From nobody Tue Aug 25 02:50:22 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=reject dis=none) header.from=linux.ibm.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1787070431163493.30027479758496; Tue, 18 Aug 2026 09:27:11 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id C89874181C; Tue, 18 Aug 2026 12:27:09 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id D14AE41ABB for ; Tue, 18 Aug 2026 12:23:47 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 5621C3F97E; Tue, 18 Aug 2026 12:23:30 -0400 (EDT) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 4BCD73F96B for ; Tue, 18 Aug 2026 12:23:27 -0400 (EDT) Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67IE3QHf504459; Tue, 18 Aug 2026 16:23:25 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g2fu4sf96-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 18 Aug 2026 16:23:25 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67IGBOb5002232; Tue, 18 Aug 2026 16:23:24 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4g33ek465b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 18 Aug 2026 16:23:24 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67IGNMSQ29819434 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 18 Aug 2026 16:23:22 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 02DBF58056; Tue, 18 Aug 2026 16:23:22 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B06058065; Tue, 18 Aug 2026 16:23:21 +0000 (GMT) Received: from Mac.ibm.com (unknown [9.61.254.95]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 18 Aug 2026 16:23:21 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=MGEHzQ7Vf/+yz9yr8 auL+WDh0d1dQz9EJHW33E5/7Uc=; b=BZ3wVM3oEMhvRP+qtHp72wGkdG3cjQr3N xI9x8DTV8wswKWOJXFpkRCRaV7jXidwew40RsDkDDKQEVHLIeRWINsdnlCFrrxFQ uWlnf0PLg9Gikii6YO2y2E1ivYxXq9o0PPhX335GjZVz02O0BEKoW98cXtMm8TrJ nP6YWZBZcB4L04Z38qP4SGVspIs/u5IFolF5aoP9+0N/b97huLr0f6yXIUP3cGk3 maI/5o5Ts+aP1rQ/2zQgK6JwJmbBjSGmKWs+9bDmFXhsF238qQOZklzKjk/Ke4r7 f7T9Zi/ezeFcTMBllDrtSnrlQyERIsI70cjVLptHCQZ7k5FQNdp9Q== From: Omar Elghoul To: devel@lists.libvirt.org Subject: [RFC PATCH v1 1/2] security: add SetSharedImageFDLabel() for shared image FDs Date: Tue, 18 Aug 2026 12:21:04 -0400 Message-ID: <20260818162130.51699-2-oelghoul@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260818162130.51699-1-oelghoul@linux.ibm.com> References: <20260818162130.51699-1-oelghoul@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: ve2XX5ZQWEaWsI4W1S3A7eLg1YmMFqGt X-Authority-Analysis: v=2.4 cv=NLLlPU6g c=1 sm=1 tr=0 ts=6a8486fd cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=JHWfrgFhslw1a-ZlmPMA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwODE4MDExOCBTYWx0ZWRfX4bc6fm+D5uhY ruIC0v4yUJEeQGK2xcwgCUKZ88UGOr9hYbt+8G90LlA2Lmk5uRB0bmFcRgXayAs2omtqxTrPyZT IOSh7jzHWSz6FbV1fKh1ctTz7OfQXQY= X-Proofpoint-ORIG-GUID: ve2XX5ZQWEaWsI4W1S3A7eLg1YmMFqGt X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODE4MDExOCBTYWx0ZWRfXx7Fz4toXV+jG XRUTS5+k4WGIFNuKmziPNd1Es4IC3fG54hjlnN65s5Q2PPtp+BrwPN1ba3qB+p5HAxHW4CkLiri sgeY5vQfyYqEP1xf/EkFjd4mzTzL40nDNd1fncIKf1vHsK5v3nqb54vyDGy+Sp21lkgM+b1pfF9 AemaBnCKM52CDDr4q9klajQgsqSsqchJDa3+XB1X+XhF5Ef/JelzWWveEmBnM71j/1gU4YP0yA8 6ssaQ/eRWQXx0hU2WkW/DFtZOH+OWzMMVuApBuZokB9JjZ7VsdkAkLSO1BPxDkwGnRIJVEGJCzO