabel->imagelabel),
              NULLSTR(seclabel->baselabel));
727

728 729 730
    return rc;
}

731
static int
732 733 734
virSecuritySELinuxReserveLabel(virSecurityManagerPtr mgr,
                               virDomainDefPtr def,
                               pid_t pid)
735 736 737 738
{
    security_context_t pctx;
    context_t ctx = NULL;
    const char *mcs;
739
    int rv;
740
    virSecurityLabelDefPtr seclabel;
741

742
    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
743 744 745
    if (!seclabel ||
        seclabel->type == VIR_DOMAIN_SECLABEL_NONE ||
        seclabel->type == VIR_DOMAIN_SECLABEL_STATIC)
746 747
        return 0;

M
Martin Kletzander 已提交
748
    if (getpidcon_raw(pid, &pctx) == -1) {
749
        virReportSystemError(errno,
750
                             _("unable to get PID %d security context"), pid);
751 752 753 754
        return -1;
    }

    ctx = context_new(pctx);
755
    freecon(pctx);
756
    if (!ctx)
757
        goto error;
758 759 760

    mcs = context_range_get(ctx);
    if (!mcs)
761 762
        goto error;

763
    if ((rv = virSecuritySELinuxMCSAdd(mgr, mcs)) < 0)
764
        goto error;
765

766 767 768 769 770 771
    if (rv == 1) {
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("MCS level for existing domain label %s already reserved"),
                       (char*)pctx);
        goto error;
    }
772 773 774 775 776

    context_free(ctx);

    return 0;

777
 error:
778 779 780 781 782
    context_free(ctx);
    return -1;
}


783
static int
784
virSecuritySELinuxSecurityDriverProbe(const char *virtDriver)
785
{
786
    if (is_selinux_enabled() <= 0)
787 788
        return SECURITY_DRIVER_DISABLE;

789 790 791 792 793 794
    if (virtDriver && STREQ(virtDriver, "LXC")) {
#if HAVE_SELINUX_LXC_CONTEXTS_PATH
        if (!virFileExists(selinux_lxc_contexts_path()))
#endif
            return SECURITY_DRIVER_DISABLE;
    }
795 796

    return SECURITY_DRIVER_ENABLE;
797 798
}

799

800
static int
801
virSecuritySELinuxSecurityDriverOpen(virSecurityManagerPtr mgr)
802
{
803
    return virSecuritySELinuxInitialize(mgr);
804 805
}

806

807
static int
808
virSecuritySELinuxSecurityDriverClose(virSecurityManagerPtr mgr)
809
{
810 811 812 813 814
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);

    if (!data)
        return 0;

815
#if HAVE_SELINUX_LABEL_H
816 817
    if (data->label_handle)
        selabel_close(data->label_handle);
818 819
#endif

820 821
    virHashFree(data->mcs);

822
    VIR_FREE(data->domain_context);
823
    VIR_FREE(data->alt_domain_context);
824 825 826
    VIR_FREE(data->file_context);
    VIR_FREE(data->content_context);

827 828 829 830
    return 0;
}


831 832
static const char *
virSecuritySELinuxSecurityGetModel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED)
833 834 835 836
{
    return SECURITY_SELINUX_NAME;
}

837 838
static const char *
virSecuritySELinuxSecurityGetDOI(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED)
839 840 841 842 843
{
    /*
     * Where will the DOI come from?  SELinux configuration, or qemu
     * configuration? For the moment, we'll just set it to "0".
     */
844
    return SECURITY_SELINUX_VOID_DOI;
845 846 847
}

static int
848 849 850 851
virSecuritySELinuxGetProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                  virDomainDefPtr def ATTRIBUTE_UNUSED,
                                  pid_t pid,
                                  virSecurityLabelPtr sec)
852 853 854
{
    security_context_t ctx;

M
Martin Kletzander 已提交
855
    if (getpidcon_raw(pid, &ctx) == -1) {
856
        virReportSystemError(errno,
857
                             _("unable to get PID %d security context"),
858
                             pid);
859 860 861 862
        return -1;
    }

    if (strlen((char *) ctx) >= VIR_SECURITY_LABEL_BUFLEN) {
863 864 865 866
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label exceeds "
                         "maximum length: %d"),
                       VIR_SECURITY_LABEL_BUFLEN - 1);
867
        freecon(ctx);
868 869 870 871
        return -1;
    }

    strcpy(sec->label, (char *) ctx);
872
    freecon(ctx);
873

874
    VIR_DEBUG("label=%s", sec->label);
875 876
    sec->enforcing = security_getenforce();
    if (sec->enforcing == -1) {
877
        virReportSystemError(errno, "%s",
878
                             _("error calling security_getenforce()"));
879 880 881 882 883 884
        return -1;
    }

    return 0;
}

885 886 887
/* Attempt to change the label of PATH to TCON.  If OPTIONAL is true,
 * return 1 if labelling was not possible.  Otherwise, require a label
 * change, and return 0 for success, -1 for failure.  */
888
static int
889 890
virSecuritySELinuxSetFileconHelper(const char *path, char *tcon,
                                   bool optional, bool privileged)
891
{
892
    security_context_t econ;
893

894 895
    VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon);

M
Martin Kletzander 已提交
896
    if (setfilecon_raw(path, tcon) < 0) {
897 898
        int setfilecon_errno = errno;

M
Martin Kletzander 已提交
899
        if (getfilecon_raw(path, &econ) >= 0) {
900 901 902
            if (STREQ(tcon, econ)) {
                freecon(econ);
                /* It's alright, there's nothing to change anyway. */
903
                return optional ? 1 : 0;
904 905 906
            }
            freecon(econ);
        }
907

908 909 910 911 912
        /* If the error complaint is related to an image hosted on a (possibly
         * read-only) NFS mount, or a usbfs/sysfs filesystem not supporting
         * labelling, then just ignore it & hope for the best.  The user
         * hopefully sets one of the necessary SELinux virt_use_{nfs,usb,pci}
         * boolean tunables to allow it ...
913
         */
914
        VIR_WARNINGS_NO_WLOGICALOP_EQUAL_EXPR
915 916
        if (setfilecon_errno != EOPNOTSUPP && setfilecon_errno != ENOTSUP &&
            setfilecon_errno != EROFS) {
917
        VIR_WARNINGS_RESET
918
            virReportSystemError(setfilecon_errno,
919
                                 _("unable to set security context '%s' on '%s'"),
920
                                 tcon, path);
921 922 923 924
            /* However, don't claim error if SELinux is in Enforcing mode and
             * we are running as unprivileged user and we really did see EPERM.
             * Otherwise we want to return error if SELinux is Enforcing. */
            if (security_getenforce() == 1 && (setfilecon_errno != EPERM || privileged))
925
                return -1;
926
        } else {
927
            const char *msg;
928
            if (virFileIsSharedFSType(path, VIR_FILE_SHFS_NFS) == 1 &&
929 930 931
                security_get_boolean_active("virt_use_nfs") != 1) {
                msg = _("Setting security context '%s' on '%s' not supported. "
                        "Consider setting virt_use_nfs");
932 933 934 935
                if (security_getenforce() == 1)
                    VIR_WARN(msg, tcon, path);
                else
                    VIR_INFO(msg, tcon, path);
936 937 938 939
            } else {
                VIR_INFO("Setting security context '%s' on '%s' not supported",
                         tcon, path);
            }
940 941
            if (optional)
                return 1;
942
        }
943 944 945 946
    }
    return 0;
}

947
static int
948 949
virSecuritySELinuxSetFileconOptional(virSecurityManagerPtr mgr,
                                     const char *path, char *tcon)
950
{
951 952
    bool privileged = virSecurityManagerGetPrivileged(mgr);
    return virSecuritySELinuxSetFileconHelper(path, tcon, true, privileged);
953 954 955
}

static int
956 957
virSecuritySELinuxSetFilecon(virSecurityManagerPtr mgr,
                             const char *path, char *tcon)
958
{
959 960
    bool privileged = virSecurityManagerGetPrivileged(mgr);
    return virSecuritySELinuxSetFileconHelper(path, tcon, false, privileged);
961 962
}

963
static int
964
virSecuritySELinuxFSetFilecon(int fd, char *tcon)
965 966 967 968 969
{
    security_context_t econ;

    VIR_INFO("Setting SELinux context on fd %d to '%s'", fd, tcon);

M
Martin Kletzander 已提交
970
    if (fsetfilecon_raw(fd, tcon) < 0) {
971 972
        int fsetfilecon_errno = errno;

M
Martin Kletzander 已提交
973
        if (fgetfilecon_raw(fd, &econ) >= 0) {
974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001
            if (STREQ(tcon, econ)) {
                freecon(econ);
                /* It's alright, there's nothing to change anyway. */
                return 0;
            }
            freecon(econ);
        }

