Updates related to libvirt
cover Updates related to libvirt
This is a set of small patches related to libvirt support.
First, we add in some context description files.
Next, we allow virt to write out and execute its tmp files. Third, we provide initrc/sysadm with the rights to execute virsh. Finally, we allow qemu to execute itself (which seems to be needed when using libvirt for qemu-based virtualizatoion.
Wkr,
Sven Vermeulen
PATCH 1/4 Adding default context rules for libvirt
The libvirt infrastructure requires the availability of the context files.
In this patch, we add the defaults to the three predefined application contexts (mls/mcs/standard).
--- Makefile | 2 +- config/appconfig-mcs/virtual_domain_context | 1 + config/appconfig-mcs/virtual_image_context | 2 ++ config/appconfig-mls/virtual_domain_context | 1 + config/appconfig-mls/virtual_image_context | 2 ++ config/appconfig-standard/virtual_domain_context | 1 + config/appconfig-standard/virtual_image_context | 2 ++ 7 files changed, 10 insertions(+), 1 deletions(-) create mode 100644 config/appconfig-mcs/virtual_domain_context create mode 100644 config/appconfig-mcs/virtual_image_context create mode 100644 config/appconfig-mls/virtual_domain_context create mode 100644 config/appconfig-mls/virtual_image_context create mode 100644 config/appconfig-standard/virtual_domain_context create mode 100644 config/appconfig-standard/virtual_image_context
Makefile +1 -1
@@ -249,7 +249,7 @@ seusers := $(appconf)/seusers appdir := $(contextpath) user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts) user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts)))) -appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names) +appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types virtual_domain_context virtual_image_context) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names) net_contexts := $(builddir)net_contexts all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
config/appconfig-mcs/virtual_domain_context new file +1 -0
@@ -0,0 +1 @@ +system_u:system_r:svirt_t:s0
config/appconfig-mcs/virtual_image_context new file +2 -0
@@ -0,0 +1,2 @@ +system_u:object_r:svirt_image_t:s0 +system_u:object_r:virt_content_t:s0
config/appconfig-mls/virtual_domain_context new file +1 -0
@@ -0,0 +1 @@ +system_u:system_r:svirt_t:s0
config/appconfig-mls/virtual_image_context new file +2 -0
@@ -0,0 +1,2 @@ +system_u:object_r:svirt_image_t:s0 +system_u:object_r:virt_content_t:s0
config/appconfig-standard/virtual_domain_context new file +1 -0
@@ -0,0 +1 @@ +system_u:system_r:svirt_t
config/appconfig-standard/virtual_image_context new file +2 -0
@@ -0,0 +1,2 @@ +system_u:object_r:svirt_image_t +system_u:object_r:virt_content_t
Signature · 1 line
1.7.3.4
PATCH 1/4 Adding default context rules for libvirt
Quoted 4 lines · Sven Vermeulen
The libvirt infrastructure requires the availability of the context files.
In this patch, we add the defaults to the three predefined application contexts (mls/mcs/standard).
Merged.
Quoted 75 lines
Signed-off-by Sven Vermeulen <[email protected]>--- Makefile | 2 +- config/appconfig-mcs/virtual_domain_context | 1 + config/appconfig-mcs/virtual_image_context | 2 ++ config/appconfig-mls/virtual_domain_context | 1 + config/appconfig-mls/virtual_image_context | 2 ++ config/appconfig-standard/virtual_domain_context | 1 + config/appconfig-standard/virtual_image_context | 2 ++ 7 files changed, 10 insertions(+), 1 deletions(-) create mode 100644 config/appconfig-mcs/virtual_domain_context create mode 100644 config/appconfig-mcs/virtual_image_context create mode 100644 config/appconfig-mls/virtual_domain_context create mode 100644 config/appconfig-mls/virtual_image_context create mode 100644 config/appconfig-standard/virtual_domain_context create mode 100644 config/appconfig-standard/virtual_image_contextMakefile +1
-1@@ -249,7 +249,7 @@ seusers := $(appconf)/seusers appdir := $(contextpath) user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts) user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts)))) -appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names) +appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types virtual_domain_context virtual_image_context) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names) net_contexts := $(builddir)net_contexts all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)config/appconfig-mcs/virtual_domain_context new file +1
-0@@ -0,0 +1 @@ +system_u:system_r:svirt_t:s0config/appconfig-mcs/virtual_image_context new file +2
-0@@ -0,0 +1,2 @@ +system_u:object_r:svirt_image_t:s0 +system_u:object_r:virt_content_t:s0config/appconfig-mls/virtual_domain_context new file +1
-0@@ -0,0 +1 @@ +system_u:system_r:svirt_t:s0config/appconfig-mls/virtual_image_context new file +2
-0@@ -0,0 +1,2 @@ +system_u:object_r:svirt_image_t:s0 +system_u:object_r:virt_content_t:s0config/appconfig-standard/virtual_domain_context new file +1
-0@@ -0,0 +1 @@ +system_u:system_r:svirt_tconfig/appconfig-standard/virtual_image_context new file +2
-0@@ -0,0 +1,2 @@ +system_u:object_r:svirt_image_t +system_u:object_r:virt_content_t
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 2/4 Let libvirt write its own tmp files (and execute them)
In reply to Sven VermeulenDuring startup of guests, libvirt needs to create temporary files and execute them (part of setting up the necessary environment of the guests).
