[libvirt] [PATCH 6/6] security_selinux: Play nicely with network FS that only emulates SELinux

[Michal Privoznik]

There are some network file systems that do support XATTRs (e.g.
gluster via FUSE). And they appear to support SELinux too.
However, not really. Problem is, that it is impossible to change
SELinux label of a file stored there, and yet we claim success
(rightfully - hypervisor succeeds in opening the file). But this
creates a problem for us - from XATTR bookkeeping POV, we haven't
changed the label and thus if we remembered any label, we must
roll back and remove it.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1740506

Signed-off-by: Michal Privoznik <mprivozn at redhat.com>
---
 src/security/security_selinux.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 855eaafdda..4d0c7a46ae 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -1384,12 +1384,22 @@ virSecuritySELinuxSetFilecon(virSecurityManagerPtr mgr,
         }
     }
 
-    if (virSecuritySELinuxSetFileconImpl(path, tcon, privileged) < 0)
+    if ((rc = virSecuritySELinuxSetFileconImpl(path, tcon, privileged)) < 0)
         goto cleanup;
 
+    /* At this point, we can claim success. However,
+     * virSecuritySELinuxSetFileconImpl() could returned 0
+     * (SELinux label changed) or 1 (SELinux label NOT changed in
+     * a non-critical fashion). If the label was NOT changed, we
+     * must remove remembered label then - there's nothing to
+     * remember, is there? But of the label was changed, don't
+     * remove the remembered label. It's valid. */
+    if (rc == 0)
+        rollback = false;
+
     ret = 0;
  cleanup:
-    if (ret < 0 && rollback) {
+    if (rollback) {
         virErrorPtr origerr;
 
         virErrorPreserveLast(&origerr);
-- 
2.21.0