        /* if the error complaint is related to an image hosted on
         * an nfs mount, or a usbfs/sysfs filesystem not supporting
         * labelling, then just ignore it & hope for the best.
         * The user hopefully set one of the necessary SELinux
         * virt_use_{nfs,usb,pci}  boolean tunables to allow it...
         */
        if (fsetfilecon_errno != EOPNOTSUPP) {
            virReportSystemError(fsetfilecon_errno,
                                 _("unable to set security context '%s' on fd %d"),
                                 tcon, fd);
            if (security_getenforce() == 1)
                return -1;
        } else {
            VIR_INFO("Setting security context '%s' on fd %d not supported",
                     tcon, fd);
        }
    }
    return 0;
}

E
Eric Blake 已提交
1002 1003
/* Set fcon to the appropriate label for path and mode, or return -1.  */
static int
1004
getContext(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
1005
           const char *newpath, mode_t mode, security_context_t *fcon)
E
Eric Blake 已提交
1006 1007
{
#if HAVE_SELINUX_LABEL_H
1008
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
E
Eric Blake 已提交
1009

1010
    return selabel_lookup_raw(data->label_handle, fcon, newpath, mode);
E
Eric Blake 已提交
1011 1012 1013 1014 1015
#else
    return matchpathcon(newpath, mode, fcon);
#endif
}

1016 1017 1018

/* This method shouldn't raise errors, since they'll overwrite
 * errors that the caller(s) are already dealing with */
1019
static int
1020 1021
virSecuritySELinuxRestoreFileLabel(virSecurityManagerPtr mgr,
                                   const char *path)
1022
{
1023 1024 1025 1026
    struct stat buf;
    security_context_t fcon = NULL;
    int rc = -1;
    char *newpath = NULL;
1027
    char ebuf[1024];
1028

1029 1030 1031 1032 1033 1034
    /* Some paths are auto-generated, so let's be safe here and do
     * nothing if nothing is needed.
     */
    if (!path)
        return 0;

1035 1036
    VIR_INFO("Restoring SELinux context on '%s'", path);

1037
    if (virFileResolveLink(path, &newpath) < 0) {
1038 1039
        VIR_WARN("cannot resolve symlink %s: %s", path,
                 virStrerror(errno, ebuf, sizeof(ebuf)));
D
Daniel P. Berrange 已提交
1040
        goto err;
1041
    }
1042

1043
    if (stat(newpath, &buf) != 0) {
1044 1045
        VIR_WARN("cannot stat %s: %s", newpath,
                 virStrerror(errno, ebuf, sizeof(ebuf)));
D
Daniel P. Berrange 已提交
1046
        goto err;
1047
    }
D
Daniel P. Berrange 已提交
1048

1049
    if (getContext(mgr, newpath, buf.st_mode, &fcon) < 0) {
1050 1051 1052
        /* Any user created path likely does not have a default label,
         * which makes this an expected non error
         */
1053
        VIR_WARN("cannot lookup default selinux label for %s", newpath);
1054
        rc = 0;
1055
    } else {
1056
        rc = virSecuritySELinuxSetFilecon(mgr, newpath, fcon);
1057
    }
1058

1059
 err:
1060
    freecon(fcon);
1061 1062
    VIR_FREE(newpath);
    return rc;
1063 1064
}

1065

1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108
static int
virSecuritySELinuxSetInputLabel(virSecurityManagerPtr mgr,
                                virDomainDefPtr def,
                                virDomainInputDefPtr input)
{
    virSecurityLabelDefPtr seclabel;

    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (seclabel == NULL)
        return 0;

    switch ((virDomainInputType) input->type) {
    case VIR_DOMAIN_INPUT_TYPE_PASSTHROUGH:
        if (virSecuritySELinuxSetFilecon(mgr, input->source.evdev,
                                         seclabel->imagelabel) < 0)
            return -1;
        break;

    case VIR_DOMAIN_INPUT_TYPE_MOUSE:
    case VIR_DOMAIN_INPUT_TYPE_TABLET:
    case VIR_DOMAIN_INPUT_TYPE_KBD:
    case VIR_DOMAIN_INPUT_TYPE_LAST:
        break;
    }

    return 0;
}


static int
virSecuritySELinuxRestoreInputLabel(virSecurityManagerPtr mgr,
                                    virDomainDefPtr def,
                                    virDomainInputDefPtr input)
{
    int rc = 0;
    virSecurityLabelDefPtr seclabel;

    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (seclabel == NULL)
        return 0;

    switch ((virDomainInputType) input->type) {
    case VIR_DOMAIN_INPUT_TYPE_PASSTHROUGH:
1109
        rc = virSecuritySELinuxRestoreFileLabel(mgr, input->source.evdev);
1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122
        break;

    case VIR_DOMAIN_INPUT_TYPE_MOUSE:
    case VIR_DOMAIN_INPUT_TYPE_TABLET:
    case VIR_DOMAIN_INPUT_TYPE_KBD:
    case VIR_DOMAIN_INPUT_TYPE_LAST:
        break;
    }

    return rc;
}


1123
static int
1124 1125 1126
virSecuritySELinuxSetTPMFileLabel(virSecurityManagerPtr mgr,
                                  virDomainDefPtr def,
                                  virDomainTPMDefPtr tpm)
1127 1128 1129 1130 1131 1132 1133 1134
{
    int rc;
    virSecurityLabelDefPtr seclabel;
    char *cancel_path;
    const char *tpmdev;

    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (seclabel == NULL)
1135
        return 0;
1136 1137 1138 1139

    switch (tpm->type) {
    case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
        tpmdev = tpm->data.passthrough.source.data.file.path;
1140
        rc = virSecuritySELinuxSetFilecon(mgr, tpmdev, seclabel->imagelabel);
1141 1142 1143 1144
        if (rc < 0)
            return -1;

        if ((cancel_path = virTPMCreateCancelPath(tpmdev)) != NULL) {
1145 1146
            rc = virSecuritySELinuxSetFilecon(mgr,
                                              cancel_path,
1147 1148 1149
                                              seclabel->imagelabel);
            VIR_FREE(cancel_path);
            if (rc < 0) {
1150
                virSecuritySELinuxRestoreTPMFileLabelInt(mgr, def, tpm);
1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165
                return -1;
            }
        } else {
            return -1;
        }
        break;
    case VIR_DOMAIN_TPM_TYPE_LAST:
        break;
    }

    return 0;
}


static int
1166 1167 1168
virSecuritySELinuxRestoreTPMFileLabelInt(virSecurityManagerPtr mgr,
                                         virDomainDefPtr def,
                                         virDomainTPMDefPtr tpm)
1169 1170 1171 1172 1173 1174 1175 1176
{
    int rc = 0;
    virSecurityLabelDefPtr seclabel;
    char *cancel_path;
    const char *tpmdev;

    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (seclabel == NULL)
1177
        return 0;
1178 1179 1180 1181

    switch (tpm->type) {
    case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
        tpmdev = tpm->data.passthrough.source.data.file.path;
1182
        rc = virSecuritySELinuxRestoreFileLabel(mgr, tpmdev);
1183 1184

        if ((cancel_path = virTPMCreateCancelPath(tpmdev)) != NULL) {
1185
            if (virSecuritySELinuxRestoreFileLabel(mgr, cancel_path) < 0)
1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197
                rc = -1;
            VIR_FREE(cancel_path);
        }
        break;
    case VIR_DOMAIN_TPM_TYPE_LAST:
        break;
    }

    return rc;
}


1198
static int
1199 1200 1201 1202
virSecuritySELinuxRestoreImageLabelInt(virSecurityManagerPtr mgr,
                                       virDomainDefPtr def,
                                       virStorageSourcePtr src,
                                       bool migrated)
1203
{
1204 1205
    virSecurityLabelDefPtr seclabel;
    virSecurityDeviceLabelDefPtr disk_seclabel;
1206 1207 1208

    if (!src->path || !virStorageSourceIsLocalStorage(src))
        return 0;
1209 1210 1211

    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (seclabel == NULL)
1212
        return 0;
1213

1214
    disk_seclabel = virStorageSourceGetSecurityLabelDef(src,
1215
                                                        SECURITY_SELINUX_NAME);
1216
    if (!seclabel->relabel || (disk_seclabel && !disk_seclabel->relabel))
1217 1218
        return 0;

1219 1220 1221
    /* If labelskip is true and there are no backing files, then we
     * know it is safe to skip the restore.  FIXME - backing files should
     * be tracked in domain XML, at which point labelskip should be a
1222
     * per-file attribute instead of a disk attribute. */
1223
    if (disk_seclabel && disk_seclabel->labelskip &&
1224
        !src->backingStore)
1225 1226
        return 0;

1227
    /* Don't restore labels on readonly/shared disks, because other VMs may
1228 1229 1230 1231 1232
     * still be accessing these. Alternatively we could iterate over all
     * running domains and try to figure out if it is in use, but this would
     * not work for clustered filesystems, since we can't see running VMs using
     * the file on other nodes. Safest bet is thus to skip the restore step. */
    if (src->readonly || src->shared)
1233 1234 1235
        return 0;


