|
 |
c313de |
From dc905fbc1f420a8d7856d9ff7f27b3faae352098 Mon Sep 17 00:00:00 2001
|
|
|
c313de |
Message-Id: <dc905fbc1f420a8d7856d9ff7f27b3faae352098@dist-git>
|
|
|
c313de |
From: Erik Skultety <eskultet@redhat.com>
|
|
|
c313de |
Date: Thu, 3 Jan 2019 10:03:46 +0100
|
|
|
c313de |
Subject: [PATCH] qemu: process: SEV: Relabel guest owner's SEV files created
|
|
|
c313de |
before start
|
|
|
c313de |
|
|
|
c313de |
Before launching a SEV guest we take the base64-encoded guest owner's
|
|
|
c313de |
data specified in launchSecurity and create files with the same content
|
|
|
c313de |
under /var/lib/libvirt/qemu/<domain>. The reason for this is that we
|
|
|
c313de |
need to pass these files on to QEMU which then uses them to communicate
|
|
|
c313de |
with the SEV firmware, except when it doesn't have permissions to open
|
|
|
c313de |
those files since we don't relabel them.
|
|
|
c313de |
|
|
|
c313de |
https://bugzilla.redhat.com/show_bug.cgi?id=1658112
|
|
|
c313de |
|
|
|
c313de |
Signed-off-by: Erik Skultety <eskultet@redhat.com>
|
|
|
c313de |
Acked-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
c313de |
(cherry picked from commit 7dc31fe503e540d5b4ee4f94d61842aa6e302e94)
|
|
|
c313de |
Signed-off-by: Erik Skultety <eskultet@redhat.com>
|
|
|
c313de |
Message-Id: <6bde21a3bda257a042d6f6c1d78ab1bf12c196d3.1546506016.git.eskultet@redhat.com>
|
|
|
c313de |
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c313de |
---
|
|
|
c313de |
src/qemu/qemu_process.c | 4 ++++
|
|
|
c313de |
1 file changed, 4 insertions(+)
|
|
|
c313de |
|
|
|
c313de |
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
|
|
|
c313de |
index 757e2d33a4..bc573f96a4 100644
|
|
|
c313de |
--- a/src/qemu/qemu_process.c
|
|
|
c313de |
+++ b/src/qemu/qemu_process.c
|
|
|
c313de |
@@ -5990,6 +5990,7 @@ qemuProcessSEVCreateFile(virDomainObjPtr vm,
|
|
|
c313de |
const char *data)
|
|
|
c313de |
{
|
|
|
c313de |
qemuDomainObjPrivatePtr priv = vm->privateData;
|
|
|
c313de |
+ virQEMUDriverPtr driver = priv->driver;
|
|
|
c313de |
char *configFile;
|
|
|
c313de |
int ret = -1;
|
|
|
c313de |
|
|
|
c313de |
@@ -6002,6 +6003,9 @@ qemuProcessSEVCreateFile(virDomainObjPtr vm,
|
|
|
c313de |
goto cleanup;
|
|
|
c313de |
}
|
|
|
c313de |
|
|
|
c313de |
+ if (qemuSecurityDomainSetPathLabel(driver, vm, configFile, true) < 0)
|
|
|
c313de |
+ goto cleanup;
|
|
|
c313de |
+
|
|
|
c313de |
ret = 0;
|
|
|
c313de |
cleanup:
|
|
|
c313de |
VIR_FREE(configFile);
|
|
|
c313de |
--
|
|
|
c313de |
2.22.0
|
|
|
c313de |
|