1
0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 17:34:18 +03:00
libvirt/run.in
Michal Privoznik 4381b83d99 run.in: Detect binaries in builddir properly
When attempting to run:

  libvirt.git/_build # ./run --selinux ./src/libvirtd

the following error is thrown:

  Refusing to change selinux context of file './src/libvirtd' outside build directory

which is obviously wrong. The problem is 'being inside of build
directory' is detected by simple progpath.startswith(builddir).
While builddir is an absolute path, progpath isn't necessarily.

And while looking into the code, I've noticed chcon() function
accessing variable outside its scope when printing out the path
it's working on.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2024-06-04 14:39:00 +02:00

247 lines
7.9 KiB
Python

#!/usr/bin/env python3
# libvirt 'run' programs locally script
# Copyright (C) 2012-2021 Red Hat, Inc.
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; If not, see
# <http://www.gnu.org/licenses/>.
# ----------------------------------------------------------------------
#
# With this script you can run libvirt programs without needing to
# install them first. You just have to do for example:
#
# ./run virsh [args ...]
#
# Note that this runs the locally compiled copy of virsh which
# is usually want you want.
#
# You can also run the C programs under valgrind like this:
#
# ./run valgrind [valgrind opts...] ./program
#
# or under gdb:
#
# ./run gdb --args ./program
#
# This also works with sudo (eg. if you need root access for libvirt):
#
# sudo ./run virsh list --all
#
# ----------------------------------------------------------------------
import argparse
import os
import os.path
import random
import shutil
import signal
import subprocess
import sys
# Function to intelligently prepend a path to an environment variable.
# See https://stackoverflow.com/a/9631350
def prepend(env, varname, extradir):
if varname in os.environ:
env[varname] = extradir + ":" + env[varname]
else:
env[varname] = extradir
here = "@abs_builddir@"
parser = argparse.ArgumentParser(add_help=False, allow_abbrev=False)
parser.add_argument('--selinux',
action='store_true',
help='Run in the appropriate selinux context')
opts, args = parser.parse_known_args()
if len(args) < 1:
print("syntax: %s [--selinux] BINARY [ARGS...]" % sys.argv[0], file=sys.stderr)
sys.exit(1)
prog = args[0]
env = os.environ
prepend(env, "LD_LIBRARY_PATH", os.path.join(here, "src"))
prepend(env, "PKG_CONFIG_PATH", os.path.join(here, "src"))
prepend(env, "PATH", os.path.join(here, "tools"))
prepend(env, "PATH", os.path.join(here, "src"))
# Ensure that any 3rd party apps using libvirt.so from the build tree get
# files resolved to the build/source tree too. Typically useful for language
# bindings running tests against non-installed libvirt.
env["LIBVIRT_DIR_OVERRIDE"] = "1"
# This is a cheap way to find some use-after-free and uninitialized
# read problems when using glibc.
env["MALLOC_PERTURB_"] = "%d" % random.randint(1, 255)
env["abs_builddir"] = "@abs_builddir@"
env["abs_top_builddir"] = "@abs_top_builddir@"
modular_daemons = [
"virtinterfaced",
"virtlxcd",
"virtnetworkd",
"virtnodedevd",
"virtnwfilterd",
"virtproxyd",
"virtqemud",
"virtsecretd",
"virtstoraged",
"virtvboxd",
"virtvzd",
"virtxend",
]
def is_modular_daemon(name):
return name in modular_daemons
def is_monolithic_daemon(name):
return name == "libvirtd"
def is_systemd_host():
if os.getuid() != 0:
return False
return os.path.exists("/run/systemd/system")
def daemon_units(name):
return [name + suffix for suffix in [
".service", ".socket", "-ro.socket", "-admin.socket"]]
def is_unit_active(name):
ret = subprocess.call(["systemctl", "is-active", "-q", name])
return ret == 0
def change_unit(name, action):
ret = subprocess.call(["systemctl", action, "-q", name])
return ret == 0
def chcon(path, user, role, type):
print("Setting file context of {} to u={}, r={}, t={}...".format(path,
user,
role,
type))
ret = subprocess.call(["chcon", "-u", user, "-r", role, "-t", type, path])
return ret == 0
def restorecon(path):
print("Restoring selinux context for {}...".format(path))
ret = subprocess.call(["restorecon", path])
return ret == 0
try_stop_units = []
if is_systemd_host():
maybe_stopped_units = []
for arg in args:
name = os.path.basename(arg)
if is_modular_daemon(name):
# Only need to stop libvirtd or this specific modular unit
maybe_stopped_units += daemon_units("libvirtd")
maybe_stopped_units += daemon_units(name)
elif is_monolithic_daemon(name):
# Need to stop libvirtd and/or all modular units
maybe_stopped_units += daemon_units("libvirtd")
for entry in modular_daemons:
maybe_stopped_units += daemon_units(entry)
for unit in maybe_stopped_units:
if is_unit_active(unit):
try_stop_units.append(unit)
if len(try_stop_units) == 0 and not opts.selinux:
# Run the program directly, replacing ourselves
os.execvpe(prog, args, env)
else:
stopped_units = []
def sighandler(signum, frame):
raise OSError("Signal %d received, terminating" % signum)
signal.signal(signal.SIGHUP, sighandler)
signal.signal(signal.SIGTERM, sighandler)
signal.signal(signal.SIGQUIT, sighandler)
try:
dorestorecon = False
progpath = shutil.which(prog)
if not progpath:
raise Exception("Can't find executable {}"
.format(prog))
progpath = os.path.abspath(progpath)
if len(try_stop_units):
print("Temporarily stopping systemd units...")
for unit in try_stop_units:
print(" > %s" % unit)
if not change_unit(unit, "stop"):
raise Exception("Unable to stop '%s'" % unit)
stopped_units.append(unit)
if opts.selinux:
# if using a wrapper command like 'gdb', setting the selinux
# context won't work because the wrapper command will not be a
# valid entrypoint for the virtd_t context
if os.path.basename(prog) not in ["libvirtd", *modular_daemons]:
raise Exception("'{}' is not recognized as a valid daemon. "
"Selinux process context can only be set when "
"executing a daemon directly without wrapper "
"commands".format(prog))
if not progpath.startswith(os.path.abspath(here)):
raise Exception("Refusing to change selinux context of file "
"'{}' outside build directory"
.format(progpath))
# selinux won't allow us to transition to the virtd_t context from
# e.g. the user_home_t context (the likely label of the local
# executable file)
if not chcon(progpath, "system_u", "object_r", "virtd_exec_t"):
raise Exception("Failed to change selinux context of binary")
dorestorecon = True
args = ['runcon',
'-u', 'system_u',
'-r', 'system_r',
'-t', 'virtd_t', *args]
print("Running '%s'..." % str(" ".join(args)))
ret = subprocess.call(args, env=env)
except KeyboardInterrupt:
pass
except Exception as e:
print("%s" % e, file=sys.stderr)
finally:
if len(stopped_units):
print("Re-starting original systemd units...")
stopped_units.reverse()
for unit in stopped_units:
print(" > %s" % unit)
if not change_unit(unit, "start"):
print(" ! unable to restart %s" % unit, file=sys.stderr)
if dorestorecon:
restorecon(progpath)