Skip to content

L
libvirt

openeuler / libvirt

通知 3
Star 0
Fork 0
L
libvirt

体验新版 GitCode，发现更多精彩内容 >>

提交 f70e0809 编写于 作者: D Daniel P. Berrange
浏览文件
操作

Pass security driver object into all security driver callbacks 

The implementation of security driver callbacks often needs
to access the security driver object. Currently only a handful
of callbacks include the driver object as a parameter. Later
patches require this is many more places.

* src/qemu/qemu_driver.c: Pass in the security driver object
  to all callbacks
* src/qemu/qemu_security_dac.c, src/qemu/qemu_security_stacked.c,
  src/security/security_apparmor.c, src/security/security_driver.h,
  src/security/security_selinux.c: Add a virSecurityDriverPtr
  param to all security callbacks
上级 a8853344
隐藏空白更改
内联 并排
Showing with 260 addition and 132 deletion
src/qemu/qemu_driver.c
浏览文件 @ f70e0809
......@@ -1282,7 +1282,8 @@ qemuReconnectDomain(void *payload, const char *name ATTRIBUTE_UNUSED, void *opaq
if (driver->securityDriver &&
driver->securityDriver->domainReserveSecurityLabel &&
driver->securityDriver->domainReserveSecurityLabel(obj) < 0)
driver->securityDriver->domainReserveSecurityLabel(driver->securityDriver,
obj) < 0)
goto error;
if (obj->def->id >= driver->nextvmid)
......@@ -3405,13 +3406,15 @@ static int qemudStartVMDaemon(virConnectPtr conn,
DEBUG0("Generating domain security label (if required)");
if (driver->securityDriver &&
driver->securityDriver->domainGenSecurityLabel &&
driver->securityDriver->domainGenSecurityLabel(vm) < 0)
driver->securityDriver->domainGenSecurityLabel(driver->securityDriver,
vm) < 0)
goto cleanup;
DEBUG0("Generating setting domain security labels (if required)");
if (driver->securityDriver &&
driver->securityDriver->domainSetSecurityAllLabel &&
driver->securityDriver->domainSetSecurityAllLabel(vm, stdin_path) < 0) {
driver->securityDriver->domainSetSecurityAllLabel(driver->securityDriver,
vm, stdin_path) < 0) {
if (stdin_path && virStorageFileIsSharedFS(stdin_path) != 1)
goto cleanup;
}
......@@ -3770,10 +3773,12 @@ static void qemudShutdownVMDaemon(struct qemud_driver *driver,
/* Reset Security Labels */
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityAllLabel)
driver->securityDriver->domainRestoreSecurityAllLabel(vm, migrated);
driver->securityDriver->domainRestoreSecurityAllLabel(driver->securityDriver,
vm, migrated);
if (driver->securityDriver &&
driver->securityDriver->domainReleaseSecurityLabel)
driver->securityDriver->domainReleaseSecurityLabel(vm);
driver->securityDriver->domainReleaseSecurityLabel(driver->securityDriver,
vm);
/* Clear out dynamically assigned labels */
if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
......@@ -5175,7 +5180,8 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path,
if ((!bypassSecurityDriver) &&
driver->securityDriver &&
driver->securityDriver->domainSetSavedStateLabel &&
driver->securityDriver->domainSetSavedStateLabel(vm, path) == -1)
driver->securityDriver->domainSetSavedStateLabel(driver->securityDriver,
vm, path) == -1)
goto endjob;
if (header.compressed == QEMUD_SAVE_FORMAT_RAW) {
......@@ -5210,7 +5216,8 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path,
if ((!bypassSecurityDriver) &&
driver->securityDriver &&
driver->securityDriver->domainRestoreSavedStateLabel &&
driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1)
driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver,
vm, path) == -1)
VIR_WARN("failed to restore save state label on %s", path);
if (cgroup != NULL) {
......@@ -5257,7 +5264,8 @@ endjob:
if ((!bypassSecurityDriver) &&
driver->securityDriver &&
driver->securityDriver->domainRestoreSavedStateLabel &&
driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1)
driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver,
vm, path) == -1)
VIR_WARN("failed to restore save state label on %s", path);
}
......@@ -5492,7 +5500,8 @@ static int qemudDomainCoreDump(virDomainPtr dom,
if (driver->securityDriver &&
driver->securityDriver->domainSetSavedStateLabel &&
driver->securityDriver->domainSetSavedStateLabel(vm, path) == -1)
driver->securityDriver->domainSetSavedStateLabel(driver->securityDriver,
vm, path) == -1)
goto endjob;
/* Migrate will always stop the VM, so the resume condition is
......@@ -5535,7 +5544,8 @@ static int qemudDomainCoreDump(virDomainPtr dom,
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSavedStateLabel &&
driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1)
driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver,
vm, path) == -1)
goto endjob;
endjob:
......@@ -5918,12 +5928,13 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec
* QEMU monitor hasn't seen SIGHUP/ERR on poll().
