Re: [libvirt] [PATCH v2 11/18] security_selinux: Track if transaction is restore

[Daniel P . Berrangé]

On Thu, Nov 29, 2018 at 02:52:26PM +0100, Michal Privoznik wrote:
> It is going to be important to know if the current transaction we
> are running is a restore operation or set label operation.

Might be worth saying why it is important :-)

> 
> Signed-off-by: Michal Privoznik 
> ---
>  src/security/security_selinux.c | 36 +++--
>  1 file changed, 25 insertions(+), 11 deletions(-)

Reviewed-by: Daniel P. Berrangé 


Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

[libvirt] [PATCH v2 11/18] security_selinux: Track if transaction is restore

[Michal Privoznik]

It is going to be important to know if the current transaction we
are running is a restore operation or set label operation.

Signed-off-by: Michal Privoznik 
---
 src/security/security_selinux.c | 36 +++--
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 95e9a1b0c7..715d9a428b 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -85,6 +85,7 @@ struct _virSecuritySELinuxContextItem {
 char *path;
 char *tcon;
 bool optional;
+bool restore;
 };
 
 typedef struct _virSecuritySELinuxContextList virSecuritySELinuxContextList;
@@ -123,7 +124,8 @@ static int
 virSecuritySELinuxContextListAppend(virSecuritySELinuxContextListPtr list,
 const char *path,
 const char *tcon,
-bool optional)
+bool optional,
+bool restore)
 {
 int ret = -1;
 virSecuritySELinuxContextItemPtr item = NULL;
@@ -135,6 +137,7 @@ 
virSecuritySELinuxContextListAppend(virSecuritySELinuxContextListPtr list,
 goto cleanup;
 
 item->optional = optional;
+item->restore = restore;
 
 if (VIR_APPEND_ELEMENT(list->items, list->nItems, item) < 0)
 goto cleanup;
@@ -178,7 +181,8 @@ virSecuritySELinuxContextListFree(void *opaque)
 static int
 virSecuritySELinuxTransactionAppend(const char *path,
 const char *tcon,
-bool optional)
+bool optional,
+bool restore)
 {
 virSecuritySELinuxContextListPtr list;
 
@@ -186,7 +190,7 @@ virSecuritySELinuxTransactionAppend(const char *path,
 if (!list)
 return 0;
 
-if (virSecuritySELinuxContextListAppend(list, path, tcon, optional) < 0)
+if (virSecuritySELinuxContextListAppend(list, path, tcon, optional, 
restore) < 0)
 return -1;
 
 return 1;
@@ -198,6 +202,11 @@ static int virSecuritySELinuxSetFileconHelper(const char 
*path,
   bool optional,
   bool privileged);
 
+
+static int virSecuritySELinuxRestoreFileLabel(virSecurityManagerPtr mgr,
+  const char *path);
+
+
 /**
  * virSecuritySELinuxTransactionRun:
  * @pid: process pid
@@ -242,13 +251,18 @@ virSecuritySELinuxTransactionRun(pid_t pid 
ATTRIBUTE_UNUSED,
 virSecuritySELinuxContextItemPtr item = list->items[i];
 
 /* TODO Implement rollback */
-if (virSecuritySELinuxSetFileconHelper(item->path,
-   item->tcon,
-   item->optional,
-   privileged) < 0) {
-rv = -1;
-break;
+if (!item->restore) {
+rv = virSecuritySELinuxSetFileconHelper(item->path,
+item->tcon,
+item->optional,
+privileged);
+} else {
+rv = virSecuritySELinuxRestoreFileLabel(list->manager,
+item->path);
 }
+
+if (rv < 0)
+break;
 }
 
 if (list->lock)
@@ -1265,7 +1279,7 @@ virSecuritySELinuxSetFileconHelper(const char *path, 
const char *tcon,
 {
 int rc;
 
-if ((rc = virSecuritySELinuxTransactionAppend(path, tcon, optional)) < 0)
+if ((rc = virSecuritySELinuxTransactionAppend(path, tcon, optional, 
false)) < 0)
 return -1;
 else if (rc > 0)
 return 0;
@@ -1387,7 +1401,7 @@ virSecuritySELinuxRestoreFileLabel(virSecurityManagerPtr 
mgr,
 goto cleanup;
 }
 
-if ((rc = virSecuritySELinuxTransactionAppend(path, fcon, false)) < 0)
+if ((rc = virSecuritySELinuxTransactionAppend(path, fcon, false, true)) < 
0)
 return -1;
 else if (rc > 0)
 return 0;
-- 
2.18.1

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list