zCZ/6AgZDE/v4KgqiyMsvaEpgoT8Hv7ZVH5aqkoQDN984ga5AFabZ6mjdFmPxyhCymsEox9jR6a LRn0j0nGzXmftx8K8uKitYffOKBVAWT3qh4obMC9Wsgx9TebIlwIhCnxDFBsHzF7aMvkXTN5KA8 FkUlolsNuJGrpPQCeoQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-18_02,2026-08-18_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 spamscore=0 lowpriorityscore=0 phishscore=0 impostorscore=0 malwarescore=0 suspectscore=0 clxscore=1015 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608180118 Message-ID-Hash: W7EROP63DFJNKT3I73XRIUQAQS55HBCD X-Message-ID-Hash: W7EROP63DFJNKT3I73XRIUQAQS55HBCD X-MailFrom: oelghoul@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: pkrempa@redhat.com, phrdina@redhat.com, jtomko@redhat.com, alifm@linux.ibm.com, fiuczy@linux.ibm.com, walling@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1787070431691158500 Content-Type: text/plain; charset="utf-8" On the SELinux driver, image FD labeling applies the domain imagelabel, which includes the per-domain MCS categories. This is correct behavior for exclusive resources, but not for host devices that are shared by multiple domains (e.g. an iommufd). Add virSecurityManagerSetSharedImageFDLabel() to address this issue. Reuse the imagelabel type in the SELinux driver, but strip the MCS categories so that the range is sensitivity-only. Preserve the pre- existing behavior in all other security drivers. Signed-off-by: Omar Elghoul --- src/libvirt_private.syms | 1 + src/security/security_apparmor.c | 1 + src/security/security_dac.c | 1 + src/security/security_driver.h | 4 ++ src/security/security_manager.c | 16 ++++++++ src/security/security_manager.h | 3 ++ src/security/security_nop.c | 1 + src/security/security_selinux.c | 63 ++++++++++++++++++++++++++++++++ src/security/security_stack.c | 18 +++++++++ 9 files changed, 108 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 6c6cc7b4ff..c67e808b13 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1895,6 +1895,7 @@ virSecurityManagerSetChildProcessLabel; virSecurityManagerSetDaemonSocketLabel; virSecurityManagerSetHostdevLabel; virSecurityManagerSetImageFDLabel; +virSecurityManagerSetSharedImageFDLabel; virSecurityManagerSetImageLabel; virSecurityManagerSetInputLabel; virSecurityManagerSetMemoryLabel; diff --git a/src/security/security_apparmor.c b/src/security/security_appar= mor.c index a66382fbac..5d292d7feb 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -1174,6 +1174,7 @@ virSecurityDriver virAppArmorSecurityDriver =3D { .domainRestoreSecurityNetdevLabel =3D AppArmorRestoreNetdevLabel, =20 .domainSetSecurityImageFDLabel =3D AppArmorSetFDLabel, + .domainSetSecuritySharedImageFDLabel =3D AppArmorSetFDLabel, .domainSetSecurityTapFDLabel =3D AppArmorSetFDLabel, =20 .domainGetSecurityMountOptions =3D AppArmorGetMountOptions, diff --git a/src/security/security_dac.c b/src/security/security_dac.c index e7cffa8e59..2da0af3336 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -2711,6 +2711,7 @@ virSecurityDriver virSecurityDriverDAC =3D { .domainRestoreSecurityHostdevLabel =3D virSecurityDACRestoreHostdevLa= bel, =20 .domainSetSecurityImageFDLabel =3D virSecurityDACSetImageFDLabel, + .domainSetSecuritySharedImageFDLabel =3D