274 lines
8.3 KiB
Diff
274 lines
8.3 KiB
Diff
>From e2ebe4b785eccb930f36f400a22940fa9660a24b Mon Sep 17 00:00:00 2001
|
|
From: Daniel P. Berrange <berrange@redhat.com>
|
|
Date: Tue, 15 Jun 2010 16:40:47 +0100
|
|
Subject: [PATCH 06/10] Convert all disk backing store loops to shared helper API
|
|
|
|
Update the QEMU cgroups code, QEMU DAC security driver, SELinux
|
|
and AppArmour security drivers over to use the shared helper API
|
|
virDomainDiskDefForeachPath().
|
|
|
|
* src/qemu/qemu_driver.c, src/qemu/qemu_security_dac.c,
|
|
src/security/security_selinux.c, src/security/virt-aa-helper.c:
|
|
Convert over to use virDomainDiskDefForeachPath()
|
|
---
|
|
src/qemu/qemu_driver.c | 161 ++++++++++++++++----------------------
|
|
src/qemu/qemu_security_dac.c | 47 ++++--------
|
|
src/security/security_selinux.c | 67 +++++++----------
|
|
src/security/virt-aa-helper.c | 71 ++++++++----------
|
|
4 files changed, 142 insertions(+), 204 deletions(-)
|
|
|
|
Index: libvirt-0.8.1/src/qemu/qemu_security_dac.c
|
|
===================================================================
|
|
--- libvirt-0.8.1.orig/src/qemu/qemu_security_dac.c
|
|
+++ libvirt-0.8.1/src/qemu/qemu_security_dac.c
|
|
@@ -99,47 +99,28 @@ err:
|
|
|
|
|
|
static int
|
|
+qemuSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED,
|
|
+ const char *path,
|
|
+ unsigned int depth ATTRIBUTE_UNUSED,
|
|
+ void *opaque ATTRIBUTE_UNUSED)
|
|
+{
|
|
+ return qemuSecurityDACSetOwnership(path, driver->user, driver->group);
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
qemuSecurityDACSetSecurityImageLabel(virDomainObjPtr vm ATTRIBUTE_UNUSED,
|
|
virDomainDiskDefPtr disk)
|
|
|
|
{
|
|
- const char *path;
|
|
-
|
|
if (!driver->privileged || !driver->dynamicOwnership)
|
|
return 0;
|
|
|
|
- if (!disk->src)
|
|
- return 0;
|
|
-
|
|
- path = disk->src;
|
|
- do {
|
|
- virStorageFileMetadata meta;
|
|
- int ret;
|
|
-
|
|
- memset(&meta, 0, sizeof(meta));
|
|
-
|
|
- ret = virStorageFileGetMetadata(path,
|
|
- VIR_STORAGE_FILE_AUTO,
|
|
- &meta);
|
|
-
|
|
- if (path != disk->src)
|
|
- VIR_FREE(path);
|
|
- path = NULL;
|
|
-
|
|
- if (ret < 0)
|
|
- return -1;
|
|
-
|
|
- if (meta.backingStore != NULL &&
|
|
- qemuSecurityDACSetOwnership(meta.backingStore,
|
|
- driver->user, driver->group) < 0) {
|
|
- VIR_FREE(meta.backingStore);
|
|
- return -1;
|
|
- }
|
|
-
|
|
- path = meta.backingStore;
|
|
- } while (path != NULL);
|
|
-
|
|
- return qemuSecurityDACSetOwnership(disk->src, driver->user, driver->group);
|
|
+ return virDomainDiskDefForeachPath(disk,
|
|
+ true,
|
|
+ false,
|
|
+ qemuSecurityDACSetSecurityFileLabel,
|
|
+ NULL);
|
|
}
|
|
|
|
|
|
Index: libvirt-0.8.1/src/security/security_selinux.c
|
|
===================================================================
|
|
--- libvirt-0.8.1.orig/src/security/security_selinux.c
|
|
+++ libvirt-0.8.1/src/security/security_selinux.c
|
|
@@ -411,56 +411,43 @@ SELinuxRestoreSecurityImageLabel(virDoma
|
|
}
|
|
|
|
static int
|
|
+SELinuxSetSecurityFileLabel(virDomainDiskDefPtr disk,
|
|
+ const char *path,
|
|
+ unsigned int depth,
|
|
+ void *opaque)
|
|
+{
|
|
+ const virSecurityLabelDefPtr secdef = opaque;
|
|
+
|
|
+ if (depth == 0) {
|
|
+ if (disk->shared) {
|
|
+ return SELinuxSetFilecon(path, default_image_context);
|
|
+ } else if (disk->readonly) {
|
|
+ return SELinuxSetFilecon(path, default_content_context);
|
|
+ } else if (secdef->imagelabel) {
|
|
+ return SELinuxSetFilecon(path, secdef->imagelabel);
|
|
+ } else {
|
|
+ return 0;
|
|
+ }
|
|
+ } else {
|
|
+ return SELinuxSetFilecon(path, default_content_context);
|
|
+ }
|
|
+}
|
|
+
|
|
+static int
|
|
SELinuxSetSecurityImageLabel(virDomainObjPtr vm,
|
|
virDomainDiskDefPtr disk)
|
