[libvirt] [PATCH] qemu: don't share kerberos caches between domains
Daniel P. Berrange
berrange at redhat.com
Thu Jan 24 09:45:57 UTC 2013
On Wed, Jan 23, 2013 at 06:26:49PM -0700, Eric Blake wrote:
> https://bugzilla.redhat.com/show_bug.cgi?id=718377
> complains that there were some SELinux AVCs when using vnc console
> over Kerberos. The root problem was that Kerberos tries to set up
> a cache file, and if we don't tell it where, then all domains use
> the same cache file, which violates sVirt protections. Setting the
> environment variable unconditionally should be safe, even for setups
> where Kerboros won't actually create a cache file.
Rare chance for me to point out a typo to Eric instead of the other
way around:-P s/Kerboros/Kerberos/
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
More information about the libvir-list
mailing list