From: dac.override@gmail.com (Dominick Grift)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] lxc_contexts file used by libvirt
Date: Sun, 14 Feb 2016 22:24:58 +0100 [thread overview]
Message-ID: <56C0F0AA.5040604@gmail.com> (raw)
In-Reply-To: <56C08898.6080608@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 02/14/2016 03:00 PM, Laurent Bigonville wrote:
> Hello,
>
> libvirt uses a config file which is not shipped by the refpolicy
> (config/appconfig-*/lxc_contexts)
>
> The fedora policy contains the following file:
>
> process = "system_u:system_r:svirt_lxc_net_t:s0" content =
> "system_u:object_r:virt_var_lib_t:s0" file =
> "system_u:object_r:svirt_sandbox_file_t:s0" sandbox_kvm_process =
> "system_u:system_r:svirt_qemu_net_t:s0" sandbox_kvm_process =
> "system_u:system_r:svirt_qemu_net_t:s0" sandbox_lxc_process =
> "system_u:system_r:svirt_lxc_net_t:s0"
>
> This file is not working with the refpolicy because
> "svirt_sandbox_file_t" doesn't exist.
>
> The following file seems to work on my system:
>
> process = "system_u:system_r:svirt_lxc_net_t:s0" content =
> "system_u:object_r:virt_var_lib_t:s0" file =
> "system_u:object_r:svirt_lxc_file_t:s0"
>
> The processes of the lxc are running under
> "system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023"
>
> Looking at the libvirt code, I don't see sandbox_kvm_process and
> sandbox_lxc_process being used anywhere (except in some test
> file).
>
> Shouldn't this file be added to the refpolicy?
>
Yes, should be added. Its also in upstream libselinux
> Cheers,
>
> Laurent Bigonville _______________________________________________
> refpolicy mailing list refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
>
- --
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQGcBAEBCAAGBQJWwPClAAoJECV0jlU3+UdpEwEL/1kNDZMxfDANbEQ8Jff/3qEy
UCtWFa59n0gbb5zLhQ3utUlal9Hcj2/yuZNH8IKbnUlKkziRBpPwJbBQ54bZzqZc
vJ0D4+8B2rY3UkRDxo9mkS8r/3O4V3PVhzMIzIOuYjElGTqBBzTMO/JsDciI4ORs
W7kbjCSr1HQmTpteo+WV8d4SFsRzHZ6avqw3qr/ljBuBfPT0Exeg4Ik0H4ZT+oW+
4fqhF5V7czrDUwsmLeAQ2rALsia/Bw5g+zOtTt09jf+lflJyttO177emg3962GQ+
FHb3FHFM6mA7t+p1DKwzGiRGQTKegmP2IGjk6uNNAgwNlw2Tr9KVobewAn70D+Lt
Jl7eq2c9WIQPHICoxryX5DSwcwGlu4Xds4usNv0tDXGCFeThkHxjbxJdazM4S/be
f4+hqQYv+/VdazaZrkmnc3E0Sr1g73/byq7wi8XnI1GoDfKtJOK1YSSW7wNN8Mz2
29F4znz3xS0pt7MFp/ASgYhNFtTqSWIODz/ToSETtQ==
=M48f
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2016-02-14 21:24 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-14 14:00 [refpolicy] lxc_contexts file used by libvirt Laurent Bigonville
2016-02-14 21:24 ` Dominick Grift [this message]
2016-02-17 17:31 ` Laurent Bigonville
2016-02-17 17:32 ` Dominick Grift
2016-02-17 18:39 ` Daniel J Walsh
2016-02-18 11:07 ` Laurent Bigonville
2016-02-18 13:48 ` Daniel J Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56C0F0AA.5040604@gmail.com \
--to=dac.override@gmail.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.