*/
if (virDomainObjIsActive(vm)) {
if (driver->securityDriver && driver->securityDriver->domainGetSecurityProcessLabel) {
if (driver->securityDriver->domainGetSecurityProcessLabel(vm, seclabel) == -1) {
qemuReportError(VIR_ERR_INTERNAL_ERROR,
"%s", _("Failed to get security label"));
goto cleanup;
}
if (driver->securityDriver &&
driver->securityDriver->domainGetSecurityProcessLabel &&
driver->securityDriver->domainGetSecurityProcessLabel(driver->securityDriver,
vm, seclabel) < 0) {
qemuReportError(VIR_ERR_INTERNAL_ERROR,
"%s", _("Failed to get security label"));
goto cleanup;
}
}
......@@ -6329,7 +6340,8 @@ qemudDomainSaveImageStartVM(virConnectPtr conn,
out:
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSavedStateLabel &&
driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1)
driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver,
vm, path) == -1)
VIR_WARN("failed to restore save state label on %s", path);
return ret;
......@@ -7043,7 +7055,8 @@ static int qemudDomainChangeEjectableMedia(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainSetSecurityImageLabel &&
driver->securityDriver->domainSetSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
return -1;
if (!(driveAlias = qemuDeviceDriveHostAlias(origdisk, qemuCmdFlags)))
......@@ -7072,7 +7085,8 @@ static int qemudDomainChangeEjectableMedia(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityImageLabel &&
driver->securityDriver->domainRestoreSecurityImageLabel(vm, origdisk) < 0)
driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver,
vm, origdisk) < 0)
VIR_WARN("Unable to restore security label on ejected image %s", origdisk->src);
VIR_FREE(origdisk->src);
......@@ -7090,7 +7104,8 @@ error:
VIR_FREE(driveAlias);
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityImageLabel &&
driver->securityDriver->domainRestoreSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
VIR_WARN("Unable to restore security label on new media %s", disk->src);
return -1;
}
......@@ -7117,7 +7132,8 @@ static int qemudDomainAttachPciDiskDevice(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainSetSecurityImageLabel &&
driver->securityDriver->domainSetSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
return -1;
if (qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE) {
......@@ -7184,7 +7200,8 @@ error:
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityImageLabel &&
driver->securityDriver->domainRestoreSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
VIR_WARN("Unable to restore security label on %s", disk->src);
return -1;
......@@ -7326,7 +7343,8 @@ static int qemudDomainAttachSCSIDisk(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainSetSecurityImageLabel &&
driver->securityDriver->domainSetSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
return -1;
/* We should have an address already, so make sure */
......@@ -7412,7 +7430,8 @@ error:
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityImageLabel &&
driver->securityDriver->domainRestoreSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
VIR_WARN("Unable to restore security label on %s", disk->src);
return -1;
......@@ -7439,7 +7458,8 @@ static int qemudDomainAttachUsbMassstorageDevice(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainSetSecurityImageLabel &&
driver->securityDriver->domainSetSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
return -1;
if (!disk->src) {
......@@ -7495,7 +7515,8 @@ error:
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityImageLabel &&
driver->securityDriver->domainRestoreSecurityImageLabel(vm, disk) < 0)
driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver,
vm, disk) < 0)
VIR_WARN("Unable to restore security label on %s", disk->src);
return -1;
......@@ -7932,7 +7953,8 @@ static int qemudDomainAttachHostDevice(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainSetSecurityHostdevLabel &&
driver->securityDriver->domainSetSecurityHostdevLabel(vm, hostdev) < 0)
driver->securityDriver->domainSetSecurityHostdevLabel(driver->securityDriver,
vm, hostdev) < 0)
return -1;
switch (hostdev->source.subsys.type) {
......@@ -7960,7 +7982,8 @@ static int qemudDomainAttachHostDevice(struct qemud_driver *driver,
error:
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityHostdevLabel &&
driver->securityDriver->domainRestoreSecurityHostdevLabel(vm, hostdev) < 0)
driver->securityDriver->domainRestoreSecurityHostdevLabel(driver->securityDriver,
vm, hostdev) < 0)
VIR_WARN0("Unable to restore host device labelling on hotplug fail");
return -1;
......@@ -8405,7 +8428,8 @@ static int qemudDomainDetachPciDiskDevice(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityImageLabel &&
driver->securityDriver->domainRestoreSecurityImageLabel(vm, dev->data.disk) < 0)
driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver,
vm, dev->data.disk) < 0)
VIR_WARN("Unable to restore security label on %s", dev->data.disk->src);
if (cgroup != NULL) {
......@@ -8468,7 +8492,8 @@ static int qemudDomainDetachSCSIDiskDevice(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityImageLabel &&
driver->securityDriver->domainRestoreSecurityImageLabel(vm, dev->data.disk) < 0)
driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver,
vm, dev->data.disk) < 0)
VIR_WARN("Unable to restore security label on %s", dev->data.disk->src);
if (cgroup != NULL) {
......@@ -8893,7 +8918,8 @@ static int qemudDomainDetachHostDevice(struct qemud_driver *driver,
if (driver->securityDriver &&
driver->securityDriver->domainRestoreSecurityHostdevLabel &&
driver->securityDriver->domainRestoreSecurityHostdevLabel(vm, dev->data.hostdev) < 0)
driver->securityDriver->domainRestoreSecurityHostdevLabel(driver->securityDriver,
vm, dev->data.hostdev) < 0)
VIR_WARN0("Failed to restore host device labelling");
return ret;
......
