[PATCH v1 0/2] DAC,SELinux: do not remember/recall labels for

[Michal Privoznik]

On 1/27/20 7:23 PM, Daniel Henrique Barboza wrote:
> Libvirt is trying to do multiple open() calls in /dev/vfio
> files, which results in errors inside the security drivers
> and QEMU returning error 125 when attempting to hotplug
> a hostdev which belongs to the same IOMMU group as an
> existing domain hostdev. See patch 2 commit msg for
> more details.
> 
> I found this problem when testing a PCI multifunction
> hotplug implementation. Since this is a problem that
> can happen in other currently supported scenarios,
> I decided it was worth sending the fix right away.
> 
> Michal, I'm CCing you because I mentioned commit 4e95cdcbb3
> ("security: Don't remember labels for TPM") in patch 2,
> which seems to fix a very similar problem. Figured you
> might want to take a look.
> 
> Daniel Henrique Barboza (2):
>    security: Allow 'remember' to be set for HostdevLabelHelper
>    security: do not remember/recall labels for VFIO
> 
>   src/security/security_dac.c     | 20 ++++++++++++--------
>   src/security/security_selinux.c | 20 ++++++++++++--------
>   2 files changed, 24 insertions(+), 16 deletions(-)
> 

Huh, I had similar patches in my local branch, but never gotten around 
to send them (dunno why).

Reviewed-by: Michal Privoznik <mprivozn at redhat.com>

Michal