1236 1237 1238
    /* If we have a shared FS and are doing migration, we must not change
     * ownership, because that kills access on the destination host which is
     * sub-optimal for the guest VM's I/O attempts :-) */
1239
    if (migrated) {
1240
        int rc = virFileIsSharedFS(src->path);
1241 1242 1243 1244
        if (rc < 0)
            return -1;
        if (rc == 1) {
            VIR_DEBUG("Skipping image label restore on %s because FS is shared",
1245
                      src->path);
1246 1247 1248 1249
            return 0;
        }
    }

1250
    return virSecuritySELinuxRestoreFileLabel(mgr, src->path);
1251 1252
}

1253 1254

static int
1255 1256 1257
virSecuritySELinuxRestoreDiskLabel(virSecurityManagerPtr mgr,
                                   virDomainDefPtr def,
                                   virDomainDiskDefPtr disk)
1258
{
1259 1260
    return virSecuritySELinuxRestoreImageLabelInt(mgr, def, disk->src,
                                                  false);
1261 1262 1263 1264
}


static int
1265 1266 1267
virSecuritySELinuxRestoreImageLabel(virSecurityManagerPtr mgr,
                                    virDomainDefPtr def,
                                    virStorageSourcePtr src)
1268
{
1269
    return virSecuritySELinuxRestoreImageLabelInt(mgr, def, src, false);
1270 1271 1272
}


1273
static int
1274 1275 1276 1277
virSecuritySELinuxSetImageLabelInternal(virSecurityManagerPtr mgr,
                                        virDomainDefPtr def,
                                        virStorageSourcePtr src,
                                        bool first)
1278
{
1279 1280
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
    virSecurityLabelDefPtr secdef;
1281
    virSecurityDeviceLabelDefPtr disk_seclabel;
1282
    int ret;
1283

1284 1285 1286 1287
    if (!src->path || !virStorageSourceIsLocalStorage(src))
        return 0;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
1288
    if (!secdef || !secdef->relabel)
1289 1290 1291
        return 0;

    disk_seclabel = virStorageSourceGetSecurityLabelDef(src,
1292 1293
                                                        SECURITY_SELINUX_NAME);

1294
    if (disk_seclabel && !disk_seclabel->relabel)
1295 1296
        return 0;

1297
    if (disk_seclabel && disk_seclabel->relabel && disk_seclabel->label) {
1298
        ret = virSecuritySELinuxSetFilecon(mgr, src->path, disk_seclabel->label);
1299 1300
    } else if (first) {
        if (src->shared) {
1301 1302
            ret = virSecuritySELinuxSetFileconOptional(mgr,
                                                       src->path,
1303 1304
                                                       data->file_context);
        } else if (src->readonly) {
1305 1306
            ret = virSecuritySELinuxSetFileconOptional(mgr,
                                                       src->path,
1307
                                                       data->content_context);
1308
        } else if (secdef->imagelabel) {
1309 1310
            ret = virSecuritySELinuxSetFileconOptional(mgr,
                                                       src->path,
1311
                                                       secdef->imagelabel);
1312
        } else {
1313
            ret = 0;
1314 1315
        }
    } else {
1316 1317
        ret = virSecuritySELinuxSetFileconOptional(mgr,
                                                   src->path,
1318
                                                   data->content_context);
1319
    }
1320

1321
    if (ret == 1 && !disk_seclabel) {
1322 1323
        /* If we failed to set a label, but virt_use_nfs let us
         * proceed anyway, then we don't need to relabel later.  */
1324
        disk_seclabel = virSecurityDeviceLabelDefNew(SECURITY_SELINUX_NAME);
1325
        if (!disk_seclabel)
1326
            return -1;
1327
        disk_seclabel->labelskip = true;
1328
        if (VIR_APPEND_ELEMENT(src->seclabels, src->nseclabels,
1329
                               disk_seclabel) < 0) {
1330 1331 1332
            virSecurityDeviceLabelDefFree(disk_seclabel);
            return -1;
        }
1333
        ret = 0;
1334
    }
1335

1336
    return ret;
1337 1338
}

1339 1340

static int
1341 1342 1343
virSecuritySELinuxSetImageLabel(virSecurityManagerPtr mgr,
                                virDomainDefPtr def,
                                virStorageSourcePtr src)
1344
{
1345
    return virSecuritySELinuxSetImageLabelInternal(mgr, def, src, true);
1346 1347 1348
}


1349
static int
1350 1351 1352
virSecuritySELinuxSetDiskLabel(virSecurityManagerPtr mgr,
                               virDomainDefPtr def,
                               virDomainDiskDefPtr disk)
1353 1354

{
1355 1356
    bool first = true;
    virStorageSourcePtr next;
1357

1358
    for (next = disk->src; next; next = next->backingStore) {
1359
        if (virSecuritySELinuxSetImageLabelInternal(mgr, def, next, first) < 0)
1360
            return -1;
1361

1362 1363 1364 1365
        first = false;
    }

    return 0;
1366 1367
}

1368
static int
1369
virSecuritySELinuxSetHostdevLabelHelper(const char *file, void *opaque)
1370
{
1371
    virSecurityLabelDefPtr secdef;
1372 1373 1374
    virSecuritySELinuxCallbackDataPtr data = opaque;
    virSecurityManagerPtr mgr = data->mgr;
    virDomainDefPtr def = data->def;
1375

1376 1377
    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (secdef == NULL)
1378
        return 0;
1379
    return virSecuritySELinuxSetFilecon(mgr, file, secdef->imagelabel);
1380 1381 1382
}

static int
1383 1384
virSecuritySELinuxSetPCILabel(virPCIDevicePtr dev ATTRIBUTE_UNUSED,
                              const char *file, void *opaque)
1385
{
1386
    return virSecuritySELinuxSetHostdevLabelHelper(file, opaque);
1387
}
1388

1389
static int
1390 1391
virSecuritySELinuxSetUSBLabel(virUSBDevicePtr dev ATTRIBUTE_UNUSED,
                              const char *file, void *opaque)
1392
{
1393
    return virSecuritySELinuxSetHostdevLabelHelper(file, opaque);
1394 1395
}

1396
static int
1397 1398
virSecuritySELinuxSetSCSILabel(virSCSIDevicePtr dev,
                               const char *file, void *opaque)
1399
{
1400
    virSecurityLabelDefPtr secdef;
1401
    virSecuritySELinuxCallbackDataPtr ptr = opaque;
1402 1403 1404 1405 1406 1407 1408 1409
    virSecurityManagerPtr mgr = ptr->mgr;
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);

    secdef = virDomainDefGetSecurityLabelDef(ptr->def, SECURITY_SELINUX_NAME);
    if (secdef == NULL)
        return 0;

    if (virSCSIDeviceGetShareable(dev))
1410
        return virSecuritySELinuxSetFileconOptional(mgr, file,
1411 1412
                                                    data->file_context);
    else if (virSCSIDeviceGetReadonly(dev))
1413
        return virSecuritySELinuxSetFileconOptional(mgr, file,
1414 1415
                                                    data->content_context);
    else
1416 1417
        return virSecuritySELinuxSetFileconOptional(mgr, file,
                                                    secdef->imagelabel);
1418
}
1419

1420
static int
1421 1422 1423 1424
virSecuritySELinuxSetHostdevSubsysLabel(virSecurityManagerPtr mgr,
                                        virDomainDefPtr def,
                                        virDomainHostdevDefPtr dev,
                                        const char *vroot)
1425 1426

{
1427
    virDomainHostdevSubsysUSBPtr usbsrc = &dev->source.subsys.u.usb;
1428
    virDomainHostdevSubsysPCIPtr pcisrc = &dev->source.subsys.u.pci;
1429
    virDomainHostdevSubsysSCSIPtr scsisrc = &dev->source.subsys.u.scsi;
1430 1431
    virSecuritySELinuxCallbackData data = {.mgr = mgr, .def = def};

1432 1433
    int ret = -1;

1434
    /* Like virSecuritySELinuxSetImageLabelInternal() for a networked
1435 1436
     * disk, do nothing for an iSCSI hostdev
     */
1437 1438
    if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
        scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
1439 1440
        return 0;

1441 1442
    switch (dev->source.subsys.type) {
    case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: {
1443
        virUSBDevicePtr usb;
1444

1445 1446 1447
        if (dev->missing)
            return 0;

1448 1449
        usb = virUSBDeviceNew(usbsrc->bus,
                              usbsrc->device,
1450
                              vroot);
1451 1452
        if (!usb)
            goto done;
1453

