[libvirt] [PATCH 8/n] selinux: avoid memory overhead of matchpathcon

Eric Blake eblake at redhat.com
Wed Dec 1 04:10:23 UTC 2010


On 11/30/2010 08:54 PM, Eric Blake wrote:
> * src/security/security_selinux.c
> (SELinuxRestoreSecurityFileLabel): Use selabel_lookup instead of
> matchpathcon.
> Suggested by Daniel Walsh.

https://bugzilla.redhat.com/show_bug.cgi?id=658657

> @@ -380,14 +382,16 @@ SELinuxRestoreSecurityFileLabel(const char *path)
>          goto err;
>      }
> 
> -    if (matchpathcon(newpath, buf.st_mode, &fcon) == 0)  {
> -        rc = SELinuxSetFilecon(newpath, fcon);
> +    if ((handle = selabel_open(SELABEL_CTX_FILE, NULL, 0)) == NULL ||
> +        selabel_lookup(handle, &fcon, newpath, buf.st_mode) < 0) {
> +        VIR_WARN("cannot lookup default selinux label for %s", newpath);

It may also make sense for a followup patch to do selabel_open once, as
part of opening the security driver, and reusing the handle throughout
the life of libvirtd, rather than repeatedly creating a new handle every
time this function is called.  But I ran out of time today to try that.

-- 
Eric Blake   eblake at redhat.com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 619 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20101130/97c38c7d/attachment-0001.sig>


More information about the libvir-list mailing list