Euler Robot 5359856aaa security: fix SELinux label generation logic ...

A process can access a file if the set of MCS categories
for the file is equal-to *or* a subset-of, the set of
MCS categories for the process.

If there are two VMs:

  a) svirt_t:s0:c117
  b) svirt_t:s0:c117,c720

Then VM (b) is able to access files labelled for VM (a).

IOW, we must discard case where the categories are equal
because that is a subset of many other valid category pairs.

Fixes: https://gitlab.com/libvirt/libvirt/-/issues/153
CVE-2021-3631
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

2021-09-26 21:28:36 +08:00

.gitee

PR/issue: Add templates for Issues and PR

2020-01-13 11:15:23 +08:00

conf-domain_conf-pin-the-retry_interval-and-retry_ti.patch

conf/domain_conf: pin the retry_interval and retry_timeout parameters to xml

2021-09-24 11:28:32 +08:00

cpu_map-Add-Cooperlake-x86-CPU-model.patch

add new CPU model Cooperlake

2021-07-27 14:20:39 +08:00

cpu_map-Add-pschange-mc-no-bit-in-IA32_ARCH_CAPABILI.patch

add new CPU model Cooperlake

2021-07-27 14:20:39 +08:00

cpu_map-Distribute-x86_Cooperlake.xml.patch

add new CPU model Cooperlake

2021-07-27 14:20:39 +08:00

libvirt-6.2.0.tar.xz

Rebase libvirt to version 6.2.0

2020-05-12 09:23:27 +08:00

libvirt-Add-retry-support-for-error-policy.patch

libvirt: Add 'retry' support for error policy

2021-04-23 11:28:50 +08:00

libvirt-cgroup-cleanup-eventParams-when-virTypedParamsAddULL.patch

cherry-pick bugfixes from version 5.5.0

2020-05-12 09:23:35 +08:00

libvirt-conf-Don-t-format-http-cookies-unless-VIR_DOMAIN_DEF.patch

Substitute security_context_t with char *

2020-08-04 09:40:08 +00:00

libvirt-conf-Set-default-values-of-retry-fileds.patch

libvirt/conf: Set default values of retry fileds

2021-04-23 11:28:50 +08:00

libvirt-cpu_map-add-kunpeng-920-features-as-known-features.patch

cpu_map: introduce Kunpeng-920 cpu features

2020-05-26 20:31:02 +08:00

libvirt-cpu_map-Introduce-arm-CPU-models.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-cpu-aarch64-enable-host-model-cpu-for-AArch64-archit.patch

cpu-model: enable 'host-model' cpu mode for AArch64 architecture

2020-05-20 15:16:15 +08:00

libvirt-cpu-arm-add-cpu-data-free-function-to-virCPUarmDataF.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-cpu-arm-add-decode-function.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-cpu-arm-add-load-cpu-map-parse-function.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-cpu-arm-add-virCPUarmGetHost-implment.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-cpu-arm-implment-cpu-baseline-function.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-cpu-arm-implment-cpu-compare-function.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-cpu-introduce-virCPUarmData-to-virCPUData.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-nodedev-fix-potential-heap-use-after-free.patch

cherry-pick bugfixes from version 5.5.0

2020-05-12 09:23:35 +08:00

libvirt-po-Refresh-translation-for-running-state.patch

cherry-pick bugfixes from version 5.5.0

2020-05-12 09:23:35 +08:00

libvirt-qemu-add-pointer-check-in-qemuMonitorLastError.patch

cherry-pick bugfixes from version 5.5.0

2020-05-12 09:23:35 +08:00

libvirt-qemu-fix-a-concurrent-operation-situation.patch

cherry-pick bugfixes from version 5.5.0

2020-05-12 09:23:35 +08:00

libvirt-qemu-fix-potential-memory-leak.patch

cherry-pick bugfixes from version 5.5.0

2020-05-12 09:23:35 +08:00

libvirt-Substitute-security_context_t-with-char.patch

Substitute security_context_t with char *

2020-08-04 09:40:08 +00:00

libvirt-tests-add-baseline-test-cases-for-arm-CPU.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-tests-add-cpu-compare-test-cases-for-arm-CPU.patch

cpu: add cpu model support for kunpeng-920

2020-05-12 11:14:30 +08:00

libvirt-util-virdaemon-fix-waiting-for-child-processes.patch

bugfix: fix virsh dump/migrate and virDaemon return code error

2020-05-12 11:14:39 +08:00

libvirt-virsh-Fix-return-code-for-dump-and-migrate.patch

bugfix: fix virsh dump/migrate and virDaemon return code error

2020-05-12 11:14:39 +08:00

libvirt-virsh-Fix-return-code-for-dump.patch

bugfix: fix virsh dump/migrate and virDaemon return code error

2020-05-12 11:14:39 +08:00

libvirt-virstoragetest-testBackingParse-Use-VIR_DOMAIN_DEF_F.patch

Substitute security_context_t with char *

2020-08-04 09:40:08 +00:00

libvirt.spec

spec: Update release version with !37

2021-09-24 11:28:36 +08:00

qemu-agent-set-ifname-to-NULL-after-freeing.patch

qemu: agent: set ifname to NULL after freeing

2020-10-26 20:25:40 +08:00

qemu-Support-retry-BLOCK_IO_ERROR-event.patch

qemu: Support 'retry' BLOCK_IO_ERROR event.

2021-04-23 11:28:50 +08:00

rpc-add-support-for-filtering-acls-by-uint-params.patch

rpc: add support for filtering @acls by uint params

2020-10-26 20:25:40 +08:00

rpc-gendispatch-handle-empty-flags.patch

rpc: gendispatch: handle empty flags

2020-10-26 20:25:40 +08:00

rpc-require-write-acl-for-guest-agent-in-virDomainIn.patch

rpc: require write acl for guest agent in virDomainInterfaceAddresses

2020-10-26 20:25:40 +08:00

security-fix-SELinux-label-generation-logic.patch

security: fix SELinux label generation logic

2021-09-26 21:28:36 +08:00

storage_driver-Unlock-object-on-ACL-fail-in-storageP.patch

storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath

2021-09-26 21:28:36 +08:00

util-Move-virIsDevMapperDevice-to-virdevmapper.c.patch

util: Move virIsDevMapperDevice() to virdevmapper.c

2021-01-20 10:22:58 +08:00

virdevmapper-Don-t-use-libdevmapper-to-obtain-depend.patch

virdevmapper: Don't use libdevmapper to obtain dependencies

2021-01-20 10:44:52 +08:00

Description

No description provided

16 MiB

Languages

Markdown 100%