1454
        ret = virUSBDeviceFileIterate(usb, virSecuritySELinuxSetUSBLabel, &data);
1455
        virUSBDeviceFree(usb);
M
Mark McLoughlin 已提交
1456
        break;
1457 1458 1459
    }

    case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: {
1460
        virPCIDevicePtr pci =
1461 1462
            virPCIDeviceNew(pcisrc->addr.domain, pcisrc->addr.bus,
                            pcisrc->addr.slot, pcisrc->addr.function);
1463 1464 1465 1466

        if (!pci)
            goto done;

1467
        if (pcisrc->backend == VIR_DOMAIN_HOSTDEV_PCI_BACKEND_VFIO) {
1468
            char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
1469

1470 1471
            if (!vfioGroupDev) {
                virPCIDeviceFree(pci);
1472
                goto done;
1473
            }
1474
            ret = virSecuritySELinuxSetPCILabel(pci, vfioGroupDev, &data);
1475 1476
            VIR_FREE(vfioGroupDev);
        } else {
1477
            ret = virPCIDeviceFileIterate(pci, virSecuritySELinuxSetPCILabel, &data);
1478
        }
1479
        virPCIDeviceFree(pci);
1480 1481 1482
        break;
    }

1483
    case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI: {
1484
        virDomainHostdevSubsysSCSIHostPtr scsihostsrc = &scsisrc->u.host;
1485

1486
        virSCSIDevicePtr scsi =
1487
            virSCSIDeviceNew(NULL,
1488 1489
                             scsihostsrc->adapter, scsihostsrc->bus,
                             scsihostsrc->target, scsihostsrc->unit,
1490
                             dev->readonly, dev->shareable);
1491 1492 1493 1494

        if (!scsi)
            goto done;

1495
        ret = virSCSIDeviceFileIterate(scsi,
1496
                                       virSecuritySELinuxSetSCSILabel,
1497
                                       &data);
1498 1499 1500 1501 1502
        virSCSIDeviceFree(scsi);

        break;
    }

1503 1504 1505 1506 1507
    default:
        ret = 0;
        break;
    }

1508
 done:
1509 1510 1511
    return ret;
}

1512

1513
static int
1514 1515 1516 1517
virSecuritySELinuxSetHostdevCapsLabel(virSecurityManagerPtr mgr,
                                      virDomainDefPtr def,
                                      virDomainHostdevDefPtr dev,
                                      const char *vroot)
1518 1519 1520 1521 1522 1523 1524
{
    int ret = -1;
    virSecurityLabelDefPtr secdef;
    char *path;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (secdef == NULL)
1525
        return 0;
1526 1527 1528 1529 1530

    switch (dev->source.caps.type) {
    case VIR_DOMAIN_HOSTDEV_CAPS_TYPE_STORAGE: {
        if (vroot) {
            if (virAsprintf(&path, "%s/%s", vroot,
1531
                            dev->source.caps.u.storage.block) < 0)
1532 1533
                return -1;
        } else {
1534
            if (VIR_STRDUP(path, dev->source.caps.u.storage.block) < 0)
1535 1536
                return -1;
        }
1537
        ret = virSecuritySELinuxSetFilecon(mgr, path, secdef->imagelabel);
1538 1539 1540 1541 1542 1543 1544
        VIR_FREE(path);
        break;
    }

    case VIR_DOMAIN_HOSTDEV_CAPS_TYPE_MISC: {
        if (vroot) {
            if (virAsprintf(&path, "%s/%s", vroot,
1545
                            dev->source.caps.u.misc.chardev) < 0)
1546 1547
                return -1;
        } else {
1548
            if (VIR_STRDUP(path, dev->source.caps.u.misc.chardev) < 0)
1549 1550
                return -1;
        }
1551
        ret = virSecuritySELinuxSetFilecon(mgr, path, secdef->imagelabel);
1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564
        VIR_FREE(path);
        break;
    }

    default:
        ret = 0;
        break;
    }

    return ret;
}


1565
static int
1566 1567 1568 1569
virSecuritySELinuxSetHostdevLabel(virSecurityManagerPtr mgr,
                                  virDomainDefPtr def,
                                  virDomainHostdevDefPtr dev,
                                  const char *vroot)
1570 1571 1572 1573 1574

{
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
1575
    if (!secdef || !secdef->relabel)
1576 1577 1578 1579
        return 0;

    switch (dev->mode) {
    case VIR_DOMAIN_HOSTDEV_MODE_SUBSYS:
1580
        return virSecuritySELinuxSetHostdevSubsysLabel(mgr, def, dev, vroot);
1581

1582
    case VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES:
1583
        return virSecuritySELinuxSetHostdevCapsLabel(mgr, def, dev, vroot);
1584

1585 1586 1587 1588 1589
    default:
        return 0;
    }
}

1590
static int
1591 1592 1593
virSecuritySELinuxRestorePCILabel(virPCIDevicePtr dev ATTRIBUTE_UNUSED,
                                  const char *file,
                                  void *opaque)
1594
{
1595 1596
    virSecurityManagerPtr mgr = opaque;

1597
    return virSecuritySELinuxRestoreFileLabel(mgr, file);
1598 1599 1600
}

static int
1601 1602 1603
virSecuritySELinuxRestoreUSBLabel(virUSBDevicePtr dev ATTRIBUTE_UNUSED,
                                  const char *file,
                                  void *opaque)
1604
{
1605 1606
    virSecurityManagerPtr mgr = opaque;

1607
    return virSecuritySELinuxRestoreFileLabel(mgr, file);
1608 1609
}

1610

1611
static int
1612 1613 1614
virSecuritySELinuxRestoreSCSILabel(virSCSIDevicePtr dev,
                                   const char *file,
                                   void *opaque)
1615 1616 1617
{
    virSecurityManagerPtr mgr = opaque;

1618 1619 1620 1621 1622 1623
    /* Don't restore labels on a shareable or readonly hostdev, because
     * other VMs may still be accessing.
     */
    if (virSCSIDeviceGetShareable(dev) || virSCSIDeviceGetReadonly(dev))
        return 0;

1624
    return virSecuritySELinuxRestoreFileLabel(mgr, file);
1625 1626
}

1627
static int
1628 1629 1630
virSecuritySELinuxRestoreHostdevSubsysLabel(virSecurityManagerPtr mgr,
                                            virDomainHostdevDefPtr dev,
                                            const char *vroot)
1631 1632

{
1633
    virDomainHostdevSubsysUSBPtr usbsrc = &dev->source.subsys.u.usb;
1634
    virDomainHostdevSubsysPCIPtr pcisrc = &dev->source.subsys.u.pci;
1635
    virDomainHostdevSubsysSCSIPtr scsisrc = &dev->source.subsys.u.scsi;
1636 1637
    int ret = -1;

1638
    /* Like virSecuritySELinuxRestoreImageLabelInt() for a networked
1639 1640
     * disk, do nothing for an iSCSI hostdev
     */
1641 1642
    if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
        scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
1643 1644
        return 0;

1645 1646
    switch (dev->source.subsys.type) {
    case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: {
1647
        virUSBDevicePtr usb;
1648 1649 1650

        if (dev->missing)
            return 0;
1651

1652 1653
        usb = virUSBDeviceNew(usbsrc->bus,
                              usbsrc->device,
1654
                              vroot);
1655 1656 1657
        if (!usb)
            goto done;

1658
        ret = virUSBDeviceFileIterate(usb, virSecuritySELinuxRestoreUSBLabel, mgr);
1659
        virUSBDeviceFree(usb);
1660 1661 1662 1663 1664

        break;
    }

    case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: {
1665
        virPCIDevicePtr pci =
1666 1667
            virPCIDeviceNew(pcisrc->addr.domain, pcisrc->addr.bus,
                            pcisrc->addr.slot, pcisrc->addr.function);
1668 1669 1670 1671

        if (!pci)
            goto done;

1672
        if (pcisrc->backend == VIR_DOMAIN_HOSTDEV_PCI_BACKEND_VFIO) {
1673
            char *vfioGroupDev = virPCIDeviceGetIOMMUGroupDev(pci);
1674

1675 1676
            if (!vfioGroupDev) {
                virPCIDeviceFree(pci);
1677
                goto done;
1678
            }
1679
            ret = virSecuritySELinuxRestorePCILabel(pci, vfioGroupDev, mgr);
1680 1681
            VIR_FREE(vfioGroupDev);
        } else {
1682
            ret = virPCIDeviceFileIterate(pci, virSecuritySELinuxRestorePCILabel, mgr);
1683
        }
1684
        virPCIDeviceFree(pci);
1685 1686 1687
        break;
    }

1688
    case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI: {
1689
        virDomainHostdevSubsysSCSIHostPtr scsihostsrc = &scsisrc->u.host;
1690
        virSCSIDevicePtr scsi =
1691
            virSCSIDeviceNew(NULL,
1692 1693
                             scsihostsrc->adapter, scsihostsrc->bus,
                             scsihostsrc->target, scsihostsrc->unit,
1694
                             dev->readonly, dev->shareable);
1695