virSecurityDACSetImageFDLabel, .domainSetSecurityTapFDLabel =3D virSecurityDACSetTapFDLabel, =20 .domainGetSecurityMountOptions =3D virSecurityDACGetMountOptions, diff --git a/src/security/security_driver.h b/src/security/security_driver.h index b8c5b416e3..874e2f1d8e 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -107,6 +107,9 @@ typedef int (*virSecurityDomainSecurityVerify) (virSecu= rityManager *mgr, typedef int (*virSecurityDomainSetImageFDLabel) (virSecurityManager *mgr, virDomainDef *def, int fd); +typedef int (*virSecurityDomainSetSharedImageFDLabel) (virSecurityManager = *mgr, + virDomainDef *def, + int fd); typedef int (*virSecurityDomainSetTapFDLabel) (virSecurityManager *mgr, virDomainDef *def, int fd); @@ -225,6 +228,7 @@ struct _virSecurityDriver { virSecurityDomainRestoreSavedStateLabel domainRestoreSavedStateLabel; =20 virSecurityDomainSetImageFDLabel domainSetSecurityImageFDLabel; + virSecurityDomainSetSharedImageFDLabel domainSetSecuritySharedImageFDL= abel; virSecurityDomainSetTapFDLabel domainSetSecurityTapFDLabel; =20 virSecurityDomainGetMountOptions domainGetSecurityMountOptions; diff --git a/src/security/security_manager.c b/src/security/security_manage= r.c index bef9863799..baa6094f2e 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -977,6 +977,22 @@ virSecurityManagerSetImageFDLabel(virSecurityManager *= mgr, } =20 =20 +int +virSecurityManagerSetSharedImageFDLabel(virSecurityManager *mgr, + virDomainDef *vm, + int fd) +{ + VIR_LOCK_GUARD lock =3D virObjectLockGuard(mgr); + + if (!mgr->drv->domainSetSecuritySharedImageFDLabel) { + virReportUnsupportedError(); + return -1; + } + + return mgr->drv->domainSetSecuritySharedImageFDLabel(mgr, vm, fd); +} + + int virSecurityManagerSetTapFDLabel(virSecurityManager *mgr, virDomainDef *vm, diff --git a/src/security/security_manager.h b/src/security/security_manage= r.h index 068ca4e290..0c1828a20d 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -156,6 +156,9 @@ int virSecurityManagerVerify(virSecurityManager *mgr, int virSecurityManagerSetImageFDLabel(virSecurityManager *mgr, virDomainDef *def, int fd); +int virSecurityManagerSetSharedImageFDLabel(virSecurityManager *mgr, + virDomainDef *def, + int fd); int virSecurityManagerSetTapFDLabel(virSecurityManager *mgr, virDomainDef *vm, int fd); diff --git a/src/security/security_nop.c b/src/security/security_nop.c index e6e337a49d..d918455acb 100644 --- a/src/security/security_nop.c +++ b/src/security/security_nop.c @@ -302,6 +302,7 @@ virSecurityDriver virSecurityDriverNop =3D { .domainRestoreSecurityHostdevLabel =3D virSecurityDomainRestoreHostde= vLabelNop, =20 .domainSetSecurityImageFDLabel =3D virSecurityDomainSetFDLabelNop, + .domainSetSecuritySharedImageFDLabel =3D virSecurityDomainSetFDLabelNo= p, .domainSetSecurityTapFDLabel =3D virSecurityDomainSetFDLabelNop, =20 .domainGetSecurityMountOptions =3D virSecurityDomainGetMountOptio= nsNop, diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index 423dcd0bd9..14e210000a 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -607,6 +607,50 @@ virSecuritySELinuxContextAddRange(const char *src, } =20 =20 +static char * +virSecuritySELinuxContextStripMCS(const char *label) +{ + g_autoptr(context_s_t) ctx =3D NULL; + g_autofree char *range =3D NULL; + const char *r; + const char *str; + char *tmp; + + if (!