virSecurityManager: Track if running as privileged

We may want to do some decisions in drivers based on fact if we
are running as privileged user or not. Propagate this info there.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>

diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
index 0e6a3e111dd344a57f578c441105280ecee73b6e..b064919e060365411c201744571416d0a66fd2ca 100644 (file)
--- a/src/lxc/lxc_controller.c
+++ b/src/lxc/lxc_controller.c
@@ -2646,7 +2646,7 @@ int main(int argc, char *argv[])
 
     if (!(ctrl->securityManager = virSecurityManagerNew(securityDriver,
                                                         LXC_DRIVER_NAME,
-                                                        false, false, false)))
+                                                        false, false, false, false)))
         goto cleanup;
 
     if (ctrl->def->seclabels) {

diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index 35df18f2d3ca4a1d9e52c4b341a205f12d37f185..71be9c7de8a6dbdb1cb114de3f2db02505a51260 100644 (file)
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -1558,7 +1558,8 @@ lxcSecurityInit(virLXCDriverConfigPtr cfg)
                                                       LXC_DRIVER_NAME,
                                                       false,
                                                       cfg->securityDefaultConfined,
-                                                      cfg->securityRequireConfined);
+                                                      cfg->securityRequireConfined,
+                                                      true);
     if (!mgr)
         goto error;
 

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 91eb6619243869ed440aec1ef94dc6bd2cf3de23..fcf86b6d94096a9926f9c765d2eb3dae5ae9ca51 100644 (file)
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -398,7 +398,8 @@ qemuSecurityInit(virQEMUDriverPtr driver)
                                               QEMU_DRIVER_NAME,
                                               cfg->allowDiskFormatProbing,
                                               cfg->securityDefaultConfined,
-                                              cfg->securityRequireConfined)))
+                                              cfg->securityRequireConfined,
+                                              virQEMUDriverIsPrivileged(driver))))
                 goto error;
             if (!stack) {
                 if (!(stack = virSecurityManagerNewStack(mgr)))
@@ -415,7 +416,8 @@ qemuSecurityInit(virQEMUDriverPtr driver)
                                           QEMU_DRIVER_NAME,
                                           cfg->allowDiskFormatProbing,
                                           cfg->securityDefaultConfined,
-                                          cfg->securityRequireConfined)))
+                                          cfg->securityRequireConfined,
+                                          virQEMUDriverIsPrivileged(driver))))
             goto error;
         if (!(stack = virSecurityManagerNewStack(mgr)))
             goto error;
@@ -429,6 +431,7 @@ qemuSecurityInit(virQEMUDriverPtr driver)
                                              cfg->allowDiskFormatProbing,
                                              cfg->securityDefaultConfined,
                                              cfg->securityRequireConfined,
+                                             virQEMUDriverIsPrivileged(driver),
                                              cfg->dynamicOwnership,
                                              qemuSecurityChownCallback)))
             goto error;

diff --git a/src/security/security_manager.c b/src/security/security_manager.c
index 1098558b0755eae682e3e697745e7478dfd242f9..28d7dfd0c0b2d697cc19adbc7f5227993d94cd72 100644 (file)
--- a/src/security/security_manager.c
+++ b/src/security/security_manager.c
@@ -40,6 +40,7 @@ struct _virSecurityManager {
     bool allowDiskFormatProbing;
     bool defaultConfined;
     bool requireConfined;
+    bool privileged;
     const char *virtDriver;
     void *privateData;
 };
@@ -78,7 +79,8 @@ virSecurityManagerNewDriver(virSecurityDriverPtr drv,
                             const char *virtDriver,
                             bool allowDiskFormatProbing,
                             bool defaultConfined,
-                            bool requireConfined)
+                            bool requireConfined,
+                            bool privileged)
 {
     virSecurityManagerPtr mgr;
     char *privateData;
@@ -87,10 +89,10 @@ virSecurityManagerNewDriver(virSecurityDriverPtr drv,
         return NULL;
 
