From nobody Sun Feb 8 11:21:39 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 205.139.110.120 as permitted sender) client-ip=205.139.110.120; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-1.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 205.139.110.120 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1591777448; cv=none; d=zohomail.com; s=zohoarc; b=CrIqOH4n+2yMYtppVUx4Nv/36g3Vvb3IecXXGJy7YaX/+JcEmCFuRbp6E5Nc5w1VIM7CtesOqt8LMToMQ9tjiYwB82N1Dd6ycWi8t/CqvLI3ePNGwV2UxQO3Q9LUzuzJAXvQb6dvKZaeUzOOcNCDveLJORo22fJ7qlrCCzTrpe0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1591777448; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=JJJ5eN5q3FGedvzlUTJACKx6MHPojJTxloASJB031HI=; b=Jk9Nm9ex+7o4hAn4PMQ7SRh4qE4c1DrgIjRjesxepOnZbyvTqCfmrk91cDovORug3DjR7iVO4UwLPnkTwWJWifAmxwqOQzIt8z/essq5ExG44z3FC57F8LhHeKTRNWUYgkK7N3PfcevBjTB+IkxUGGDxVaDOR/Wl/Q2UygXBfVU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 205.139.110.120 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) by mx.zohomail.com with SMTPS id 1591777448686581.1529676400893; Wed, 10 Jun 2020 01:24:08 -0700 (PDT) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-288-UGQjyytMOOyEN85HPvgOoA-1; Wed, 10 Jun 2020 04:24:05 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 18C31106B3BA; Wed, 10 Jun 2020 08:24:00 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id ECB835D9D3; Wed, 10 Jun 2020 08:23:59 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id C0CC5B3498; Wed, 10 Jun 2020 08:23:59 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 05A8NiqI006945 for ; Wed, 10 Jun 2020 04:23:44 -0400 Received: by smtp.corp.redhat.com (Postfix) id 38F7E5C3FD; Wed, 10 Jun 2020 08:23:44 +0000 (UTC) Received: from localhost.localdomain (unknown [10.40.195.12]) by smtp.corp.redhat.com (Postfix) with ESMTP id AD7C75C1BD for ; Wed, 10 Jun 2020 08:23:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1591777447; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=JJJ5eN5q3FGedvzlUTJACKx6MHPojJTxloASJB031HI=; b=DHGp+pIh6ErVuj5VqJXKlHv9XNdERnR+SemVF1VULyjvtDGXrbOpyK27/BxxgfbKI8+Z2K pgJ7DzMRBALOZ9U7deolGPD5HD/BIxViqPVsAMXX3Eu7gwex+bc0Dm/Pv9OrR10cdhLaCg 5nTFeQD40Ff2hI0AkCKHcXXhR5roh5Q= X-MC-Unique: UGQjyytMOOyEN85HPvgOoA-1 From: Michal Privoznik To: libvir-list@redhat.com Subject: [PATCH v3 4/6] secdrivers: Relabel firmware config files Date: Wed, 10 Jun 2020 10:23:32 +0200 Message-Id: <1fe665405405169c4afdb9dd090e7aebfce5efc2.1591776549.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-loop: libvir-list@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) For the case where -fw_cfg uses a file, we need to set the seclabels on it to allow QEMU the access. While QEMU allows writing into the file (if specified on the command line), so far we are enabling reading only and thus we can use read only label (in case of SELinux). Signed-off-by: Michal Privoznik Reviewed-by: Daniel P. Berrang=C3=A9 --- src/security/security_dac.c | 50 +++++++++++++++++++++++++++++++++ src/security/security_selinux.c | 50 +++++++++++++++++++++++++++++++++ src/security/virt-aa-helper.c | 12 ++++++++ 3 files changed, 112 insertions(+) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 7b95a6f86d..7e65b78fbe 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1916,6 +1916,24 @@ virSecurityDACRestoreSEVLabel(virSecurityManagerPtr = mgr G_GNUC_UNUSED, } =20 =20 +static int +virSecurityDACRestoreSysinfoLabel(virSecurityManagerPtr mgr, + virSysinfoDefPtr def) +{ + size_t i; + + for (i =3D 0; i < def->nfw_cfgs; i++) { + virSysinfoFWCfgDefPtr f =3D &def->fw_cfgs[i]; + + if (f->file && + virSecurityDACRestoreFileLabel(mgr, f->file) < 0) + return -1; + } + + return 0; +} + + static int virSecurityDACRestoreAllLabel(virSecurityManagerPtr mgr, virDomainDefPtr def, @@ -1991,6 +2009,12 @@ virSecurityDACRestoreAllLabel(virSecurityManagerPtr = mgr, rc =3D -1; } =20 + for (i =3D 0; i < def->nsysinfo; i++) { + if (virSecurityDACRestoreSysinfoLabel(mgr, + def->sysinfo[i]) < 0) + rc =3D -1; + } + if (def->os.loader && def->os.loader->nvram && virSecurityDACRestoreFileLabel(mgr, def->os.loader->nvram) < 0) rc =3D -1; @@ -2094,6 +2118,27 @@ virSecurityDACSetSEVLabel(virSecurityManagerPtr mgr, } =20 =20 +static int +virSecurityDACSetSysinfoLabel(virSecurityManagerPtr mgr, + uid_t user, + gid_t group, + virSysinfoDefPtr def) +{ + size_t i; + + for (i =3D 0; i < def->nfw_cfgs; i++) { + virSysinfoFWCfgDefPtr f =3D &def->fw_cfgs[i]; + + if (f->file && + virSecurityDACSetOwnership(mgr, NULL, f->file, + user, group, true) < 0) + return -1; + } + + return 0; +} + + static int virSecurityDACSetAllLabel(virSecurityManagerPtr mgr, virDomainDefPtr def, @@ -2173,6 +2218,11 @@ virSecurityDACSetAllLabel(virSecurityManagerPtr mgr, if (virSecurityDACGetImageIds(secdef, priv, &user, &group)) return -1; =20 + for (i =3D 0; i < def->nsysinfo; i++) { + if (virSecurityDACSetSysinfoLabel(mgr, user, group, def->sysinfo[i= ]) < 0) + return -1; + } + if (def->os.loader && def->os.loader->nvram && virSecurityDACSetOwnership(mgr, NULL, def->os.loader->nvram, diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index 7bb7c2b7b1..e6819af26c 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -2720,6 +2720,24 @@ virSecuritySELinuxGetBaseLabel(virSecurityManagerPtr= mgr, int virtType) } =20 =20 +static int +virSecuritySELinuxRestoreSysinfoLabel(virSecurityManagerPtr mgr, + virSysinfoDefPtr def) +{ + size_t i; + + for (i =3D 0; i < def->nfw_cfgs; i++) { + virSysinfoFWCfgDefPtr f =3D &def->fw_cfgs[i]; + + if (f->file && + virSecuritySELinuxRestoreFileLabel(mgr, f->file, true) < 0) + return -1; + } + + return 0; +} + + static int virSecuritySELinuxRestoreAllLabel(virSecurityManagerPtr mgr, virDomainDefPtr def, @@ -2786,6 +2804,11 @@ virSecuritySELinuxRestoreAllLabel(virSecurityManager= Ptr mgr, mgr) < 0) rc =3D -1; =20 + for (i =3D 0; i < def->nsysinfo; i++) { + if (virSecuritySELinuxRestoreSysinfoLabel(mgr, def->sysinfo[i]) < = 0) + rc =3D -1; + } + if (def->os.loader && def->os.loader->nvram && virSecuritySELinuxRestoreFileLabel(mgr, def->os.loader->nvram, tru= e) < 0) rc =3D -1; @@ -3123,6 +3146,26 @@ virSecuritySELinuxSetSecuritySmartcardCallback(virDo= mainDefPtr def, } =20 =20 +static int +virSecuritySELinuxSetSysinfoLabel(virSecurityManagerPtr mgr, + virSysinfoDefPtr def, + virSecuritySELinuxDataPtr data) +{ + size_t i; + + for (i =3D 0; i < def->nfw_cfgs; i++) { + virSysinfoFWCfgDefPtr f =3D &def->fw_cfgs[i]; + + if (f->file && + virSecuritySELinuxSetFilecon(mgr, f->file, + data->content_context, true) < 0) + return -1; + } + + return 0; +} + + static int virSecuritySELinuxSetAllLabel(virSecurityManagerPtr mgr, virDomainDefPtr def, @@ -3194,6 +3237,13 @@ virSecuritySELinuxSetAllLabel(virSecurityManagerPtr = mgr, mgr) < 0) return -1; =20 + for (i =3D 0; i < def->nsysinfo; i++) { + if (virSecuritySELinuxSetSysinfoLabel(mgr, + def->sysinfo[i], + data) < 0) + return -1; + } + /* This is different than kernel or initrd. The nvram store * is really a disk, qemu can read and write to it. */ if (def->os.loader && def->os.loader->nvram && diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 6e6dd1b1db..34c281100e 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1175,6 +1175,18 @@ get_files(vahControl * ctl) } } =20 + for (i =3D 0; i < ctl->def->nsysinfo; i++) { + size_t j; + + for (j =3D 0; j < ctl->def->sysinfo[i]->nfw_cfgs; j++) { + virSysinfoFWCfgDefPtr f =3D &ctl->def->sysinfo[i]->fw_cfgs[j]; + + if (f->file && + vah_add_file(&buf, f->file, "r") !=3D 0) + goto cleanup; + } + } + for (i =3D 0; i < ctl->def->nshmems; i++) { virDomainShmemDef *shmem =3D ctl->def->shmems[i]; /* explicit server paths can be on any model to overwrites default= s. --=20 2.26.2