[libvirt] [PATCH 2/2] Rework lxc apparmor profile

[Serge Hallyn]

Quoting Cedric Bosdonnat (cbosdonnat at suse.com):
> Hi Serge,
> 
> On Mon, 2014-07-14 at 13:55 +0000, Serge Hallyn wrote:
> > Quoting Cédric Bosdonnat (cbosdonnat at suse.com):
> > 
> > > diff --git a/examples/apparmor/libvirt-lxc b/examples/apparmor/libvirt-lxc
> > > index d404328..4bfb503 100644
> > > --- a/examples/apparmor/libvirt-lxc
> > > +++ b/examples/apparmor/libvirt-lxc
> > > @@ -2,16 +2,115 @@
> > 
> > Hi,
> > 
> > this being a verbatim copy from lxc's policy, is there any plan for
> > keeping the policy uptodate as the lxc policy is updated?
> 
> Well... ATM I have nothing planned to keep it up to date. But I can
> write a script to check if there are changes in the lxc policy we could
> merge.
> 
> > Does lxc-enter-namespace --cmd /bin/bash still work?  (I would expect so)
> 
> Yes, it still works.
> 
> > > diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
> > > index 1e2a38b..778d233 100644
> > > --- a/src/security/security_apparmor.c
> > > +++ b/src/security/security_apparmor.c
> > > @@ -351,26 +351,36 @@ AppArmorSetSecuritySCSILabel(virSCSIDevicePtr dev ATTRIBUTE_UNUSED,
> > >  static int
> > >  AppArmorSecurityManagerProbe(const char *virtDriver ATTRIBUTE_UNUSED)
> > >  {
> > > -    char *template = NULL;
> > > +    char *template_qemu = NULL;
> > > +    char *template_lxc = NULL;
> > >      int rc = SECURITY_DRIVER_DISABLE;
> > >  
> > >      if (use_apparmor() < 0)
> > >          return rc;
> > >  
> > >      /* see if template file exists */
> > > -    if (virAsprintf(&template, "%s/TEMPLATE",
> > > +    if (virAsprintf(&template_qemu, "%s/TEMPLATE.qemu",
> > >                                 APPARMOR_DIR "/libvirt") == -1)
> > >          return rc;
> > >  
> > > -    if (!virFileExists(template)) {
> > > +    if (virAsprintf(&template_lxc, "%s/TEMPLATE.lxc",
> > > +                               APPARMOR_DIR "/libvirt") == -1)
> > 
> > (This remains a bug, a 'goto cleanup' is needed here)
> 
> Oops, indeed... seems like I went blind. Patch v3 just sent with that
> fix in.

