From d8116b5a0a6364b29e9774323d9aa442ad8c561d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A1n=20Tomko?= Date: Tue, 21 Nov 2017 13:31:53 +0100 Subject: [PATCH] security: Introduce functions for input device hot(un)plug Export the existing DAC and SELinux for separate use and introduce functions for stack, nop and the security manager. --- src/libvirt_private.syms | 2 ++ src/security/security_dac.c | 3 +++ src/security/security_driver.h | 9 ++++++++ src/security/security_manager.c | 36 +++++++++++++++++++++++++++++++ src/security/security_manager.h | 8 +++++++ src/security/security_nop.c | 11 ++++++++++ src/security/security_selinux.c | 3 +++ src/security/security_stack.c | 38 +++++++++++++++++++++++++++++++++ 8 files changed, 110 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index b4d3b9a941..875e474b6d 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1276,6 +1276,7 @@ virSecurityManagerRestoreAllLabel; virSecurityManagerRestoreDiskLabel; virSecurityManagerRestoreHostdevLabel; virSecurityManagerRestoreImageLabel; +virSecurityManagerRestoreInputLabel; virSecurityManagerRestoreMemoryLabel; virSecurityManagerRestoreSavedStateLabel; virSecurityManagerSetAllLabel; @@ -1285,6 +1286,7 @@ virSecurityManagerSetDiskLabel; virSecurityManagerSetHostdevLabel; virSecurityManagerSetImageFDLabel; virSecurityManagerSetImageLabel; +virSecurityManagerSetInputLabel; virSecurityManagerSetMemoryLabel; virSecurityManagerSetProcessLabel; virSecurityManagerSetSavedStateLabel; diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 54120890fd..52ca07a10f 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -2123,6 +2123,9 @@ virSecurityDriver virSecurityDriverDAC = { .domainSetSecurityMemoryLabel = virSecurityDACSetMemoryLabel, .domainRestoreSecurityMemoryLabel = virSecurityDACRestoreMemoryLabel, + .domainSetSecurityInputLabel = virSecurityDACSetInputLabel, + .domainRestoreSecurityInputLabel = virSecurityDACRestoreInputLabel, + .domainSetSecurityDaemonSocketLabel = virSecurityDACSetDaemonSocketLabel, .domainSetSecuritySocketLabel = virSecurityDACSetSocketLabel, .domainClearSecuritySocketLabel = virSecurityDACClearSocketLabel, diff --git a/src/security/security_driver.h b/src/security/security_driver.h index 0b3b452486..1b3070d06d 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -131,6 +131,12 @@ typedef int (*virSecurityDomainSetMemoryLabel) (virSecurityManagerPtr mgr, typedef int (*virSecurityDomainRestoreMemoryLabel) (virSecurityManagerPtr mgr, virDomainDefPtr def, virDomainMemoryDefPtr mem); +typedef int (*virSecurityDomainSetInputLabel) (virSecurityManagerPtr mgr, + virDomainDefPtr def, + virDomainInputDefPtr input); +typedef int (*virSecurityDomainRestoreInputLabel) (virSecurityManagerPtr mgr, + virDomainDefPtr def, + virDomainInputDefPtr input); typedef int (*virSecurityDomainSetPathLabel) (virSecurityManagerPtr mgr, virDomainDefPtr def, const char *path); @@ -163,6 +169,9 @@ struct _virSecurityDriver { virSecurityDomainSetMemoryLabel domainSetSecurityMemoryLabel; virSecurityDomainRestoreMemoryLabel domainRestoreSecurityMemoryLabel; + virSecurityDomainSetInputLabel domainSetSecurityInputLabel; + virSecurityDomainRestoreInputLabel domainRestoreSecurityInputLabel; + virSecurityDomainSetDaemonSocketLabel domainSetSecurityDaemonSocketLabel; virSecurityDomainSetSocketLabel domainSetSecuritySocketLabel; virSecurityDomainClearSocketLabel domainClearSecuritySocketLabel; diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 60cfc92e77..3cf12188a0 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -1116,3 +1116,39 @@ virSecurityManagerRestoreMemoryLabel(virSecurityManagerPtr mgr, virReportUnsupportedError(); return -1; } + + +int +virSecurityManagerSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + if (mgr->drv->domainSetSecurityInputLabel) { + int ret; + virObjectLock(mgr); + ret = mgr->drv->domainSetSecurityInputLabel(mgr, vm, input); + virObjectUnlock(mgr); + return ret; + } + + virReportUnsupportedError(); + return -1; +} + + +int +virSecurityManagerRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + