File 945e8e71-selinux-only-if-supported.patch of Package virt-sandbox

Overview Repositories Revisions Requests Users Attributes Meta

File 945e8e71-selinux-only-if-supported.patch of Package virt-sandbox

From 945e8e71436d457d2e94750fbf151e48b1d2ec63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Bosdonnat?= <cbosdonnat@suse.com>
Date: Tue, 17 Jun 2014 16:01:53 +0200
Subject: [PATCH] Only set SELinux seclabel if supported by the host.

This code depends on new API in libvirt-gconfig to extract the
secmodels handled by the host.
---
 libvirt-sandbox/libvirt-sandbox-builder.c | 50 +++++++++++++++++++++++++++----
 1 file changed, 44 insertions(+), 6 deletions(-)

diff --git a/libvirt-sandbox/libvirt-sandbox-builder.c b/libvirt-sandbox/libvirt-sandbox-builder.c
index 48b3acc..48fc9bc 100644
--- a/libvirt-sandbox/libvirt-sandbox-builder.c
+++ b/libvirt-sandbox/libvirt-sandbox-builder.c
@@ -322,12 +322,10 @@ static gboolean gvir_sandbox_builder_construct_devices(GVirSandboxBuilder *build
     return TRUE;
 }
 
-
-static gboolean gvir_sandbox_builder_construct_security(GVirSandboxBuilder *builder G_GNUC_UNUSED,
-                                                        GVirSandboxConfig *config G_GNUC_UNUSED,
-                                                        const gchar *statedir G_GNUC_UNUSED,
-                                                        GVirConfigDomain *domain,
-                                                        GError **error G_GNUC_UNUSED)
+static gboolean gvir_sandbox_builder_construct_security_selinux (GVirSandboxBuilder *builder,
+                                                                 GVirSandboxConfig *config,
+                                                                 GVirConfigDomain *domain,
+                                                                 GError **error)
 {
     GVirConfigDomainSeclabel *sec = gvir_config_domain_seclabel_new();
     const char *label = gvir_sandbox_config_get_security_label(config);
@@ -360,6 +358,46 @@ static gboolean gvir_sandbox_builder_construct_security(GVirSandboxBuilder *buil
     return TRUE;
 }
 
+static gboolean gvir_sandbox_builder_construct_security(GVirSandboxBuilder *builder,
+                                                        GVirSandboxConfig *config,
+                                                        const gchar *statedir G_GNUC_UNUSED,
+                                                        GVirConfigDomain *domain,
+                                                        GError **error)
+{
+    GVirConnection *connection = gvir_sandbox_builder_get_connection(builder);
+    GVirConfigCapabilities *configCapabilities;
+    GVirConfigCapabilitiesHost *hostCapabilities;
+    GList *secmodels, *iter;
+    gboolean supportsSelinux = FALSE;
+
+    /* What security models are available on the host? */
+    if (!(configCapabilities = gvir_connection_get_capabilities(connection, error))) {
+        g_object_unref(connection);
+        return FALSE;
+    }
+
+    hostCapabilities = gvir_config_capabilities_get_host(configCapabilities);
+
+    secmodels = gvir_config_capabilities_host_get_secmodels(hostCapabilities);
+    for (iter = secmodels; iter != NULL; iter = iter->next) {
+        if (g_str_equal(gvir_config_capabilities_host_secmodel_get_model(
+                GVIR_CONFIG_CAPABILITIES_HOST_SECMODEL(iter->data)), "selinux"))
+            supportsSelinux = TRUE;
+        g_object_unref(iter->data);
+    }
+
+    g_list_free(secmodels);
+    g_object_unref(hostCapabilities);
+    g_object_unref(configCapabilities);
+    g_object_unref(connection);
+
+    if (supportsSelinux)
+        return gvir_sandbox_builder_construct_security_selinux(builder, config,
+                                                               domain, error);
+
+    return TRUE;
+}
+
 
 static gboolean gvir_sandbox_builder_clean_post_start_default(GVirSandboxBuilder *builder G_GNUC_UNUSED,
                                                               GVirSandboxConfig *config G_GNUC_UNUSED,
-- 
1.8.4.5

Places

File 945e8e71-selinux-only-if-supported.patch of Package virt-sandbox

Places