     VIR_DEBUG("drv=%p (%s) virtDriver=%s allowDiskFormatProbing=%d "
-              "defaultConfined=%d requireConfined=%d",
+              "defaultConfined=%d requireConfined=%d privileged=%d",
               drv, drv->name, virtDriver,
               allowDiskFormatProbing, defaultConfined,
-              requireConfined);
+              requireConfined, privileged);
 
     if (VIR_ALLOC_N(privateData, drv->privateDataLen) < 0)
         return NULL;
@@ -104,6 +106,7 @@ virSecurityManagerNewDriver(virSecurityDriverPtr drv,
     mgr->allowDiskFormatProbing = allowDiskFormatProbing;
     mgr->defaultConfined = defaultConfined;
     mgr->requireConfined = requireConfined;
+    mgr->privileged = privileged;
     mgr->virtDriver = virtDriver;
     mgr->privateData = privateData;
 
@@ -124,7 +127,8 @@ virSecurityManagerNewStack(virSecurityManagerPtr primary)
                                     virSecurityManagerGetDriver(primary),
                                     virSecurityManagerGetAllowDiskFormatProbing(primary),
                                     virSecurityManagerGetDefaultConfined(primary),
-                                    virSecurityManagerGetRequireConfined(primary));
+                                    virSecurityManagerGetRequireConfined(primary),
+                                    virSecurityManagerGetPrivileged(primary));
 
     if (!mgr)
         return NULL;
@@ -153,6 +157,7 @@ virSecurityManagerNewDAC(const char *virtDriver,
                          bool defaultConfined,
                          bool requireConfined,
                          bool dynamicOwnership,
+                         bool privileged,
                          virSecurityManagerDACChownCallback chownCallback)
 {
     virSecurityManagerPtr mgr =
@@ -160,7 +165,8 @@ virSecurityManagerNewDAC(const char *virtDriver,
                                     virtDriver,
                                     allowDiskFormatProbing,
                                     defaultConfined,
-                                    requireConfined);
+                                    requireConfined,
+                                    privileged);
 
     if (!mgr)
         return NULL;
@@ -182,7 +188,8 @@ virSecurityManagerNew(const char *name,
                       const char *virtDriver,
                       bool allowDiskFormatProbing,
                       bool defaultConfined,
-                      bool requireConfined)
+                      bool requireConfined,
+                      bool privileged)
 {
     virSecurityDriverPtr drv = virSecurityDriverLookup(name, virtDriver);
     if (!drv)
@@ -212,7 +219,8 @@ virSecurityManagerNew(const char *name,
                                        virtDriver,
                                        allowDiskFormatProbing,
                                        defaultConfined,
-                                       requireConfined);
+                                       requireConfined,
+                                       privileged);
 }
 
 
@@ -333,6 +341,13 @@ virSecurityManagerGetRequireConfined(virSecurityManagerPtr mgr)
 }
 
 
+bool
+virSecurityManagerGetPrivileged(virSecurityManagerPtr mgr)
+{
+    return mgr->privileged;
+}
+
+
 /**
  * virSecurityManagerRestoreDiskLabel:
  * @mgr: security manager object

diff --git a/src/security/security_manager.h b/src/security/security_manager.h
index 78f34a033fddb1fe02b082ee5f648a7aa71293b7..53e56f684a7d35f293140e55948e38dfb4570270 100644 (file)
--- a/src/security/security_manager.h
+++ b/src/security/security_manager.h
@@ -34,7 +34,8 @@ virSecurityManagerPtr virSecurityManagerNew(const char *name,
                                             const char *virtDriver,
                                             bool allowDiskFormatProbing,
                                             bool defaultConfined,
-                                            bool requireConfined);
+                                            bool requireConfined,
+                                            bool privileged);
 
 virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary);
 int virSecurityManagerStackAddNested(virSecurityManagerPtr stack,
@@ -62,6 +63,7 @@ virSecurityManagerPtr virSecurityManagerNewDAC(const char *virtDriver,
                                                bool defaultConfined,
                                                bool requireConfined,
                                                bool dynamicOwnership,
+                                               bool privileged,
                                                virSecurityManagerDACChownCallback chownCallback);
 
