[libvirt] [PATCH v3 10/11] security: dac: gfx: egl-headless: Relabel the DRI device

Erik Skultety eskultet at redhat.com
Thu Nov 29 14:20:20 UTC 2018


Just like for SPICE, we need to change the permissions on the DRI device
used as the @rendernode for egl-headless graphics type.

Signed-off-by: Erik Skultety <eskultet at redhat.com>
---
 src/security/security_dac.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index 6b64d2c07a..4bdc6ed213 100644
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -1492,11 +1492,16 @@ virSecurityDACSetGraphicsLabel(virSecurityManagerPtr mgr,
                                virDomainGraphicsDefPtr gfx)
 
 {
+    const char *rendernode = virDomainGraphicsGetRenderNode(gfx);
     virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr);
     virSecurityLabelDefPtr seclabel;
     uid_t user;
     gid_t group;
 
+    /* There's nothing to relabel */
+    if (!rendernode)
+        return 0;
+
     /* Skip chowning the shared render file if namespaces are disabled */
     if (!priv->mountNamespace)
         return 0;
@@ -1508,14 +1513,8 @@ virSecurityDACSetGraphicsLabel(virSecurityManagerPtr mgr,
     if (virSecurityDACGetIds(seclabel, priv, &user, &group, NULL, NULL) < 0)
         return -1;
 
-    if (gfx->type == VIR_DOMAIN_GRAPHICS_TYPE_SPICE &&
-        gfx->data.spice.gl == VIR_TRISTATE_BOOL_YES &&
-        gfx->data.spice.rendernode) {
-        if (virSecurityDACSetOwnership(mgr, NULL,
-                                       gfx->data.spice.rendernode,
-                                       user, group) < 0)
-            return -1;
-    }
+    if (virSecurityDACSetOwnership(mgr, NULL, rendernode, user, group) < 0)
+        return -1;
 
     return 0;
 }
-- 
2.19.1




More information about the libvir-list mailing list