[libvirt] [PATCH v2 10/18] virSecurityDACRestoreImageLabelInt: Restore even shared/RO disks

[Daniel P. Berrangé]

On Thu, Nov 29, 2018 at 02:52:25PM +0100, Michal Privoznik wrote:
> Now that we have seclabel remembering we can safely restore
> labels for shared and RO disks. In fact we need to do that to
> keep seclabel refcount stored in XATTRs in sync with reality.
> 
> Signed-off-by: Michal Privoznik <mprivozn at redhat.com>
> ---
>  src/security/security_dac.c | 8 --------
>  1 file changed, 8 deletions(-)
> 
> diff --git a/src/security/security_dac.c b/src/security/security_dac.c
> index 9d31faa9d4..60adfaf526 100644
> --- a/src/security/security_dac.c
> +++ b/src/security/security_dac.c
> @@ -921,14 +921,6 @@ virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr mgr,
>      if (!priv->dynamicOwnership)
>          return 0;
>  
> -    /* Don't restore labels on readoly/shared disks, because other VMs may
> -     * still be accessing these. Alternatively we could iterate over all
> -     * running domains and try to figure out if it is in use, but this would
> -     * not work for clustered filesystems, since we can't see running VMs using
> -     * the file on other nodes. Safest bet is thus to skip the restore step. */
> -    if (src->readonly || src->shared)
> -        return 0;
> -
>      secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME);
>      if (secdef && !secdef->relabel)
>          return 0;

Reviewed-by: Daniel P. Berrangé <berrange at redhat.com>

though I'd probably squash this into the previous commit, otherwise the
bisection has a point in time where it leaks attrs for shared/readonly
disk

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|