 int virSecurityManagerPreFork(virSecurityManagerPtr mgr);
@@ -77,6 +79,7 @@ const char *virSecurityManagerGetBaseLabel(virSecurityManagerPtr mgr, int virtTy
 bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr);
 bool virSecurityManagerGetDefaultConfined(virSecurityManagerPtr mgr);
 bool virSecurityManagerGetRequireConfined(virSecurityManagerPtr mgr);
+bool virSecurityManagerGetPrivileged(virSecurityManagerPtr mgr);
 
 int virSecurityManagerRestoreDiskLabel(virSecurityManagerPtr mgr,
                                        virDomainDefPtr def,

diff --git a/tests/qemuhotplugtest.c b/tests/qemuhotplugtest.c
index 368a5e7bfd5d2621f101d403c96960a9e92e40ec..48318bd78b53efbc76d142a94c4c8d9bdada3b44 100644 (file)
--- a/tests/qemuhotplugtest.c
+++ b/tests/qemuhotplugtest.c
@@ -361,7 +361,7 @@ mymain(void)
     if (!driver.lockManager)
         return EXIT_FAILURE;
 
-    if (!(mgr = virSecurityManagerNew("none", "qemu", false, false, false)))
+    if (!(mgr = virSecurityManagerNew("none", "qemu", false, false, false, true)))
         return EXIT_FAILURE;
     if (!(driver.securityManager = virSecurityManagerNewStack(mgr)))
         return EXIT_FAILURE;

diff --git a/tests/seclabeltest.c b/tests/seclabeltest.c
index 51765c9ec4b843b5cdf324d68d1f02eb8113cf76..93ddcbbddaa5f2982e488de5dc7bd32a6419e413 100644 (file)
--- a/tests/seclabeltest.c
+++ b/tests/seclabeltest.c
@@ -17,7 +17,7 @@ main(int argc ATTRIBUTE_UNUSED, char **argv ATTRIBUTE_UNUSED)
     if (virThreadInitialize() < 0)
         return EXIT_FAILURE;
 
-    mgr = virSecurityManagerNew(NULL, "QEMU", false, true, false);
+    mgr = virSecurityManagerNew(NULL, "QEMU", false, true, false, false);
     if (mgr == NULL) {
         fprintf(stderr, "Failed to start security driver");
         return EXIT_FAILURE;

diff --git a/tests/securityselinuxlabeltest.c b/tests/securityselinuxlabeltest.c
index 85fad370bfba169681ce8ba97910be223f4e7311..4808eea386183e8007a13c2914f25021b8de3a99 100644 (file)
--- a/tests/securityselinuxlabeltest.c
+++ b/tests/securityselinuxlabeltest.c
@@ -351,7 +351,7 @@ mymain(void)
     if (!rc)
         return EXIT_AM_SKIP;
 
-    if (!(mgr = virSecurityManagerNew("selinux", "QEMU", false, true, false))) {
+    if (!(mgr = virSecurityManagerNew("selinux", "QEMU", false, true, false, true))) {
         virErrorPtr err = virGetLastError();
         VIR_TEST_VERBOSE("Unable to initialize security driver: %s\n",
                 err->message);

diff --git a/tests/securityselinuxtest.c b/tests/securityselinuxtest.c
index 38ab70e6ac8e22868ca69d2b46118349c0d048be..3a7862f4260e841687eca8a6d9693baf99f3b6cb 100644 (file)
--- a/tests/securityselinuxtest.c
+++ b/tests/securityselinuxtest.c
@@ -272,7 +272,7 @@ mymain(void)
     int ret = 0;
     virSecurityManagerPtr mgr;
 
-    if (!(mgr = virSecurityManagerNew("selinux", "QEMU", false, true, false))) {
+    if (!(mgr = virSecurityManagerNew("selinux", "QEMU", false, true, false, true))) {
         virErrorPtr err = virGetLastError();
         fprintf(stderr, "Unable to initialize security driver: %s\n",
                 err->message);