[libvirt] [PATCH] Fuse file system mounted at /proc/meminfo needs correct label.

[Eric Blake]

On 04/23/2013 02:22 PM, dwalsh at redhat.com wrote:
> From: Dan Walsh <dwalsh at redhat.com>
> 
> Currently the /proc/meminfo is labeled fusefs_t rather then proc_t.
> SELinux blocks openshift instances from reading fusefs_t, this
> patch sets the file to the default label of /proc/meminfo
> ---
>  .gnulib                 |  2 +-
>  src/lxc/lxc_container.c | 25 +++++++++++++++++++++++++
>  2 files changed, 26 insertions(+), 1 deletion(-)
> 
> diff --git a/.gnulib b/.gnulib
> index 92f3a4c..819b1c3 160000
> --- a/.gnulib
> +++ b/.gnulib
> @@ -1 +1 @@
> -Subproject commit 92f3a4c8e52e64c233e260431d095dbf88554c14
> +Subproject commit 819b1c38b9abd94d7d1ca2a77bbe16053b75029c

The .gnulib submodule update should not be part of this patch.

> @@ -763,6 +767,27 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def,
>                             def->name)) < 0)
>          return ret;
>  
> +#if WITH_SELINUX
> +    if (is_selinux_enabled() > 0)
> +    {

{ on the same line as the if()

> +        security_context_t scon;
> +        ret = getfilecon("/proc/meminfo", &scon);
> +        if (ret) {
> +            virReportSystemError(errno,
> +                                 _("Failed to get security context of %s for /proc/meminfo mount point"),
> +                                 meminfo_path);
> +            return ret;
> +        }
> +        ret = setfilecon(meminfo_path,scon);

Space after comma.

> +        freecon(scon);
> +        if (ret) {
> +            virReportSystemError(errno,
> +                                 _("Failed to set security context of %s for /proc/meminfo mount point"),
> +                                 meminfo_path);
> +            return ret;
> +        }
> +    }
> +#endif
>      if ((ret = mount(meminfo_path, "/proc/meminfo",
>                       NULL, MS_BIND, NULL)) < 0) {
>          virReportSystemError(errno,
> 

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130423/aad0a93d/attachment-0001.sig>