|
 |
9c6c51 |
From a95511a2d1f6be0e63af0dc001a92bcb7869d3f8 Mon Sep 17 00:00:00 2001
|
|
|
9c6c51 |
Message-Id: <a95511a2d1f6be0e63af0dc001a92bcb7869d3f8@dist-git>
|
|
|
9c6c51 |
From: Erik Skultety <eskultet@redhat.com>
|
|
|
9c6c51 |
Date: Fri, 1 Feb 2019 17:21:57 +0100
|
|
|
9c6c51 |
Subject: [PATCH] security: dac: Relabel /dev/sev in the namespace
|
|
|
9c6c51 |
MIME-Version: 1.0
|
|
|
9c6c51 |
Content-Type: text/plain; charset=UTF-8
|
|
|
9c6c51 |
Content-Transfer-Encoding: 8bit
|
|
|
9c6c51 |
|
|
|
9c6c51 |
The default permissions (0600 root:root) are of no use to the qemu
|
|
|
9c6c51 |
process so we need to change the owner to qemu iff running with
|
|
|
9c6c51 |
namespaces.
|
|
|
9c6c51 |
|
|
|
9c6c51 |
Signed-off-by: Erik Skultety <eskultet@redhat.com>
|
|
|
9c6c51 |
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
9c6c51 |
(cherry picked from commit 17f6a257f1ea484489277f4da38be914b246a30b)
|
|
|
9c6c51 |
|
|
|
9c6c51 |
https://bugzilla.redhat.com/show_bug.cgi?id=1665400
|
|
|
9c6c51 |
|
|
|
9c6c51 |
Conflicts:
|
|
|
9c6c51 |
- virSecurityDACSetOwnership's signature had to be adjusted to
|
|
|
9c6c51 |
match the signature of its counterpart in libvirt 4.5.0.
|
|
|
9c6c51 |
|
|
|
9c6c51 |
Signed-off-by: Erik Skultety <eskultet@redhat.com>
|
|
|
9c6c51 |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
9c6c51 |
---
|
|
|
9c6c51 |
src/security/security_dac.c | 51 +++++++++++++++++++++++++++++++++++++
|
|
|
9c6c51 |
1 file changed, 51 insertions(+)
|
|
|
9c6c51 |
|
|
|
9c6c51 |
diff --git a/src/security/security_dac.c b/src/security/security_dac.c
|
|
|
9c6c51 |
index 74c70dd092..cc86060e3f 100644
|
|
|
9c6c51 |
--- a/src/security/security_dac.c
|
|
|
9c6c51 |
+++ b/src/security/security_dac.c
|
|
|
9c6c51 |
@@ -47,6 +47,7 @@
|
|
|
9c6c51 |
VIR_LOG_INIT("security.security_dac");
|
|
|
9c6c51 |
|
|
|
9c6c51 |
#define SECURITY_DAC_NAME "dac"
|
|
|
9c6c51 |
+#define DEV_SEV "/dev/sev"
|
|
|
9c6c51 |
|
|
|
9c6c51 |
typedef struct _virSecurityDACData virSecurityDACData;
|
|
|
9c6c51 |
typedef virSecurityDACData *virSecurityDACDataPtr;
|
|
|
9c6c51 |
@@ -1545,6 +1546,16 @@ virSecurityDACRestoreMemoryLabel(virSecurityManagerPtr mgr,
|
|
|
9c6c51 |
}
|
|
|
9c6c51 |
|
|
|
9c6c51 |
|
|
|
9c6c51 |
+static int
|
|
|
9c6c51 |
+virSecurityDACRestoreSEVLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
|
|
|
9c6c51 |
+ virDomainDefPtr def ATTRIBUTE_UNUSED)
|
|
|
9c6c51 |
+{
|
|
|
9c6c51 |
+ /* we only label /dev/sev when running with namespaces, so we don't need to
|
|
|
9c6c51 |
+ * restore anything */
|
|
|
9c6c51 |
+ return 0;
|
|
|
9c6c51 |
+}
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