J
Ján Tomko 已提交
1696 1697
        if (!scsi)
            goto done;
1698

1699
        ret = virSCSIDeviceFileIterate(scsi, virSecuritySELinuxRestoreSCSILabel, mgr);
J
Ján Tomko 已提交
1700
        virSCSIDeviceFree(scsi);
1701

J
Ján Tomko 已提交
1702 1703
        break;
    }
1704

1705 1706 1707 1708 1709
    default:
        ret = 0;
        break;
    }

1710
 done:
1711 1712 1713
    return ret;
}

1714

1715
static int
1716 1717 1718
virSecuritySELinuxRestoreHostdevCapsLabel(virSecurityManagerPtr mgr,
                                          virDomainHostdevDefPtr dev,
                                          const char *vroot)
1719 1720 1721 1722 1723 1724 1725 1726
{
    int ret = -1;
    char *path;

    switch (dev->source.caps.type) {
    case VIR_DOMAIN_HOSTDEV_CAPS_TYPE_STORAGE: {
        if (vroot) {
            if (virAsprintf(&path, "%s/%s", vroot,
1727
                            dev->source.caps.u.storage.block) < 0)
1728 1729
                return -1;
        } else {
1730
            if (VIR_STRDUP(path, dev->source.caps.u.storage.block) < 0)
1731 1732
                return -1;
        }
1733
        ret = virSecuritySELinuxRestoreFileLabel(mgr, path);
1734 1735 1736 1737 1738 1739 1740
        VIR_FREE(path);
        break;
    }

    case VIR_DOMAIN_HOSTDEV_CAPS_TYPE_MISC: {
        if (vroot) {
            if (virAsprintf(&path, "%s/%s", vroot,
1741
                            dev->source.caps.u.misc.chardev) < 0)
1742 1743
                return -1;
        } else {
1744
            if (VIR_STRDUP(path, dev->source.caps.u.misc.chardev) < 0)
1745 1746
                return -1;
        }
1747
        ret = virSecuritySELinuxRestoreFileLabel(mgr, path);
1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760
        VIR_FREE(path);
        break;
    }

    default:
        ret = 0;
        break;
    }

    return ret;
}


1761
static int
1762 1763 1764 1765
virSecuritySELinuxRestoreHostdevLabel(virSecurityManagerPtr mgr,
                                      virDomainDefPtr def,
                                      virDomainHostdevDefPtr dev,
                                      const char *vroot)
1766 1767 1768 1769 1770

{
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
1771
    if (!secdef || !secdef->relabel)
1772 1773 1774 1775
        return 0;

    switch (dev->mode) {
    case VIR_DOMAIN_HOSTDEV_MODE_SUBSYS:
1776
        return virSecuritySELinuxRestoreHostdevSubsysLabel(mgr, dev, vroot);
1777

1778
    case VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES:
1779
        return virSecuritySELinuxRestoreHostdevCapsLabel(mgr, dev, vroot);
1780

1781 1782 1783 1784 1785 1786
    default:
        return 0;
    }
}


1787
static int
1788 1789 1790 1791
virSecuritySELinuxSetChardevLabel(virSecurityManagerPtr mgr,
                                  virDomainDefPtr def,
                                  virDomainChrDefPtr dev,
                                  virDomainChrSourceDefPtr dev_source)
1792 1793

{
1794 1795 1796
    virSecurityLabelDefPtr seclabel;
    virSecurityDeviceLabelDefPtr chr_seclabel = NULL;
    char *imagelabel = NULL;
1797 1798 1799
    char *in = NULL, *out = NULL;
    int ret = -1;

1800
    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
1801
    if (!seclabel || !seclabel->relabel)
1802
        return 0;
1803

1804 1805 1806 1807
    if (dev)
        chr_seclabel = virDomainChrDefGetSecurityLabelDef(dev,
                                                          SECURITY_SELINUX_NAME);

1808
    if (chr_seclabel && !chr_seclabel->relabel)
1809 1810
        return 0;

1811 1812 1813 1814 1815 1816
    if (chr_seclabel)
        imagelabel = chr_seclabel->label;
    if (!imagelabel)
        imagelabel = seclabel->imagelabel;

    switch (dev_source->type) {
1817 1818
    case VIR_DOMAIN_CHR_TYPE_DEV:
    case VIR_DOMAIN_CHR_TYPE_FILE:
1819 1820
        ret = virSecuritySELinuxSetFilecon(mgr,
                                           dev_source->data.file.path,
1821 1822 1823 1824 1825
                                           imagelabel);
        break;

    case VIR_DOMAIN_CHR_TYPE_UNIX:
        if (!dev_source->data.nix.listen) {
1826 1827
            if (virSecuritySELinuxSetFilecon(mgr,
                                             dev_source->data.nix.path,
1828 1829 1830 1831
                                             imagelabel) < 0)
                goto done;
        }
        ret = 0;
1832 1833 1834
        break;

    case VIR_DOMAIN_CHR_TYPE_PIPE:
1835
        if ((virAsprintf(&in, "%s.in", dev_source->data.file.path) < 0) ||
1836
            (virAsprintf(&out, "%s.out", dev_source->data.file.path) < 0))
1837 1838
            goto done;
        if (virFileExists(in) && virFileExists(out)) {
1839 1840
            if ((virSecuritySELinuxSetFilecon(mgr, in, imagelabel) < 0) ||
                (virSecuritySELinuxSetFilecon(mgr, out, imagelabel) < 0)) {
1841
                goto done;
1842
            }
1843 1844
        } else if (virSecuritySELinuxSetFilecon(mgr,
                                                dev_source->data.file.path,
1845
                                                imagelabel) < 0) {
1846
            goto done;
1847 1848 1849 1850 1851 1852 1853 1854 1855
        }
        ret = 0;
        break;

    default:
        ret = 0;
        break;
    }

1856
 done:
1857 1858 1859 1860 1861 1862
    VIR_FREE(in);
    VIR_FREE(out);
    return ret;
}

static int
1863 1864 1865 1866
virSecuritySELinuxRestoreChardevLabel(virSecurityManagerPtr mgr,
                                      virDomainDefPtr def,
                                      virDomainChrDefPtr dev,
                                      virDomainChrSourceDefPtr dev_source)
1867 1868

{
1869 1870
    virSecurityLabelDefPtr seclabel;
    virSecurityDeviceLabelDefPtr chr_seclabel = NULL;
1871 1872 1873
    char *in = NULL, *out = NULL;
    int ret = -1;

1874
    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
1875
    if (!seclabel || !seclabel->relabel)
1876
        return 0;
1877

1878 1879 1880
    if (dev)
        chr_seclabel = virDomainChrDefGetSecurityLabelDef(dev,
                                                          SECURITY_SELINUX_NAME);
1881
    if (chr_seclabel && !chr_seclabel->relabel)
1882 1883
        return 0;

1884
    switch (dev_source->type) {
1885 1886
    case VIR_DOMAIN_CHR_TYPE_DEV:
    case VIR_DOMAIN_CHR_TYPE_FILE:
1887
        if (virSecuritySELinuxRestoreFileLabel(mgr, dev_source->data.file.path) < 0)
1888 1889
            goto done;
        ret = 0;
1890
        break;
1891 1892 1893

    case VIR_DOMAIN_CHR_TYPE_UNIX:
        if (!dev_source->data.nix.listen) {
1894
            if (virSecuritySELinuxRestoreFileLabel(mgr, dev_source->data.file.path) < 0)
1895 1896 1897 1898 1899
                goto done;
        }
        ret = 0;
        break;

1900
    case VIR_DOMAIN_CHR_TYPE_PIPE:
1901
        if ((virAsprintf(&out, "%s.out", dev_source->data.file.path) < 0) ||
1902
            (virAsprintf(&in, "%s.in", dev_source->data.file.path) < 0))
1903
            goto done;
1904
        if (virFileExists(in) && virFileExists(out)) {
1905 1906
            if ((virSecuritySELinuxRestoreFileLabel(mgr, out) < 0) ||
                (virSecuritySELinuxRestoreFileLabel(mgr, in) < 0)) {
1907 1908
                goto done;
            }
1909
        } else if (virSecuritySELinuxRestoreFileLabel(mgr, dev_source->data.file.path) < 0) {
1910
            goto done;
1911
        }
1912 1913 1914 1915 1916 1917 1918 1919
        ret = 0;
        break;

    default:
        ret = 0;
        break;
    }

1920
 done:
1921 1922 1923 1924 1925 1926 1927
    VIR_FREE(in);
    VIR_FREE(out);
    return ret;
}


static int
1928 1929
virSecuritySELinuxRestoreSecurityChardevCallback(virDomainDefPtr def,
                                                 virDomainChrDefPtr dev,
1930
                                                 void *opaque)
1931
{
1932 1933
    virSecurityManagerPtr mgr = opaque;

