[libvirt] [PATCH] Change label of fusefs mounted at /proc/meminfo in lxc containers

[Michal Privoznik]

On 15.05.2013 16:35, dwalsh at redhat.com wrote:
> From: Dan Walsh <dwalsh at redhat.com>
> 
> We do not want to allow contained applications to be able to read fusefs_t.
> So we want /proc/meminfo label to match the system default proc_t.
> 
> Fix checking of error codes
> ---
>  src/lxc/lxc_container.c | 24 ++++++++++++++++++++++++
>  1 file changed, 24 insertions(+)
> 
> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
> index 8e1d10a..8c0edb0 100644
> --- a/src/lxc/lxc_container.c
> +++ b/src/lxc/lxc_container.c
> @@ -52,6 +52,10 @@
>  # include <blkid/blkid.h>
>  #endif
>  
> +#if WITH_SELINUX
> +# include <selinux/selinux.h>
> +#endif
> +
>  #include "virerror.h"
>  #include "virlog.h"
>  #include "lxc_container.h"
> @@ -761,6 +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def,
>                             def->name)) < 0)
>          return ret;
>  
> +#if WITH_SELINUX

indent

> +    if (is_selinux_enabled() > 0) {
> +        security_context_t scon;
> +        ret = getfilecon("/proc/meminfo", &scon);
> +        if (ret < 0) {
> +            virReportSystemError(errno,
> +                                 _("Failed to get security context of %s for /proc/meminfo mount point"),
> +                                 meminfo_path);
> +            return ret;
> +        }
> +        ret = setfilecon(meminfo_path, scon);
> +        freecon(scon);
> +        if (ret < 0) {
> +            virReportSystemError(errno,
> +                                 _("Failed to set security context of %s for /proc/meminfo mount point"),
> +                                 meminfo_path);
> +            return ret;
> +        }
> +    }
> +#endif

indent

>      if ((ret = mount(meminfo_path, "/proc/meminfo",
>                       NULL, MS_BIND, NULL)) < 0) {
>          virReportSystemError(errno,
> 

Ran 'syntax-check' and pushed now with this squashed in:

diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index cefa18d..461eb5f 100644
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -760,7 +760,7 @@ static int lxcContainerMountProcFuse(virDomainDefPtr
def)
                            def->name)) < 0)
         return ret;

-#if WITH_SELINUX
+# if WITH_SELINUX
     if (is_selinux_enabled() > 0) {
         security_context_t scon;
         ret = getfilecon("/proc/meminfo", &scon);
@@ -779,7 +779,7 @@ static int lxcContainerMountProcFuse(virDomainDefPtr
def)
             return ret;
         }
     }
-#endif
+# endif
     if ((ret = mount(meminfo_path, "/proc/meminfo",
                      NULL, MS_BIND, NULL)) < 0) {
         virReportSystemError(errno,

Michal