Eric Blake 6cb4acce8b
seclabel: extend XML to allow per-disk label overrides ...
When doing security relabeling, there are cases where a per-file
override might be appropriate. For example, with a static label
and relabeling, it might be appropriate to skip relabeling on a
particular disk, where the backing file lives on NFS that lacks
the ability to track labeling. Or with dynamic labeling, it might
be appropriate to use a custom (non-dynamic) label for a disk
specifically intended to be shared across domains.
The new XML resembles the top-level <seclabel>, but with fewer
options (basically relabel='no', or <label>text</label>):
<domain ...>
...
<devices>
<disk type='file' device='disk'>
<source file='/path/to/image1'>
<seclabel relabel='no'/> <!-- override for just this disk -->
</source>
...
</disk>
<disk type='file' device='disk'>
<source file='/path/to/image1'>
<seclabel relabel='yes'> <!-- override for just this disk -->
<label>system_u:object_r:shared_content_t:s0</label>
</seclabel>
</source>
...
</disk>
...
</devices>
<seclabel type='dynamic' model='selinux'>
<baselabel>text</baselabel> <!-- used for all devices without override -->
</seclabel>
</domain>
This patch only introduces the XML and documentation; future patches
will actually parse and make use of it. The intent is that we can
further extend things as needed, adding a per-device <seclabel> in
more places (such as the source of a console device), and possibly
allowing a <baselabel> instead of <label> for labeling where we want
to reuse the cNNN,cNNN pair of a dynamically labeled domain but a
different base label.
First suggested by Daniel P. Berrange here:
https://www.redhat.com/archives/libvir-list/2011-December/msg00258.html
* docs/schemas/domaincommon.rng (devSeclabel): New define.
(disk): Use it.
* docs/formatdomain.html.in (elementsDisks, seclabel): Document
the new XML.
* tests/qemuxml2argvdata/qemuxml2argv-seclabel-dynamic-override.xml:
New test, to validate RNG.
2011-12-30 10:57:58 +08:00
2010-12-02 11:13:09 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-07-11 11:47:14 +02:00
2011-07-11 11:47:14 +02:00
2011-11-30 11:36:11 -07:00
2011-11-30 11:36:11 -07:00
2011-11-29 12:26:21 -07:00
2011-11-29 12:26:21 -07:00
2011-02-08 11:43:45 -07:00
2011-02-08 11:43:45 -07:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-01 19:11:58 +02:00
2011-06-01 19:11:58 +02:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-02-04 09:17:01 -07:00
2011-02-04 09:17:01 -07:00
2011-02-03 21:14:50 -07:00
2011-02-03 21:14:50 -07:00
2011-11-03 12:01:05 +00:00
2011-01-29 00:42:10 +01:00
2011-11-03 12:01:05 +00:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-11-03 12:01:05 +00:00
2011-11-03 12:01:05 +00:00
2011-11-03 12:01:05 +00:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-11-17 13:47:11 -07:00
2011-11-17 13:47:11 -07:00
2011-11-17 13:47:11 -07:00
2011-11-17 13:47:11 -07:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-03-29 22:13:46 +08:00
2011-07-21 17:11:12 +08:00
2011-03-03 07:45:31 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-09-02 08:42:54 -06:00
2011-09-02 08:42:54 -06:00
2011-09-23 08:29:57 -06:00
2011-09-23 08:29:57 -06:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-10-26 11:55:39 -06:00
2011-01-29 00:42:10 +01:00
2011-10-26 11:55:39 -06:00
2011-01-29 00:42:10 +01:00
2011-10-26 11:55:39 -06:00
2011-10-06 14:49:23 -04:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-11-15 17:06:42 -07:00
2011-11-15 17:06:42 -07:00
2011-11-15 17:06:42 -07:00
2011-11-15 17:06:42 -07:00
