[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCHv4 12/15] qemu: use common API for reading difficult files



On 03/25/2011 03:56 PM, Eric Blake wrote:
> On 03/10/2011 05:14 AM, Daniel P. Berrange wrote:
>> On Wed, Mar 09, 2011 at 07:18:30PM -0700, Eric Blake wrote:
>>> Direct access to an open file is so much simpler than passing
>>> everything through a pipe!
>>
>> Did you test with SELinux in enforcing mode - there's a very
>> slight chance this could impact things, though I think we
>> do label all FDs correctly these days.
> 
> Yes, I did, and things still worked to a local disk (where I'm assuming
> SELinux enforcing would have stopped me).  In fact, when passing the fd
> via SCM_RIGHTS, things still worked even without relabeling the file
> (although I have no idea if that's a hole in SELinux enforcing).

Then again, my testing was done via running just-built daemon/libvirtd,
which probably means I was in an unconfined context, where transitions
just work.  I guess that means I need to retest with libvirtd running as
a service under its normal SELinux settings, which might make a difference.

-- 
Eric Blake   eblake redhat com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]