(ctx =3D context_new(label))) { + virReportSystemError(errno, + _("unable to parse SELinux context '%1$s'"), + label); + return NULL; + } + + r =3D context_range_get(ctx); + if (!r) + r =3D "s0"; + + range =3D g_strdup(r); + + if ((tmp =3D strchr(range, ':'))) + *tmp =3D '\0'; + if ((tmp =3D strchr(range, '-'))) + *tmp =3D '\0'; + + if (context_range_set(ctx, range) !=3D 0) { + virReportSystemError(errno, + _("unable to set SELinux context rnge '%1$s'"= ), + range); + return NULL; + } + + if (!(str =3D context_str(ctx))) { + virReportSystemError(errno, "%s", + _("unable to format SELinux context")); + return NULL; + } + + return g_strdup(str); +} + + static char * virSecuritySELinuxContextSetFromFile(const char *origLabel, const char *binaryPath) @@ -3492,6 +3536,24 @@ virSecuritySELinuxSetImageFDLabel(virSecurityManager= *mgr G_GNUC_UNUSED, return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel); } =20 +static int +virSecuritySELinuxSetSharedImageFDLabel(virSecurityManager *mgr G_GNUC_UNU= SED, + virDomainDef *def, + int fd) +{ + virSecurityLabelDef *secdef; + g_autofree char *label =3D NULL; + + secdef =3D virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME); + if (!secdef || !secdef->imagelabel) + return 0; + + if (!(label =3D virSecuritySELinuxContextStripMCS(secdef->imagelabel))) + return -1; + + return virSecuritySELinuxFSetFilecon(fd, label); +} + static int virSecuritySELinuxSetTapFDLabel(virSecurityManager *mgr, virDomainDef *def, @@ -3844,6 +3906,7 @@ virSecurityDriver virSecurityDriverSELinux =3D { .domainRestoreSavedStateLabel =3D virSecuritySELinuxRestoreSaved= StateLabel, =20 .domainSetSecurityImageFDLabel =3D virSecuritySELinuxSetImageFDLa= bel, + .domainSetSecuritySharedImageFDLabel =3D virSecuritySELinuxSetSharedIm= ageFDLabel, .domainSetSecurityTapFDLabel =3D virSecuritySELinuxSetTapFDLabe= l, =20 .domainGetSecurityMountOptions =3D virSecuritySELinuxGetSecurityM= ountOptions, diff --git a/src/security/security_stack.c b/src/security/security_stack.c index a55e94e764..e6dc64332e 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -590,6 +590,23 @@ virSecurityStackSetImageFDLabel(virSecurityManager *mg= r, return rc; } =20 +static int +virSecurityStackSetSharedImageFDLabel(virSecurityManager *mgr, + virDomainDef *vm, + int fd) +{ + virSecurityStackData *priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityStackItem *item =3D priv->itemsHead; + int rc =3D 0; + + for (; item; item =3D item->next) { + if (virSecurityManagerSetSharedImageFDLabel(item->securityManager,= vm, fd) < 0) + rc =3D -1; + } + + return rc; +} + static int virSecurityStackSetTapFDLabel(virSecurityManager *mgr, virDomainDef *vm, @@ -1072,6 +1089,7 @@ virSecurityDriver virSecurityDriverStack =3D { .domainRestoreSavedStateLabel =3D virSecurityStackRestoreSavedSt= ateLabel, =20 .domainSetSecurityImageFDLabel =3D virSecurityStackSetImageFDLabe= l, + .domainSetSecuritySharedImageFDLabel =3D virSecurityStackSetSharedImag= eFDLabel, .domainSetSecurityTapFDLabel =3D virSecurityStackSetTapFDLabel, =20 .domainGetSecurityMountOptions =3D virSecurityStackGetMountOption= s, --=20 2.55.0 From nobody Tue Aug 25 02:50:22 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=reject dis=none) header.from=linux.ibm.