1934 1935 1936 1937 1938
    /* This is taken care of by processing of def->serials */
    if (dev->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE &&
        dev->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL)
        return 0;

1939
    return virSecuritySELinuxRestoreChardevLabel(mgr, def, dev, &dev->source);
1940 1941 1942
}


E
Eric Blake 已提交
1943
static int
1944 1945
virSecuritySELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def,
                                                   virDomainSmartcardDefPtr dev,
1946
                                                   void *opaque)
E
Eric Blake 已提交
1947
{
1948
    virSecurityManagerPtr mgr = opaque;
E
Eric Blake 已提交
1949 1950 1951 1952 1953 1954 1955 1956 1957 1958
    const char *database;

    switch (dev->type) {
    case VIR_DOMAIN_SMARTCARD_TYPE_HOST:
        break;

    case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
        database = dev->data.cert.database;
        if (!database)
            database = VIR_DOMAIN_SMARTCARD_DEFAULT_DATABASE;
1959
        return virSecuritySELinuxRestoreFileLabel(mgr, database);
E
Eric Blake 已提交
1960 1961

    case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH:
1962
        return virSecuritySELinuxRestoreChardevLabel(mgr, def, NULL, &dev->data.passthru);
E
Eric Blake 已提交
1963 1964

    default:
1965 1966 1967
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("unknown smartcard type %d"),
                       dev->type);
E
Eric Blake 已提交
1968 1969 1970 1971 1972 1973 1974
        return -1;
    }

    return 0;
}


1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985
static const char *
virSecuritySELinuxGetBaseLabel(virSecurityManagerPtr mgr, int virtType)
{
    virSecuritySELinuxDataPtr priv = virSecurityManagerGetPrivateData(mgr);
    if (virtType == VIR_DOMAIN_VIRT_QEMU && priv->alt_domain_context)
        return priv->alt_domain_context;
    else
        return priv->domain_context;
}


1986
static int
1987 1988 1989
virSecuritySELinuxRestoreAllLabel(virSecurityManagerPtr mgr,
                                  virDomainDefPtr def,
                                  bool migrated)
1990
{
1991
    virSecurityLabelDefPtr secdef;
1992
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
1993
    size_t i;
1994
    int rc = 0;
1995

1996
    VIR_DEBUG("Restoring security label on %s", def->name);
1997

1998 1999
    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);

2000
    if (!secdef || !secdef->relabel || data->skipAllLabel)
2001 2002
        return 0;

2003
    if (def->tpm) {
2004
        if (virSecuritySELinuxRestoreTPMFileLabelInt(mgr, def, def->tpm) < 0)
2005 2006 2007
            rc = -1;
    }

2008
    for (i = 0; i < def->nhostdevs; i++) {
2009 2010 2011 2012
        if (virSecuritySELinuxRestoreHostdevLabel(mgr,
                                                  def,
                                                  def->hostdevs[i],
                                                  NULL) < 0)
2013
            rc = -1;
2014
    }
2015 2016 2017 2018 2019 2020

    for (i = 0; i < def->ninputs; i++) {
        if (virSecuritySELinuxRestoreInputLabel(mgr, def, def->inputs[i]) < 0)
            rc = -1;
    }

2021
    for (i = 0; i < def->ndisks; i++) {
2022 2023
        virDomainDiskDefPtr disk = def->disks[i];

2024 2025
        if (virSecuritySELinuxRestoreImageLabelInt(mgr, def, disk->src,
                                                   migrated) < 0)
2026 2027
            rc = -1;
    }
2028

2029
    if (virDomainChrDefForeach(def,
2030
                               false,
2031
                               virSecuritySELinuxRestoreSecurityChardevCallback,
2032
                               mgr) < 0)
2033 2034
        rc = -1;

2035
    if (virDomainSmartcardDefForeach(def,
E
Eric Blake 已提交
2036
                                     false,
2037
                                     virSecuritySELinuxRestoreSecuritySmartcardCallback,
2038
                                     mgr) < 0)
E
Eric Blake 已提交
2039 2040
        rc = -1;

2041
    if (def->os.loader && def->os.loader->nvram &&
2042
        virSecuritySELinuxRestoreFileLabel(mgr, def->os.loader->nvram) < 0)
2043 2044
        rc = -1;

2045 2046 2047 2048
    return rc;
}

static int
2049 2050
virSecuritySELinuxReleaseLabel(virSecurityManagerPtr mgr,
                               virDomainDefPtr def)
2051
{
2052 2053 2054 2055
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (secdef == NULL)
2056
        return 0;
2057

2058 2059 2060 2061
    if (secdef->type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
        if (secdef->label != NULL) {
            context_t con = context_new(secdef->label);
            if (con) {
2062
                virSecuritySELinuxMCSRemove(mgr, context_range_get(con));
2063 2064 2065 2066 2067 2068
                context_free(con);
            }
        }
        VIR_FREE(secdef->label);
        if (!secdef->baselabel)
            VIR_FREE(secdef->model);
2069 2070 2071
    }
    VIR_FREE(secdef->imagelabel);

2072
    return 0;
2073 2074
}

2075 2076

static int
2077
virSecuritySELinuxSetSavedStateLabel(virSecurityManagerPtr mgr,
2078 2079
                                     virDomainDefPtr def,
                                     const char *savefile)
2080
{
2081 2082 2083
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2084
    if (!secdef || !secdef->relabel)
2085 2086
        return 0;

2087
    return virSecuritySELinuxSetFilecon(mgr, savefile, secdef->imagelabel);
2088 2089 2090 2091
}


static int
2092
virSecuritySELinuxRestoreSavedStateLabel(virSecurityManagerPtr mgr,
2093 2094
                                         virDomainDefPtr def,
                                         const char *savefile)
2095
{
2096 2097 2098
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2099
    if (!secdef || !secdef->relabel)
2100 2101
        return 0;

2102
    return virSecuritySELinuxRestoreFileLabel(mgr, savefile);
2103 2104 2105
}


2106
static int
2107 2108
virSecuritySELinuxSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                 virDomainDefPtr def)
2109
{
2110 2111 2112 2113
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (secdef == NULL)
2114
        return 0;
2115

2116
    if (STRNEQ(SECURITY_SELINUX_NAME, secdef->model)) {
2117 2118 2119 2120
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label driver mismatch: "
                         "'%s' model configured for domain, but "
                         "hypervisor driver is '%s'."),
2121
                       secdef->model, SECURITY_SELINUX_NAME);
2122 2123 2124
        return -1;
    }

2125 2126
    if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC) {
        if (security_check_context(secdef->label) != 0) {
2127 2128
            virReportError(VIR_ERR_XML_ERROR,
                           _("Invalid security label %s"), secdef->label);
2129 2130 2131 2132 2133 2134
            return -1;
        }
    }
    return 0;
}

2135
static int
2136 2137
virSecuritySELinuxSetProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                  virDomainDefPtr def)
2138 2139
{
    /* TODO: verify DOI */
2140 2141 2142
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2143
    if (!secdef || !secdef->label)
2144 2145
        return 0;

2146
    VIR_DEBUG("label=%s", secdef->label);
2147
    if (STRNEQ(SECURITY_SELINUX_NAME, secdef->model)) {
2148 2149 2150 2151
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label driver mismatch: "
                         "'%s' model configured for domain, but "
                         "hypervisor driver is '%s'."),
2152
                       secdef->model, SECURITY_SELINUX_NAME);
2153
        if (security_getenforce() == 1)
2154
            return -1;
2155 2156
    }

M
Martin Kletzander 已提交
2157
    if (setexeccon_raw(secdef->label) == -1) {
2158
        virReportSystemError(errno,
2159 2160
                             _("unable to set security context '%s'"),
                             secdef->label);
2161
        if (security_getenforce() == 1)
2162
            return -1;
2163 2164
    }

2165 2166 2167
    return 0;
}

2168
static int
2169 2170 2171
virSecuritySELinuxSetChildProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                       virDomainDefPtr def,
                                       virCommandPtr cmd)
2172 2173 2174 2175 2176
{
    /* TODO: verify DOI */
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2177
    if (!secdef || !secdef->label)
2178 2179 2180
        return 0;

    VIR_DEBUG("label=%s", secdef->label);
2181
    if (STRNEQ(SECURITY_SELINUX_NAME, secdef->model)) {
2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label driver mismatch: "
                         "'%s' model configured for domain, but "
                         "hypervisor driver is '%s'."),
                       secdef->model, SECURITY_SELINUX_NAME);
        if (security_getenforce() == 1)
            return -1;
    }

    /* save in cmd to be set after fork/before child process is exec'ed */
    virCommandSetSELinuxLabel(cmd, secdef->label);
    return 0;
}

2196
static int
2197 2198
virSecuritySELinuxSetDaemonSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                       virDomainDefPtr def)
2199 2200
{
    /* TODO: verify DOI */
2201
    virSecurityLabelDefPtr secdef;
2202
    security_context_t scon = NULL;
2203
    char *str = NULL;
2204 2205
    int rc = -1;

