From: dwalsh@redhat.com (Daniel J Walsh)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] lxc_contexts file used by libvirt
Date: Thu, 18 Feb 2016 08:48:41 -0500 [thread overview]
Message-ID: <56C5CBB9.3000909@redhat.com> (raw)
In-Reply-To: <56C5A5FA.9050201@debian.org>
On 02/18/2016 06:07 AM, Laurent Bigonville wrote:
> Le 17/02/16 19:39, Daniel J Walsh a ?crit :
>> On 02/17/2016 12:32 PM, Dominick Grift wrote:
>>> On 02/17/2016 06:31 PM, Laurent Bigonville wrote:
>>>> Le 14/02/16 22:24, Dominick Grift a ?crit :
>>>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
>>>>>
>>>>> On 02/14/2016 03:00 PM, Laurent Bigonville wrote:
>>>>>> Hello,
>>>>>>
>>>>>> libvirt uses a config file which is not shipped by the
>>>>>> refpolicy (config/appconfig-*/lxc_contexts)
>>>>>>
>>>>>> The fedora policy contains the following file:
>>>>>>
>>>>>> process = "system_u:system_r:svirt_lxc_net_t:s0" content =
>>>>>> "system_u:object_r:virt_var_lib_t:s0" file =
>>>>>> "system_u:object_r:svirt_sandbox_file_t:s0" sandbox_kvm_process
>>>>>> = "system_u:system_r:svirt_qemu_net_t:s0" sandbox_kvm_process
>>>>>> = "system_u:system_r:svirt_qemu_net_t:s0" sandbox_lxc_process
>>>>>> = "system_u:system_r:svirt_lxc_net_t:s0"
>>>>>>
>>>>>> This file is not working with the refpolicy because
>>>>>> "svirt_sandbox_file_t" doesn't exist.
>>>>>>
>>>>>> The following file seems to work on my system:
>>>>>>
>>>>>> process = "system_u:system_r:svirt_lxc_net_t:s0" content =
>>>>>> "system_u:object_r:virt_var_lib_t:s0" file =
>>>>>> "system_u:object_r:svirt_lxc_file_t:s0"
>>>>>>
>>>>>> The processes of the lxc are running under
>>>>>> "system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023"
>>>>>>
>>>>>> Looking at the libvirt code, I don't see sandbox_kvm_process
>>>>>> and sandbox_lxc_process being used anywhere (except in some
>>>>>> test file).
>>>>>>
>>>>>> Shouldn't this file be added to the refpolicy?
>>>>>>
>>>>> Yes, should be added. Its also in upstream libselinux
>>>> I can propose a patch, but I'm a bit concerned about the
>>>> correctness of the content of the file tbh, especially the
>>>> sandbox_*_process fields
>>> Yes, i would only include what i know for sure to be right. leave
>>> everything else out
>>>
>>>
>> Which types are questionable?
> I cannot find where the sandbox_*_process parameters are used.
> (https://codesearch.debian.net/results/sandbox_lxc_process/)
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
They were added for libvirt. I see these names in their tests suite,
although I am not sure h ow they are using them.
prev parent reply other threads:[~2016-02-18 13:48 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-14 14:00 [refpolicy] lxc_contexts file used by libvirt Laurent Bigonville
2016-02-14 21:24 ` Dominick Grift
2016-02-17 17:31 ` Laurent Bigonville
2016-02-17 17:32 ` Dominick Grift
2016-02-17 18:39 ` Daniel J Walsh
2016-02-18 11:07 ` Laurent Bigonville
2016-02-18 13:48 ` Daniel J Walsh [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56C5CBB9.3000909@redhat.com \
--to=dwalsh@redhat.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.