src/qemu/qemu_security_dac.c
浏览文件 @ f70e0809
......@@ -108,7 +108,8 @@ qemuSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED,
static int
qemuSecurityDACSetSecurityImageLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED,
qemuSecurityDACSetSecurityImageLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm ATTRIBUTE_UNUSED,
virDomainDiskDefPtr disk)
{
......@@ -124,7 +125,8 @@ qemuSecurityDACSetSecurityImageLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED,
static int
qemuSecurityDACRestoreSecurityImageLabelInt(virDomainObjPtr vm ATTRIBUTE_UNUSED,
qemuSecurityDACRestoreSecurityImageLabelInt(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm ATTRIBUTE_UNUSED,
virDomainDiskDefPtr disk,
int migrated)
{
......@@ -166,10 +168,11 @@ qemuSecurityDACRestoreSecurityImageLabelInt(virDomainObjPtr vm ATTRIBUTE_UNUSED,
static int
qemuSecurityDACRestoreSecurityImageLabel(virDomainObjPtr vm,
qemuSecurityDACRestoreSecurityImageLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
virDomainDiskDefPtr disk)
{
return qemuSecurityDACRestoreSecurityImageLabelInt(vm, disk, 0);
return qemuSecurityDACRestoreSecurityImageLabelInt(drv, vm, disk, 0);
}
......@@ -192,7 +195,8 @@ qemuSecurityDACSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
static int
qemuSecurityDACSetSecurityHostdevLabel(virDomainObjPtr vm,
qemuSecurityDACSetSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev)
{
......@@ -261,7 +265,8 @@ qemuSecurityDACRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
static int
qemuSecurityDACRestoreSecurityHostdevLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED,
qemuSecurityDACRestoreSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm ATTRIBUTE_UNUSED,
virDomainHostdevDefPtr dev)
{
......@@ -407,7 +412,8 @@ qemuSecurityDACRestoreChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
static int
qemuSecurityDACRestoreSecurityAllLabel(virDomainObjPtr vm,
qemuSecurityDACRestoreSecurityAllLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
int migrated)
{
int i;
......@@ -420,12 +426,14 @@ qemuSecurityDACRestoreSecurityAllLabel(virDomainObjPtr vm,
vm->def->name, migrated);
for (i = 0 ; i < vm->def->nhostdevs ; i++) {
if (qemuSecurityDACRestoreSecurityHostdevLabel(vm,
if (qemuSecurityDACRestoreSecurityHostdevLabel(drv,
vm,
vm->def->hostdevs[i]) < 0)
rc = -1;
}
for (i = 0 ; i < vm->def->ndisks ; i++) {
if (qemuSecurityDACRestoreSecurityImageLabelInt(vm,
if (qemuSecurityDACRestoreSecurityImageLabelInt(drv,
vm,
vm->def->disks[i],
migrated) < 0)
rc = -1;
......@@ -461,7 +469,9 @@ qemuSecurityDACSetChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
static int
qemuSecurityDACSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path ATTRIBUTE_UNUSED)
qemuSecurityDACSetSecurityAllLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
const char *stdin_path ATTRIBUTE_UNUSED)
{
int i;
......@@ -472,11 +482,15 @@ qemuSecurityDACSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path AT
/* XXX fixme - we need to recursively label the entriy tree :-( */
if (vm->def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR)
continue;
if (qemuSecurityDACSetSecurityImageLabel(vm, vm->def->disks[i]) < 0)
if (qemuSecurityDACSetSecurityImageLabel(drv,
vm,
vm->def->disks[i]) < 0)
return -1;
}
for (i = 0 ; i < vm->def->nhostdevs ; i++) {
if (qemuSecurityDACSetSecurityHostdevLabel(vm, vm->def->hostdevs[i]) < 0)
if (qemuSecurityDACSetSecurityHostdevLabel(drv,
vm,
vm->def->hostdevs[i]) < 0)
return -1;
}
......@@ -503,7 +517,8 @@ qemuSecurityDACSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path AT
static int
qemuSecurityDACSetSavedStateLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED,
qemuSecurityDACSetSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm ATTRIBUTE_UNUSED,
const char *savefile)
{
if (!driver->privileged)
......@@ -514,7 +529,8 @@ qemuSecurityDACSetSavedStateLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED,
static int
qemuSecurityDACRestoreSavedStateLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED,
qemuSecurityDACRestoreSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm ATTRIBUTE_UNUSED,
const char *savefile)
{
if (!driver->privileged)
......
