[libvirt] [PATCH 4/4] security: label the slic_table

[Ján Tomko]

Add support for the slic_able  to the security drivers.
---
 src/security/security_dac.c     | 5 +++++
 src/security/security_selinux.c | 5 +++++
 src/security/virt-aa-helper.c   | 4 ++++
 3 files changed, 14 insertions(+)

diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index df3ed47..442ce70 100644
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -1218,6 +1218,11 @@ virSecurityDACSetAllLabel(virSecurityManagerPtr mgr,
                                    def->os.dtb, user, group) < 0)
         return -1;
 
+    if (def->os.slic_table &&
+        virSecurityDACSetOwnership(priv, NULL,
+                                   def->os.slic_table, user, group) < 0)
+        return -1;
+
     return 0;
 }
 
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index b33d54a..aa61767 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -2444,6 +2444,11 @@ virSecuritySELinuxSetAllLabel(virSecurityManagerPtr mgr,
                                      data->content_context) < 0)
         return -1;
 
+    if (def->os.slic_table &&
+        virSecuritySELinuxSetFilecon(mgr, def->os.slic_table,
+                                     data->content_context) < 0)
+        return -1;
+
     if (stdin_path &&
         virSecuritySELinuxSetFilecon(mgr, stdin_path,
                                      data->content_context) < 0)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 7eeb4ef..e5f25bc 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1051,6 +1051,10 @@ get_files(vahControl * ctl)
         if (vah_add_file(&buf, ctl->def->os.dtb, "r") != 0)
             goto cleanup;
 
+    if (ctl->def->os.slic_table)
+        if (vah_add_file(&buf, ctl->def->os.slic_table, "r") != 0)
+            goto cleanup;
+
     if (ctl->def->os.loader && ctl->def->os.loader->path)
         if (vah_add_file(&buf, ctl->def->os.loader->path, "r") != 0)
             goto cleanup;
-- 
2.7.3