From nobody Sat Apr 27 21:44:31 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 151127678303147.384731382281984; Tue, 21 Nov 2017 07:06:23 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 3C6C96551; Tue, 21 Nov 2017 15:06:21 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 129E560BE0; Tue, 21 Nov 2017 15:06:21 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 8E3A31800FC4; Tue, 21 Nov 2017 15:06:20 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id vALF6KXs010363 for ; Tue, 21 Nov 2017 10:06:20 -0500 Received: by smtp.corp.redhat.com (Postfix) id 1941560BE0; Tue, 21 Nov 2017 15:06:20 +0000 (UTC) Received: from icr.brq.redhat.com (unknown [10.43.2.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 940E860C9D for ; Tue, 21 Nov 2017 15:06:00 +0000 (UTC) From: =?UTF-8?q?J=C3=A1n=20Tomko?= To: libvir-list@redhat.com Date: Tue, 21 Nov 2017 16:05:39 +0100 Message-Id: <0f79bd70331de2a4888d3ee525a79f7f2a7beb06.1511276654.git.jtomko@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 1/5] Introduce virDomainInputDefGetPath X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 21 Nov 2017 15:06:21 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Use it to denadify qemuDomainSetupInput. --- src/conf/domain_conf.c | 16 ++++++++++++++++ src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 1 + src/qemu/qemu_domain.c | 21 ++++----------------- 4 files changed, 22 insertions(+), 17 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 969a6632b..5d0290d07 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1404,6 +1404,22 @@ void virDomainGraphicsDefFree(virDomainGraphicsDefPt= r def) VIR_FREE(def); } =20 +const char *virDomainInputDefGetPath(virDomainInputDefPtr input) +{ + switch ((virDomainInputType) input->type) { + case VIR_DOMAIN_INPUT_TYPE_MOUSE: + case VIR_DOMAIN_INPUT_TYPE_TABLET: + case VIR_DOMAIN_INPUT_TYPE_KBD: + case VIR_DOMAIN_INPUT_TYPE_LAST: + return NULL; + break; + + case VIR_DOMAIN_INPUT_TYPE_PASSTHROUGH: + return input->source.evdev; + } + return NULL; +} + void virDomainInputDefFree(virDomainInputDefPtr def) { if (!def) diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index cb8701dd2..e8ab9abdf 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2706,6 +2706,7 @@ int virDomainObjWaitUntil(virDomainObjPtr vm, void virDomainPanicDefFree(virDomainPanicDefPtr panic); void virDomainResourceDefFree(virDomainResourceDefPtr resource); void virDomainGraphicsDefFree(virDomainGraphicsDefPtr def); +const char *virDomainInputDefGetPath(virDomainInputDefPtr input); void virDomainInputDefFree(virDomainInputDefPtr def); virDomainDiskDefPtr virDomainDiskDefNew(virDomainXMLOptionPtr xmlopt); void virDomainDiskDefFree(virDomainDiskDefPtr def); diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index d3ca6b2ec..2997a469d 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -395,6 +395,7 @@ virDomainHypervTypeToString; virDomainInputBusTypeToString; virDomainInputDefFind; virDomainInputDefFree; +virDomainInputDefGetPath; virDomainIOMMUModelTypeFromString; virDomainIOMMUModelTypeToString; virDomainIOThreadIDAdd; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index cc7596bad..b2fc3b816 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8949,25 +8949,12 @@ qemuDomainSetupInput(virQEMUDriverConfigPtr cfg ATT= RIBUTE_UNUSED, virDomainInputDefPtr input, const struct qemuDomainCreateDeviceData *data) { - int ret =3D -1; - - switch ((virDomainInputType) input->type) { - case VIR_DOMAIN_INPUT_TYPE_PASSTHROUGH: - if (qemuDomainCreateDevice(input->source.evdev, data, false) < 0) - goto cleanup; - break; + const char *path =3D virDomainInputDefGetPath(input); =20 - case VIR_DOMAIN_INPUT_TYPE_MOUSE: - case VIR_DOMAIN_INPUT_TYPE_TABLET: - case VIR_DOMAIN_INPUT_TYPE_KBD: - case VIR_DOMAIN_INPUT_TYPE_LAST: - /* nada */ - break; - } + if (path && qemuDomainCreateDevice(path, data, false) < 0) + return -1; =20 - ret =3D 0; - cleanup: - return ret; + return 0; } =20 =20 --=20 2.13.6 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Sat Apr 27 21:44:31 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 151127678447921.85245270748544; Tue, 21 Nov 2017 07:06:24 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 12B7F1A4083; Tue, 21 Nov 2017 15:06:23 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E12C76F13B; Tue, 21 Nov 2017 15:06:22 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id A96D43D38B; Tue, 21 Nov 2017 15:06:22 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id vALF6LZG010372 for ; Tue, 21 Nov 2017 10:06:21 -0500 Received: by smtp.corp.redhat.com (Postfix) id 708FB60C99; Tue, 21 Nov 2017 15:06:21 +0000 (UTC) Received: from icr.brq.redhat.com (unknown [10.43.2.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id C40DA60C9D for ; Tue, 21 Nov 2017 15:06:20 +0000 (UTC) From: =?UTF-8?q?J=C3=A1n=20Tomko?= To: libvir-list@redhat.com Date: Tue, 21 Nov 2017 16:05:40 +0100 Message-Id: <17e6e2ae4527dd7c88ca325d9d2e19715dfcf92b.1511276654.git.jtomko@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 2/5] security: Introduce functions for input device hot(un)plug X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 21 Nov 2017 15:06:23 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Export the existing DAC and SELinux for separate use and introduce functions for stack, nop and the security manager. --- src/libvirt_private.syms | 2 ++ src/security/security_dac.c | 3 +++ src/security/security_driver.h | 9 +++++++++ src/security/security_manager.c | 36 ++++++++++++++++++++++++++++++++++++ src/security/security_manager.h | 8 ++++++++ src/security/security_nop.c | 11 +++++++++++ src/security/security_selinux.c | 3 +++ src/security/security_stack.c | 38 ++++++++++++++++++++++++++++++++++++++ 8 files changed, 110 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 2997a469d..31969a092 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1274,6 +1274,7 @@ virSecurityManagerRestoreAllLabel; virSecurityManagerRestoreDiskLabel; virSecurityManagerRestoreHostdevLabel; virSecurityManagerRestoreImageLabel; +virSecurityManagerRestoreInputLabel; virSecurityManagerRestoreMemoryLabel; virSecurityManagerRestoreSavedStateLabel; virSecurityManagerSetAllLabel; @@ -1283,6 +1284,7 @@ virSecurityManagerSetDiskLabel; virSecurityManagerSetHostdevLabel; virSecurityManagerSetImageFDLabel; virSecurityManagerSetImageLabel; +virSecurityManagerSetInputLabel; virSecurityManagerSetMemoryLabel; virSecurityManagerSetProcessLabel; virSecurityManagerSetSavedStateLabel; diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 54120890f..52ca07a10 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -2123,6 +2123,9 @@ virSecurityDriver virSecurityDriverDAC =3D { .domainSetSecurityMemoryLabel =3D virSecurityDACSetMemoryLabel, .domainRestoreSecurityMemoryLabel =3D virSecurityDACRestoreMemoryLab= el, =20 + .domainSetSecurityInputLabel =3D virSecurityDACSetInputLabel, + .domainRestoreSecurityInputLabel =3D virSecurityDACRestoreInputLabe= l, + .domainSetSecurityDaemonSocketLabel =3D virSecurityDACSetDaemonSocketL= abel, .domainSetSecuritySocketLabel =3D virSecurityDACSetSocketLabel, .domainClearSecuritySocketLabel =3D virSecurityDACClearSocketLabel, diff --git a/src/security/security_driver.h b/src/security/security_driver.h index 0b3b45248..1b3070d06 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -131,6 +131,12 @@ typedef int (*virSecurityDomainSetMemoryLabel) (virSec= urityManagerPtr mgr, typedef int (*virSecurityDomainRestoreMemoryLabel) (virSecurityManagerPtr = mgr, virDomainDefPtr def, virDomainMemoryDefPtr = mem); +typedef int (*virSecurityDomainSetInputLabel) (virSecurityManagerPtr mgr, + virDomainDefPtr def, + virDomainInputDefPtr input); +typedef int (*virSecurityDomainRestoreInputLabel) (virSecurityManagerPtr