Merge "set correct SELinux context for injected ssh keys"

2 files changed, 37 insertions, 0 deletions

diff --git a/etc/nova/rootwrap.d/compute.filters b/etc/nova/rootwrap.d/compute.filters
index fffeff85a..9aa19a11a 100644
--- a/etc/nova/rootwrap.d/compute.filters
+++ b/etc/nova/rootwrap.d/compute.filters
@@ -166,6 +166,10 @@ mkfs: CommandFilter, /sbin/mkfs, root
 # nova/virt/libvirt/utils.py: 'qemu-img'
 qemu-img: CommandFilter, /usr/bin/qemu-img, root
 
+# nova/virt/disk/api.py: 'readlink', '-e'
+readlink: CommandFilter, /bin/readlink, root
+readlink_usr: CommandFilter, /usr/bin/readlink, root
+
 # nova/virt/disk/api.py: 'touch', target
 touch: CommandFilter, /usr/bin/touch, root
 
diff --git a/nova/virt/disk/api.py b/nova/virt/disk/api.py
index 54d974534..264c87ac4 100644
--- a/nova/virt/disk/api.py
+++ b/nova/virt/disk/api.py
@@ -361,6 +361,37 @@ def _inject_metadata_into_fs(metadata, fs):
     _inject_file_into_fs(fs, 'meta.js', jsonutils.dumps(metadata))
 
 
+def _setup_selinux_for_keys(fs):
+    """Get selinux guests to ensure correct context on injected keys."""
+
+    se_cfg = _join_and_check_path_within_fs(fs, 'etc', 'selinux')
+    se_cfg, _err = utils.trycmd('readlink', '-e', se_cfg, run_as_root=True)
+    if not se_cfg:
+        return
+
+    rclocal = _join_and_check_path_within_fs(fs, 'etc', 'rc.local')
+
+    # Support systemd based systems
+    rc_d = _join_and_check_path_within_fs(fs, 'etc', 'rc.d')
+    rclocal_e, _err = utils.trycmd('readlink', '-e', rclocal, run_as_root=True)
+    rc_d_e, _err = utils.trycmd('readlink', '-e', rc_d, run_as_root=True)
+    if not rclocal_e and rc_d_e:
+        rclocal = os.path.join(rc_d, 'rc.local')
+
+    # Note some systems end rc.local with "exit 0"
+    # and so to append there you'd need something like:
+    #  utils.execute('sed', '-i', '${/^exit 0$/d}' rclocal, run_as_root=True)
+    restorecon = [
+        '#!/bin/sh\n',
+        '# Added by Nova to ensure injected ssh keys have the right context\n',
+        'restorecon -RF /root/.ssh/ 2>/dev/null || :\n',
+    ]
+
+    rclocal_rel = os.path.relpath(rclocal, fs)
+    _inject_file_into_fs(fs, rclocal_rel, ''.join(restorecon), append=True)
+    utils.execute('chmod', 'a+x', rclocal, run_as_root=True)
+
+
 def _inject_key_into_fs(key, fs):
     """Add the given public ssh key to root's authorized_keys.
 
@@ -384,6 +415,8 @@ def _inject_key_into_fs(key, fs):
 
     _inject_file_into_fs(fs, keyfile, key_data, append=True)
 
+    _setup_selinux_for_keys(fs)
+
 
 def _inject_net_into_fs(net, fs):
     """Inject /etc/network/interfaces into the filesystem rooted at fs.