[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] selinux: ignore missing imagelabel in SetSavedStateLabel

On Tue, Nov 11, 2014 at 09:07:08AM +0100, Ján Tomko wrote:
If we have no imagelabel to set (e.g. the domain was created
by qemu-attach where we don't generate an imagelabel) return
success instead of crashing.

src/security/security_selinux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index f96be50..db0df7d 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -1970,7 +1970,7 @@ virSecuritySELinuxSetSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
    virSecurityLabelDefPtr secdef;

    secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
-    if (!secdef || !secdef->relabel)
+    if (!secdef || !secdef->relabel || !secdef->imagelabel)
        return 0;

Are you sure this is the only function that needs this?  I think more
APIs will cause a crash with attached domain.  For example
hot-plugging a disk.

I think that we should either create a unified way of getting
(image)labels from secdefs or, if there is no way that selinux secdef
exists without imagelabel for normal domain, we should just fill/clean
labels for attached domains and document that attaching to a domain
automatically implies model="none" or relabe="yes" or whatever.


Attachment: signature.asc
Description: Digital signature

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]