1
0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 21:34:54 +03:00
libvirt/docs/schemas
Eric Blake 0f082e699e selinux: distinguish failure to label from request to avoid label
https://bugzilla.redhat.com/show_bug.cgi?id=924153

Commit 904e05a2 (v0.9.9) added a per-<disk> seclabel element with
an attribute relabel='no' in order to try and minimize the
impact of shutdown delays when an NFS server disappears.  The idea
was that if a disk is on NFS and can't be labeled in the first
place, there is no need to attempt the (no-op) relabel on domain
shutdown.  Unfortunately, the way this was implemented was by
modifying the domain XML so that the optimization would survive
libvirtd restart, but in a way that is indistinguishable from an
explicit user setting.  Furthermore, once the setting is turned
on, libvirt avoids attempts at labeling, even for operations like
snapshot or blockcopy where the chain is being extended or pivoted
onto non-NFS, where SELinux labeling is once again possible.  As
a result, it was impossible to do a blockcopy to pivot from an
NFS image file onto a local file.

The solution is to separate the semantics of a chain that must
not be labeled (which the user can set even on persistent domains)
vs. the optimization of not attempting a relabel on cleanup (a
live-only annotation), and using only the user's explicit notation
rather than the optimization as the decision on whether to skip
a label attempt in the first place.  When upgrading an older
libvirtd to a newer, an NFS volume will still attempt the relabel;
but as the avoidance of a relabel was only an optimization, this
shouldn't cause any problems.

In the ideal future, libvirt will eventually have XML describing
EVERY file in the backing chain, with each file having a separate
<seclabel> element.  At that point, libvirt will be able to track
more closely which files need a relabel attempt at shutdown.  But
until we reach that point, the single <seclabel> for the entire
<disk> chain is treated as a hint - when a chain has only one
file, then we know it is accurate; but if the chain has more than
one file, we have to attempt relabel in spite of the attribute,
in case part of the chain is local and SELinux mattered for that
portion of the chain.

* src/conf/domain_conf.h (_virSecurityDeviceLabelDef): Add new
member.
* src/conf/domain_conf.c (virSecurityDeviceLabelDefParseXML):
Parse it, for live images only.
(virSecurityDeviceLabelDefFormat): Output it.
(virDomainDiskDefParseXML, virDomainChrSourceDefParseXML)
(virDomainDiskSourceDefFormat, virDomainChrDefFormat)
(virDomainDiskDefFormat): Pass flags on through.
* src/security/security_selinux.c
(virSecuritySELinuxRestoreSecurityImageLabelInt): Honor labelskip
when possible.
(virSecuritySELinuxSetSecurityFileLabel): Set labelskip, not
norelabel, if labeling fails.
(virSecuritySELinuxSetFileconHelper): Fix indentation.
* docs/formatdomain.html.in (seclabel): Document new xml.
* docs/schemas/domaincommon.rng (devSeclabel): Allow it in RNG.
* tests/qemuxml2argvdata/qemuxml2argv-seclabel-*-labelskip.xml:
* tests/qemuxml2argvdata/qemuxml2argv-seclabel-*-labelskip.args:
* tests/qemuxml2xmloutdata/qemuxml2xmlout-seclabel-*-labelskip.xml:
New test files.
* tests/qemuxml2argvtest.c (mymain): Run the new tests.
* tests/qemuxml2xmltest.c (mymain): Likewise.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-08-20 10:39:03 -06:00
..
basictypes.rng qemu: Allow the disk wwn to have "0x" prefix 2013-04-17 23:05:56 +08:00
capability.rng qemu: Implement CPUs check against machine type's cpu-max 2013-07-01 14:30:42 +02:00
domain.rng snapshot: update rng to support full domain in xml 2011-09-03 08:12:13 -06:00
domaincommon.rng selinux: distinguish failure to label from request to avoid label 2013-08-20 10:39:03 -06:00
domainsnapshot.rng Add support for storage format in FS <driver> 2013-05-13 13:15:19 +01:00
interface.rng xml: Clean up schemas to use shared data types instead of local 2012-03-08 15:31:54 +01:00
Makefile.am conf: add features to volume target XML 2013-06-21 13:25:30 +02:00
network.rng network: permit upstream forwarding of unqualified DNS names 2013-08-14 09:46:22 -04:00
networkcommon.rng Configure native vlan modes on Open vSwitch ports 2013-06-25 00:22:36 -04:00
nodedev.rng nodedev: add iommuGroup to node device object 2013-06-26 14:10:56 -04:00
nwfilter.rng Correct invalid RNG schemas 2013-03-21 17:24:08 +01:00
secret.rng secret: add iscsi to possible usage types 2013-03-22 12:10:23 +08:00
storageencryption.rng rng: Have colorful *.rng with editor 2013-01-23 23:03:17 +08:00
storagefilefeatures.rng conf: add features to volume target XML 2013-06-21 13:25:30 +02:00
storagepool.rng Make logical pools independent on target path 2013-07-16 12:16:37 +02:00
storagevol.rng conf: add features to volume target XML 2013-06-21 13:25:30 +02:00