From nobody Sun Nov 24 09:42:39 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1722605348362948.327437780242; Fri, 2 Aug 2024 06:29:08 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 996) id 2E6E0146C; Fri, 2 Aug 2024 09:29:07 -0400 (EDT) Received: from lists.libvirt.org (localhost [IPv6:::1]) by lists.libvirt.org (Postfix) with ESMTP id 80C0C14D5; Fri, 2 Aug 2024 09:24:22 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 996) id 6C64B144C; Fri, 2 Aug 2024 09:24:13 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id EDAAC14ED for ; Fri, 2 Aug 2024 09:24:01 -0400 (EDT) Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-687-tsoS0hBqPgGAk22iLtJi6A-1; Fri, 02 Aug 2024 09:24:00 -0400 Received: from mx-prod-int-04.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-04.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.40]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id AAF4E1955F45 for ; Fri, 2 Aug 2024 13:23:59 +0000 (UTC) Received: from speedmetal.redhat.com (unknown [10.45.242.16]) by mx-prod-int-04.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E09FF19560AA for ; Fri, 2 Aug 2024 13:23:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=3.4.4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1722605041; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XPvQwdCvtcbZ+lWwWUCtLaLDUI63LO5FITghVtXPxkU=; b=aY1YTM/3eZhL3P0Tm0rkKSw9dRCDAS7o0AF2UQK/Dt+A6nMoq3IHyqRt524BmfuMpB8E0A l59Hy36LF0xfl28F/Z7zyNDz0Lwx37GgCKonsrhevjgmScSnaZSz/bCKWZVnopqPajlchI bwGlSROIuRjgm7gJl6QZ91XM8W6mLZM= X-MC-Unique: tsoS0hBqPgGAk22iLtJi6A-1 From: Peter Krempa To: devel@lists.libvirt.org Subject: [PATCH v5 09/11] security_(dac|selinux): Unref remebered security labels on outgoing migration Date: Fri, 2 Aug 2024 15:23:42 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.40 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: OLI3FRIU246MU4O5S4TM3FW5ISVQATCU X-Message-ID-Hash: OLI3FRIU246MU4O5S4TM3FW5ISVQATCU X-MailFrom: pkrempa@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-config-1; header-match-config-2; header-match-config-3; header-match-devel.lists.libvirt.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header X-Mailman-Version: 3.2.2 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1722605348758116600 Content-Type: text/plain; charset="utf-8" When 'qemuSecurityRestoreAllLabel' is called on outgoing migration it skips the actual relabeling part of the images in dac/selinux drivers in order to avoid cutting off access to the image. As shared filesystems don't really support the trusted XATTR groups, remembering of security labels never worked on those paths so we never actually had remembered seclabels for images that could be migrated. With recent changes we now support migration from local storage to remote in case the admin declares it as shared. This means that in case when the VM is started on local storage we'd actually store seclabels, but when migrating out the XATTRs remembering the seclabels would not actually be unref'd and thus the seclabels would leak. As we can't know whether a remote host will be able to use the XATTRs or not (but really it won't) and at the same time the destination side of migration will actually call 'qemuSecuritySetAllLabel' setting/refing it's own seclabels we really need to unref them on our side. This patch adds the appropriate *RecallLabel() calls on the code paths in which relabelling is skipped due to migration. Signed-off-by: Peter Krempa --- src/security/security_dac.c | 3 +++ src/security/security_selinux.c | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 95dbe4636f..c327e4c9e0 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1022,6 +1022,9 @@ virSecurityDACRestoreImageLabelInt(virSecurityManager= *mgr, if (rc =3D=3D 1) { VIR_DEBUG("Skipping image label restore on %s because FS is sh= ared", src->path); + + ignore_value(virSecurityDACRecallLabel(priv, src->path, NULL, = NULL)); + return 0; } } diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index 453ac67d25..158f40fed9 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1837,8 +1837,15 @@ virSecuritySELinuxRestoreImageLabelInt(virSecurityMa= nager *mgr, } if (rc =3D=3D 1) { + g_autofree char *oldlabel =3D NULL; + VIR_DEBUG("Skipping image label restore on %s because FS is sh= ared", src->path); + + /* We still want to remove the local reference of the remember= ed + * seclabel. The destination will take it's own reference when + * starting the migrated VM */ + ignore_value(virSecuritySELinuxRecallLabel(src->path, &oldlabe= l)); return 0; } } --=20 2.45.2