External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-10-24 06:53:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

virSecuritySELinuxRestoreImageLabelInt: Move FD image relabeling after 'migrated' check

Browse Source 
Reorganize the code so that the 'migrated' flag isn't checked multiple
times and thus that it's more obvious what is happening when the
'migrated' flag is asserted.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
This commit is contained in:
Peter Krempa 2024-08-02 15:23:41 +02:00 committed by Andrea Bolognani
parent 568b3c6abe
commit 2983dd44c5
1 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
src/security/security_selinux.c
View File

@ -1819,26 +1819,15 @@ virSecuritySELinuxRestoreImageLabelInt(virSecurityManager *mgr,
if (src->readonly || src->shared)
return 0;
if (virStorageSourceIsFD(src)) {
if (migrated)
return 0;
if (!src->fdtuple ||
!src->fdtuple->selinuxLabel ||
src->fdtuple->nfds == 0)
return 0;
ignore_value(virSecuritySELinuxFSetFilecon(src->fdtuple->fds[0],
src->fdtuple->selinuxLabel));
return 0;
}
/* If we have a shared FS and are doing migration, we must not change
* ownership, because that kills access on the destination host which is
* sub-optimal for the guest VM's I/O attempts :-) */
if (migrated) {
int rc = 1;
if (virStorageSourceIsFD(src))
return 0;
if (virStorageSourceIsLocalStorage(src)) {
if (!src->path)
return 0;
@ -1854,6 +1843,17 @@ virSecuritySELinuxRestoreImageLabelInt(virSecurityManager *mgr,
}
}
if (virStorageSourceIsFD(src)) {
if (!src->fdtuple ||
!src->fdtuple->selinuxLabel ||
src->fdtuple->nfds == 0)
return 0;
ignore_value(virSecuritySELinuxFSetFilecon(src->fdtuple->fds[0],
src->fdtuple->selinuxLabel));
return 0;
}
/* This is not very clean. But so far we don't have NVMe
* storage pool backend so that its chownCallback would be
* called. And this place looks least offensive. */