qemu: Properly setup the NVRAM virStorageSource

Use the designated helpers for virStorageSource instead using the
file-based ones with a check.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Tested-by: Rohit Kumar <rohit.kumar3@nutanix.com>

diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
index 64baed14e6227a3233994e935403f7cfb9176db1..f189ca2bb6f5dcf7c3345f913dc9e859cb3585ea 100644 (file)
--- a/src/qemu/qemu_cgroup.c
+++ b/src/qemu/qemu_cgroup.c
@@ -581,8 +581,7 @@ qemuSetupFirmwareCgroup(virDomainObj *vm)
         return -1;
 
     if (vm->def->os.loader->nvram &&
-        virStorageSourceIsLocalStorage(vm->def->os.loader->nvram) &&
-        qemuSetupImagePathCgroup(vm, vm->def->os.loader->nvram->path, false) < 0)
+        qemuSetupImageCgroup(vm, vm->def->os.loader->nvram) < 0)
         return -1;
 
     return 0;

diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
index 9e133587b73893eea3cf09a869e28d40a38b809e..59c6dc52ac29a78ea6a8efecf872038dbe330d43 100644 (file)
--- a/src/qemu/qemu_namespace.c
+++ b/src/qemu/qemu_namespace.c
@@ -573,8 +573,9 @@ qemuDomainSetupLoader(virDomainObj *vm,
             *paths = g_slist_prepend(*paths, g_strdup(loader->path));
 
             if (loader->nvram &&
-                virStorageSourceIsLocalStorage(loader->nvram))
-                *paths = g_slist_prepend(*paths, g_strdup(loader->nvram->path));
+                qemuDomainSetupDisk(loader->nvram, paths) < 0)
+                return -1;
+
             break;
 
         case VIR_DOMAIN_LOADER_TYPE_NONE:

diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index ad03ae65e69b4e736aeac1d8d7792c884287167f..21cebae69499dc1abf9a4088013b2d3c9030840e 100644 (file)
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -1973,10 +1973,11 @@ virSecurityDACRestoreAllLabel(virSecurityManager *mgr,
             rc = -1;
     }
 
-    if (def->os.loader && def->os.loader->nvram &&
-        virStorageSourceIsLocalStorage(def->os.loader->nvram) &&
-        virSecurityDACRestoreFileLabel(mgr, def->os.loader->nvram->path) < 0)
-        rc = -1;
+    if (def->os.loader && def->os.loader->nvram) {
+        if (virSecurityDACRestoreImageLabelInt(mgr, def, def->os.loader->nvram,
+                                               migrated) < 0)
+            rc = -1;
+    }
 
     if (def->os.kernel &&
         virSecurityDACRestoreFileLabel(mgr, def->os.kernel) < 0)
@@ -2185,12 +2186,12 @@ virSecurityDACSetAllLabel(virSecurityManager *mgr,
             return -1;
     }
 
-    if (def->os.loader && def->os.loader->nvram &&
-        virStorageSourceIsLocalStorage(def->os.loader->nvram) &&
-        virSecurityDACSetOwnership(mgr, NULL,
-                                   def->os.loader->nvram->path,
-                                   user, group, true) < 0)
-        return -1;
+    if (def->os.loader && def->os.loader->nvram) {
+        if (virSecurityDACSetImageLabel(mgr, def, def->os.loader->nvram,
+                                        VIR_SECURITY_DOMAIN_IMAGE_LABEL_BACKING_CHAIN |
+                                        VIR_SECURITY_DOMAIN_IMAGE_PARENT_CHAIN_TOP) < 0)
+            return -1;
+    }
 
     if (def->os.kernel &&
         virSecurityDACSetOwnership(mgr, NULL,

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 918012a32307fba2c3bcf6fd781ddf30da0d3783..e2f34a27dcdc35b2acbad460df6b0c96dd2018a2 100644 (file)
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -2803,10 +2803,11 @@ virSecuritySELinuxRestoreAllLabel(virSecurityManager *mgr,
             rc = -1;
     }
 
-    if (def->os.loader && def->os.loader->nvram &&
-        virStorageSourceIsLocalStorage(def->os.loader->nvram) &&
-        virSecuritySELinuxRestoreFileLabel(mgr, def->os.loader->nvram->path, true) < 0)
-        rc = -1;
+    if (def->os.loader && def->os.loader->nvram) {
+        if (virSecuritySELinuxRestoreImageLabelInt(mgr, def, def->os.loader->nvram,
+                                                   migrated) < 0)
+            rc = -1;
+    }
 
     if (def->os.kernel &&
         virSecuritySELinuxRestoreFileLabel(mgr, def->os.kernel, true) < 0)
@@ -3208,14 +3209,12 @@ virSecuritySELinuxSetAllLabel(virSecurityManager *mgr,
             return -1;
     }
 
-    /* This is different than kernel or initrd. The nvram store
-     * is really a disk, qemu can read and write to it. */
-    if (def->os.loader && def->os.loader->nvram &&
-        virStorageSourceIsLocalStorage(def->os.loader->nvram) &&
-        secdef && secdef->imagelabel &&
-        virSecuritySELinuxSetFilecon(mgr, def->os.loader->nvram->path,
-                                     secdef->imagelabel, true) < 0)
-        return -1;
+    if (def->os.loader && def->os.loader->nvram) {
+        if (virSecuritySELinuxSetImageLabel(mgr, def, def->os.loader->nvram,
+                                            VIR_SECURITY_DOMAIN_IMAGE_LABEL_BACKING_CHAIN |
+                                            VIR_SECURITY_DOMAIN_IMAGE_PARENT_CHAIN_TOP) < 0)
+            return -1;
+    }
 
     if (def->os.kernel &&
         virSecuritySELinuxSetFilecon(mgr, def->os.kernel,

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 2ddf293c2cb167f6fd4446e5aefd1098e95e6866..8629503e111daf41530c2af4e2e7f58531d66e47 100644 (file)
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1006,10 +1006,10 @@ get_files(vahControl * ctl)
         if (vah_add_file(&buf, ctl->def->os.loader->path, "rk") != 0)
             goto cleanup;
 
-    if (ctl->def->os.loader && ctl->def->os.loader->nvram &&
-        virStorageSourceIsLocalStorage(ctl->def->os.loader->nvram))
-        if (vah_add_file(&buf, ctl->def->os.loader->nvram->path, "rwk") != 0)
+    if (ctl->def->os.loader && ctl->def->os.loader->nvram) {
+        if (storage_source_add_files(ctl->def->os.loader->nvram, &buf, 0) < 0)
             goto cleanup;
+    }
 
     for (i = 0; i < ctl->def->ngraphics; i++) {
         virDomainGraphicsDef *graphics = ctl->def->graphics[i];