Subject: Re: libvirt: Please enable selinux security driver

From: Laurent Bigonville <[email-masked]>
Date: Thu, 26 Dec 2013 16:36:52 +0100

tag 688179 + patch
thanks

Hi,

Please apply the attached patch.

I've just tested again and the VM's (using qemu) are starting properly
and run in the expected context.

Cheers,

Laurent Bigonville

diff -Nru libvirt-1.2.0/debian/control libvirt-1.2.0/debian/control
--- libvirt-1.2.0/debian/control	2013-12-17 23:14:46.000000000 +0100
+++ libvirt-1.2.0/debian/control	2013-12-26 16:33:45.000000000 +0100
@@ -36,6 +36,7 @@
  libnetcf-dev (>= 1:0.2.3-3~) [linux-any],
  libsanlock-dev [linux-any],
  libaudit-dev [linux-any],
+ libselinux1-dev (>= 2.0.82) [linux-any],
  systemtap-sdt-dev [amd64 armel armhf i386 ia64 powerpc s390],
 # for --with-storage-sheepdog
  sheepdog [linux-any],
@@ -88,6 +89,7 @@
 Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}
 Recommends: lvm2 [linux-any]
+Breaks: selinux-policy-default (<< 2:2.20131214-1~), selinux-policy-mls (<< 2:2.20131214-1~)
 Description: library for interfacing with different virtualization systems
  Libvirt is a C toolkit to interact with the virtualization capabilities
  of recent versions of Linux (and other OSes). The library aims at providing
diff -Nru libvirt-1.2.0/debian/rules libvirt-1.2.0/debian/rules
--- libvirt-1.2.0/debian/rules	2013-12-17 23:14:46.000000000 +0100
+++ libvirt-1.2.0/debian/rules	2013-12-26 15:56:00.000000000 +0100
@@ -29,6 +29,7 @@
   WITH_SANLOCK        = --with-sanlock
   WITH_INIT_SCRIPT    =	--with-init-script=systemd
   WITH_AUDIT          = --with-audit
+  WITH_SELINUX        = --with-selinux --with-secdriver-selinux
   ifneq (,$(findstring $(DEB_HOST_ARCH), amd64 armel armhf i386 ia64 powerpc s390))
       WITH_DTRACE     = --with-dtrace
   else
@@ -61,6 +62,7 @@
   WITH_NETCF          = --without-netcf
   WITH_INIT_SCRIPT    =	--with-init-script=none
   WITH_AUDIT          = --without-audit
+  WITH_SELINUX        = --without-selinux
   WITH_DTRACE         = --without-dtrace
   WITH_XEN            = --without-xen
   WITH_LIBXL          = --without-libxl
@@ -88,7 +90,7 @@
 	$(WITH_STORAGE_RBD)      \
 	$(WITH_INIT_SCRIPT)      \
 	$(WITH_NUMA)             \
-	--without-selinux        \
+	$(WITH_SELINUX)          \
 	--without-esx		 \
 	--without-phyp           \
 	$(WITH_CAPNG)		 \

---

From: Guido Günther <[email-masked]>
Date: Thu, 26 Dec 2013 22:04:07 +0100

> and run in the expected context.

The main reason for not enabling this upfront was that it triggered buts
when selinux was not available. Did you by any chance test this as well?
Cheers,
 -- Guido

> _______________________________________________
> Pkg-libvirt-maintainers mailing list
> [email-masked]
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-libvirt-maintainers

---

From: Laurent Bigonville <[email-masked]>
Date: Thu, 26 Dec 2013 22:50:47 +0100

Le Thu, 26 Dec 2013 22:04:07 +0100,
Guido Günther <[email-masked]> a écrit :

> > I've just tested again and the VM's (using qemu) are starting
> > properly and run in the expected context.
> 
> The main reason for not enabling this upfront was that it triggered
> buts when selinux was not available. Did you by any chance test this
> as well? Cheers,

IIRC the main issue was the fact that the selinux policy was too old.

Anyway, I just retired and I can confirm that with selinux security
driver compiled in libvirt and selinux disabled on the machine, I can
still start VM's

So I guess it's OK

Cheers,

Laurent Bigonville

---

From: Guido Günther <[email-masked]>
Date: Sat, 28 Dec 2013 11:39:57 +0100

Hi,
> IIRC the main issue was the fact that the selinux policy was too old.

Well in fact both. While too old policy is an issue for selinux enabled
systems I rember there were problems in the volumen handling parts with
selinux compiled in but not enabled. But let's check and fix this in
case it pops up again.
Cheers and thanks for your patches,
 -- Guido

P.S.: it'd be awesome if you could generate our patches with
git-format-patch since this would give me the correct authorship
information. Extra bonus points for adding a git-dch compatible "Closes:
#" line.