|
 |
acda74 |
From accd96c210d9c45ec9bae0d9259cf713eb574d52 Mon Sep 17 00:00:00 2001
|
|
|
acda74 |
Message-Id: <accd96c210d9c45ec9bae0d9259cf713eb574d52@dist-git>
|
|
|
acda74 |
From: Laine Stump <laine@redhat.com>
|
|
|
acda74 |
Date: Wed, 1 Mar 2023 15:58:24 -0500
|
|
|
acda74 |
Subject: [PATCH] qemu: set SELinux label of passt process to its own binary's
|
|
|
acda74 |
label
|
|
|
acda74 |
|
|
|
acda74 |
set useBinarySpecificLabel = true when calling qemuSecurityCommandRun
|
|
|
acda74 |
for the passt process, so that the new process context will include
|
|
|
acda74 |
the binary-specific label that should be used for passt (passt_t)
|
|
|
acda74 |
rather than svirt_t (as would happen if useBinarySpecificLabel was
|
|
|
acda74 |
false). (The MCS part of the label, which is common to all child
|
|
|
acda74 |
processes related to a particular qemu domain instance, is also set).
|
|
|
acda74 |
|
|
|
acda74 |
Resolves: https://bugzilla.redhat.com/2172267
|
|
|
acda74 |
Signed-off-by: Laine Stump <laine@redhat.com>
|
|
|
acda74 |
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
|
|
|
acda74 |
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
acda74 |
(cherry picked from commit 8419dd3b69cfada783a2e6df315e45dd294b0d18)
|
|
|
acda74 |
|
|
|
acda74 |
Conflicts:
|
|
|
acda74 |
src/qemu/qemu_passt.c
|
|
|
acda74 |
|
|
|
acda74 |
Another conflict caused by upstream-only change to arglist of
|
|
|
acda74 |
qemuSecurityCommandRun().
|
|
|
acda74 |
|
|
|
acda74 |
https://bugzilla.redhat.com/2172267
|
|
|
acda74 |
Signed-off-by: Laine Stump <laine@redhat.com>
|
|
|
acda74 |
---
|
|
|
acda74 |
src/qemu/qemu_passt.c | 2 +-
|
|
|
acda74 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
acda74 |
|
|
|
acda74 |
diff --git a/src/qemu/qemu_passt.c b/src/qemu/qemu_passt.c
|
|
|
acda74 |
index ed7b518212..ecf1c8cb6c 100644
|
|
|
acda74 |
--- a/src/qemu/qemu_passt.c
|
|
|
acda74 |
+++ b/src/qemu/qemu_passt.c
|
|
|
acda74 |
@@ -285,7 +285,7 @@ qemuPasstStart(virDomainObj *vm,
|
|
|
acda74 |
if (qemuExtDeviceLogCommand(driver, vm, cmd, "passt") < 0)
|
|
|
acda74 |
return -1;
|
|
|
acda74 |
|
|
|
acda74 |
- if (qemuSecurityCommandRun(driver, vm, cmd, -1, -1, false,
|
|
|
acda74 |
+ if (qemuSecurityCommandRun(driver, vm, cmd, -1, -1, true,
|
|
|
acda74 |
&exitstatus, &cmdret) < 0) {
|
|
|
acda74 |
goto error;
|
|
|
acda74 |
}
|
|
|
acda74 |
--
|
|
|
acda74 |
2.40.0
|
|
|
acda74 |
|