[libvirt] [PATCH] selinux: distinguish failure to label from request to avoid label

[Eric Blake]

On 08/20/2013 07:04 AM, Daniel P. Berrange wrote:
> On Mon, Aug 12, 2013 at 10:19:47PM -0600, Eric Blake wrote:
>> https://bugzilla.redhat.com/show_bug.cgi?id=924153
>>

>> The solution is to separate the semantics of a chain that must
>> not be labeled (which the user can set even on persistent domains)
>> vs. the optimization of not attempting a relabel on cleanup (a
>> live-only annotation), and using only the user's explicit notation
>> rather than the optimization as the decision on whether to skip
>> a label attempt in the first place.  When upgrading an older
>> libvirtd to a newer, an NFS volume will still attempt the relabel;
>> but as the avoidance of a relabel was only an optimization, this
>> shouldn't cause any problems.
>>

> 
> ACK

I've pushed this and the followup testsuite securityselinuxlabeltest
enhancement.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130820/676b7015/attachment-0001.sig>