|
 |
4372d3 |
From 07fb786e0d17bd395333d276ebbaad42c72ee358 Mon Sep 17 00:00:00 2001
|
|
|
4372d3 |
Message-Id: <07fb786e0d17bd395333d276ebbaad42c72ee358@dist-git>
|
|
|
4372d3 |
From: David Michael <david@bigbadwolfsecurity.com>
|
|
|
4372d3 |
Date: Tue, 28 Jun 2022 08:33:41 -0400
|
|
|
4372d3 |
Subject: [PATCH] security_selinux.c: Relabel existing mode="bind" UNIX sockets
|
|
|
4372d3 |
|
|
|
4372d3 |
This supports sockets created by libvirt and passed by FD using the
|
|
|
4372d3 |
same method as in security_dac.c.
|
|
|
4372d3 |
|
|
|
4372d3 |
Signed-off-by: David Michael <david@bigbadwolfsecurity.com>
|
|
|
4372d3 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
4372d3 |
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
4372d3 |
(cherry picked from commit 9f13f54a6348b54170f7de3595039c99b9da72c7)
|
|
|
4372d3 |
|
|
|
4372d3 |
https://bugzilla.redhat.com/show_bug.cgi?id=2101575
|
|
|
4372d3 |
|
|
|
4372d3 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
4372d3 |
---
|
|
|
4372d3 |
src/security/security_selinux.c | 9 +++++++--
|
|
|
4372d3 |
tests/securityselinuxlabeldata/chardev.txt | 2 +-
|
|
|
4372d3 |
2 files changed, 8 insertions(+), 3 deletions(-)
|
|
|
4372d3 |
|
|
|
4372d3 |
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
|
|
|
4372d3 |
index 0952431064..b90e819fd2 100644
|
|
|
4372d3 |
--- a/src/security/security_selinux.c
|
|
|
4372d3 |
+++ b/src/security/security_selinux.c
|
|
|
4372d3 |
@@ -2545,7 +2545,12 @@ virSecuritySELinuxSetChardevLabel(virSecurityManager *mgr,
|
|
|
4372d3 |
break;
|
|
|
4372d3 |
|
|
|
4372d3 |
case VIR_DOMAIN_CHR_TYPE_UNIX:
|
|
|
4372d3 |
- if (!dev_source->data.nix.listen) {
|
|
|
4372d3 |
+ if (!dev_source->data.nix.listen ||
|
|
|
4372d3 |
+ (dev_source->data.nix.path &&
|
|
|
4372d3 |
+ virFileExists(dev_source->data.nix.path))) {
|
|
|
4372d3 |
+ /* Also label mode='bind' sockets if they exist,
|
|
|
4372d3 |
+ * e.g. because they were created by libvirt
|
|
|
4372d3 |
+ * and passed via FD */
|
|
|
4372d3 |
if (virSecuritySELinuxSetFilecon(mgr,
|
|
|
4372d3 |
dev_source->data.nix.path,
|
|
|
4372d3 |
imagelabel,
|
|
|
4372d3 |
@@ -2622,7 +2627,7 @@ virSecuritySELinuxRestoreChardevLabel(virSecurityManager *mgr,
|
|
|
4372d3 |
case VIR_DOMAIN_CHR_TYPE_UNIX:
|
|
|
4372d3 |
if (!dev_source->data.nix.listen) {
|
|
|
4372d3 |
if (virSecuritySELinuxRestoreFileLabel(mgr,
|
|
|
4372d3 |
- dev_source->data.file.path,
|
|
|
4372d3 |
+ dev_source->data.nix.path,
|
|
|
4372d3 |
true) < 0)
|
|
|
4372d3 |
goto done;
|
|
|
4372d3 |
}
|
|
|
4372d3 |
diff --git a/tests/securityselinuxlabeldata/chardev.txt b/tests/securityselinuxlabeldata/chardev.txt
|
|
|
4372d3 |
index 3f4b6302b9..bdb367f7a5 100644
|
|
|
4372d3 |
--- a/tests/securityselinuxlabeldata/chardev.txt
|
|
|
4372d3 |
+++ b/tests/securityselinuxlabeldata/chardev.txt
|
|
|
4372d3 |
@@ -2,6 +2,6 @@
|
|
|
4372d3 |
/plain.dev;system_u:object_r:svirt_image_t:s0:c41,c264
|
|
|
4372d3 |
/plain.fifo;system_u:object_r:svirt_image_t:s0:c41,c264
|
|
|
4372d3 |
/nolabel.sock;
|
|
|
4372d3 |
-/plain.sock;
|
|
|
4372d3 |
+/plain.sock;system_u:object_r:svirt_image_t:s0:c41,c264
|
|
|
4372d3 |
/yeslabel.sock;system_u:object_r:svirt_image_t:s0:c41,c264
|
|
|
4372d3 |
/altlabel.sock;system_u:object_r:svirt_image_custom_t:s0:c41,c264
|
|
|
4372d3 |
--
|
|
|
4372d3 |
2.35.1
|
|
|
4372d3 |
|