--- virt.te | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-)
virt.te +8 -0
@@ -74,6 +74,9 @@ userdom_user_home_content(virt_content_t) type virt_log_t; logging_log_file(virt_log_t) +type virt_tmp_t; +files_tmp_file(virt_tmp_t) + type virt_var_run_t; files_pid_file(virt_var_run_t)
@@ -207,6 +210,11 @@ manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) manage_files_pattern(virtd_t, virt_log_t, virt_log_t) logging_log_filetrans(virtd_t, virt_log_t, { file dir }) +manage_dirs_pattern(virtd_t, virt_tmp_t, virt_tmp_t) +manage_files_pattern(virtd_t, virt_tmp_t, virt_tmp_t) +files_tmp_filetrans(virtd_t, virt_tmp_t, { file dir }) +can_exec(virtd_t, virt_tmp_t) + manage_dirs_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) manage_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) manage_sock_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t)
Signature · 1 line
1.7.3.4
PATCH 2/4 Let libvirt write its own tmp files (and execute them)
Quoted 2 lines · Sven Vermeulen
During startup of guests, libvirt needs to create temporary files and execute them (part of setting up the necessary environment of the guests).
Merged.
Quoted 31 lines
Signed-off-by Sven Vermeulen <[email protected]>--- virt.te | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-)virt.te +8
-0@@ -74,6 +74,9 @@ userdom_user_home_content(virt_content_t) type virt_log_t; logging_log_file(virt_log_t) +type virt_tmp_t; +files_tmp_file(virt_tmp_t) + type virt_var_run_t; files_pid_file(virt_var_run_t)@@ -207,6 +210,11 @@ manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) manage_files_pattern(virtd_t, virt_log_t, virt_log_t) logging_log_filetrans(virtd_t, virt_log_t, { file dir }) +manage_dirs_pattern(virtd_t, virt_tmp_t, virt_tmp_t) +manage_files_pattern(virtd_t, virt_tmp_t, virt_tmp_t) +files_tmp_filetrans(virtd_t, virt_tmp_t, { file dir }) +can_exec(virtd_t, virt_tmp_t) + manage_dirs_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) manage_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) manage_sock_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/4 Calling virsh requires stream_connect rights towards virt
In reply to Sven VermeulenWhen virsh is used to manage the virtual guests, the parent domain requires stream_connect rights towards the virtd_t domain. This patch adds it in for initrc_t (for init scripts managing the environment) and sysadm_t (system administrator).
--- policy/modules/roles/sysadm.te | 4 ++++ policy/modules/system/init.te | 1 + 2 files changed, 5 insertions(+), 0 deletions(-)
policy/modules/roles/sysadm.te +4 -0
@@ -394,6 +394,10 @@ optional_policy(` ') optional_policy(` + virt_stream_connect(sysadm_t) +') + +optional_policy(` vmware_role(sysadm_r, sysadm_t) ')
policy/modules/system/init.te +1 -0
@@ -822,6 +822,7 @@ optional_policy(` ') optional_policy(` + virt_stream_connect(initrc_t) virt_manage_svirt_cache(initrc_t) ')
Signature · 1 line
1.7.3.4
PATCH 3/4 Calling virsh requires stream_connect rights towards virt
Quoted 3 lines · Sven Vermeulen
When virsh is used to manage the virtual guests, the parent domain requires
stream_connectrights towards thevirtd_tdomain. This patch adds it in forinitrc_t(for init scripts managing the environment) andsysadm_t(system administrator).
Merged.
Quoted 33 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/roles/sysadm.te | 4 ++++ policy/modules/system/init.te | 1 + 2 files changed, 5 insertions(+), 0 deletions(-)policy/modules/roles/sysadm.te +4
-0@@ -394,6 +394,10 @@ optional_policy(` ') optional_policy(` + virt_stream_connect(sysadm_t) +') + +optional_policy(` vmware_role(sysadm_r, sysadm_t) ')policy/modules/system/init.te +1
-0@@ -822,6 +822,7 @@ optional_policy(` ') optional_policy(` + virt_stream_connect(initrc_t) virt_manage_svirt_cache(initrc_t) ')
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 4/4 libvirt use of qemu requires re-exec of qemu
In reply to Sven VermeulenWhen using libvirt as the virtualization framework, using qemu as the virtualization environment itself, launching guests requires the qemu domain to have exec rights on its own binaries.
--- qemu.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
qemu.te +2 -0
@@ -50,6 +50,8 @@ role system_r types qemu_t; # qemu local policy # +can_exec(qemu_t, qemu_exec_t) + storage_raw_write_removable_device(qemu_t) storage_raw_read_removable_device(qemu_t)
Signature · 1 line
1.7.3.4
PATCH 4/4 libvirt use of qemu requires re-exec of qemu
Quoted 2 lines · Sven Vermeulen
When using libvirt as the virtualization framework, using qemu as the virtualization environment itself, launching guests requires the qemu domain to have exec rights on its own binaries.
Merged.
Quoted 18 lines
Signed-off-by Sven Vermeulen <[email protected]>--- qemu.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)qemu.te +2
-0@@ -50,6 +50,8 @@ role system_r types qemu_t; # qemu local policy # +can_exec(qemu_t, qemu_exec_t) + storage_raw_write_removable_device(qemu_t) storage_raw_read_removable_device(qemu_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com