[libvirt] Patch to allow setting of svirt XML.

[Daniel P. Berrange]

On Mon, Mar 30, 2009 at 09:15:33AM -0400, Daniel J Walsh wrote:
> On 03/28/2009 07:51 AM, Daniel P. Berrange wrote:
> >On Thu, Mar 26, 2009 at 11:51:21AM -0400, Daniel J Walsh wrote:
> >>This patch fixes the seclabel handling in domain_conf.c to allow
> >>virt-manager to set the seclabel model, type and label.
> >>
> >>Also adds missing error messages when the xml is incorrect.
> >
> >I'm not sure why this change to the XML parser is needed ? The calling
> >app is already able to supply a seclabel, provided it sets type='static'
> >to indicate a statically defined label. If it doesn't set this, then
> >libvirt will ignore anything i nthe XML, and generate a dynamic label.
> >This change is appears to just be making it parse dynamic label from
> >the XML, which shouldn't be needed.
>
> Currently you get no error messages if you specify anything wrong the 
> code fails silently.

Ah,well that's a different issue then -  can you provide some examples
of XML configs where it doesn't give correct error messages. 

> >>How much verification should we be doing on this?  I have another patch
> >>that verifies the model as being a known model and a patch to verify the
> >>label is a correct label.  (IE SELinux verifies the label is understood
> >>by the kernel.)
> >
> >During the parsing stage, the only semantic validation we do is for
> >stuff listed in the hypervisor capabilities object (virCapabilitiesPtr).
> >
> >There is a record of the security model in the capabilities object,
> >so you could validate that.  Validating the actual user supplied
> >label would be done later at the time it is used.
> >
> >
> But if a user specifies that a label that the libvirt system does not 
> understand, he needs to know that right away.

In  that case I'd reckon it'd be worth putting some validation into
the QEMU driver after its called virDomainDefParseString(), so we don't
need to put full semantic validation in the XML parser.

Daniel
-- 
|: Red Hat, Engineering, London   -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org  -o-  http://virt-manager.org  -o-  http://ovirt.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-  F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|