m= gr, + virDomainDefPtr def, + virDomainInputDefPtr in= put); typedef int (*virSecurityDomainSetPathLabel) (virSecurityManagerPtr mgr, virDomainDefPtr def, const char *path); @@ -163,6 +169,9 @@ struct _virSecurityDriver { virSecurityDomainSetMemoryLabel domainSetSecurityMemoryLabel; virSecurityDomainRestoreMemoryLabel domainRestoreSecurityMemoryLabel; =20 + virSecurityDomainSetInputLabel domainSetSecurityInputLabel; + virSecurityDomainRestoreInputLabel domainRestoreSecurityInputLabel; + virSecurityDomainSetDaemonSocketLabel domainSetSecurityDaemonSocketLab= el; virSecurityDomainSetSocketLabel domainSetSecuritySocketLabel; virSecurityDomainClearSocketLabel domainClearSecuritySocketLabel; diff --git a/src/security/security_manager.c b/src/security/security_manage= r.c index 60cfc92e7..3cf12188a 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -1116,3 +1116,39 @@ virSecurityManagerRestoreMemoryLabel(virSecurityMana= gerPtr mgr, virReportUnsupportedError(); return -1; } + + +int +virSecurityManagerSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + if (mgr->drv->domainSetSecurityInputLabel) { + int ret; + virObjectLock(mgr); + ret =3D mgr->drv->domainSetSecurityInputLabel(mgr, vm, input); + virObjectUnlock(mgr); + return ret; + } + + virReportUnsupportedError(); + return -1; +} + + +int +virSecurityManagerRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + if (mgr->drv->domainRestoreSecurityInputLabel) { + int ret; + virObjectLock(mgr); + ret =3D mgr->drv->domainRestoreSecurityInputLabel(mgr, vm, input); + virObjectUnlock(mgr); + return ret; + } + + virReportUnsupportedError(); + return -1; +} diff --git a/src/security/security_manager.h b/src/security/security_manage= r.h index 6712112e7..834c7f159 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -172,6 +172,14 @@ int virSecurityManagerRestoreMemoryLabel(virSecurityMa= nagerPtr mgr, virDomainDefPtr vm, virDomainMemoryDefPtr mem); =20 +int virSecurityManagerSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input); +int virSecurityManagerRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input); + + int virSecurityManagerDomainSetPathLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, const char *path); diff --git a/src/security/security_nop.c b/src/security/security_nop.c index 527be11e5..cfb032c68 100644 --- a/src/security/security_nop.c +++ b/src/security/security_nop.c @@ -254,6 +254,14 @@ virSecurityDomainRestoreMemoryLabelNop(virSecurityMana= gerPtr mgr ATTRIBUTE_UNUSE return 0; } =20 +static int +virSecurityDomainInputLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainInputDefPtr input ATTRIBUTE_UNUSED) +{ + return 0; +} + =20 virSecurityDriver virSecurityDriverNop =3D { .privateDataLen =3D 0, @@ -276,6 +284,9 @@ virSecurityDriver virSecurityDriverNop =3D { .domainSetSecurityMemoryLabel =3D virSecurityDomainSetMemoryLabe= lNop, .domainRestoreSecurityMemoryLabel =3D virSecurityDomainRestoreMemory= LabelNop, =20 + .domainSetSecurityInputLabel =3D virSecurityDomainInputLabelNop, + .domainRestoreSecurityInputLabel =3D virSecurityDomainInputLabelNop, + .domainSetSecurityDaemonSocketLabel =3D virSecurityDomainSetDaemonSock= etLabelNop, .domainSetSecuritySocketLabel =3D virSecurityDomainSetSocketLabe= lNop, .domainClearSecuritySocketLabel =3D virSecurityDomainClearSocketLa= belNop, diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index ed1828a12..b677fbcda 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -3064,6 +3064,9 @@ virSecurityDriver virSecurityDriverSELinux =3D { .domainSetSecurityMemoryLabel =3D virSecuritySELinuxSetMemoryLab= el, .domainRestoreSecurityMemoryLabel =3D virSecuritySELinuxRestoreMemor= yLabel, =20 + .domainSetSecurityInputLabel =3D virSecuritySELinuxSetInputLabe= l, + .domainRestoreSecurityInputLabel =3D virSecuritySELinuxRestoreInput= Label, + .domainSetSecurityDaemonSocketLabel =3D