mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-25 01:34:11 +03:00
conf: Reject invalid device's <seclabel relabel='yes'/> with no <label/>
We allow (some) domain devices to have a different <seclabel/> than the top level domain one (this is mostly to allow access to a resource for multiple domains). Now, we do couple of sanity checks for such <seclabel/>, e.g. when the <label/> is specified, but '@relabel' is set to no. But what we are missing is the opposite: when '@relabel' is set, but no <label/> was provided. Our schema already denies such combination. Make our parser behave the same. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2160356 Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
parent
68545ed21b
commit
a36318be9d
@ -6910,6 +6910,7 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceLabelDef ***seclabels_rtn,
|
||||
for (i = 0; i < n; i++) {
|
||||
g_autofree char *model = NULL;
|
||||
g_autofree char *label = NULL;
|
||||
int relabelSpecified;
|
||||
virTristateBool t;
|
||||
|
||||
/* get model associated to this override */
|
||||
@ -6926,7 +6927,9 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceLabelDef ***seclabels_rtn,
|
||||
seclabels[i]->model = g_steal_pointer(&model);
|
||||
}
|
||||
|
||||
if (virXMLPropTristateBool(list[i], "relabel", VIR_XML_PROP_NONE, &t) < 0)
|
||||
relabelSpecified = virXMLPropTristateBool(list[i], "relabel",
|
||||
VIR_XML_PROP_NONE, &t);
|
||||
if (relabelSpecified < 0)
|
||||
goto error;
|
||||
|
||||
seclabels[i]->relabel = true;
|
||||
@ -6953,6 +6956,15 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceLabelDef ***seclabels_rtn,
|
||||
NULLSTR(seclabels[i]->model));
|
||||
goto error;
|
||||
}
|
||||
|
||||
if (relabelSpecified > 0 &&
|
||||
flags & VIR_DOMAIN_DEF_PARSE_INACTIVE &&
|
||||
seclabels[i]->relabel && !seclabels[i]->label) {
|
||||
virReportError(VIR_ERR_XML_ERROR,
|
||||
_("Cannot specify relabel if label is missing. model=%1$s"),
|
||||
NULLSTR(seclabels[i]->model));
|
||||
goto error;
|
||||
}
|
||||
}
|
||||
|
||||
*nseclabels_rtn = nseclabels;
|
||||
|
@ -0,0 +1 @@
|
||||
XML error: Cannot specify relabel if label is missing. model=selinux
|
35
tests/qemuxml2argvdata/seclabel-device-relabel-invalid.xml
Normal file
35
tests/qemuxml2argvdata/seclabel-device-relabel-invalid.xml
Normal file
@ -0,0 +1,35 @@
|
||||
<domain type='qemu'>
|
||||
<name>QEMUGuest1</name>
|
||||
<uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
|
||||
<memory unit='KiB'>219100</memory>
|
||||
<currentMemory unit='KiB'>219100</currentMemory>
|
||||
<vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu>
|
||||
<os>
|
||||
<type arch='i686' machine='pc'>hvm</type>
|
||||
<boot dev='hd'/>
|
||||
</os>
|
||||
<clock offset='utc'/>
|
||||
<on_poweroff>destroy</on_poweroff>
|
||||
<on_reboot>restart</on_reboot>
|
||||
<on_crash>destroy</on_crash>
|
||||
<devices>
|
||||
<emulator>/usr/bin/qemu-system-i386</emulator>
|
||||
<disk type='block' device='disk'>
|
||||
<source dev='/dev/HostVG/QEMUGuest1'>
|
||||
<seclabel model='dac' relabel='no'/>
|
||||
<seclabel model='selinux' relabel='yes'/>
|
||||
</source>
|
||||
<target dev='hda' bus='ide'/>
|
||||
<address type='drive' controller='0' bus='0' target='0' unit='0'/>
|
||||
</disk>
|
||||
<controller type='usb' index='0'/>
|
||||
<controller type='ide' index='0'/>
|
||||
<controller type='pci' index='0' model='pci-root'/>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
<input type='keyboard' bus='ps2'/>
|
||||
<memballoon model='virtio'/>
|
||||
</devices>
|
||||
<seclabel type='static' model='selinux' relabel='no'>
|
||||
<label>system_u:system_r:svirt_custom_t:s0:c192,c392</label>
|
||||
</seclabel>
|
||||
</domain>
|
@ -1913,6 +1913,7 @@ mymain(void)
|
||||
DO_TEST_NOCAPS("seclabel-dac-none");
|
||||
DO_TEST_PARSE_ERROR_NOCAPS("seclabel-multiple");
|
||||
DO_TEST_PARSE_ERROR_NOCAPS("seclabel-device-duplicates");
|
||||
DO_TEST_PARSE_ERROR_NOCAPS("seclabel-device-relabel-invalid");
|
||||
|
||||
DO_TEST_CAPS_LATEST_PPC64("pseries-basic");
|
||||
DO_TEST_CAPS_LATEST_PPC64("pseries-vio");
|
||||
|
Loading…
Reference in New Issue
Block a user