External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-12 15:52:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

selinux: Detect virt_use_nfs boolean set

Browse Source 
If we fail setting label on a file and this file is on NFS share,
it is wise to advise user to set virt_use_nfs selinux boolean
variable.
This commit is contained in:
Michal Privoznik 2011-09-08 18:23:25 +02:00
parent b14e7d2a16
commit c9b37fee25
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/security/security_selinux.c
View File

@ -420,8 +420,17 @@ SELinuxSetFilecon(const char *path, char *tcon)
* virt_use_{nfs,usb,pci} boolean tunables to allow it... * virt_use_{nfs,usb,pci} boolean tunables to allow it...
*/ */
if (setfilecon_errno != EOPNOTSUPP) { if (setfilecon_errno != EOPNOTSUPP) {
const char *errmsg;
if ((virStorageFileIsSharedFSType(path,
VIR_STORAGE_FILE_SHFS_NFS) == 1) &&
security_get_boolean_active("virt_use_nfs") != 1) {
errmsg = _("unable to set security context '%s' on '%s'. "
"Consider setting virt_use_nfs");
} else {
errmsg = _("unable to set security context '%s' on '%s'");
}
virReportSystemError(setfilecon_errno, virReportSystemError(setfilecon_errno,
_("unable to set security context '%s' on '%s'"), errmsg,
tcon, path); tcon, path);
if (security_getenforce() == 1) if (security_getenforce() == 1)
return -1; return -1;