virSecuritySELinuxSetDaemonSoc= ketLabel, .domainSetSecuritySocketLabel =3D virSecuritySELinuxSetSocketLab= el, .domainClearSecuritySocketLabel =3D virSecuritySELinuxClearSocketL= abel, diff --git a/src/security/security_stack.c b/src/security/security_stack.c index 53eee1692..cd916382b 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -667,6 +667,41 @@ virSecurityStackRestoreMemoryLabel(virSecurityManagerP= tr mgr, } =20 static int +virSecurityStackSetInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + virSecurityStackDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item =3D priv->itemsHead; + int rc =3D 0; + + for (; item; item =3D item->next) { + if (virSecurityManagerSetInputLabel(item->securityManager, vm, inp= ut) < 0) + rc =3D -1; + } + + return rc; +} + +static int +virSecurityStackRestoreInputLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + virDomainInputDefPtr input) +{ + virSecurityStackDataPtr priv =3D virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item =3D priv->itemsHead; + int rc =3D 0; + + for (; item; item =3D item->next) { + if (virSecurityManagerRestoreInputLabel(item->securityManager, + vm, input) < 0) + rc =3D -1; + } + + return rc; +} + +static int virSecurityStackDomainSetPathLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, const char *path) @@ -711,6 +746,9 @@ virSecurityDriver virSecurityDriverStack =3D { .domainSetSecurityMemoryLabel =3D virSecurityStackSetMemoryLabel, .domainRestoreSecurityMemoryLabel =3D virSecurityStackRestoreMemoryL= abel, =20 + .domainSetSecurityInputLabel =3D virSecurityStackSetInputLabel, + .domainRestoreSecurityInputLabel =3D virSecurityStackRestoreInputLa= bel, + .domainSetSecurityDaemonSocketLabel =3D virSecurityStackSetDaemonSocke= tLabel, .domainSetSecuritySocketLabel =3D virSecurityStackSetSocketLabel, .domainClearSecuritySocketLabel =3D virSecurityStackClearSocketLab= el, --=20 2.13.6 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Sat Apr 27 21:44:31 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 151127678983114.123494571389756; Tue, 21 Nov 2017 07:06:29 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id AC9807CDE2; Tue, 21 Nov 2017 15:06:28 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 820606C435; Tue, 21 Nov 2017 15:06:28 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 4D9AB180474C; Tue, 21 Nov 2017 15:06:28 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id vALF6MYA010379 for ; Tue, 21 Nov 2017 10:06:22 -0500 Received: by smtp.corp.redhat.com (Postfix) id 521DD61986; Tue, 21 Nov 2017 15:06:22 +0000 (UTC) Received: from icr.brq.redhat.com (unknown [10.43.2.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id BEF4260BE0 for ; Tue, 21 Nov 2017 15:06:21 +0000 (UTC) From: =?UTF-8?q?J=C3=A1n=20Tomko?= To: libvir-list@redhat.com Date: Tue, 21 Nov 2017 16:05:41 +0100 Message-Id: <0f6c56ab13ce00a6ef646bd6139c6a7feb43bf3f.1511276654.git.jtomko@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 3/5] qemu: Introduce functions for input device cgroup manipulation X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 21 Nov 2017 15:06:29 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Export qemuSetupInputCgroup and introduce qemuTeardownInputCgroup for hotunplug. --- src/qemu/qemu_cgroup.c | 25 ++++++++++++++++++++++++- src/qemu/qemu_cgroup.h | 4 ++++ 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index 0f75e22f9..19252ea23 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -246,7 +246,7 @@ qemuSetupTPMCgroup(virDomainObjPtr vm) } =20 =20 -static int +int qemuSetupInputCgroup(virDomainObjPtr vm, virDomainInputDefPtr dev) { @@ -270,6 +270,29 @@ qemuSetupInputCgroup(virDomainObjPtr vm, =20 =20 int +qemuTeardownInputCgroup(virDomainObjPtr vm, + virDomainInputDefPtr dev) +{ + qemuDomainObjPrivatePtr priv =3D vm->privateData; + int ret =3D 0; + + if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICE= S)) + return 