2206
    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2207
    if (!secdef || !secdef->label)
2208 2209
        return 0;

2210
    if (STRNEQ(SECURITY_SELINUX_NAME, secdef->model)) {
2211 2212 2213 2214
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label driver mismatch: "
                         "'%s' model configured for domain, but "
                         "hypervisor driver is '%s'."),
2215
                       secdef->model, SECURITY_SELINUX_NAME);
2216 2217 2218
        goto done;
    }

M
Martin Kletzander 已提交
2219
    if (getcon_raw(&scon) == -1) {
2220 2221 2222 2223 2224 2225
        virReportSystemError(errno,
                             _("unable to get current process context '%s'"),
                             secdef->label);
        goto done;
    }

2226
    if (!(str = virSecuritySELinuxContextAddRange(secdef->label, scon)))
2227 2228
        goto done;

2229 2230
    VIR_DEBUG("Setting VM %s socket context %s", def->name, str);
    if (setsockcreatecon_raw(str) == -1) {
2231
        virReportSystemError(errno,
2232
                             _("unable to set socket security context '%s'"), str);
2233 2234 2235 2236
        goto done;
    }

    rc = 0;
2237
 done:
2238 2239 2240 2241

    if (security_getenforce() != 1)
        rc = 0;
    freecon(scon);
2242
    VIR_FREE(str);
2243 2244 2245
    return rc;
}

2246
static int
2247 2248
virSecuritySELinuxSetSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                 virDomainDefPtr vm)
2249
{
2250
    virSecurityLabelDefPtr secdef;
2251 2252
    int rc = -1;

2253
    secdef = virDomainDefGetSecurityLabelDef(vm, SECURITY_SELINUX_NAME);
2254
    if (!secdef || !secdef->label)
2255 2256
        return 0;

2257
    if (STRNEQ(SECURITY_SELINUX_NAME, secdef->model)) {
2258 2259 2260 2261
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label driver mismatch: "
                         "'%s' model configured for domain, but "
                         "hypervisor driver is '%s'."),
2262
                       secdef->model, SECURITY_SELINUX_NAME);
2263 2264 2265 2266
        goto done;
    }

    VIR_DEBUG("Setting VM %s socket context %s",
2267
              vm->name, secdef->label);
M
Martin Kletzander 已提交
2268
    if (setsockcreatecon_raw(secdef->label) == -1) {
2269 2270 2271 2272 2273 2274 2275 2276
        virReportSystemError(errno,
                             _("unable to set socket security context '%s'"),
                             secdef->label);
        goto done;
    }

    rc = 0;

2277
 done:
2278 2279 2280 2281 2282 2283
    if (security_getenforce() != 1)
        rc = 0;

    return rc;
}

2284
static int
2285 2286
virSecuritySELinuxClearSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                   virDomainDefPtr def)
2287 2288
{
    /* TODO: verify DOI */
2289 2290 2291
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2292
    if (!secdef || !secdef->label)
2293 2294
        return 0;

2295
    if (STRNEQ(SECURITY_SELINUX_NAME, secdef->model)) {
2296 2297 2298 2299
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("security label driver mismatch: "
                         "'%s' model configured for domain, but "
                         "hypervisor driver is '%s'."),
2300
                       secdef->model, SECURITY_SELINUX_NAME);
2301 2302 2303 2304
        if (security_getenforce() == 1)
            return -1;
    }

M
Martin Kletzander 已提交
2305
    if (setsockcreatecon_raw(NULL) == -1) {
2306 2307 2308 2309 2310 2311 2312 2313 2314
        virReportSystemError(errno,
                             _("unable to clear socket security context '%s'"),
                             secdef->label);
        if (security_getenforce() == 1)
            return -1;
    }
    return 0;
}

2315 2316

static int
2317 2318
virSecuritySELinuxSetSecurityChardevCallback(virDomainDefPtr def,
                                             virDomainChrDefPtr dev,
2319
                                             void *opaque)
2320
{
2321 2322
    virSecurityManagerPtr mgr = opaque;

2323 2324 2325 2326 2327
    /* This is taken care of by processing of def->serials */
    if (dev->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE &&
        dev->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL)
        return 0;

2328
    return virSecuritySELinuxSetChardevLabel(mgr, def, dev, &dev->source);
2329 2330 2331
}


E
Eric Blake 已提交
2332
static int
2333 2334 2335
virSecuritySELinuxSetSecuritySmartcardCallback(virDomainDefPtr def,
                                               virDomainSmartcardDefPtr dev,
                                               void *opaque)
E
Eric Blake 已提交
2336 2337
{
    const char *database;
2338 2339
    virSecurityManagerPtr mgr = opaque;
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
E
Eric Blake 已提交
2340 2341 2342 2343 2344 2345 2346 2347 2348

    switch (dev->type) {
    case VIR_DOMAIN_SMARTCARD_TYPE_HOST:
        break;

    case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
        database = dev->data.cert.database;
        if (!database)
            database = VIR_DOMAIN_SMARTCARD_DEFAULT_DATABASE;
2349
        return virSecuritySELinuxSetFilecon(mgr, database, data->content_context);
E
Eric Blake 已提交
2350 2351

    case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH:
2352 2353
        return virSecuritySELinuxSetChardevLabel(mgr, def, NULL,
                                                 &dev->data.passthru);
E
Eric Blake 已提交
2354 2355

    default:
2356 2357 2358
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("unknown smartcard type %d"),
                       dev->type);
E
Eric Blake 已提交
2359 2360 2361 2362 2363 2364 2365
        return -1;
    }

    return 0;
}


2366
static int
2367 2368 2369
virSecuritySELinuxSetAllLabel(virSecurityManagerPtr mgr,
                              virDomainDefPtr def,
                              const char *stdin_path)
2370
{
2371
    size_t i;
2372 2373 2374 2375
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2376

2377
    if (!secdef || !secdef->relabel || data->skipAllLabel)
2378 2379
        return 0;

2380
    for (i = 0; i < def->ndisks; i++) {
2381
        /* XXX fixme - we need to recursively label the entire tree :-( */
E
Eric Blake 已提交
2382
        if (virDomainDiskGetType(def->disks[i]) == VIR_STORAGE_TYPE_DIR) {
2383
            VIR_WARN("Unable to relabel directory tree %s for disk %s",
2384 2385
                     virDomainDiskGetSource(def->disks[i]),
                     def->disks[i]->dst);
2386
            continue;
2387
        }
2388 2389
        if (virSecuritySELinuxSetDiskLabel(mgr,
                                           def, def->disks[i]) < 0)
2390 2391
            return -1;
    }
2392
    /* XXX fixme process  def->fss if relabel == true */
2393

2394
    for (i = 0; i < def->nhostdevs; i++) {
2395 2396 2397 2398
        if (virSecuritySELinuxSetHostdevLabel(mgr,
                                              def,
                                              def->hostdevs[i],
                                              NULL) < 0)
2399
            return -1;
2400
    }
2401 2402 2403 2404 2405 2406

    for (i = 0; i < def->ninputs; i++) {
        if (virSecuritySELinuxSetInputLabel(mgr, def, def->inputs[i]) < 0)
            return -1;
    }

2407
    if (def->tpm) {
2408
        if (virSecuritySELinuxSetTPMFileLabel(mgr, def, def->tpm) < 0)
2409 2410
            return -1;
    }
2411

2412
    if (virDomainChrDefForeach(def,
2413
                               true,
2414
                               virSecuritySELinuxSetSecurityChardevCallback,
2415
                               mgr) < 0)
2416 2417
        return -1;

2418
    if (virDomainSmartcardDefForeach(def,
E
Eric Blake 已提交
2419
                                     true,
2420
                                     virSecuritySELinuxSetSecuritySmartcardCallback,
2421
                                     mgr) < 0)
E
Eric Blake 已提交
2422 2423
        return -1;

M
Michal Privoznik 已提交
2424 2425
    /* This is different than kernel or initrd. The nvram store
     * is really a disk, qemu can read and write to it. */
2426
    if (def->os.loader && def->os.loader->nvram &&
M
Michal Privoznik 已提交
2427
        secdef && secdef->imagelabel &&
2428 2429
        virSecuritySELinuxSetFilecon(mgr, def->os.loader->nvram,
                                     secdef->imagelabel) < 0)
2430 2431
        return -1;

2432
    if (def->os.kernel &&
2433 2434
        virSecuritySELinuxSetFilecon(mgr, def->os.kernel,
                                     data->content_context) < 0)
2435 2436
        return -1;

2437
    if (def->os.initrd &&
2438 2439
        virSecuritySELinuxSetFilecon(mgr, def->os.initrd,
                                     data->content_context) < 0)
2440 2441
        return -1;