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1787070489905776.3656693325636; Tue, 18 Aug 2026 09:28:09 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id AE837417F5; Tue, 18 Aug 2026 12:28:08 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 680F541B49 for ; Tue, 18 Aug 2026 12:23:54 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 8B1FA3F95D; Tue, 18 Aug 2026 12:23:31 -0400 (EDT) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 865B13F97B for ; Tue, 18 Aug 2026 12:23:27 -0400 (EDT) Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67IE3Rp4504591; Tue, 18 Aug 2026 16:23:26 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4g2fu4sf98-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 18 Aug 2026 16:23:26 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 67IGBMXO014491; Tue, 18 Aug 2026 16:23:25 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4g32tw49q9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 18 Aug 2026 16:23:25 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (smtpav05.dal12v.mail.ibm.com [10.241.53.104]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 67IGNMoG34079442 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 18 Aug 2026 16:23:23 GMT Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D976858052; Tue, 18 Aug 2026 16:23:22 +0000 (GMT) Received: from smtpav05.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2120B58065; Tue, 18 Aug 2026 16:23:22 +0000 (GMT) Received: from Mac.ibm.com (unknown [9.61.254.95]) by smtpav05.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 18 Aug 2026 16:23:22 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=VaV73cJh48kQxMmLP n3K4bXe/ZcVDH8qzYcFlz5CNPs=; b=coQtInvAZZVZ0V0DqLMmHs+K+Nz/ws/z0 /JPig+68MpW8fF+jv7Ob1sAuQ1WYfLjQvyZFqm1TYpOj/yj1K1dfM/nZ9gskfsZO ZCtCES7/KSP6g7C5KjO/xZrUvlp1FF97C6Cb6E1lwaYv0iP0qeHZCRg3AwzOCBC/ pwNnv77H8u4i3a2NoBoLXzm+Axeb0ekstKNHeg+cy7PALzdM37Iv1lkBrszRQMw2 3slUhqClaaf0QWxeRhe/pvRwzK1PjA8Fn0h59RRMnKxrrTMy0OqljMsMVD5Km5ye ZnufyrBSImXxBlOinoqmC3Uv2kZ0cQxLxGZkgNw/93y+ueX4wir9g== From: Omar Elghoul To: devel@lists.libvirt.org Subject: [RFC PATCH v1 2/2] qemu: drop per-domain MCS categories from IOMMU device Date: Tue, 18 Aug 2026 12:21:05 -0400 Message-ID: <20260818162130.51699-3-oelghoul@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260818162130.51699-1-oelghoul@linux.ibm.com> References: <20260818162130.51699-1-oelghoul@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 4fUentUTsPOVSUOfWdWlJil8IJ0rNnjC X-Authority-Analysis: v=2.4 cv=NLLlPU6g c=1 sm=1 tr=0 ts=6a8486fe cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=Sv0fKeRqtYgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=BaWdZ1Be3OCbgzSMqnkA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwODE4MDExOCBTYWx0ZWRfX9v0UH6cxyKsj esCrjTL8tgjh850wtNNjyxlMxGIVc7BdvB/z+Asg5uaLtErc76cQqbwcZoudg3nTxlup29lUDcD nPbnFITe0aSVBetfoq4ey7qmz+dA91Q= X-Proofpoint-ORIG-GUID: 4fUentUTsPOVSUOfWdWlJil8IJ0rNnjC X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODE4MDExOCBTYWx0ZWRfX6S2cLA3PIDXE QeZtniaLXux+VnyCn3BnvKJ6IuCKKBIGy8nd/LAQ/NLqJrWgTWfs0iz6r+maJ0izS86ZpbTfbY1 