3d212b41e9
Under SELinux, Unix domain sockets have two labels. One is on the disk and can be set with commands such as chcon(1). There is a different label stored in memory (called the process label). This can only be set by the process creating the socket. When using SELinux + SVirt and wanting qemu to be able to connect to a qemu-nbd instance, you must set both labels correctly first. For qemu-nbd the options to set the second label are awkward. You can create the socket in a wrapper program and then exec into qemu-nbd. Or you could try something with LD_PRELOAD. This commit adds the ability to set the label straightforwardly on the command line, via the new --selinux-label flag. (The name of the flag is the same as the equivalent nbdkit option.) A worked example showing how to use the new option can be found in this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1984938 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1984938 Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> [eblake: rebase to configure changes, reject --selinux-label if it is not compiled in or not used on a Unix socket] Note that we may relax some of these restrictions at a later date, such as making it possible to label a TCP socket, although it may be smarter to do so as a generic QMP action rather than more one-off command lines in qemu-nbd. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20211115202944.615966-1-eblake@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> [eblake: adjust meson output as suggested by thuth] Signed-off-by: Eric Blake <eblake@redhat.com>
118 lines
2.2 KiB
Docker
118 lines
2.2 KiB
Docker
FROM docker.io/library/ubuntu:18.04
|
|
ENV PACKAGES \
|
|
bc \
|
|
bsdmainutils \
|
|
bzip2 \
|
|
ca-certificates \
|
|
ccache \
|
|
clang \
|
|
dbus \
|
|
debianutils \
|
|
diffutils \
|
|
exuberant-ctags \
|
|
findutils \
|
|
g++ \
|
|
gcc \
|
|
gcovr \
|
|
genisoimage \
|
|
gettext \
|
|
git \
|
|
glusterfs-common \
|
|
hostname \
|
|
libaio-dev \
|
|
libasan5 \
|
|
libasound2-dev \
|
|
libattr1-dev \
|
|
libbrlapi-dev \
|
|
libbz2-dev \
|
|
libc6-dev \
|
|
libcacard-dev \
|
|
libcap-ng-dev \
|
|
libcapstone-dev \
|
|
libcurl4-gnutls-dev \
|
|
libdaxctl-dev \
|
|
libdrm-dev \
|
|
libepoxy-dev \
|
|
libfdt-dev \
|
|
libffi-dev \
|
|
libgbm-dev \
|
|
libgcrypt20-dev \
|
|
libglib2.0-dev \
|
|
libgnutls28-dev \
|
|
libgtk-3-dev \
|
|
libibverbs-dev \
|
|
libiscsi-dev \
|
|
libjemalloc-dev \
|
|
libjpeg-turbo8-dev \
|
|
liblttng-ust-dev \
|
|
liblzo2-dev \
|
|
libncursesw5-dev \
|
|
libnfs-dev \
|
|
libnuma-dev \
|
|
libpam0g-dev \
|
|
libpixman-1-dev \
|
|
libpmem-dev \
|
|
libpng-dev \
|
|
libpulse-dev \
|
|
librbd-dev \
|
|
librdmacm-dev \
|
|
libsasl2-dev \
|
|
libsdl2-dev \
|
|
libsdl2-image-dev \
|
|
libseccomp-dev \
|
|
libselinux-dev \
|
|
libsnappy-dev \
|
|
libspice-protocol-dev \
|
|
libspice-server-dev \
|
|
libssh-dev \
|
|
libsystemd-dev \
|
|
libtasn1-6-dev \
|
|
libtest-harness-perl \
|
|
libubsan1 \
|
|
libudev-dev \
|
|
libusb-1.0-0-dev \
|
|
libusbredirhost-dev \
|
|
libvdeplug-dev \
|
|
libvirglrenderer-dev \
|
|
libvte-2.91-dev \
|
|
libxen-dev \
|
|
libxml2-dev \
|
|
libzstd-dev \
|
|
llvm \
|
|
locales \
|
|
make \
|
|
multipath-tools \
|
|
netcat-openbsd \
|
|
nettle-dev \
|
|
ninja-build \
|
|
openssh-client \
|
|
perl-base \
|
|
pkgconf \
|
|
python3 \
|
|
python3-numpy \
|
|
python3-opencv \
|
|
python3-pillow \
|
|
python3-pip \
|
|
python3-setuptools \
|
|
python3-sphinx \
|
|
python3-sphinx-rtd-theme \
|
|
python3-venv \
|
|
python3-wheel \
|
|
python3-yaml \
|
|
rpm2cpio \
|
|
sed \
|
|
sparse \
|
|
systemtap-sdt-dev \
|
|
tar \
|
|
tesseract-ocr \
|
|
tesseract-ocr-eng \
|
|
texinfo \
|
|
xfslibs-dev \
|
|
zlib1g-dev
|
|
RUN apt-get update && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y install $PACKAGES
|
|
RUN dpkg -l $PACKAGES | sort > /packages.txt
|
|
|
|
# https://bugs.launchpad.net/qemu/+bug/1838763
|
|
ENV QEMU_CONFIGURE_OPTS --disable-libssh
|