[PATCH 1/3] selinux: Don't remember label for restore path

[Erik Skultety]

On Fri, Apr 03, 2020 at 05:58:01PM +0200, Michal Privoznik wrote:
> The seclabel for @stdin_path in virSecuritySELinuxSetAllLabel()
> is not restored, because at virSecuritySELinuxRestoreAllLabel()
> phase it's too late and the caller (QEMU driver) simply doesn't
> care. Well, don't remember the label and let the perms leak.
>
> Signed-off-by: Michal Privoznik <mprivozn at redhat.com>
> ---
>  src/security/security_selinux.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
> index 8aeb6e45a5..f47bfbdba9 100644
> --- a/src/security/security_selinux.c
> +++ b/src/security/security_selinux.c
> @@ -3233,7 +3233,7 @@ virSecuritySELinuxSetAllLabel(virSecurityManagerPtr mgr,
>
>      if (stdin_path &&
>          virSecuritySELinuxSetFilecon(mgr, stdin_path,
> -                                     data->content_context, true) < 0)
> +                                     data->content_context, false) < 0)

You're removing this whole condition in patch 3/3, so I suggest, you drop this
patch completely.

--
Erik Skultety