[Libguestfs] [PATCH 3/7] add_drive: Add selinuxnorelabel optional boolean.

[Matthew Booth]

On Thu, 2013-02-28 at 15:49 +0000, Daniel P. Berrange wrote:
> On Thu, Feb 28, 2013 at 03:01:20PM +0000, Matthew Booth wrote:
> > Secondly, by relabelling disk images we're potentially making them
> > temporarily unavailable to other processes, which is something we
> > weren't doing before. It's possible there may be no way round this, but
> > if so we ought to highlight it as a major gotcha. Is there any way we
> > can give a file 2 different SELinux contexts? If there were, we could
> > leave the original untouched and only allow our ephemeral process to
> > access the second one. A hard link doesn't allow this, btw. A copy is
> > almost certainly infeasible in the general case, but if the FS allows
> > reflink it might fly. Thoughts?
> 
> There will never be any way to give one file multiple SELinux labels.
> It is explicitly rejected as a concept by security people.
> 
> What I describe here though is explicitly about *not* having to make
> libguestfs relabel other disk images. The point is to define a policy
> such that libguestfs can access the other VMs' disks without any
> relabelling needing doing to them.
> 
> Any relabelling would only be needing on any qcow2 snapshot that
> libguestfs has above the original disks.

I wasn't talking about whether libguestfs or libvirt does the
relabelling, I was talking about the problems of any relabelling
happening at all to the input file.

Matt