From: bigon@debian.org (Laurent Bigonville)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] lxc_contexts file used by libvirt
Date: Wed, 17 Feb 2016 18:31:16 +0100 [thread overview]
Message-ID: <56C4AE64.4010009@debian.org> (raw)
In-Reply-To: <56C0F0AA.5040604@gmail.com>
Le 14/02/16 22:24, Dominick Grift a ?crit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 02/14/2016 03:00 PM, Laurent Bigonville wrote:
>> Hello,
>>
>> libvirt uses a config file which is not shipped by the refpolicy
>> (config/appconfig-*/lxc_contexts)
>>
>> The fedora policy contains the following file:
>>
>> process = "system_u:system_r:svirt_lxc_net_t:s0" content =
>> "system_u:object_r:virt_var_lib_t:s0" file =
>> "system_u:object_r:svirt_sandbox_file_t:s0" sandbox_kvm_process =
>> "system_u:system_r:svirt_qemu_net_t:s0" sandbox_kvm_process =
>> "system_u:system_r:svirt_qemu_net_t:s0" sandbox_lxc_process =
>> "system_u:system_r:svirt_lxc_net_t:s0"
>>
>> This file is not working with the refpolicy because
>> "svirt_sandbox_file_t" doesn't exist.
>>
>> The following file seems to work on my system:
>>
>> process = "system_u:system_r:svirt_lxc_net_t:s0" content =
>> "system_u:object_r:virt_var_lib_t:s0" file =
>> "system_u:object_r:svirt_lxc_file_t:s0"
>>
>> The processes of the lxc are running under
>> "system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023"
>>
>> Looking at the libvirt code, I don't see sandbox_kvm_process and
>> sandbox_lxc_process being used anywhere (except in some test
>> file).
>>
>> Shouldn't this file be added to the refpolicy?
>>
> Yes, should be added. Its also in upstream libselinux
I can propose a patch, but I'm a bit concerned about the correctness of
the content of the file tbh, especially the sandbox_*_process fields
next prev parent reply other threads:[~2016-02-17 17:31 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-14 14:00 [refpolicy] lxc_contexts file used by libvirt Laurent Bigonville
2016-02-14 21:24 ` Dominick Grift
2016-02-17 17:31 ` Laurent Bigonville [this message]
2016-02-17 17:32 ` Dominick Grift
2016-02-17 18:39 ` Daniel J Walsh
2016-02-18 11:07 ` Laurent Bigonville
2016-02-18 13:48 ` Daniel J Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56C4AE64.4010009@debian.org \
--to=bigon@debian.org \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.