src/qemu/qemu_security_stacked.c
浏览文件 @ f70e0809
......@@ -57,18 +57,21 @@ qemuSecurityStackedVerify(virDomainDefPtr def)
static int
qemuSecurityStackedGenLabel(virDomainObjPtr vm)
qemuSecurityStackedGenLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainGenSecurityLabel &&
driver->securitySecondaryDriver->domainGenSecurityLabel(vm) < 0)
driver->securitySecondaryDriver->domainGenSecurityLabel(driver->securitySecondaryDriver,
vm) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainGenSecurityLabel &&
driver->securityPrimaryDriver->domainGenSecurityLabel(vm) < 0)
driver->securityPrimaryDriver->domainGenSecurityLabel(driver->securityPrimaryDriver,
vm) < 0)
rc = -1;
return rc;
......@@ -76,18 +79,21 @@ qemuSecurityStackedGenLabel(virDomainObjPtr vm)
static int
qemuSecurityStackedReleaseLabel(virDomainObjPtr vm)
qemuSecurityStackedReleaseLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainReleaseSecurityLabel &&
driver->securitySecondaryDriver->domainReleaseSecurityLabel(vm) < 0)
driver->securitySecondaryDriver->domainReleaseSecurityLabel(driver->securitySecondaryDriver,
vm) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainReleaseSecurityLabel &&
driver->securityPrimaryDriver->domainReleaseSecurityLabel(vm) < 0)
driver->securityPrimaryDriver->domainReleaseSecurityLabel(driver->securityPrimaryDriver,
vm) < 0)
rc = -1;
return rc;
......@@ -95,18 +101,21 @@ qemuSecurityStackedReleaseLabel(virDomainObjPtr vm)
static int
qemuSecurityStackedReserveLabel(virDomainObjPtr vm)
qemuSecurityStackedReserveLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainReserveSecurityLabel &&
driver->securitySecondaryDriver->domainReserveSecurityLabel(vm) < 0)
driver->securitySecondaryDriver->domainReserveSecurityLabel(driver->securitySecondaryDriver,
vm) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainReserveSecurityLabel &&
driver->securityPrimaryDriver->domainReserveSecurityLabel(vm) < 0)
driver->securityPrimaryDriver->domainReserveSecurityLabel(driver->securityPrimaryDriver,
vm) < 0)
rc = -1;
return rc;
......@@ -114,19 +123,22 @@ qemuSecurityStackedReserveLabel(virDomainObjPtr vm)
static int
qemuSecurityStackedSetSecurityImageLabel(virDomainObjPtr vm,
qemuSecurityStackedSetSecurityImageLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainDiskDefPtr disk)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainSetSecurityImageLabel &&
driver->securitySecondaryDriver->domainSetSecurityImageLabel(vm, disk) < 0)
driver->securitySecondaryDriver->domainSetSecurityImageLabel(driver->securitySecondaryDriver,
vm, disk) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainSetSecurityImageLabel &&
driver->securityPrimaryDriver->domainSetSecurityImageLabel(vm, disk) < 0)
driver->securityPrimaryDriver->domainSetSecurityImageLabel(driver->securityPrimaryDriver,
vm, disk) < 0)
rc = -1;
return rc;
......@@ -134,19 +146,22 @@ qemuSecurityStackedSetSecurityImageLabel(virDomainObjPtr vm,
static int
qemuSecurityStackedRestoreSecurityImageLabel(virDomainObjPtr vm,
qemuSecurityStackedRestoreSecurityImageLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainDiskDefPtr disk)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainRestoreSecurityImageLabel &&
driver->securitySecondaryDriver->domainRestoreSecurityImageLabel(vm, disk) < 0)
driver->securitySecondaryDriver->domainRestoreSecurityImageLabel(driver->securitySecondaryDriver,
vm, disk) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainRestoreSecurityImageLabel &&
driver->securityPrimaryDriver->domainRestoreSecurityImageLabel(vm, disk) < 0)
driver->securityPrimaryDriver->domainRestoreSecurityImageLabel(driver->securityPrimaryDriver,
vm, disk) < 0)
rc = -1;
return rc;
......@@ -154,7 +169,8 @@ qemuSecurityStackedRestoreSecurityImageLabel(virDomainObjPtr vm,
static int
qemuSecurityStackedSetSecurityHostdevLabel(virDomainObjPtr vm,
qemuSecurityStackedSetSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev)
{
......@@ -162,12 +178,14 @@ qemuSecurityStackedSetSecurityHostdevLabel(virDomainObjPtr vm,
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainSetSecurityHostdevLabel &&
driver->securitySecondaryDriver->domainSetSecurityHostdevLabel(vm, dev) < 0)
driver->securitySecondaryDriver->domainSetSecurityHostdevLabel(driver->securitySecondaryDriver,
vm, dev) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainSetSecurityHostdevLabel &&
driver->securityPrimaryDriver->domainSetSecurityHostdevLabel(vm, dev) < 0)
driver->securityPrimaryDriver->domainSetSecurityHostdevLabel(driver->securityPrimaryDriver,
vm, dev) < 0)
rc = -1;
return rc;
