[libvirt] PATCH: Mark <seclabel> as dynamic generated, or statically pre-defined
Daniel Veillard
veillard at redhat.com
Tue Mar 3 15:58:29 UTC 2009
On Tue, Mar 03, 2009 at 03:42:58PM +0000, Daniel P. Berrange wrote:
> This patch implements the behaviour I was refering to earlier, whereby
> the domain XML explicitly says whether the security label is a statically
> pre-defined one, or dynamically generated on VM boot by libvirtd
>
> So when creating a new guest, apps like virt-install have 2 options:
>
> - Leave out the <seclabel> tag completely
> -> If no security driver is active, just works as normal unconfined VM
> -> If a security driver is active, a dynamic seclabel is generated
>
> <seclabel type='dynamic' model='selinux'>
> <label>system_u:system_r:qemu_t:s0:c424,c719</label>
> <imagelabel>system_u:object_r:virt_image_t:s0:c424,c719</imagelabel>
> </seclabel>
>
> - Add an explicit <seclabel> tag with type='static' attribute
> -> Security driver uses the defined label & imagelabel
>
> <seclabel type='static' model='selinux'>
> <label>system_u:system_r:qemu_t:s0:c25,c100</label>
> <imagelabel>system_u:system_r:virt_image_t:s0:c25,c100</imagelabel>
> </seclabel>
>
>
> A static seclabel is visible in the XML, at all times, whether the VM is
> active or inactive.
>
> A dynamic seclabel is only visible when the VM is running, since it is
> auto-generated at VM boot. If you migrate the VM, or save/restore it,
> the dynamic seclabel will change on each boot. The seclabel isn't visible
> when not running, or if asking for the inactive XML dump
>
> This patch implements parsing of the 'type' attribute, and makes the
> seclabel generation key off this attribute.
>
> It also adds the 'imagelabel' XML element, since that was being used
> internally, but was not including in the XML output, or parsing
> routines, making it impossible to specify a pre-defined image label
> or see the dyanmic one
The patch looks sane to me, I didn't spot anything suspect, but I'm
not really able to validate the principle itself.
Daniel
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel at veillard.com | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/
More information about the libvir-list
mailing list