[libvirt] Fix a failure to restore SELinux label for character devices
Daniel Veillard
veillard at redhat.com
Thu Nov 18 15:26:55 UTC 2010
The code in SELinuxRestoreSecurityChardevLabel() was trying to
use SELinuxSetFilecon directly for devices or file types while
it should really use SELinuxRestoreSecurityFileLabel encapsulating
routine, which avoid various problems like resolving symlinks,
making sure he file exists and work around NFS problems
Daniel
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 936a1a6..996177a 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -694,9 +694,10 @@ SELinuxRestoreSecurityChardevLabel(virDomainObjPtr vm,
switch (dev->type) {
case VIR_DOMAIN_CHR_TYPE_DEV:
case VIR_DOMAIN_CHR_TYPE_FILE:
- ret = SELinuxSetFilecon(dev->data.file.path, secdef->imagelabel);
+ if (SELinuxRestoreSecurityFileLabel(dev->data.file.path) < 0)
+ goto done;
+ ret = 0;
break;
-
case VIR_DOMAIN_CHR_TYPE_PIPE:
if ((virAsprintf(&out, "%s.out", dev->data.file.path) < 0) ||
(virAsprintf(&in, "%s.in", dev->data.file.path) < 0)) {
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel at veillard.com | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/
More information about the libvir-list
mailing list