DAC,SELinux: do not remember/recall labels for

[PATCH v1 0/2] DAC,SELinux: do not remember/recall labels for

Daniel Henrique Barboza posted 2 patches 4 years, 3 months ago

Download series mbox

Test syntax-check failed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/20200127182321.713525-1-danielhb413@gmail.com

src/security/security_dac.c     | 20 ++++++++++++--------
src/security/security_selinux.c | 20 ++++++++++++--------
2 files changed, 24 insertions(+), 16 deletions(-)

Expand all Fold all

[PATCH v1 0/2] DAC,SELinux: do not remember/recall labels for

Posted by Daniel Henrique Barboza 4 years, 3 months ago

Libvirt is trying to do multiple open() calls in /dev/vfio
files, which results in errors inside the security drivers
and QEMU returning error 125 when attempting to hotplug
a hostdev which belongs to the same IOMMU group as an
existing domain hostdev. See patch 2 commit msg for
more details.

I found this problem when testing a PCI multifunction
hotplug implementation. Since this is a problem that
can happen in other currently supported scenarios,
I decided it was worth sending the fix right away.

Michal, I'm CCing you because I mentioned commit 4e95cdcbb3
("security: Don't remember labels for TPM") in patch 2,
which seems to fix a very similar problem. Figured you
might want to take a look.

Daniel Henrique Barboza (2):
  security: Allow 'remember' to be set for HostdevLabelHelper
  security: do not remember/recall labels for VFIO

 src/security/security_dac.c     | 20 ++++++++++++--------
 src/security/security_selinux.c | 20 ++++++++++++--------
 2 files changed, 24 insertions(+), 16 deletions(-)

-- 
2.24.1

Re: [PATCH v1 0/2] DAC,SELinux: do not remember/recall labels for

Posted by Michal Privoznik 4 years, 2 months ago

On 1/27/20 7:23 PM, Daniel Henrique Barboza wrote:
> Libvirt is trying to do multiple open() calls in /dev/vfio
> files, which results in errors inside the security drivers
> and QEMU returning error 125 when attempting to hotplug
> a hostdev which belongs to the same IOMMU group as an
> existing domain hostdev. See patch 2 commit msg for
> more details.
> 
> I found this problem when testing a PCI multifunction
> hotplug implementation. Since this is a problem that
> can happen in other currently supported scenarios,
> I decided it was worth sending the fix right away.
> 
> Michal, I'm CCing you because I mentioned commit 4e95cdcbb3
> ("security: Don't remember labels for TPM") in patch 2,
> which seems to fix a very similar problem. Figured you
> might want to take a look.
> 
> Daniel Henrique Barboza (2):
>    security: Allow 'remember' to be set for HostdevLabelHelper
>    security: do not remember/recall labels for VFIO
> 
>   src/security/security_dac.c     | 20 ++++++++++++--------
>   src/security/security_selinux.c | 20 ++++++++++++--------
>   2 files changed, 24 insertions(+), 16 deletions(-)
> 

Huh, I had similar patches in my local branch, but never gotten around 
to send them (dunno why).

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

Michal