dSbIYUyKD56weZCzkZu5baTYbDhLZttrf44lm29qcd2SFrGwcLb93e55artDs/e4kZbbtmgF8GI lTkOct8HIcBh/NKBoMCYsjTq8GgEvJ1SI7HJb5l6SYAViQGGIU/hazkeU0SIhTSqkmXvJV/naKp Gbnt+CsxR9dO8Ci6NE8HLLBCGE4E+QR3UAaYoe3esWpUp4iMuvi3NAyChWjfs/CwaSjwwyRW60r sAPsiwhvwV64vljjIumuwhOt0PR5F4eg9nCELP5t7CZs0o3CH9fX+NdPj2gtpcw0ycv08w/Jxen p9Sr3m2PjZcqaUEHj2SfhDOxhfM2Toy3cMSF2YeG9fzCluxsaQYsctlVo3WujDwhs5p9bHaAa62 zfZGfP10z+hCjqHJWVg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-18_02,2026-08-18_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 spamscore=0 lowpriorityscore=0 phishscore=0 impostorscore=0 malwarescore=0 suspectscore=0 clxscore=1011 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608180118 Message-ID-Hash: 3FBJEMDYMUX6QIQDSF743EQNNKCJRH7Y X-Message-ID-Hash: 3FBJEMDYMUX6QIQDSF743EQNNKCJRH7Y X-MailFrom: oelghoul@linux.ibm.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: pkrempa@redhat.com, phrdina@redhat.com, jtomko@redhat.com, alifm@linux.ibm.com, fiuczy@linux.ibm.com, walling@linux.ibm.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1787070492013158500 Content-Type: text/plain; charset="utf-8" The /dev/iommu device is shared between all domains. Relabeling it with qemuSecuritySetImageFDLabel() can incorrectly add one domain's MCS categories onto that inode, blocking other domains' access. Call qemuSecuritySetSharedImageFDLabel() instead when an iommufd is opened or inherited, which sets the desired labels while omitting the MCS categories. Signed-off-by: Omar Elghoul --- src/qemu/qemu_process.c | 4 ++-- src/qemu/qemu_security.h | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index b2506edce0..e085a50a33 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7693,7 +7693,7 @@ qemuProcessOpenIommuFd(virDomainObj *vm) if ((iommufd =3D virIOMMUFDOpenDevice(priv->driver->privileged)) < 0) return -1; =20 - if (qemuSecuritySetImageFDLabel(priv->driver->securityManager, vm->def= , iommufd) < 0) + if (qemuSecuritySetSharedImageFDLabel(priv->driver->securityManager, v= m->def, iommufd) < 0) return -1; =20 priv->iommufd =3D qemuFDPassDirectNew("iommufd", &iommufd); @@ -7733,7 +7733,7 @@ qemuProcessGetPassedIommuFd(virDomainObj *vm) =20 iommufd =3D dup(fdt->fds[0]); =20 - if (qemuSecuritySetImageFDLabel(priv->driver->securityManager, vm->def= , iommufd) < 0) + if (qemuSecuritySetSharedImageFDLabel(priv->driver->securityManager, v= m->def, iommufd) < 0) return -1; =20 priv->iommufd =3D qemuFDPassDirectNew("iommufd", &iommufd); diff --git a/src/qemu/qemu_security.h b/src/qemu/qemu_security.h index 36663cffde..882babf2e9 100644 --- a/src/qemu/qemu_security.h +++ b/src/qemu/qemu_security.h @@ -148,6 +148,7 @@ int qemuSecurityCommandRun(virQEMUDriver *driver, #define qemuSecuritySetChildProcessLabel virSecurityManagerSetChildProcess= Label #define qemuSecuritySetDaemonSocketLabel virSecurityManagerSetDaemonSocket= Label #define qemuSecuritySetImageFDLabel virSecurityManagerSetImageFDLabel +#define qemuSecuritySetSharedImageFDLabel virSecurityManagerSetSharedImage= FDLabel #define qemuSecuritySetSavedStateLabel virSecurityManagerSetSavedStateLabel #define qemuSecuritySetSocketLabel virSecurityManagerSetSocketLabel #define qemuSecuritySetTapFDLabel virSecurityManagerSetTapFDLabel --=20 2.55.0