0; + + switch (dev->type) { + case VIR_DOMAIN_INPUT_TYPE_PASSTHROUGH: + VIR_DEBUG("Process path '%s' for input device", dev->source.evdev); + ret =3D virCgroupDenyDevicePath(priv->cgroup, dev->source.evdev, + VIR_CGROUP_DEVICE_RWM, false); + virDomainAuditCgroupPath(vm, priv->cgroup, "deny", dev->source.evd= ev, "rwm", ret =3D=3D 0); + break; + } + + return ret; +} + + +int qemuSetupHostdevCgroup(virDomainObjPtr vm, virDomainHostdevDefPtr dev) { diff --git a/src/qemu/qemu_cgroup.h b/src/qemu/qemu_cgroup.h index 3fc158361..3b8ff6055 100644 --- a/src/qemu/qemu_cgroup.h +++ b/src/qemu/qemu_cgroup.h @@ -37,6 +37,10 @@ int qemuSetupDiskCgroup(virDomainObjPtr vm, virDomainDiskDefPtr disk); int qemuTeardownDiskCgroup(virDomainObjPtr vm, virDomainDiskDefPtr disk); +int qemuSetupInputCgroup(virDomainObjPtr vm, + virDomainInputDefPtr dev); +int qemuTeardownInputCgroup(virDomainObjPtr vm, + virDomainInputDefPtr dev); int qemuSetupHostdevCgroup(virDomainObjPtr vm, virDomainHostdevDefPtr dev) ATTRIBUTE_RETURN_CHECK; --=20 2.13.6 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Sat Apr 27 21:44:31 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1511276806095726.8022766580378; Tue, 21 Nov 2017 07:06:46 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D924B3DBEA; Tue, 21 Nov 2017 15:06:44 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B364A6F113; Tue, 21 Nov 2017 15:06:44 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 7A81B3D38C; Tue, 21 Nov 2017 15:06:44 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id vALF6hLr010419 for ; Tue, 21 Nov 2017 10:06:43 -0500 Received: by smtp.corp.redhat.com (Postfix) id 1CF9B60BE0; Tue, 21 Nov 2017 15:06:43 +0000 (UTC) Received: from icr.brq.redhat.com (unknown [10.43.2.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 95B44609AA for ; Tue, 21 Nov 2017 15:06:22 +0000 (UTC) From: =?UTF-8?q?J=C3=A1n=20Tomko?= To: libvir-list@redhat.com Date: Tue, 21 Nov 2017 16:05:42 +0100 Message-Id: <3ef84d9ed21616502ca3c34c449e4091b6b74a07.1511276654.git.jtomko@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 4/5] qemu: functions for dealing with input device namespaces and labels X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 21 Nov 2017 15:06:45 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Introudce functions that will let us create the evdevs in namespaces and label the devices on input device hotplug/hotunplug. --- src/qemu/qemu_domain.c | 72 ++++++++++++++++++++++++++++++++++++++++++++= ++++ src/qemu/qemu_domain.h | 6 ++++ src/qemu/qemu_security.c | 58 ++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_security.h | 6 ++++ 4 files changed, 142 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index b2fc3b816..5831a2025 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -9969,6 +9969,78 @@ qemuDomainNamespaceTeardownRNG(virQEMUDriverPtr driv= er, } =20 =20 +int +qemuDomainNamespaceSetupInput(virDomainObjPtr vm, + virDomainInputDefPtr input) +{ + qemuDomainObjPrivatePtr priv =3D vm->privateData; + virQEMUDriverPtr driver =3D priv->driver; + virQEMUDriverConfigPtr cfg =3D NULL; + char **devMountsPath =3D NULL; + size_t ndevMountsPath =3D 0; + const char *path =3D NULL; + int ret =3D -1; + + if (!(path =3D virDomainInputDefGetPath(input))) + return 0; + + if (!qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) + return 0; + + cfg =3D virQEMUDriverGetConfig(driver); + if (qemuDomainGetPreservedMounts(cfg, vm, + &devMountsPath, NULL, + &ndevMountsPath) < 0) + goto cleanup; + + if (qemuDomainAttachDeviceMknod(driver, vm, path, + devMountsPath, ndevMountsPath) < 0) + goto cleanup; + + ret =3D 0; + cleanup: + virStringListFreeCount(devMountsPath, ndevMountsPath); + virObjectUnref(cfg); + return ret; +} + + +int +qemuDomainNamespaceTeardownInput(virDomainObjPtr vm, + virDomainInputDefPtr input) +{ + qemuDomainObjPrivatePtr priv =3D vm->privateData; + virQEMUDriverPtr driver =3D priv->driver; + virQEMUDriverConfigPtr cfg =3D NULL; + char **devMountsPath =3D NULL; + size_t ndevMountsPath =3D 0; + const char *path =3D NULL; + int ret =3D -1; + + if (!