From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:55875)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jdenemar@redhat.com>) id 1S60dB-0005P0-8a
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 09:17:27 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jdenemar@redhat.com>) id 1S60cz-0008AI-52
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 09:17:16 -0500
Received: from mx1.redhat.com ([209.132.183.28]:23817)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jdenemar@redhat.com>) id 1S60cy-00089x-TR
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 09:17:05 -0500
Date: Fri, 9 Mar 2012 15:16:53 +0100
From: Jiri Denemark <jdenemar@redhat.com>
Message-ID: <20120309141653.GH4883@orkuz.home>
References: <CAJSP0QUvcm_L4kf+6tDupQbEjAtLnOyEcTxddFqWVr4OY_k+NQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAJSP0QUvcm_L4kf+6tDupQbEjAtLnOyEcTxddFqWVr4OY_k+NQ@mail.gmail.com>
Subject: Re: [Qemu-devel] QEMU fstatfs(2) and libvirt SELinux policy
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: libvir-list@redhat.com, qemu-devel <qemu-devel@nongnu.org>, Khoa Huynh <khoa@us.ibm.com>, George Wilson <gcwilson@us.ibm.com>, Paolo Bonzini <pbonzini@redhat.com>, laine@laine.org

Hi.

On Fri, Mar 09, 2012 at 11:32:47 +0000, Stefan Hajnoczi wrote:
...
> static __inline__ int platform_test_xfs_fd(int fd)
> {
>         struct statfs buf;
>         if (fstatfs(fd, &buf) < 0)
>                 return 0;
>         return (buf.f_type == 0x58465342);      /* XFSB */
> }
> 
> In other words, XFS detection will fail when SELinux is enabled.
> 
> I'm not familiar with libvirt's use of SELinux.  Can someone explain
> if we need to expand the policy in libvirt and how to do that?

Actually, there is no SELinux policy in libvirt. Libvirt merely uses an
appropriate security context when running qemu processes. The rules what such
processes can do and what they are forbidden to do are described in SELinux
policy which is provided as a separate package (or packages on some distros).
So it's this policy (selinux-policy package on Fedora based distros) which
would need to be expanded. Thus it should be negotiated with SELinux policy
maintainers if they are willing to allow svirt_t domain calling fstatfs.

Jirka