[libvirt] [PATCH] SELinux: don't silently fail when no label is present

Ján Tomko jtomko at redhat.com
Tue Jun 10 08:18:52 UTC 2014


On 06/10/2014 12:33 AM, Eric Blake wrote:
> On 06/09/2014 08:30 AM, Ján Tomko wrote:
>> This fixes startup of a domain with:
>> <seclabel type='none' model='dac'/>
>> on a host with selinux and dac drivers and
>> security_default_confined = 0
>>
>> https://bugzilla.redhat.com/show_bug.cgi?id=1105939
>> ---
>>  src/security/security_selinux.c | 98 ++++++++++++-----------------------------
>>  1 file changed, 29 insertions(+), 69 deletions(-)
> 
> Shouldn't there also be a change somewhere under tests/ to ensure that
> we parse XML in that situation?

I can add a test for parsing: <seclabel type='none' model='dac'/>
but the only thing in seclabel XML parsing that depends on the security
drivers is the default model that's filled in for <seclabel type='none'/>

I'll send it separately as it wouldn't be directly related to the bug.

> 
> Otherwise, this looks like a fairly mechanical conversion of
> virDomainDefGetSecurityLabelDef() returning NULL from being a silent
> error into being successful; and that makes sense since domain_conf.c
> does not report any errors if a label cannot be looked up.  ACK.
> 

Thanks, pushed.

Jan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20140610/76908c08/attachment-0001.sig>


More information about the libvir-list mailing list