[libvirt] [PATCH 1/3] Allow a base label to be specified in dynamic labelling mode

Eric Blake eblake at redhat.com
Mon Jun 27 16:07:23 UTC 2011


On 06/27/2011 06:20 AM, Daniel P. Berrange wrote:
> Normally the dynamic labelling mode will always use a base
> label of 'svirt_t' for VMs. Introduce a <baselabel> field
> in the <seclabel> XML to allow this base label to be changed
> 
> eg
> 
>    <seclabel type='dynamic' model='selinux'>
>      <baselabel>system_u:object_r:virt_t:s0</baselabel>
>    </seclabel>
> 
> * docs/schemas/domain.rng: Add <baselabel>
> * src/conf/domain_conf.c, src/conf/domain_conf.h: Parsing
>   of base label
> * src/qemu/qemu_process.c: Don't reset 'model' attribute if
>   a base label is specified
> * src/security/security_apparmor.c: Refuse to support base label
> * src/security/security_selinux.c: Use 'baselabel' when generating
>   label, if available

The code looks okay, but this missed the RC1 freeze.  Is this something
we need in 0.9.3 for a bug-fix, or should it wait until after the
release as a feature addition?

> ---
>  docs/schemas/domain.rng          |    3 ++

Missing the counterpart to docs/formatdomain.html.in.

-- 
Eric Blake   eblake at redhat.com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 619 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20110627/fc6e775f/attachment-0001.sig>


More information about the libvir-list mailing list