[libvirt] [PATCH 0/4] manage the shmem device source

Luyao Huang lhuang at redhat.com
Thu Jul 23 10:13:45 UTC 2015


Since there is a shmobj leak when let qemu create shmobj by
themselves, also the label of shmobj/shmem-server socket
is not right. Guest cannot direct use the shmem-server
if users enabled selinux. So it will be better to manage it
in libvirt.

The way i chosed is region the shmem deivce in a list, and
save it status to a local file to avoid losing it after restart
libvirtd, and count the guest which use it, and let the callers
know if there is no guest is using it (then we can relabel/cleanup
some resource).

Notice: you still cannot use the ivshmem-server if the process label
is not correct, just set the socket label is not enought, selinux
still will forbid qemu use it, because the shmem-server's process is
not correct, you will find the AVC like this (i set up the ivshmem
server via shell):

type=AVC msg=audit(1437642157.227:73784): avc:  denied  { connectto } for \
 pid=6137 comm="qemu-kvm" path="/tmp/ivshmem_socket" \
scontext=system_u:system_r:svirt_t:s0:c703,c707 \
 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket

But the problem is we cannot change the running shm-server process label,
We need wait ivshmem-server to be a part of qemu progrem, then setup the
ivshmem-server by libvirt. we cannot do nothing for the ivshmem-server right now.

Luyao Huang (4):
  conf: introduce seclabels in shmem device element
  security: add security part for shmem device
  util: introduce new helpers to manage shmem device
  qemu: call the helpers in virshm.c to manage shmem device

 configure.ac                    |  10 +
 docs/formatdomain.html.in       |   7 +
 docs/schemas/domaincommon.rng   |   3 +
 po/POTFILES.in                  |   3 +-
 src/Makefile.am                 |   5 +-
 src/conf/domain_conf.c          |  55 +++-
 src/conf/domain_conf.h          |   5 +
 src/libvirt_private.syms        |  18 ++
 src/qemu/qemu_conf.h            |   3 +
 src/qemu/qemu_driver.c          |   4 +
 src/qemu/qemu_process.c         | 158 ++++++++++
 src/security/security_dac.c     |  67 +++++
 src/security/security_driver.h  |  11 +
 src/security/security_manager.c |  38 +++
 src/security/security_manager.h |   8 +
 src/security/security_selinux.c |  70 +++++
 src/security/security_stack.c   |  41 +++
 src/util/virshm.c               | 623 ++++++++++++++++++++++++++++++++++++++++
 src/util/virshm.h               | 104 +++++++
 19 files changed, 1220 insertions(+), 13 deletions(-)
 create mode 100644 src/util/virshm.c
 create mode 100644 src/util/virshm.h

-- 
1.8.3.1




More information about the libvir-list mailing list