[libvirt] [PATCH v2 10/18] virSecurityDACRestoreImageLabelInt: Restore even shared/RO disks
Daniel P. Berrangé
berrange at redhat.com
Thu Dec 6 12:06:00 UTC 2018
On Thu, Nov 29, 2018 at 02:52:25PM +0100, Michal Privoznik wrote:
> Now that we have seclabel remembering we can safely restore
> labels for shared and RO disks. In fact we need to do that to
> keep seclabel refcount stored in XATTRs in sync with reality.
>
> Signed-off-by: Michal Privoznik <mprivozn at redhat.com>
> ---
> src/security/security_dac.c | 8 --------
> 1 file changed, 8 deletions(-)
>
> diff --git a/src/security/security_dac.c b/src/security/security_dac.c
> index 9d31faa9d4..60adfaf526 100644
> --- a/src/security/security_dac.c
> +++ b/src/security/security_dac.c
> @@ -921,14 +921,6 @@ virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr mgr,
> if (!priv->dynamicOwnership)
> return 0;
>
> - /* Don't restore labels on readoly/shared disks, because other VMs may
> - * still be accessing these. Alternatively we could iterate over all
> - * running domains and try to figure out if it is in use, but this would
> - * not work for clustered filesystems, since we can't see running VMs using
> - * the file on other nodes. Safest bet is thus to skip the restore step. */
> - if (src->readonly || src->shared)
> - return 0;
> -
> secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME);
> if (secdef && !secdef->relabel)
> return 0;
Reviewed-by: Daniel P. Berrangé <berrange at redhat.com>
though I'd probably squash this into the previous commit, otherwise the
bisection has a point in time where it leaks attrs for shared/readonly
disk
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
More information about the libvir-list
mailing list