[libvirt] [PATCH] Remove bogus virSecurityManagerSetProcessFDLabel method

[Eric Blake]

On 08/30/2011 11:03 AM, Daniel P. Berrange wrote:
>> This is non-trivial code.  While we've already determined that
>> SELinux doesn't need SetProcessFDLabel, is there any chance that
>> app-armor still needs this approach?  If so, that would argue for
>> keeping the function, but making it a no-op stub for SELinux, and
>> still calling it in all the right places for the benefit of
>> app-armor.
>>
>> I'm not familiar enough with app-armor theory of operation to answer
>> this question, and without an answer, I can't give ack or nack.
>
> The app armour code here was just copied from the similarly name
> SetImageFDLabel, which resolves the FD into a file path using
> /proc/self/fd/$FDNUM. This actually never worked for TCP sockets
> with apparmour, so I don't believe I'm making anything worse.

Fair enough.  If we actually need something for tcp socket labeling in 
apparmor, then we can add a working solution later; disabling the 
questionable code now is okay.  You've given me an answer good enough 
that I feel comfortable for:

ACK.

-- 
Eric Blake   eblake at redhat.com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org