From nobody Sun Feb 8 12:12:00 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1727884041846968.8483468438335; Wed, 2 Oct 2024 08:47:21 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 996) id B931C154F; Wed, 2 Oct 2024 11:47:20 -0400 (EDT) Received: from lists.libvirt.org (localhost [IPv6:::1]) by lists.libvirt.org (Postfix) with ESMTP id 56BDA173E; Wed, 2 Oct 2024 11:42:37 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 996) id E4006173A; Wed, 2 Oct 2024 11:42:30 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 252AC1587 for ; Wed, 2 Oct 2024 11:42:06 -0400 (EDT) Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-580-Yr7-ssYWPbSf1loQHqK77A-1; Wed, 02 Oct 2024 11:42:04 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id CF034195608A for ; Wed, 2 Oct 2024 15:42:03 +0000 (UTC) Received: from harajuku.usersys.redhat.com (unknown [10.45.226.81]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EE4993000198 for ; Wed, 2 Oct 2024 15:42:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=3.4.4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1727883725; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vAakyE8da3sOHUMfoUWWQcqYkFi6hMH00l7aOpiG+bM=; b=DIJvm5Psowvb+LCb+G5UXx4Y4sFJ1y+FMzdWvyhLjUXyUsZ1Aq/b6dWIHnmqISLW4EPnHj dRX3AwvjvHdQ5ZdkWRno1PyIpBHW9yI2jxmfB4QL1FNLHnAQvyNVjtACnDqqKrZLKFrvgr GM2U7vb3Z/FCUSBsPEAEf0RHcuHq8Fs= X-MC-Unique: Yr7-ssYWPbSf1loQHqK77A-1 From: Andrea Bolognani To: devel@lists.libvirt.org Subject: [PATCH v7 09/14] security_(dac|selinux): Unref remembered security labels on outgoing migration Date: Wed, 2 Oct 2024 17:41:42 +0200 Message-ID: <20241002154147.446044-10-abologna@redhat.com> In-Reply-To: <20241002154147.446044-1-abologna@redhat.com> References: <20241002154147.446044-1-abologna@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: YENGPWKFQG4FBUIGVQ4YHQODZ756QSLS X-Message-ID-Hash: YENGPWKFQG4FBUIGVQ4YHQODZ756QSLS X-MailFrom: abologna@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-config-1; header-match-config-2; header-match-config-3; header-match-devel.lists.libvirt.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header X-Mailman-Version: 3.2.2 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1727884042772116600 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Peter Krempa When 'qemuSecurityRestoreAllLabel' is called on outgoing migration it skips the actual relabeling part of the images in dac/selinux drivers in order to avoid cutting off access to the image. As shared filesystems don't really support the trusted XATTR groups, remembering of security labels never worked on those paths so we never actually had remembered seclabels for images that could be migrated. With recent changes we now support migration from local storage to remote in case the admin declares it as shared. This means that in case when the VM is started on local storage we'd actually store seclabels, but when migrating out the XATTRs remembering the seclabels would not actually be unref'd and thus the seclabels would leak. As we can't know whether a remote host will be able to use the XATTRs or not (but really it won't) and at the same time the destination side of migration will actually call 'qemuSecuritySetAllLabel' setting/refing it's own seclabels we really need to unref them on our side. This patch adds the appropriate *RecallLabel() calls on the code paths in which relabelling is skipped due to migration. Signed-off-by: Peter Krempa Reviewed-by: Andrea Bolognani Signed-off-by: Andrea Bolognani --- src/security/security_dac.c | 3 +++ src/security/security_selinux.c | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 95dbe4636f..c327e4c9e0 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1022,6 +1022,9 @@ virSecurityDACRestoreImageLabelInt(virSecurityManager= *mgr, if (rc =3D=3D 1) { VIR_DEBUG("Skipping image label restore on %s because FS is sh= ared", src->path); + + ignore_value(virSecurityDACRecallLabel(priv, src->path, NULL, = NULL)); + return 0; } } diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index 453ac67d25..779a52ac11 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1837,8 +1837,15 @@ virSecuritySELinuxRestoreImageLabelInt(virSecurityMa= nager *mgr, } =20 if (rc =3D=3D 1) { + g_autofree char *oldlabel =3D NULL; + VIR_DEBUG("Skipping image label restore on %s because FS is sh= ared", src->path); + + /* We still want to remove the local reference of the remember= ed + * seclabel. The destination will take its own reference when + * starting the migrated VM */ + ignore_value(virSecuritySELinuxRecallLabel(src->path, &oldlabe= l)); return 0; } } --=20 2.46.2