[libvirt] [PATCH] selinux: ignore missing imagelabel in SetSavedStateLabel
Martin Kletzander
mkletzan at redhat.com
Tue Nov 11 10:18:34 UTC 2014
On Tue, Nov 11, 2014 at 09:07:08AM +0100, Ján Tomko wrote:
>If we have no imagelabel to set (e.g. the domain was created
>by qemu-attach where we don't generate an imagelabel) return
>success instead of crashing.
>
>https://bugzilla.redhat.com/show_bug.cgi?id=1161831
>---
> src/security/security_selinux.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
>index f96be50..db0df7d 100644
>--- a/src/security/security_selinux.c
>+++ b/src/security/security_selinux.c
>@@ -1970,7 +1970,7 @@ virSecuritySELinuxSetSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
> virSecurityLabelDefPtr secdef;
>
> secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
>- if (!secdef || !secdef->relabel)
>+ if (!secdef || !secdef->relabel || !secdef->imagelabel)
> return 0;
>
Are you sure this is the only function that needs this? I think more
APIs will cause a crash with attached domain. For example
hot-plugging a disk.
I think that we should either create a unified way of getting
(image)labels from secdefs or, if there is no way that selinux secdef
exists without imagelabel for normal domain, we should just fill/clean
labels for attached domains and document that attaching to a domain
automatically implies model="none" or relabe="yes" or whatever.
Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20141111/4a9054ad/attachment-0001.sig>
More information about the libvir-list
mailing list