static int
|
|
|
9c6c51 |
virSecurityDACRestoreAllLabel(virSecurityManagerPtr mgr,
|
|
|
9c6c51 |
virDomainDefPtr def,
|
|
|
9c6c51 |
@@ -1615,6 +1626,11 @@ virSecurityDACRestoreAllLabel(virSecurityManagerPtr mgr,
|
|
|
9c6c51 |
rc = -1;
|
|
|
9c6c51 |
}
|
|
|
9c6c51 |
|
|
|
9c6c51 |
+ if (def->sev) {
|
|
|
9c6c51 |
+ if (virSecurityDACRestoreSEVLabel(mgr, def) < 0)
|
|
|
9c6c51 |
+ rc = -1;
|
|
|
9c6c51 |
+ }
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
if (def->os.loader && def->os.loader->nvram &&
|
|
|
9c6c51 |
virSecurityDACRestoreFileLabel(priv, def->os.loader->nvram) < 0)
|
|
|
9c6c51 |
rc = -1;
|
|
|
9c6c51 |
@@ -1670,6 +1686,36 @@ virSecurityDACSetMemoryLabel(virSecurityManagerPtr mgr,
|
|
|
9c6c51 |
}
|
|
|
9c6c51 |
|
|
|
9c6c51 |
|
|
|
9c6c51 |
+static int
|
|
|
9c6c51 |
+virSecurityDACSetSEVLabel(virSecurityManagerPtr mgr,
|
|
|
9c6c51 |
+ virDomainDefPtr def)
|
|
|
9c6c51 |
+{
|
|
|
9c6c51 |
+ virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr);
|
|
|
9c6c51 |
+ virSecurityLabelDefPtr seclabel;
|
|
|
9c6c51 |
+ uid_t user;
|
|
|
9c6c51 |
+ gid_t group;
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+ /* Skip chowning /dev/sev if namespaces are disabled as we'd significantly
|
|
|
9c6c51 |
+ * increase the chance of a DOS attack on SEV
|
|
|
9c6c51 |
+ */
|
|
|
9c6c51 |
+ if (!priv->mountNamespace)
|
|
|
9c6c51 |
+ return 0;
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+ seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME);
|
|
|
9c6c51 |
+ if (seclabel && !seclabel->relabel)
|
|
|
9c6c51 |
+ return 0;
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+ if (virSecurityDACGetIds(seclabel, priv, &user, &group, NULL, NULL) < 0)
|
|
|
9c6c51 |
+ return -1;
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+ if (virSecurityDACSetOwnership(priv, NULL, DEV_SEV,
|
|
|
9c6c51 |
+ user, group) < 0)
|
|
|
9c6c51 |
+ return -1;
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+ return 0;
|
|
|
9c6c51 |
+}
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
static int
|
|
|
9c6c51 |
virSecurityDACSetAllLabel(virSecurityManagerPtr mgr,
|
|
|
9c6c51 |
virDomainDefPtr def,
|
|
|
9c6c51 |
@@ -1740,6 +1786,11 @@ virSecurityDACSetAllLabel(virSecurityManagerPtr mgr,
|
|
|
9c6c51 |
return -1;
|
|
|
9c6c51 |
}
|
|
|
9c6c51 |
|
|
|
9c6c51 |
+ if (def->sev) {
|
|
|
9c6c51 |
+ if (virSecurityDACSetSEVLabel(mgr, def) < 0)
|
|
|
9c6c51 |
+ return -1;
|
|
|
9c6c51 |
+ }
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
if (virSecurityDACGetImageIds(secdef, priv, &user, &group))
|
|
|
9c6c51 |
return -1;
|
|
|
9c6c51 |
|
|
|
9c6c51 |
--
|
|
|
9c6c51 |
2.20.1
|
|
|
9c6c51 |
|