if (mgr->drv->domainRestoreSecurityInputLabel) { + int ret; + virObjectLock(mgr); + ret = mgr->drv->domainRestoreSecurityInputLabel(mgr, vm, input); + virObjectUnlock(mgr); + return ret; + } + + virReportUnsupportedError(); + return -1; +} diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 6712112e76..834c7f1593 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -172,6 +172,14 @@ int virSecurityManagerRestoreMemoryLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, virDomainMemoryDefPtr mem); +int virSecurityManagerSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input); +int virSecurityManagerRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input); + + int virSecurityManagerDomainSetPathLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, const char *path); diff --git a/src/security/security_nop.c b/src/security/security_nop.c index 527be11e5a..cfb032c686 100644 --- a/src/security/security_nop.c +++ b/src/security/security_nop.c @@ -254,6 +254,14 @@ virSecurityDomainRestoreMemoryLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSE return 0; } +static int +virSecurityDomainInputLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainInputDefPtr input ATTRIBUTE_UNUSED) +{ + return 0; +} + virSecurityDriver virSecurityDriverNop = { .privateDataLen = 0, @@ -276,6 +284,9 @@ virSecurityDriver virSecurityDriverNop = { .domainSetSecurityMemoryLabel = virSecurityDomainSetMemoryLabelNop, .domainRestoreSecurityMemoryLabel = virSecurityDomainRestoreMemoryLabelNop, + .domainSetSecurityInputLabel = virSecurityDomainInputLabelNop, + .domainRestoreSecurityInputLabel = virSecurityDomainInputLabelNop, + .domainSetSecurityDaemonSocketLabel = virSecurityDomainSetDaemonSocketLabelNop, .domainSetSecuritySocketLabel = virSecurityDomainSetSocketLabelNop, .domainClearSecuritySocketLabel = virSecurityDomainClearSocketLabelNop, diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index ed1828a12f..b677fbcda7 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -3064,6 +3064,9 @@ virSecurityDriver virSecurityDriverSELinux = { .domainSetSecurityMemoryLabel = virSecuritySELinuxSetMemoryLabel, .domainRestoreSecurityMemoryLabel = virSecuritySELinuxRestoreMemoryLabel, + .domainSetSecurityInputLabel = virSecuritySELinuxSetInputLabel, + .domainRestoreSecurityInputLabel = virSecuritySELinuxRestoreInputLabel, + .domainSetSecurityDaemonSocketLabel = virSecuritySELinuxSetDaemonSocketLabel, .domainSetSecuritySocketLabel = virSecuritySELinuxSetSocketLabel, .domainClearSecuritySocketLabel = virSecuritySELinuxClearSocketLabel, diff --git a/src/security/security_stack.c b/src/security/security_stack.c index 53eee1692f..cd916382b2 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -666,6 +666,41 @@ virSecurityStackRestoreMemoryLabel(virSecurityManagerPtr mgr, return rc; } +static int +virSecurityStackSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item = priv->itemsHead; + int rc = 0; + + for (; item; item = item->next) { + if (virSecurityManagerSetInputLabel(item->securityManager, vm, input) < 0) + rc = -1; + } + + return rc; +} + +static int +virSecurityStackRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item = priv->itemsHead; + int rc = 0; + + for (; item; item = item->next) { + if (virSecurityManagerRestoreInputLabel(item->securityManager, + vm, input) < 0) + rc = -1; + } + + return rc; +} + static int virSecurityStackDomainSetPathLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, @@ -711,6 +746,9 @@ virSecurityDriver virSecurityDriverStack = { .domainSetSecurityMemoryLabel = virSecurityStackSetMemoryLabel, .domainRestoreSecurityMemoryLabel = virSecurityStackRestoreMemoryLabel, + .domainSetSecurityInputLabel = virSecurityStackSetInputLabel, + .domainRestoreSecurityInputLabel = virSecurityStackRestoreInputLabel, + .domainSetSecurityDaemonSocketLabel = virSecurityStackSetDaemonSocketLabel, .domainSetSecuritySocketLabel = virSecurityStackSetSocketLabel, .domainClearSecuritySocketLabel = virSecurityStackClearSocketLabel, -- GitLab