......@@ -175,20 +193,22 @@ qemuSecurityStackedSetSecurityHostdevLabel(virDomainObjPtr vm,
static int
qemuSecurityStackedRestoreSecurityHostdevLabel(virDomainObjPtr vm,
qemuSecurityStackedRestoreSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel &&
driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel(vm, dev) < 0)
driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel(driver->securitySecondaryDriver,
vm, dev) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel &&
driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel(vm, dev) < 0)
driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel(driver->securityPrimaryDriver,
vm, dev) < 0)
rc = -1;
return rc;
......@@ -196,18 +216,22 @@ qemuSecurityStackedRestoreSecurityHostdevLabel(virDomainObjPtr vm,
static int
qemuSecurityStackedSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path)
qemuSecurityStackedSetSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
const char *stdin_path)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainSetSecurityAllLabel &&
driver->securitySecondaryDriver->domainSetSecurityAllLabel(vm, stdin_path) < 0)
driver->securitySecondaryDriver->domainSetSecurityAllLabel(driver->securitySecondaryDriver,
vm, stdin_path) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainSetSecurityAllLabel &&
driver->securityPrimaryDriver->domainSetSecurityAllLabel(vm, stdin_path) < 0)
driver->securityPrimaryDriver->domainSetSecurityAllLabel(driver->securityPrimaryDriver,
vm, stdin_path) < 0)
rc = -1;
return rc;
......@@ -215,19 +239,22 @@ qemuSecurityStackedSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_pat
static int
qemuSecurityStackedRestoreSecurityAllLabel(virDomainObjPtr vm,
qemuSecurityStackedRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
int migrated)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainRestoreSecurityAllLabel &&
driver->securitySecondaryDriver->domainRestoreSecurityAllLabel(vm, migrated) < 0)
driver->securitySecondaryDriver->domainRestoreSecurityAllLabel(driver->securitySecondaryDriver,
vm, migrated) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainRestoreSecurityAllLabel &&
driver->securityPrimaryDriver->domainRestoreSecurityAllLabel(vm, migrated) < 0)
driver->securityPrimaryDriver->domainRestoreSecurityAllLabel(driver->securityPrimaryDriver,
vm, migrated) < 0)
rc = -1;
return rc;
......@@ -235,19 +262,22 @@ qemuSecurityStackedRestoreSecurityAllLabel(virDomainObjPtr vm,
static int
qemuSecurityStackedSetSavedStateLabel(virDomainObjPtr vm,
qemuSecurityStackedSetSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
const char *savefile)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainSetSavedStateLabel &&
driver->securitySecondaryDriver->domainSetSavedStateLabel(vm, savefile) < 0)
driver->securitySecondaryDriver->domainSetSavedStateLabel(driver->securitySecondaryDriver,
vm, savefile) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainSetSavedStateLabel &&
driver->securityPrimaryDriver->domainSetSavedStateLabel(vm, savefile) < 0)
driver->securityPrimaryDriver->domainSetSavedStateLabel(driver->securityPrimaryDriver,
vm, savefile) < 0)
rc = -1;
return rc;
......@@ -255,19 +285,22 @@ qemuSecurityStackedSetSavedStateLabel(virDomainObjPtr vm,
static int
qemuSecurityStackedRestoreSavedStateLabel(virDomainObjPtr vm,
qemuSecurityStackedRestoreSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
const char *savefile)
{
int rc = 0;
if (driver->securitySecondaryDriver &&
driver->securitySecondaryDriver->domainRestoreSavedStateLabel &&
driver->securitySecondaryDriver->domainRestoreSavedStateLabel(vm, savefile) < 0)
driver->securitySecondaryDriver->domainRestoreSavedStateLabel(driver->securitySecondaryDriver,
vm, savefile) < 0)
rc = -1;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainRestoreSavedStateLabel &&
driver->securityPrimaryDriver->domainRestoreSavedStateLabel(vm, savefile) < 0)
driver->securityPrimaryDriver->domainRestoreSavedStateLabel(driver->securityPrimaryDriver,
vm, savefile) < 0)
rc = -1;
return rc;
......@@ -296,14 +329,16 @@ qemuSecurityStackedSetProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
}
static int
qemuSecurityStackedGetProcessLabel(virDomainObjPtr vm,
qemuSecurityStackedGetProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virSecurityLabelPtr seclabel)
{
int rc = 0;
if (driver->securityPrimaryDriver &&
driver->securityPrimaryDriver->domainGetSecurityProcessLabel &&
driver->securityPrimaryDriver->domainGetSecurityProcessLabel(vm,
driver->securityPrimaryDriver->domainGetSecurityProcessLabel(driver->securityPrimaryDriver,
vm,
seclabel) < 0)
rc = -1;
......
