[libvirt] [PATCH] selinux: ignore missing imagelabel in SetSavedStateLabel

[Martin Kletzander]

On Tue, Nov 11, 2014 at 09:07:08AM +0100, Ján Tomko wrote:
>If we have no imagelabel to set (e.g. the domain was created
>by qemu-attach where we don't generate an imagelabel) return
>success instead of crashing.
>
>https://bugzilla.redhat.com/show_bug.cgi?id=1161831
>---
> src/security/security_selinux.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
>index f96be50..db0df7d 100644
>--- a/src/security/security_selinux.c
>+++ b/src/security/security_selinux.c
>@@ -1970,7 +1970,7 @@ virSecuritySELinuxSetSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
>     virSecurityLabelDefPtr secdef;
>
>     secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
>-    if (!secdef || !secdef->relabel)
>+    if (!secdef || !secdef->relabel || !secdef->imagelabel)
>         return 0;
>

Are you sure this is the only function that needs this?  I think more
APIs will cause a crash with attached domain.  For example
hot-plugging a disk.

I think that we should either create a unified way of getting
(image)labels from secdefs or, if there is no way that selinux secdef
exists without imagelabel for normal domain, we should just fill/clean
labels for attached domains and document that attaching to a domain
automatically implies model="none" or relabe="yes" or whatever.

Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20141111/4a9054ad/attachment-0001.sig>