|
|
|
{
|
|
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
|
|
- const char *path;
|
|
|
|
if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC)
|
|
return 0;
|
|
|
|
- if (!disk->src)
|
|
- return 0;
|
|
-
|
|
- path = disk->src;
|
|
- do {
|
|
- virStorageFileMetadata meta;
|
|
- int ret;
|
|
-
|
|
- memset(&meta, 0, sizeof(meta));
|
|
-
|
|
- ret = virStorageFileGetMetadata(path,
|
|
- VIR_STORAGE_FILE_AUTO,
|
|
- &meta);
|
|
-
|
|
- if (path != disk->src)
|
|
- VIR_FREE(path);
|
|
- path = NULL;
|
|
-
|
|
- if (ret < 0)
|
|
- break;
|
|
-
|
|
- if (meta.backingStore != NULL &&
|
|
- SELinuxSetFilecon(meta.backingStore,
|
|
- default_content_context) < 0) {
|
|
- VIR_FREE(meta.backingStore);
|
|
- return -1;
|
|
- }
|
|
-
|
|
- path = meta.backingStore;
|
|
- } while (path != NULL);
|
|
-
|
|
- if (disk->shared) {
|
|
- return SELinuxSetFilecon(disk->src, default_image_context);
|
|
- } else if (disk->readonly) {
|
|
- return SELinuxSetFilecon(disk->src, default_content_context);
|
|
- } else if (secdef->imagelabel) {
|
|
- return SELinuxSetFilecon(disk->src, secdef->imagelabel);
|
|
- }
|
|
-
|
|
- return 0;
|
|
+ return virDomainDiskDefForeachPath(disk,
|
|
+ true,
|
|
+ false,
|
|
+ SELinuxSetSecurityFileLabel,
|
|
+ secdef);
|
|
}
|
|
|
|
|
|
Index: libvirt-0.8.1/src/security/virt-aa-helper.c
|
|
===================================================================
|
|
--- libvirt-0.8.1.orig/src/security/virt-aa-helper.c
|
|
+++ libvirt-0.8.1/src/security/virt-aa-helper.c
|
|
@@ -36,7 +36,6 @@
|
|
#include "uuid.h"
|
|
#include "hostusb.h"
|
|
#include "pci.h"
|
|
-#include "storage_file.h"
|
|
|
|
static char *progname;
|
|
|
|
@@ -802,6 +801,28 @@ file_iterate_pci_cb(pciDevice *dev ATTRI
|
|
}
|
|
|
|
static int
|
|
+add_file_path(virDomainDiskDefPtr disk,
|
|
+ const char *path,
|
|
+ unsigned int depth,
|
|
+ void *opaque)
|
|
+{
|
|
+ virBufferPtr buf = opaque;
|
|
+ int ret;
|
|
+
|
|
+ if (depth == 0) {
|
|
+ if (disk->readonly)
|
|
+ ret = vah_add_file(buf, path, "r");
|
|
+ else
|
|
+ ret = vah_add_file(buf, path, "rw");
|
|
+ } else {
|
|
+ ret = vah_add_file(buf, path, "r");
|
|
+ }
|
|
+
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
get_files(vahControl * ctl)
|
|
{
|
|
virBuffer buf = VIR_BUFFER_INITIALIZER;
|
|
@@ -822,47 +843,15 @@ get_files(vahControl * ctl)
|
|
goto clean;
|
|
}
|
|
|
|
- for (i = 0; i < ctl->def->ndisks; i++)
|
|
- if (ctl->def->disks[i] && ctl->def->disks[i]->src) {
|
|
- int ret;
|
|
- const char *path;
|
|
-
|
|
- path = ctl->def->disks[i]->src;
|
|
- do {
|
|
- virStorageFileMetadata meta;
|
|
-
|
|
- memset(&meta, 0, sizeof(meta));
|
|
-
|
|
- ret = virStorageFileGetMetadata(path,
|
|
- VIR_STORAGE_FILE_AUTO,
|
|
- &meta);
|
|
-
|
|
- if (path != ctl->def->disks[i]->src)
|
|
- VIR_FREE(path);
|
|
- path = NULL;
|
|
-
|
|
- if (ret < 0) {
|
|
- vah_warning("could not open path, skipping");
|
|
- continue;
|
|
- }
|
|
-
|
|
- if (meta.backingStore != NULL &&
|
|
- (ret = vah_add_file(&buf, meta.backingStore, "rw")) != 0) {
|
|
- VIR_FREE(meta.backingStore);
|
|
- goto clean;
|
|
- }
|
|
-
|
|
- path = meta.backingStore;
|
|
- } while (path != NULL);
|
|
-
|
|
- if (ctl->def->disks[i]->readonly)
|
|
- ret = vah_add_file(&buf, ctl->def->disks[i]->src, "r");
|
|
- else
|
|
- ret = vah_add_file(&buf, ctl->def->disks[i]->src, "rw");
|
|
-
|
|
- if (ret != 0)
|
|
- goto clean;
|
|
- }
|
|
+ for (i = 0; i < ctl->def->ndisks; i++) {
|
|
+ int ret = virDomainDiskDefForeachPath(ctl->def->disks[i],
|
|
+ true,
|
|
+ false,
|
|
+ add_file_path,
|
|
+ &buf);
|
|
+ if (ret != 0)
|
|
+ goto clean;
|
|
+ }
|
|
|
|
for (i = 0; i < ctl->def->nserials; i++)
|
|
if (ctl->def->serials[i] && ctl->def->serials[i]->data.file.path)
|