NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

virt-aa-helper: handle 9pfs

Browse Source 
Make virt-aa-helper create rules to allow VMs access to filesystem
mounts from the host.

Signed-off-by: Felix Geyer <debfx@fobos.de>
Signed-off-by: Hiroshi Miura <miurahr@linux.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Guido Günther <agx@sigxcpu.org>
This commit is contained in:
Felix Geyer 2014-03-09 16:03:20 +01:00 committed by Guido Günther
parent 7d949aa9c2
commit 29ea8a9b64
1 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
src/security/virt-aa-helper.c
View File

@ -606,9 +606,6 @@ valid_path(const char *path, const bool readonly)
return -1; return -1;
switch (sb.st_mode & S_IFMT) { switch (sb.st_mode & S_IFMT) {
case S_IFDIR:
return 1;
break;
case S_IFSOCK: case S_IFSOCK:
return 1; return 1;
break; break;
@ -775,7 +772,7 @@ get_definition(vahControl * ctl, const char *xmlStr)
} }
static int static int
vah_add_file(virBufferPtr buf, const char *path, const char *perms) vah_add_path(virBufferPtr buf, const char *path, const char *perms, bool recursive)
{ {
char *tmp = NULL; char *tmp = NULL;
int rc = -1; int rc = -1;
@ -816,10 +813,14 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms)
goto cleanup; goto cleanup;
} }
virBufferAsprintf(buf, " \"%s\" %s,\n", tmp, perms); virBufferAsprintf(buf, " \"%s%s\" %s,\n", tmp, recursive ? "/**" : "", perms);
if (readonly) { if (readonly) {
virBufferAddLit(buf, " # don't audit writes to readonly files\n"); virBufferAddLit(buf, " # don't audit writes to readonly files\n");
virBufferAsprintf(buf, " deny \"%s\" w,\n", tmp); virBufferAsprintf(buf, " deny \"%s%s\" w,\n", tmp, recursive ? "/**" : "");
}
if (recursive) {
/* allow reading (but not creating) the dir */
virBufferAsprintf(buf, " \"%s/\" r,\n", tmp);
} }
cleanup: cleanup:
@ -828,6 +829,12 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms)
return rc; return rc;
} }
static int
vah_add_file(virBufferPtr buf, const char *path, const char *perms)
{
return vah_add_path(buf, path, perms, false);
}
static int static int
vah_add_file_chardev(virBufferPtr buf, vah_add_file_chardev(virBufferPtr buf,
const char *path, const char *path,
@ -1077,6 +1084,19 @@ get_files(vahControl * ctl)
} /* switch */ } /* switch */
} }
for (i = 0; i < ctl->def->nfss; i++) {
if (ctl->def->fss[i] &&
ctl->def->fss[i]->type == VIR_DOMAIN_FS_TYPE_MOUNT &&
(ctl->def->fss[i]->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_PATH ||
ctl->def->fss[i]->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_DEFAULT) &&
ctl->def->fss[i]->src){
virDomainFSDefPtr fs = ctl->def->fss[i];
if (vah_add_path(&buf, fs->src, fs->readonly ? "r" : "rw", true) != 0)
goto cleanup;
}
}
if (ctl->newfile) if (ctl->newfile)
if (vah_add_file(&buf, ctl->newfile, "rw") != 0) if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
goto cleanup; goto cleanup;