We're setting seclabels on unix sockets but never restoring them.
Surprisingly, we are in SELinux driver.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
---
 src/security/security_dac.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index 6f8ca8cd54..0adf71bed6 100644
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -1457,13 +1457,25 @@ virSecurityDACRestoreChardevLabel(virSecurityManagerPtr mgr,
         ret = 0;
         break;
 
+    case VIR_DOMAIN_CHR_TYPE_UNIX:
+        if (!dev_source->data.nix.listen ||
+            (dev_source->data.nix.path &&
+             virFileExists(dev_source->data.nix.path))) {
+            /* Also label mode='bind' sockets if they exist,
+             * e.g. because they were created by libvirt
+             * and passed via FD */
+            if (virSecurityDACRestoreFileLabel(mgr, dev_source->data.nix.path) < 0)
+                goto done;
+        }
+        ret = 0;
+        break;
+
     case VIR_DOMAIN_CHR_TYPE_NULL:
     case VIR_DOMAIN_CHR_TYPE_VC:
     case VIR_DOMAIN_CHR_TYPE_PTY:
     case VIR_DOMAIN_CHR_TYPE_STDIO:
     case VIR_DOMAIN_CHR_TYPE_UDP:
     case VIR_DOMAIN_CHR_TYPE_TCP:
-    case VIR_DOMAIN_CHR_TYPE_UNIX:
     case VIR_DOMAIN_CHR_TYPE_SPICEVMC:
     case VIR_DOMAIN_CHR_TYPE_SPICEPORT:
     case VIR_DOMAIN_CHR_TYPE_NMDM:
-- 
2.21.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Mon, Apr 15, 2019 at 05:52:50PM +0200, Michal Privoznik wrote:
>We're setting seclabels on unix sockets but never restoring them.
>Surprisingly, we are in SELinux driver.

s/we are/we are doing so/ would be clearer

>
>Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
>---
> src/security/security_dac.c | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
>
>diff --git a/src/security/security_dac.c b/src/security/security_dac.c
>index 6f8ca8cd54..0adf71bed6 100644
>--- a/src/security/security_dac.c
>+++ b/src/security/security_dac.c
>@@ -1457,13 +1457,25 @@ virSecurityDACRestoreChardevLabel(virSecurityManagerPtr mgr,
>         ret = 0;
>         break;
>
>+    case VIR_DOMAIN_CHR_TYPE_UNIX:
>+        if (!dev_source->data.nix.listen ||

>+            (dev_source->data.nix.path &&
>+             virFileExists(dev_source->data.nix.path))) {
>+            /* Also label mode='bind' sockets if they exist,
>+             * e.g. because they were created by libvirt
>+             * and passed via FD */

This condition does not really work after the domain startup - all
listen sockets should exist at this point. Fortunately they will get
unlinked by qemuProcessCleanupChardevDevice through qemuProcessStop
anyway.

So all we need to check here is if (!dev_source->data.nix.listen)

>+            if (virSecurityDACRestoreFileLabel(mgr, dev_source->data.nix.path) < 0)
>+                goto done;
>+        }
>+        ret = 0;
>+        break;
>+

Reviewed-by: Ján Tomko <jtomko@redhat.com>

Jano
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list