[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] selinux: distinguish failure to label from request to avoid label



On 08/20/2013 07:04 AM, Daniel P. Berrange wrote:
> On Mon, Aug 12, 2013 at 10:19:47PM -0600, Eric Blake wrote:
>> https://bugzilla.redhat.com/show_bug.cgi?id=924153
>>

>> The solution is to separate the semantics of a chain that must
>> not be labeled (which the user can set even on persistent domains)
>> vs. the optimization of not attempting a relabel on cleanup (a
>> live-only annotation), and using only the user's explicit notation
>> rather than the optimization as the decision on whether to skip
>> a label attempt in the first place.  When upgrading an older
>> libvirtd to a newer, an NFS volume will still attempt the relabel;
>> but as the avoidance of a relabel was only an optimization, this
>> shouldn't cause any problems.
>>

> 
> ACK

I've pushed this and the followup testsuite securityselinuxlabeltest
enhancement.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]