src/security/security_apparmor.c
浏览文件 @ f70e0809
......@@ -148,7 +148,8 @@ profile_status_file(const char *str)
* load (add) a profile. Will create one if necessary
*/
static int
load_profile(const char *profile, virDomainObjPtr vm,
load_profile(virSecurityDriverPtr drv,
const char *profile, virDomainObjPtr vm,
const char *fn)
{
int rc = -1, status, ret;
......@@ -281,7 +282,8 @@ cleanup:
* NULL.
*/
static int
reload_profile(virDomainObjPtr vm, const char *fn)
reload_profile(virSecurityDriverPtr drv,
virDomainObjPtr vm, const char *fn)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
int rc = -1;
......@@ -295,7 +297,7 @@ reload_profile(virDomainObjPtr vm, const char *fn)
/* Update the profile only if it is loaded */
if (profile_loaded(secdef->imagelabel) >= 0) {
if (load_profile(secdef->imagelabel, vm, fn) < 0) {
if (load_profile(drv, secdef->imagelabel, vm, fn) < 0) {
virSecurityReportError(VIR_ERR_INTERNAL_ERROR,
_("cannot update AppArmor profile "
"\'%s\'"),
......@@ -357,7 +359,8 @@ AppArmorSecurityDriverOpen(virSecurityDriverPtr drv)
* called on shutdown.
*/
static int
AppArmorGenSecurityLabel(virDomainObjPtr vm)
AppArmorGenSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
int rc = -1;
char *profile_name = NULL;
......@@ -411,14 +414,15 @@ AppArmorGenSecurityLabel(virDomainObjPtr vm)
}
static int
AppArmorSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path)
AppArmorSetSecurityAllLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm, const char *stdin_path)
{
if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC)
return 0;
/* if the profile is not already loaded, then load one */
if (profile_loaded(vm->def->seclabel.label) < 0) {
if (load_profile(vm->def->seclabel.label, vm, stdin_path) < 0) {
if (load_profile(drv, vm->def->seclabel.label, vm, stdin_path) < 0) {
virSecurityReportError(VIR_ERR_INTERNAL_ERROR,
_("cannot generate AppArmor profile "
"\'%s\'"), vm->def->seclabel.label);
......@@ -433,7 +437,9 @@ AppArmorSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path)
* running.
*/
static int
AppArmorGetSecurityProcessLabel(virDomainObjPtr vm, virSecurityLabelPtr sec)
AppArmorGetSecurityProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virSecurityLabelPtr sec)
{
int rc = -1;
char *profile_name = NULL;
......@@ -465,7 +471,8 @@ AppArmorGetSecurityProcessLabel(virDomainObjPtr vm, virSecurityLabelPtr sec)
* more details. Currently called via qemudShutdownVMDaemon.
