shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 21:34:54 +03:00
Code Releases Activity

conf: Don't allow multiple seclabels for same model

Browse Source 
https://bugzilla.redhat.com/show_bug.cgi?id=1066894

With current code it's possible to have for instance:

virsh dumpxml mydomain | grep seclabel
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>

what doesn't make any sense. We should reject the XML in the config
parsing phase.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Michal Privoznik 2014-07-09 15:15:27 +02:00
parent 0b22a16d7e
commit d1abf819cf
3 changed files with 57 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/conf/domain_conf.c
View File

@ -4668,7 +4668,7 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def,
virCapsPtr caps,
unsigned int flags)
{
size_t i = 0;
size_t i = 0, j;
int n;
xmlNodePtr *list = NULL, saved_node;
virCapsHostPtr host = &caps->host;
@ -4689,10 +4689,23 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def,
/* Parse each "seclabel" tag */
for (i = 0; i < n; i++) {
virSecurityLabelDefPtr seclabel;
ctxt->node = list[i];
def->seclabels[i] = virSecurityLabelDefParseXML(ctxt, flags);
if (def->seclabels[i] == NULL)
if (!(seclabel = virSecurityLabelDefParseXML(ctxt, flags)))
goto error;
for (j = 0; j < i; j++) {
if (STREQ_NULLABLE(seclabel->model, def->seclabels[j]->model)) {
virReportError(VIR_ERR_XML_DETAIL,
_("seclablel for model %s is already provided"),
seclabel->model);
virSecurityLabelDefFree(seclabel);
goto error;
}
}
def->seclabels[i] = seclabel;
}
def->nseclabels = n;
ctxt->node = saved_node;

40
tests/qemuxml2argvdata/qemuxml2argv-seclabel-multiple.xml Normal file
View File

@ -0,0 +1,40 @@
<domain type='qemu' id='1'>
<name>QEMUGuest1</name>
<uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
<memory unit='KiB'>219100</memory>
<currentMemory unit='KiB'>219100</currentMemory>
<vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu>
<os>
<type arch='i686' machine='pc'>hvm</type>
<boot dev='hd'/>
</os>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/usr/bin/qemu</emulator>
<disk type='block' device='disk'>
<source dev='/dev/HostVG/QEMUGuest1'>
<seclabel model='selinux' labelskip='yes'/>
</source>
<backingStore/>
<target dev='hda' bus='ide'/>
<address type='drive' controller='0' bus='0' target='0' unit='0'/>
</disk>
<controller type='usb' index='0'/>
<controller type='ide' index='0'/>
<controller type='pci' index='0' model='pci-root'/>
<memballoon model='virtio'/>
</devices>
<seclabel type='none' relabel='no'/>
<seclabel type='dynamic' model='dac' relabel='yes'/>
<seclabel type='static' model='selinux' relabel='yes'>
<label>system_u:system_r:svirt_custom_t:s0:c192,c392</label>
<imagelabel>system_u:system_r:svirt_custom_t:s0:c192,c392</imagelabel>
</seclabel>
<seclabel type='static' model='selinux' relabel='yes'>
<label>system_u:system_r:svirt_custom_t:s0:c192,c393</label>
<imagelabel>system_u:system_r:svirt_custom_t:s0:c192,c393</imagelabel>
</seclabel>
</domain>

1
tests/qemuxml2argvtest.c
View File

@ -1223,6 +1223,7 @@ mymain(void)
DO_TEST("seclabel-static-labelskip", QEMU_CAPS_NAME);
DO_TEST("seclabel-none", QEMU_CAPS_NAME);
DO_TEST("seclabel-dac-none", QEMU_CAPS_NAME);
DO_TEST_PARSE_ERROR("seclabel-multiple", QEMU_CAPS_NAME);
DO_TEST("pseries-basic",
QEMU_CAPS_CHARDEV, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG);