External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-22 04:25:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

security_selinux: Play nicely with network FS that only emulates SELinux

Browse Source 
There are some network file systems that do support XATTRs (e.g.
gluster via FUSE). And they appear to support SELinux too.
However, not really. Problem is, that it is impossible to change
SELinux label of a file stored there, and yet we claim success
(rightfully - hypervisor succeeds in opening the file). But this
creates a problem for us - from XATTR bookkeeping POV, we haven't
changed the label and thus if we remembered any label, we must
roll back and remove it.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1740506

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
This commit is contained in:
Michal Privoznik 2019-08-22 16:34:02 +02:00
parent eaa2a064fa
commit 8fe953805a
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/security/security_selinux.c
View File

@ -1384,12 +1384,18 @@ virSecuritySELinuxSetFilecon(virSecurityManagerPtr mgr,
}
}
if (virSecuritySELinuxSetFileconImpl(path, tcon, privileged) < 0)
rc = virSecuritySELinuxSetFileconImpl(path, tcon, privileged);
if (rc < 0)
goto cleanup;
/* Do not try restoring the label if it was not changed
* (setting it failed in a non-critical fashion) */
if (rc == 0)
rollback = false;
ret = 0;
cleanup:
if (ret < 0 && rollback) {
if (rollback) {
virErrorPtr origerr;
virErrorPreserveLast(&origerr);