*/
static int
AppArmorReleaseSecurityLabel(virDomainObjPtr vm)
AppArmorReleaseSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
......@@ -478,7 +485,8 @@ AppArmorReleaseSecurityLabel(virDomainObjPtr vm)
static int
AppArmorRestoreSecurityAllLabel(virDomainObjPtr vm,
AppArmorRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
int migrated ATTRIBUTE_UNUSED)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
......@@ -533,15 +541,17 @@ AppArmorSetSecurityProcessLabel(virSecurityDriverPtr drv, virDomainObjPtr vm)
/* Called when hotplugging */
static int
AppArmorRestoreSecurityImageLabel(virDomainObjPtr vm,
AppArmorRestoreSecurityImageLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
virDomainDiskDefPtr disk ATTRIBUTE_UNUSED)
{
return reload_profile(vm, NULL);
return reload_profile(drv, vm, NULL);
}
/* Called when hotplugging */
static int
AppArmorSetSecurityImageLabel(virDomainObjPtr vm, virDomainDiskDefPtr disk)
AppArmorSetSecurityImageLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm, virDomainDiskDefPtr disk)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
int rc = -1;
......@@ -566,7 +576,7 @@ AppArmorSetSecurityImageLabel(virDomainObjPtr vm, virDomainDiskDefPtr disk)
/* update the profile only if it is loaded */
if (profile_loaded(secdef->imagelabel) >= 0) {
if (load_profile(secdef->imagelabel, vm, disk->src) < 0) {
if (load_profile(drv, secdef->imagelabel, vm, disk->src) < 0) {
virSecurityReportError(VIR_ERR_INTERNAL_ERROR,
_("cannot update AppArmor profile "
"\'%s\'"),
......@@ -600,14 +610,16 @@ AppArmorSecurityVerify(virDomainDefPtr def)
}
static int
AppArmorReserveSecurityLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED)
AppArmorReserveSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm ATTRIBUTE_UNUSED)
{
/* NOOP. Nothing to reserve with AppArmor */
return 0;
}
static int
AppArmorSetSecurityHostdevLabel(virDomainObjPtr vm,
AppArmorSetSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED)
{
......@@ -621,7 +633,8 @@ AppArmorSetSecurityHostdevLabel(virDomainObjPtr vm,
}
static int
AppArmorRestoreSecurityHostdevLabel(virDomainObjPtr vm,
AppArmorRestoreSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED)
{
......@@ -634,18 +647,20 @@ AppArmorRestoreSecurityHostdevLabel(virDomainObjPtr vm,
}
static int
AppArmorSetSavedStateLabel(virDomainObjPtr vm,
const char *savefile)
AppArmorSetSavedStateLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
const char *savefile)
{
return reload_profile(vm, savefile);
return reload_profile(drv, vm, savefile);
}
static int
AppArmorRestoreSavedStateLabel(virDomainObjPtr vm,
AppArmorRestoreSavedStateLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
const char *savefile ATTRIBUTE_UNUSED)
{
return reload_profile(vm, NULL);
return reload_profile(drv, vm, NULL);
}
virSecurityDriver virAppArmorSecurityDriver = {
......
src/security/security_driver.h
浏览文件 @ f70e0809
......@@ -28,32 +28,48 @@ typedef enum {
typedef struct _virSecurityDriver virSecurityDriver;
typedef virSecurityDriver *virSecurityDriverPtr;
typedef struct _virSecurityDriverState virSecurityDriverState;
typedef virSecurityDriverState *virSecurityDriverStatePtr;
typedef virSecurityDriverStatus (*virSecurityDriverProbe) (void);
typedef int (*virSecurityDriverOpen) (virSecurityDriverPtr drv);
typedef int (*virSecurityDomainRestoreImageLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainRestoreImageLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
virDomainDiskDefPtr disk);
typedef int (*virSecurityDomainSetSocketLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm);
typedef int (*virSecurityDomainClearSocketLabel)(virSecurityDriverPtr drv,
virDomainObjPtr vm);
typedef int (*virSecurityDomainSetImageLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainSetImageLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
virDomainDiskDefPtr disk);
typedef int (*virSecurityDomainRestoreHostdevLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainRestoreHostdevLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev);
typedef int (*virSecurityDomainSetHostdevLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainSetHostdevLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev);
typedef int (*virSecurityDomainSetSavedStateLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainSetSavedStateLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
const char *savefile);
typedef int (*virSecurityDomainRestoreSavedStateLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainRestoreSavedStateLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
const char *savefile);
typedef int (*virSecurityDomainGenLabel) (virDomainObjPtr sec);
typedef int (*virSecurityDomainReserveLabel) (virDomainObjPtr sec);
typedef int (*virSecurityDomainReleaseLabel) (virDomainObjPtr sec);
typedef int (*virSecurityDomainSetAllLabel) (virDomainObjPtr sec,
typedef int (*virSecurityDomainGenLabel) (virSecurityDriverPtr drv,
virDomainObjPtr sec);
typedef int (*virSecurityDomainReserveLabel) (virSecurityDriverPtr drv,
virDomainObjPtr sec);
typedef int (*virSecurityDomainReleaseLabel) (virSecurityDriverPtr drv,
virDomainObjPtr sec);
typedef int (*virSecurityDomainSetAllLabel) (virSecurityDriverPtr drv,
virDomainObjPtr sec,
const char *stdin_path);
typedef int (*virSecurityDomainRestoreAllLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainRestoreAllLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
int migrated);
typedef int (*virSecurityDomainGetProcessLabel) (virDomainObjPtr vm,
typedef int (*virSecurityDomainGetProcessLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm,
virSecurityLabelPtr sec);
typedef int (*virSecurityDomainSetProcessLabel) (virSecurityDriverPtr drv,
virDomainObjPtr vm);
......
