mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2025-02-02 01:45:17 +00:00
security: Allow RW access to pstore device
The whole point of pstore device is that the guest writes crash dumps into it. But the way SELinux label is set on the corresponding file warrants RO access only. This is due to a copy-paste from code around: kernel/initrd/DTB/SLIC - these are RO indeed, but pstore MUST be writable too. In a sense it's closer to NVRAM/disks - hence set imagelabel on it. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Andrea Bolognani <abologna@redhat.com>
This commit is contained in:
parent
d913f204e0
commit
ac0b669c56
@ -3341,7 +3341,7 @@ virSecuritySELinuxSetAllLabel(virSecurityManager *mgr,
|
||||
|
||||
if (def->pstore &&
|
||||
virSecuritySELinuxSetFilecon(mgr, def->pstore->path,
|
||||
data->content_context, true) < 0)
|
||||
secdef->imagelabel, true) < 0)
|
||||
return -1;
|
||||
|
||||
return 0;
|
||||
|
Loading…
x
Reference in New Issue
Block a user