From nobody Sun May 5 19:59:53 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1500309129717570.6327762180462; Mon, 17 Jul 2017 09:32:09 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6C9F4C058EBD; Mon, 17 Jul 2017 16:32:06 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 8354477A1A; Mon, 17 Jul 2017 16:32:05 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 1AEB04A491; Mon, 17 Jul 2017 16:32:04 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id v6HGW3cd008404 for ; Mon, 17 Jul 2017 12:32:03 -0400 Received: by smtp.corp.redhat.com (Postfix) id 48BD67770B; Mon, 17 Jul 2017 16:32:03 +0000 (UTC) Received: from worklaptop.redhat.com (ovpn-116-195.phx2.redhat.com [10.3.116.195]) by smtp.corp.redhat.com (Postfix) with ESMTP id E4AF477BE8; Mon, 17 Jul 2017 16:31:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 6C9F4C058EBD Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=libvir-list-bounces@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 6C9F4C058EBD From: Cole Robinson To: libvir-list@redhat.com Date: Mon, 17 Jul 2017 12:31:50 -0400 Message-Id: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH] security: dac: relabel spice rendernode X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Mon, 17 Jul 2017 16:32:07 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" For a logged in user this a path like /dev/dri/renderD128 will have default ownership root:video which won't work for the qemu:qemu user, so we need to chown it. Thankfully with the namespace work we don't need to worry about this shutting out other legitimate users https://bugzilla.redhat.com/show_bug.cgi?id=3D1460804 Signed-off-by: Cole Robinson --- Sidenote: Not sure about security_selinux changes... Fedora selinux policy doesn't require relabeling /dev/dri/* nowadays so it isn't required to get qemu to startup, and infact will probably cause issues for qemu:///session and non-namespace qemu:///system src/security/security_dac.c | 61 +++++++++++++++++++++++++++++++++++++++++= ++++ 1 file changed, 61 insertions(+) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index ca7a6af6d..4c86e5fe8 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1371,6 +1371,57 @@ virSecurityDACRestoreTPMFileLabel(virSecurityManager= Ptr mgr, =20 =20 static int +virSecurityDACSetGraphicsLabel(virSecurityManagerPtr mgr, + virDomainDefPtr def, + virDomainGraphicsDefPtr gfx) + +{ + virSecurityDACDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityLabelDefPtr seclabel; + uid_t user; + gid_t group; + + seclabel =3D virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME); + if (seclabel && !seclabel->relabel) + return 0; + + if (virSecurityDACGetIds(seclabel, priv, &user, &group, NULL, NULL) < = 0) + return -1; + + if (gfx->type =3D=3D VIR_DOMAIN_GRAPHICS_TYPE_SPICE && + gfx->data.spice.gl =3D=3D VIR_TRISTATE_BOOL_YES && + gfx->data.spice.rendernode) { + if (virSecurityDACSetOwnership(priv, NULL, + gfx->data.spice.rendernode, + user, group) < 0) + return -1; + } + + return 0; +} + + +static int +virSecurityDACRestoreGraphicsLabel(virSecurityManagerPtr mgr, + virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainGraphicsDefPtr gfx) + +{ + virSecurityDACDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + + if (gfx->type =3D=3D VIR_DOMAIN_GRAPHICS_TYPE_SPICE && + gfx->data.spice.gl =3D=3D VIR_TRISTATE_BOOL_YES && + gfx->data.spice.rendernode) { + if (virSecurityDACRestoreFileLabel(priv, + gfx->data.spice.rendernode) < 0) + return -1; + } + + return 0; +} + + +static int virSecurityDACSetInputLabel(virSecurityManagerPtr mgr, virDomainDefPtr def, virDomainInputDefPtr input) @@ -1481,6 +1532,11 @@ virSecurityDACRestoreAllLabel(virSecurityManagerPtr = mgr, rc =3D -1; } =20 + for (i =3D 0; i < def->ngraphics; i++) { + if (virSecurityDACRestoreGraphicsLabel(mgr, def, def->graphics[i])= < 0) + return -1; + } + for (i =3D 0; i < def->ninputs; i++) { if (virSecurityDACRestoreInputLabel(mgr, def, def->inputs[i]) < 0) rc =3D -1; @@ -1601,6 +1657,11 @@ virSecurityDACSetAllLabel(virSecurityManagerPtr mgr, return -1; } =20 + for (i =3D 0; i < def->ngraphics; i++) { + if (virSecurityDACSetGraphicsLabel(mgr, def, def->graphics[i]) < 0) + return -1; + } + for (i =3D 0; i < def->ninputs; i++) { if (virSecurityDACSetInputLabel(mgr, def, def->inputs[i]) < 0) return -1; --=20 2.13.3 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list