Oh, bother.  I think I just deleted that.  Assuming that was the only change,

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> 
> --
> Cedric
> 
> > > +
> > > +    if (!virFileExists(template_qemu)) {
> > > +        virReportError(VIR_ERR_INTERNAL_ERROR,
> > > +                       _("template \'%s\' does not exist"), template_qemu);
> > > +        goto cleanup;
> > > +    }
> > > +    if (!virFileExists(template_lxc)) {
> > >          virReportError(VIR_ERR_INTERNAL_ERROR,
> > > -                       _("template \'%s\' does not exist"), template);
> > > +                       _("template \'%s\' does not exist"), template_lxc);
> > >          goto cleanup;
> > >      }
> > >      rc = SECURITY_DRIVER_ENABLE;
> > >  
> > >   cleanup:
> > > -    VIR_FREE(template);
> > > +    VIR_FREE(template_qemu);
> > > +    VIR_FREE(template_lxc);
> > >  
> > >      return rc;
> > >  }
> > > diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> > > index d563b98..2a09145 100644
> > > --- a/src/security/virt-aa-helper.c
> > > +++ b/src/security/virt-aa-helper.c
> > > @@ -336,24 +336,20 @@ create_profile(const char *profile, const char *profile_name,
> > >      char *pcontent = NULL;
> > >      char *replace_name = NULL;
> > >      char *replace_files = NULL;
> > > -    char *replace_driver = NULL;
> > >      const char *template_name = "\nprofile LIBVIRT_TEMPLATE";
> > >      const char *template_end = "\n}";
> > > -    const char *template_driver = "libvirt-driver";
> > >      int tlen, plen;
> > >      int fd;
> > >      int rc = -1;
> > > -    const char *driver_name = "qemu";
> > > -
> > > -    if (virtType == VIR_DOMAIN_VIRT_LXC)
> > > -        driver_name = "lxc";
> > >  
> > >      if (virFileExists(profile)) {
> > >          vah_error(NULL, 0, _("profile exists"));
> > >          goto end;
> > >      }
> > >  
> > > -    if (virAsprintfQuiet(&template, "%s/TEMPLATE", APPARMOR_DIR "/libvirt") < 0) {
> > > +
> > > +    if (virAsprintfQuiet(&template, "%s/TEMPLATE.%s", APPARMOR_DIR "/libvirt",
> > > +                         virDomainVirtTypeToString(virtType)) < 0) {
> > >          vah_error(NULL, 0, _("template name exceeds maximum length"));
> > >          goto end;
> > >      }
> > > @@ -378,11 +374,6 @@ create_profile(const char *profile, const char *profile_name,
> > >          goto clean_tcontent;
> > >      }
> > >  
> > > -    if (strstr(tcontent, template_driver) == NULL) {
> > > -        vah_error(NULL, 0, _("no replacement string in template"));
> > > -        goto clean_tcontent;
> > > -    }
> > > -
> > >      /* '\nprofile <profile_name>\0' */
> > >      if (virAsprintfQuiet(&replace_name, "\nprofile %s", profile_name) == -1) {
> > >          vah_error(NULL, 0, _("could not allocate memory for profile name"));
> > > @@ -397,15 +388,7 @@ create_profile(const char *profile, const char *profile_name,
> > >          goto clean_tcontent;
> > >      }
> > >  
> > > -    /* 'libvirt-<driver_name>\0' */
> > > -    if (virAsprintfQuiet(&replace_driver, "libvirt-%s", driver_name) == -1) {
> > > -        vah_error(NULL, 0, _("could not allocate memory for profile driver"));
> > > -        VIR_FREE(replace_driver);
> > > -        goto clean_tcontent;
> > > -    }
> > > -
> > > -    plen = tlen + strlen(replace_name) - strlen(template_name) +
> > > -           strlen(replace_driver) - strlen(template_driver) + 1;
> > > +    plen = tlen + strlen(replace_name) - strlen(template_name) + 1;
> > >  
> > >      if (virtType != VIR_DOMAIN_VIRT_LXC)
> > >          plen += strlen(replace_files) - strlen(template_end);
> > > @@ -422,9 +405,6 @@ create_profile(const char *profile, const char *profile_name,
> > >      pcontent[0] = '\0';
> > >      strcpy(pcontent, tcontent);
> > >  
> > > -    if (replace_string(pcontent, plen, template_driver, replace_driver) < 0)
> > > -        goto clean_all;
> > > -
> > >      if (replace_string(pcontent, plen, template_name, replace_name) < 0)
> > >          goto clean_all;
> > >  
> > > @@ -455,7 +435,6 @@ create_profile(const char *profile, const char *profile_name,
> > >   clean_replace:
> > >      VIR_FREE(replace_name);
> > >      VIR_FREE(replace_files);
> > > -    VIR_FREE(replace_driver);
> > >   clean_tcontent:
> > >      VIR_FREE(tcontent);
> > >   end:
> > > -- 
> > > 1.8.4.5
> > > 
> > > --
> > > libvir-list mailing list
> > > libvir-list at redhat.com
> > > https://www.redhat.com/mailman/listinfo/libvir-list
> > 
> > --
> > libvir-list mailing list
> > libvir-list at redhat.com
> > https://www.redhat.com/mailman/listinfo/libvir-list
> > 
> 
> 
> --
> libvir-list mailing list
> libvir-list at redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list