From: bigon@debian.org (Laurent Bigonville)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] lxc_contexts file used by libvirt
Date: Sun, 14 Feb 2016 15:00:56 +0100 [thread overview]
Message-ID: <56C08898.6080608@debian.org> (raw)
Hello,
libvirt uses a config file which is not shipped by the refpolicy
(config/appconfig-*/lxc_contexts)
The fedora policy contains the following file:
process = "system_u:system_r:svirt_lxc_net_t:s0"
content = "system_u:object_r:virt_var_lib_t:s0"
file = "system_u:object_r:svirt_sandbox_file_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_lxc_process = "system_u:system_r:svirt_lxc_net_t:s0"
This file is not working with the refpolicy because
"svirt_sandbox_file_t" doesn't exist.
The following file seems to work on my system:
process = "system_u:system_r:svirt_lxc_net_t:s0"
content = "system_u:object_r:virt_var_lib_t:s0"
file = "system_u:object_r:svirt_lxc_file_t:s0"
The processes of the lxc are running under
"system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023"
Looking at the libvirt code, I don't see sandbox_kvm_process and
sandbox_lxc_process being used anywhere (except in some test file).
Shouldn't this file be added to the refpolicy?
Cheers,
Laurent Bigonville
next reply other threads:[~2016-02-14 14:00 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-14 14:00 Laurent Bigonville [this message]
2016-02-14 21:24 ` [refpolicy] lxc_contexts file used by libvirt Dominick Grift
2016-02-17 17:31 ` Laurent Bigonville
2016-02-17 17:32 ` Dominick Grift
2016-02-17 18:39 ` Daniel J Walsh
2016-02-18 11:07 ` Laurent Bigonville
2016-02-18 13:48 ` Daniel J Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56C08898.6080608@debian.org \
--to=bigon@debian.org \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.