(path =3D virDomainInputDefGetPath(input))) + return 0; + + if (!qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) + return 0; + + cfg =3D virQEMUDriverGetConfig(driver); + if (qemuDomainGetPreservedMounts(cfg, vm, + &devMountsPath, NULL, + &ndevMountsPath) < 0) + goto cleanup; + + if (qemuDomainDetachDeviceUnlink(driver, vm, path, + devMountsPath, ndevMountsPath) < 0) + goto cleanup; + + ret =3D 0; + cleanup: + virStringListFreeCount(devMountsPath, ndevMountsPath); + virObjectUnref(cfg); + return ret; +} + + /** * qemuDomainDiskLookupByNodename: * @def: domain definition to look for the disk diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index e021da51f..e699ab5ba 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -968,6 +968,12 @@ int qemuDomainNamespaceTeardownRNG(virQEMUDriverPtr dr= iver, virDomainObjPtr vm, virDomainRNGDefPtr rng); =20 +int qemuDomainNamespaceSetupInput(virDomainObjPtr vm, + virDomainInputDefPtr input); + +int qemuDomainNamespaceTeardownInput(virDomainObjPtr vm, + virDomainInputDefPtr input); + virDomainDiskDefPtr qemuDomainDiskLookupByNodename(virDomainDefPtr def, const char *nodename, virStorageSourcePtr *sr= c, diff --git a/src/qemu/qemu_security.c b/src/qemu/qemu_security.c index 6fc3b0bb6..e7d2bbd5a 100644 --- a/src/qemu/qemu_security.c +++ b/src/qemu/qemu_security.c @@ -306,3 +306,61 @@ qemuSecurityRestoreMemoryLabel(virQEMUDriverPtr driver, virSecurityManagerTransactionAbort(driver->securityManager); return ret; } + + +int +qemuSecuritySetInputLabel(virDomainObjPtr vm, + virDomainInputDefPtr input) +{ + qemuDomainObjPrivatePtr priv =3D vm->privateData; + virQEMUDriverPtr driver =3D priv->driver; + int ret =3D -1; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT) && + virSecurityManagerTransactionStart(driver->securityManager) < 0) + goto cleanup; + + if (virSecurityManagerSetInputLabel(driver->securityManager, + vm->def, + input) < 0) + goto cleanup; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT) && + virSecurityManagerTransactionCommit(driver->securityManager, + vm->pid) < 0) + goto cleanup; + + ret =3D 0; + cleanup: + virSecurityManagerTransactionAbort(driver->securityManager); + return ret; +} + + +int +qemuSecurityRestoreInputLabel(virDomainObjPtr vm, + virDomainInputDefPtr input) +{ + qemuDomainObjPrivatePtr priv =3D vm->privateData; + virQEMUDriverPtr driver =3D priv->driver; + int ret =3D -1; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT) && + virSecurityManagerTransactionStart(driver->securityManager) < 0) + goto cleanup; + + if (virSecurityManagerRestoreInputLabel(driver->securityManager, + vm->def, + input) < 0) + goto cleanup; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT) && + virSecurityManagerTransactionCommit(driver->securityManager, + vm->pid) < 0) + goto cleanup; + + ret =3D 0; + cleanup: + virSecurityManagerTransactionAbort(driver->securityManager); + return ret; +} diff --git a/src/qemu/qemu_security.h b/src/qemu/qemu_security.h index 7b25855bf..76d63f06e 100644 --- a/src/qemu/qemu_security.h +++ b/src/qemu/qemu_security.h @@ -70,6 +70,12 @@ int qemuSecurityRestoreMemoryLabel(virQEMUDriverPtr driv= er, virDomainObjPtr vm, virDomainMemoryDefPtr mem); =20 +int qemuSecuritySetInputLabel(virDomainObjPtr vm, + virDomainInputDefPtr input); + +int qemuSecurityRestoreInputLabel(virDomainObjPtr vm, + virDomainInputDefPtr input); + /* Please note that for these APIs there is no wrapper yet. Do NOT blindly= add * new APIs here. If an API can touch a /dev file add a proper wrapper ins= tead. */ --=20 2.13.6 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Sat Apr 27 21:44:31 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1511276817149191.51309595678606; Tue, 21 Nov 2017 07:06:57 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 185853E803; Tue, 21 Nov 2017 15:06:56 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E39DA62684; Tue, 21 Nov 2017 15:06:55 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 4076A3D38E; Tue, 21 Nov 2017 15:06:55 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id vALF6rXn010430 for ; Tue, 21 Nov 2017 10:06:53 -0500 Received: by smtp.corp.redhat.com (Postfix) id 7448360BE0; Tue, 21 Nov 2017 15:06:53 +0000 (UTC) Received: from icr.brq.redhat.com (unknown [10.43.2.