[Libguestfs] [PATCH] If using SELinux, mount /selinux in the appliance
Richard W.M. Jones
rjones at redhat.com
Wed Aug 12 15:42:12 UTC 2009
I think this patch is also uncontroversial.
If selinux=1 then we mount /selinux in the appliance. We also
bind-mount it into guests when running commands, just like we do for
/proc, /dev etc.
If SELinux is disabled, then /selinux doesn't get mounted.
Rich.
--
Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines. Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v
-------------- next part --------------
>From e31c8587643ae8f5987198d39e014e041112a663 Mon Sep 17 00:00:00 2001
From: Richard Jones <rjones at trick.home.annexia.org>
Date: Wed, 12 Aug 2009 16:31:06 +0100
Subject: [PATCH] If using SELinux, mount /selinux in the appliance.
If selinux=1 on the Linux kernel command line, then we mount
/selinux in the appliance. We will also bind-mount this
directory into guests when we run commands.
---
appliance/init | 4 ++++
appliance/make.sh.in | 3 +++
daemon/command.c | 10 ++++++++--
3 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/appliance/init b/appliance/init
index b33a34c..fe135b4 100755
--- a/appliance/init
+++ b/appliance/init
@@ -33,6 +33,10 @@ else
modprobe virtio_net
fi
+if grep -sq selinux=1 /proc/cmdline; then
+ mount -t selinuxfs none /selinux
+fi
+
modprobe dm_mod ||:
ifconfig lo 127.0.0.1
diff --git a/appliance/make.sh.in b/appliance/make.sh.in
index d76c961..66bdebc 100755
--- a/appliance/make.sh.in
+++ b/appliance/make.sh.in
@@ -47,6 +47,9 @@ if [ "@DIST@" = "REDHAT" ]; then
# Create /tmp if it is missing.
@FEBOOTSTRAP_RUN@ initramfs -- mkdir -p --mode=0777 /tmp
+ # Create /selinux if it is missing.
+ @FEBOOTSTRAP_RUN@ initramfs -- mkdir -p --mode=0755 /selinux
+
# Nuke some stuff. The kernel pulls mkinitrd and plymouth which pulls in
# all of Python. Sheez.
(cd initramfs && find -name '*plymouth*' -print0) |
diff --git a/daemon/command.c b/daemon/command.c
index 0399255..3261513 100644
--- a/daemon/command.c
+++ b/daemon/command.c
@@ -31,8 +31,9 @@ do_command (char **argv)
{
char *out, *err;
int r;
- char *sysroot_proc, *sysroot_dev, *sysroot_dev_pts, *sysroot_sys;
- int proc_ok, dev_ok, dev_pts_ok, sys_ok;
+ char *sysroot_dev, *sysroot_dev_pts, *sysroot_proc,
+ *sysroot_selinux, *sysroot_sys;
+ int dev_ok, dev_pts_ok, proc_ok, selinux_ok, sys_ok;
/* We need a root filesystem mounted to do this. */
NEED_ROOT (NULL);
@@ -57,6 +58,7 @@ do_command (char **argv)
sysroot_dev = sysroot_path ("/dev");
sysroot_dev_pts = sysroot_path ("/dev/pts");
sysroot_proc = sysroot_path ("/proc");
+ sysroot_selinux = sysroot_path ("/selinux");
sysroot_sys = sysroot_path ("/sys");
r = command (NULL, NULL, "mount", "--bind", "/dev", sysroot_dev, NULL);
@@ -65,6 +67,8 @@ do_command (char **argv)
dev_pts_ok = r != -1;
r = command (NULL, NULL, "mount", "--bind", "/proc", sysroot_proc, NULL);
proc_ok = r != -1;
+ r = command (NULL, NULL, "mount", "--bind", "/selinux", sysroot_selinux, NULL);
+ selinux_ok = r != -1;
r = command (NULL, NULL, "mount", "--bind", "/sys", sysroot_sys, NULL);
sys_ok = r != -1;
@@ -73,6 +77,7 @@ do_command (char **argv)
CHROOT_OUT;
if (sys_ok) command (NULL, NULL, "umount", sysroot_sys, NULL);
+ if (selinux_ok) command (NULL, NULL, "umount", sysroot_selinux, NULL);
if (proc_ok) command (NULL, NULL, "umount", sysroot_proc, NULL);
if (dev_pts_ok) command (NULL, NULL, "umount", sysroot_dev_pts, NULL);
if (dev_ok) command (NULL, NULL, "umount", sysroot_dev, NULL);
@@ -80,6 +85,7 @@ do_command (char **argv)
free (sysroot_dev);
free (sysroot_dev_pts);
free (sysroot_proc);
+ free (sysroot_selinux);
free (sysroot_sys);
if (r == -1) {
--
1.6.2.5
More information about the Libguestfs
mailing list