O
Olivia Yin 已提交
2442
    if (def->os.dtb &&
2443 2444
        virSecuritySELinuxSetFilecon(mgr, def->os.dtb,
                                     data->content_context) < 0)
O
Olivia Yin 已提交
2445 2446
        return -1;

2447
    if (stdin_path &&
2448 2449
        virSecuritySELinuxSetFilecon(mgr, stdin_path,
                                     data->content_context) < 0)
2450
        return -1;
2451

2452 2453 2454
    return 0;
}

2455
static int
2456 2457 2458
virSecuritySELinuxSetImageFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                  virDomainDefPtr def,
                                  int fd)
2459
{
2460 2461 2462
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2463
    if (!secdef || !secdef->imagelabel)
2464 2465
        return 0;

2466
    return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel);
2467 2468
}

2469
static int
2470
virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr,
2471 2472 2473
                                virDomainDefPtr def,
                                int fd)
{
2474 2475
    struct stat buf;
    security_context_t fcon = NULL;
2476
    virSecurityLabelDefPtr secdef;
2477
    char *str = NULL, *proc = NULL, *fd_path = NULL;
2478
    int rc = -1;
2479 2480

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
2481
    if (!secdef || !secdef->label)
2482 2483
        return 0;

2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494
    if (fstat(fd, &buf) < 0) {
        virReportSystemError(errno, _("cannot stat tap fd %d"), fd);
        goto cleanup;
    }

    if ((buf.st_mode & S_IFMT) != S_IFCHR) {
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("tap fd %d is not character device"), fd);
        goto cleanup;
    }

2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512
    /* Label /dev/tap.* devices only. Leave /dev/net/tun alone! */
    if (virAsprintf(&proc, "/proc/self/fd/%d", fd) == -1)
        goto cleanup;

    if (virFileResolveLink(proc, &fd_path) < 0) {
        virReportSystemError(errno,
                             _("Unable to resolve link: %s"), proc);
        goto cleanup;
    }

    if (!STRPREFIX(fd_path, "/dev/tap")) {
        VIR_DEBUG("fd=%d points to %s not setting SELinux label",
                  fd, fd_path);
        rc = 0;
        goto cleanup;
    }

    if (getContext(mgr, "/dev/tap*", buf.st_mode, &fcon) < 0) {
2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525
        virReportError(VIR_ERR_INTERNAL_ERROR,
                       _("cannot lookup default selinux label for tap fd %d"), fd);
        goto cleanup;
    }

    if (!(str = virSecuritySELinuxContextAddRange(secdef->label, fcon))) {
        goto cleanup;
    } else {
        rc = virSecuritySELinuxFSetFilecon(fd, str);
    }

 cleanup:
    freecon(fcon);
2526 2527
    VIR_FREE(fd_path);
    VIR_FREE(proc);
2528 2529
    VIR_FREE(str);
    return rc;
2530 2531
}

2532 2533 2534 2535
static char *
virSecuritySELinuxGenImageLabel(virSecurityManagerPtr mgr,
                                virDomainDefPtr def)
{
2536
    virSecurityLabelDefPtr secdef;
2537 2538 2539 2540
    virSecuritySELinuxDataPtr data = virSecurityManagerGetPrivateData(mgr);
    const char *range;
    context_t ctx = NULL;
    char *label = NULL;
2541
    char *mcs = NULL;
2542

2543 2544 2545 2546
    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (secdef == NULL)
        goto cleanup;

2547 2548 2549
    if (secdef->label) {
        ctx = context_new(secdef->label);
        if (!ctx) {
2550 2551
            virReportSystemError(errno, _("unable to create selinux context for: %s"),
                                 secdef->label);
2552 2553 2554 2555
            goto cleanup;
        }
        range = context_range_get(ctx);
        if (range) {
2556
            if (VIR_STRDUP(mcs, range) < 0)
2557
                goto cleanup;
2558 2559
            if (!(label = virSecuritySELinuxGenNewContext(data->file_context,
                                                          mcs, true)))
2560 2561 2562 2563
                goto cleanup;
        }
    }

2564
 cleanup:
2565 2566 2567
    context_free(ctx);
    VIR_FREE(mcs);
    return label;
2568 2569
}

2570 2571 2572 2573
static char *
virSecuritySELinuxGetSecurityMountOptions(virSecurityManagerPtr mgr,
                                          virDomainDefPtr def)
{
2574
    char *opts = NULL;
2575 2576
    virSecurityLabelDefPtr secdef;

2577 2578 2579 2580 2581 2582 2583
    if ((secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME))) {
        if (!secdef->imagelabel)
            secdef->imagelabel = virSecuritySELinuxGenImageLabel(mgr, def);

        if (secdef->imagelabel &&
            virAsprintf(&opts,
                        ",context=\"%s\"",
2584
                        (const char*) secdef->imagelabel) < 0)
2585 2586
            return NULL;
    }
2587

2588
    if (!opts && VIR_STRDUP(opts, "") < 0)
2589
        return NULL;
2590

2591 2592
    VIR_DEBUG("imageLabel=%s opts=%s",
              secdef ? secdef->imagelabel : "(null)", opts);
2593 2594 2595
    return opts;
}

G
Guido Günther 已提交
2596
static int
2597
virSecuritySELinuxDomainSetDirLabel(virSecurityManagerPtr mgr,
2598 2599 2600 2601 2602 2603 2604 2605 2606
                                    virDomainDefPtr def,
                                    const char *path)
{
    virSecurityLabelDefPtr seclabel;

    seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
    if (!seclabel || !seclabel->relabel)
        return 0;

2607
    return virSecuritySELinuxSetFilecon(mgr, path, seclabel->imagelabel);
2608 2609
}

2610
virSecurityDriver virSecurityDriverSELinux = {
2611 2612
    .privateDataLen                     = sizeof(virSecuritySELinuxData),
    .name                               = SECURITY_SELINUX_NAME,
2613 2614 2615
    .probe                              = virSecuritySELinuxSecurityDriverProbe,
    .open                               = virSecuritySELinuxSecurityDriverOpen,
    .close                              = virSecuritySELinuxSecurityDriverClose,
2616

2617 2618
    .getModel                           = virSecuritySELinuxSecurityGetModel,
    .getDOI                             = virSecuritySELinuxSecurityGetDOI,
2619

2620
    .domainSecurityVerify               = virSecuritySELinuxSecurityVerify,
2621

2622 2623
    .domainSetSecurityDiskLabel         = virSecuritySELinuxSetDiskLabel,
    .domainRestoreSecurityDiskLabel     = virSecuritySELinuxRestoreDiskLabel,
2624

2625 2626
    .domainSetSecurityImageLabel        = virSecuritySELinuxSetImageLabel,
    .domainRestoreSecurityImageLabel    = virSecuritySELinuxRestoreImageLabel,
2627

2628 2629 2630
    .domainSetSecurityDaemonSocketLabel = virSecuritySELinuxSetDaemonSocketLabel,
    .domainSetSecuritySocketLabel       = virSecuritySELinuxSetSocketLabel,
    .domainClearSecuritySocketLabel     = virSecuritySELinuxClearSocketLabel,
2631

2632 2633 2634
    .domainGenSecurityLabel             = virSecuritySELinuxGenLabel,
    .domainReserveSecurityLabel         = virSecuritySELinuxReserveLabel,
    .domainReleaseSecurityLabel         = virSecuritySELinuxReleaseLabel,
2635

2636 2637 2638
    .domainGetSecurityProcessLabel      = virSecuritySELinuxGetProcessLabel,
    .domainSetSecurityProcessLabel      = virSecuritySELinuxSetProcessLabel,
    .domainSetSecurityChildProcessLabel = virSecuritySELinuxSetChildProcessLabel,
2639

2640 2641
    .domainSetSecurityAllLabel          = virSecuritySELinuxSetAllLabel,
    .domainRestoreSecurityAllLabel      = virSecuritySELinuxRestoreAllLabel,
2642

2643 2644
    .domainSetSecurityHostdevLabel      = virSecuritySELinuxSetHostdevLabel,
    .domainRestoreSecurityHostdevLabel  = virSecuritySELinuxRestoreHostdevLabel,
2645

2646 2647
    .domainSetSavedStateLabel           = virSecuritySELinuxSetSavedStateLabel,
    .domainRestoreSavedStateLabel       = virSecuritySELinuxRestoreSavedStateLabel,
2648

2649
    .domainSetSecurityImageFDLabel      = virSecuritySELinuxSetImageFDLabel,
2650
    .domainSetSecurityTapFDLabel        = virSecuritySELinuxSetTapFDLabel,
2651

2652
    .domainGetSecurityMountOptions      = virSecuritySELinuxGetSecurityMountOptions,
2653
    .getBaseLabel                       = virSecuritySELinuxGetBaseLabel,
2654 2655

    .domainSetDirLabel                  = virSecuritySELinuxDomainSetDirLabel,
2656
};