src/security/security_selinux.c
浏览文件 @ f70e0809
......@@ -156,7 +156,8 @@ SELinuxInitialize(void)
}
static int
SELinuxGenSecurityLabel(virDomainObjPtr vm)
SELinuxGenSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
int rc = -1;
char mcs[1024];
......@@ -220,7 +221,8 @@ done:
}
static int
SELinuxReserveSecurityLabel(virDomainObjPtr vm)
SELinuxReserveSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
security_context_t pctx;
context_t ctx = NULL;
......@@ -275,7 +277,8 @@ SELinuxSecurityDriverOpen(virSecurityDriverPtr drv)
}
static int
SELinuxGetSecurityProcessLabel(virDomainObjPtr vm,
SELinuxGetSecurityProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virSecurityLabelPtr sec)
{
security_context_t ctx;
......@@ -387,7 +390,8 @@ err:
}
static int
SELinuxRestoreSecurityImageLabelInt(virDomainObjPtr vm,
SELinuxRestoreSecurityImageLabelInt(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainDiskDefPtr disk,
int migrated)
{
......@@ -431,10 +435,11 @@ SELinuxRestoreSecurityImageLabelInt(virDomainObjPtr vm,
static int
SELinuxRestoreSecurityImageLabel(virDomainObjPtr vm,
SELinuxRestoreSecurityImageLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
virDomainDiskDefPtr disk)
{
return SELinuxRestoreSecurityImageLabelInt(vm, disk, 0);
return SELinuxRestoreSecurityImageLabelInt(drv, vm, disk, 0);
}
......@@ -462,7 +467,8 @@ SELinuxSetSecurityFileLabel(virDomainDiskDefPtr disk,
}
static int
SELinuxSetSecurityImageLabel(virDomainObjPtr vm,
SELinuxSetSecurityImageLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainDiskDefPtr disk)
{
......@@ -500,7 +506,8 @@ SELinuxSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
}
static int
SELinuxSetSecurityHostdevLabel(virDomainObjPtr vm,
SELinuxSetSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev)
{
......@@ -568,7 +575,8 @@ SELinuxRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED,
}
static int
SELinuxRestoreSecurityHostdevLabel(virDomainObjPtr vm,
SELinuxRestoreSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev)
{
......@@ -715,7 +723,8 @@ SELinuxRestoreSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
static int
SELinuxRestoreSecurityAllLabel(virDomainObjPtr vm,
SELinuxRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
int migrated ATTRIBUTE_UNUSED)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
......@@ -728,11 +737,14 @@ SELinuxRestoreSecurityAllLabel(virDomainObjPtr vm,
return 0;
for (i = 0 ; i < vm->def->nhostdevs ; i++) {
if (SELinuxRestoreSecurityHostdevLabel(vm, vm->def->hostdevs[i]) < 0)
if (SELinuxRestoreSecurityHostdevLabel(drv,
vm,
vm->def->hostdevs[i]) < 0)
rc = -1;
}
for (i = 0 ; i < vm->def->ndisks ; i++) {
if (SELinuxRestoreSecurityImageLabelInt(vm,
if (SELinuxRestoreSecurityImageLabelInt(drv,
vm,
vm->def->disks[i],
migrated) < 0)
rc = -1;
......@@ -756,7 +768,8 @@ SELinuxRestoreSecurityAllLabel(virDomainObjPtr vm,
}
static int
SELinuxReleaseSecurityLabel(virDomainObjPtr vm)
SELinuxReleaseSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
......@@ -779,7 +792,8 @@ SELinuxReleaseSecurityLabel(virDomainObjPtr vm)
static int
SELinuxSetSavedStateLabel(virDomainObjPtr vm,
SELinuxSetSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
const char *savefile)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
......@@ -792,7 +806,8 @@ SELinuxSetSavedStateLabel(virDomainObjPtr vm,
static int
SELinuxRestoreSavedStateLabel(virDomainObjPtr vm,
SELinuxRestoreSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
virDomainObjPtr vm,
const char *savefile)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
......@@ -963,7 +978,9 @@ SELinuxSetSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED,
static int
SELinuxSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path)
SELinuxSetSecurityAllLabel(virSecurityDriverPtr drv,
virDomainObjPtr vm,
const char *stdin_path)
{
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
int i;
......@@ -978,11 +995,14 @@ SELinuxSetSecurityAllLabel(virDomainObjPtr vm, const char *stdin_path)
vm->def->disks[i]->src, vm->def->disks[i]->dst);
continue;
}
if (SELinuxSetSecurityImageLabel(vm, vm->def->disks[i]) < 0)
if (SELinuxSetSecurityImageLabel(drv,
vm, vm->def->disks[i]) < 0)
return -1;
}
for (i = 0 ; i < vm->def->nhostdevs ; i++) {
if (SELinuxSetSecurityHostdevLabel(vm, vm->def->hostdevs[i]) < 0)
if (SELinuxSetSecurityHostdevLabel(drv,
vm,
vm->def->hostdevs[i]) < 0)
return -1;
}
......
Markdown is supported
0% 或 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑！
想要评论请 注册 或