2011-11-15 17:06:42 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-15 11:29:09 +02:00
2011-06-15 11:29:09 +02:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-22 09:26:24 +02:00
2011-06-22 09:26:24 +02:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-01 19:14:08 +02:00
2011-06-01 19:14:08 +02:00
2011-10-17 15:44:21 -06:00
2011-10-17 15:44:21 -06:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-09-05 07:03:04 -06:00
2011-09-05 07:03:04 -06:00
2011-09-05 07:03:04 -06:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-12-09 19:40:53 -05:00
2011-12-09 19:40:53 -05:00
2011-08-15 09:35:42 -04:00
2011-08-15 09:35:42 -04:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-10-12 12:15:28 -06:00
2011-10-12 12:15:28 -06:00
2011-07-28 13:46:39 -04:00
2011-07-28 13:46:39 -04:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-05-31 16:33:36 +02:00
2011-07-28 13:46:39 -04:00
2011-03-06 22:00:27 +08:00
2011-07-28 13:46:39 -04:00
2011-06-01 15:41:24 -06:00
2011-07-08 17:00:43 +02:00
2011-06-14 17:03:26 -06:00
2011-07-28 13:46:39 -04:00
2011-01-31 11:25:34 -07:00
2011-07-28 13:46:39 -04:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-07-28 13:46:39 -04:00
2011-05-24 10:33:53 -04:00
2011-07-28 13:46:39 -04:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-09-27 11:23:28 -04:00
2011-09-27 11:23:28 -04:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-09-02 23:39:03 +08:00
2011-09-02 23:22:56 +08:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-07-28 13:46:39 -04:00
2011-06-02 10:54:00 +01:00
2011-06-02 10:54:00 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-09-21 16:53:06 +02:00
2011-06-24 12:13:47 +01:00
2011-10-01 11:48:28 -04:00
2011-10-01 11:48:28 -04:00
2011-07-25 13:50:20 +08:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-02-17 11:07:58 -05:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-07-21 14:46:44 -04:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-09-21 16:53:06 +02:00
2011-09-21 16:53:06 +02:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-06-20 15:17:43 +08:00
2011-06-20 15:17:43 +08:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-12-30 10:38:37 +08:00
2011-12-30 10:38:37 +08:00
2011-12-30 10:57:58 +08:00
2011-12-30 10:38:37 +08:00
2011-12-30 10:38:37 +08:00
2011-12-30 10:38:37 +08:00
2011-12-30 10:38:37 +08:00
2011-12-30 10:38:37 +08:00
2011-12-30 10:38:37 +08:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-14 10:29:39 -06:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-08-11 15:19:51 +08:00
2011-08-11 15:19:51 +08:00
2011-08-11 15:19:51 +08:00
2011-08-11 15:19:51 +08:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-02-03 19:27:43 -07:00
2011-04-06 10:05:14 -06:00
2011-02-03 19:27:43 -07:00
2011-04-06 10:05:14 -06:00
2011-02-03 19:27:43 -07:00
2011-04-06 10:05:14 -06:00
2011-02-04 09:00:39 -07:00
2011-04-06 10:05:14 -06:00
2011-02-03 19:27:43 -07:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-10-01 11:48:28 -04:00
2011-10-01 11:48:28 -04:00
2011-09-05 15:03:27 +08:00
2011-09-05 15:03:27 +08:00
2011-09-05 15:03:27 +08:00
2011-09-02 23:38:52 +08:00
2011-10-01 11:48:28 -04:00
2011-10-01 11:48:28 -04:00
2011-10-01 11:48:28 -04:00
2011-09-02 23:22:56 +08:00
2011-10-01 11:48:28 -04:00
2011-09-02 23:22:56 +08:00
2011-09-05 15:03:27 +08:00
2011-09-02 23:39:03 +08:00
2011-10-01 11:48:28 -04:00
2011-10-01 11:48:28 -04:00
2011-04-06 10:05:14 -06:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
2011-01-31 11:25:34 -07:00
2011-01-29 00:42:10 +01:00
6cb4acce8b