|
 |
9119d9 |
From bac831a6f6cba82adec7419dfdd1124a241a3c3e Mon Sep 17 00:00:00 2001
|
|
|
9119d9 |
Message-Id: <bac831a6f6cba82adec7419dfdd1124a241a3c3e@dist-git>
|
|
|
9119d9 |
From: Cole Robinson <crobinso@redhat.com>
|
|
|
9119d9 |
Date: Thu, 25 Sep 2014 11:21:46 -0400
|
|
|
9119d9 |
Subject: [PATCH] security: Fix labelling host devices
|
|
|
9119d9 |
|
|
|
9119d9 |
https://bugzilla.redhat.com/show_bug.cgi?id=1146550
|
|
|
9119d9 |
|
|
|
9119d9 |
The check for ISCSI devices was missing a check of subsys type, which
|
|
|
9119d9 |
meant we could skip labelling of other host devices as well. This fixes
|
|
|
9119d9 |
USB hotplug.
|
|
|
9119d9 |
|
|
|
9119d9 |
(cherry picked from commit d3489548b52083d7b4ff757e727a7a9471e1fe4f)
|
|
|
9119d9 |
Signed-off-by: John Ferlan <jferlan@redhat.com>
|
|
|
9119d9 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
9119d9 |
---
|
|
|
9119d9 |
src/security/security_apparmor.c | 3 ++-
|
|
|
9119d9 |
src/security/security_dac.c | 6 ++++--
|
|
|
9119d9 |
src/security/security_selinux.c | 6 ++++--
|
|
|
9119d9 |
3 files changed, 10 insertions(+), 5 deletions(-)
|
|
|
9119d9 |
|
|
|
9119d9 |
diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
|
|
|
9119d9 |
index 041ce65..3025284 100644
|
|
|
9119d9 |
--- a/src/security/security_apparmor.c
|
|
|
9119d9 |
+++ b/src/security/security_apparmor.c
|
|
|
9119d9 |
@@ -828,7 +828,8 @@ AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
|
|
|
9119d9 |
/* Like AppArmorRestoreSecurityImageLabel() for a networked disk,
|
|
|
9119d9 |
* do nothing for an iSCSI hostdev
|
|
|
9119d9 |
*/
|
|
|
9119d9 |
- if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
+ if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
|
|
9119d9 |
+ scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
return 0;
|
|
|
9119d9 |
|
|
|
9119d9 |
if (profile_loaded(secdef->imagelabel) < 0)
|
|
|
9119d9 |
diff --git a/src/security/security_dac.c b/src/security/security_dac.c
|
|
|
9119d9 |
index e398d2c..85253af 100644
|
|
|
9119d9 |
--- a/src/security/security_dac.c
|
|
|
9119d9 |
+++ b/src/security/security_dac.c
|
|
|
9119d9 |
@@ -523,7 +523,8 @@ virSecurityDACSetSecurityHostdevLabel(virSecurityManagerPtr mgr,
|
|
|
9119d9 |
/* Like virSecurityDACSetSecurityImageLabel() for a networked disk,
|
|
|
9119d9 |
* do nothing for an iSCSI hostdev
|
|
|
9119d9 |
*/
|
|
|
9119d9 |
- if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
+ if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
|
|
9119d9 |
+ scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
return 0;
|
|
|
9119d9 |
|
|
|
9119d9 |
cbdata.manager = mgr;
|
|
|
9119d9 |
@@ -657,7 +658,8 @@ virSecurityDACRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr,
|
|
|
9119d9 |
/* Like virSecurityDACRestoreSecurityImageLabelInt() for a networked disk,
|
|
|
9119d9 |
* do nothing for an iSCSI hostdev
|
|
|
9119d9 |
*/
|
|
|
9119d9 |
- if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
+ if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
|
|
9119d9 |
+ scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
return 0;
|
|
|
9119d9 |
|
|
|
9119d9 |
switch ((virDomainHostdevSubsysType) dev->source.subsys.type) {
|
|
|
9119d9 |
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
|
|
|
9119d9 |
index 1c9150b..85ad073 100644
|
|
|
9119d9 |
--- a/src/security/security_selinux.c
|
|
|
9119d9 |
+++ b/src/security/security_selinux.c
|
|
|
9119d9 |
@@ -1327,7 +1327,8 @@ virSecuritySELinuxSetSecurityHostdevSubsysLabel(virDomainDefPtr def,
|
|
|
9119d9 |
/* Like virSecuritySELinuxSetSecurityImageLabelInternal() for a networked
|
|
|
9119d9 |
* disk, do nothing for an iSCSI hostdev
|
|
|
9119d9 |
*/
|
|
|
9119d9 |
- if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
+ if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
|
|
9119d9 |
+ scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
return 0;
|
|
|
9119d9 |
|
|
|
9119d9 |
switch (dev->source.subsys.type) {
|
|
|
9119d9 |
@@ -1520,7 +1521,8 @@ virSecuritySELinuxRestoreSecurityHostdevSubsysLabel(virSecurityManagerPtr mgr,
|
|
|
9119d9 |
/* Like virSecuritySELinuxRestoreSecurityImageLabelInt() for a networked
|
|
|
9119d9 |
* disk, do nothing for an iSCSI hostdev
|
|
|
9119d9 |
*/
|
|
|
9119d9 |
- if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
+ if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI &&
|
|
|
9119d9 |
+ scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
|
|
|
9119d9 |
return 0;
|
|
|
9119d9 |
|
|
|
9119d9 |
switch (dev->source.subsys.type) {
|
|
|
9119d9 |
--
|
|
|
9119d9 |
2.1.1
|
|
|
9119d9 |
|