[libvirt] [PATCH 5/8] Honour current user and role in SELinux label generation

[Eric Blake]

On 08/10/2012 07:48 AM, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" <berrange at redhat.com>
> 
> When generating an SELinux context for a VM from the template
> "system_u:system_r:svirt_t:s0", copy the role + user from the
> current process instead of the template context. So if the
> current process is
> 
>    unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> 
> then the VM context ends up as
> 
>   unconfined_u:unconfined_r:svirt_t:s0:c386,c703
> 
> instead of
> 
>    system_u:system_r:svirt_t:s0:c177,c424
> 

>  virSecuritySELinuxGenNewContext(const char *basecontext, const char *mcs)
>  {
> -    context_t context;
> +    context_t context = NULL;
>      char *ret = NULL;
>      char *str;
> +    security_context_t curseccontext = NULL;

When I first read this, I wondered why you felt the context of the C
language was worth cursing - is it really hard to manage security labels
in the C language?  Adding some underscores would not hurt, since you
meant cur_sec_context and not curse_c_context :)

ACK.

-- 
Eric Blake   eblake at redhat.com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 620 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20120810/f4a82b37/attachment-0001.sig>