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id EF0EA609AD for ; Tue, 21 Nov 2017 15:06:43 +0000 (UTC) From: =?UTF-8?q?J=C3=A1n=20Tomko?= To: libvir-list@redhat.com Date: Tue, 21 Nov 2017 16:05:43 +0100 Message-Id: <6c99014ea8df30cd70bc3a256fc2414353466a36.1511276654.git.jtomko@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 5/5] qemu: Properly label and create evdev on input device hotplug X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Tue, 21 Nov 2017 15:06:56 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Utilize all the newly introduced function to create the evdev node and label it on hotplug and destroy it on hotunplug. This was forgotten in commits bc9ffaf and 67486bb. https://bugzilla.redhat.com/show_bug.cgi?id=3D1509866 --- src/qemu/qemu_hotplug.c | 40 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 72a57d89e..fe69d42e8 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -2746,7 +2746,11 @@ qemuDomainAttachInputDevice(virQEMUDriverPtr driver, qemuDomainObjPrivatePtr priv =3D vm->privateData; virDomainDeviceDef dev =3D { VIR_DOMAIN_DEVICE_INPUT, { .input =3D input } }; + virErrorPtr originalError =3D NULL; bool releaseaddr =3D false; + bool teardowndevice =3D false; + bool teardownlabel =3D false; + bool teardowncgroup =3D false; =20 if (input->bus !=3D VIR_DOMAIN_INPUT_BUS_USB && input->bus !=3D VIR_DOMAIN_INPUT_BUS_VIRTIO) { @@ -2773,6 +2777,18 @@ qemuDomainAttachInputDevice(virQEMUDriverPtr driver, if (qemuBuildInputDevStr(&devstr, vm->def, input, priv->qemuCaps) < 0) goto cleanup; =20 + if (qemuDomainNamespaceSetupInput(vm, input) < 0) + goto cleanup; + teardowndevice =3D true; + + if (qemuSetupInputCgroup(vm, input) < 0) + goto cleanup; + teardowncgroup =3D true; + + if (qemuSecuritySetInputLabel(vm, input) < 0) + goto cleanup; + teardownlabel =3D true; + if (VIR_REALLOC_N(vm->def->inputs, vm->def->ninputs + 1) < 0) goto cleanup; =20 @@ -2788,14 +2804,23 @@ qemuDomainAttachInputDevice(virQEMUDriverPtr driver, VIR_APPEND_ELEMENT_COPY_INPLACE(vm->def->inputs, vm->def->ninputs, inp= ut); =20 ret =3D 0; - releaseaddr =3D false; =20 audit: virDomainAuditInput(vm, input, "attach", ret =3D=3D 0); =20 cleanup: - if (releaseaddr) - qemuDomainReleaseDeviceAddress(vm, &input->info, NULL); + if (ret < 0) { + virErrorPreserveLast(&originalError); + if (teardownlabel) + qemuSecurityRestoreInputLabel(vm, input); + if (teardowncgroup) + qemuTeardownInputCgroup(vm, input); + if (teardowndevice) + qemuDomainNamespaceTeardownInput(vm, input); + if (releaseaddr) + qemuDomainReleaseDeviceAddress(vm, &input->info, NULL); + virErrorRestore(&originalError); + } =20 VIR_FREE(devstr); return ret; @@ -4283,6 +4308,15 @@ qemuDomainRemoveInputDevice(virDomainObjPtr vm, break; } qemuDomainReleaseDeviceAddress(vm, &dev->info, NULL); + if (qemuSecurityRestoreInputLabel(vm, dev) < 0) + VIR_WARN("Unable to restore security label on input device"); + + if (qemuTeardownInputCgroup(vm, dev) < 0) + VIR_WARN("Unable to remove input device cgroup ACL"); + + if (qemuDomainNamespaceTeardownInput(vm, dev) < 0) + VIR_WARN("Unable to remove input device from /dev"); + virDomainInputDefFree(vm->def->inputs[i]); VIR_DELETE_ELEMENT(vm->def->inputs, i, vm->def->ninputs); return 0; --=20 2.13.6 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list