edecca
From d81bacdc16215d7cf0d175187f1d342e1081cf33 Mon Sep 17 00:00:00 2001
edecca
Message-Id: <d81bacdc16215d7cf0d175187f1d342e1081cf33@dist-git>
edecca
From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
edecca
Date: Tue, 2 Oct 2018 14:00:41 +0200
edecca
Subject: [PATCH] security: dac: also label listen UNIX sockets
edecca
MIME-Version: 1.0
edecca
Content-Type: text/plain; charset=UTF-8
edecca
Content-Transfer-Encoding: 8bit
edecca
edecca
We switched to opening mode='bind' sockets ourselves:
edecca
commit 30fb2276d88b275dc2aad6ddd28c100d944b59a5
edecca
    qemu: support passing pre-opened UNIX socket listen FD
edecca
in v4.5.0-rc1~251
edecca
edecca
Then fixed qemuBuildChrChardevStr to change libvirtd's label
edecca
while creating the socket:
edecca
commit b0c6300fc42bbc3e5eb0b236392f7344581c5810
edecca
    qemu: ensure FDs passed to QEMU for chardevs have correct SELinux labels
edecca
v4.5.0-rc1~52
edecca
edecca
Also add labeling of these sockets to the DAC driver.
edecca
Instead of duplicating the logic which decides whether libvirt should
edecca
pre-create the socket, assume an existing path meaning that it was created
edecca
by libvirt.
edecca
edecca
https://bugzilla.redhat.com/show_bug.cgi?id=1633389
edecca
edecca
Signed-off-by: Ján Tomko <jtomko@redhat.com>
edecca
Reviewed-by: Erik Skultety <eskultet@redhat.com>
edecca
(cherry picked from commit d6b8838dd83697f721fe0706068df765148154de)
edecca
Signed-off-by: Ján Tomko <jtomko@redhat.com>
edecca
edecca
RHEL 8.0: https://bugzilla.redhat.com/show_bug.cgi?id=1634775
edecca
edecca
Conflicts: src/security/security_dac.c
edecca
    commit 3ac7793ad1ae0f4dc7b7ddbcfd182d5ff0b45538
edecca
      security_dac: Pass virSecurityManagerPtr to virSecurityDACSetOwnership
edecca
    is not backported
edecca
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
edecca
---
edecca
 src/security/security_dac.c | 7 ++++++-
edecca
 1 file changed, 6 insertions(+), 1 deletion(-)
edecca
edecca
diff --git a/src/security/security_dac.c b/src/security/security_dac.c
edecca
index 4b623dcf39..74c70dd092 100644
edecca
--- a/src/security/security_dac.c
edecca
+++ b/src/security/security_dac.c
edecca
@@ -1248,7 +1248,12 @@ virSecurityDACSetChardevLabel(virSecurityManagerPtr mgr,
edecca
         break;
edecca
 
edecca
     case VIR_DOMAIN_CHR_TYPE_UNIX:
edecca
-        if (!dev_source->data.nix.listen) {
edecca
+        if (!dev_source->data.nix.listen ||
edecca
+            (dev_source->data.nix.path &&
edecca
+             virFileExists(dev_source->data.nix.path))) {
edecca
+            /* Also label mode='bind' sockets if they exist,
edecca
+             * e.g. because they were created by libvirt
edecca
+             * and passed via FD */
edecca
             if (virSecurityDACSetOwnership(priv, NULL,
edecca
                                            dev_source->data.nix.path,
edecca
                                            user, group) < 0)
edecca
-- 
edecca
2.19.1
edecca