Re: [libvirt] [PATCH] selinux: Don't fail RestoreAll if file doesn't have a default label

On 10/22/2012 11:51 AM, Eric Blake wrote: > On 10/21/2012 02:44 PM, Cole Robinson wrote: >> When restoring selinux labels after a VM is stopped, any non-standard >> path that doesn't have a default selinux label causes the process to >> stop and exit early. This isn't really an error condition IMO. >> >> Of course the selinux API could be erroring for some other reason but >> hopefully that's rare enough to not need explicit handling. >> >> Common example here is storing disk images in a non-standard location >> like under /mnt. --- src/security/security_selinux.c | 4 ++++ 1 file >> changed, 4 insertions(+) >> >> diff --git a/src/security/security_selinux.c >> b/src/security/security_selinux.c index eee8d71..7681f1b 100644 --- >> a/src/security/security_selinux.c +++ >> b/src/security/security_selinux.c @@ -936,7 +936,11 @@ >> virSecuritySELinuxRestoreSecurityFileLabel(const char *path) } >> >> if (getContext(newpath, buf.st_mode, &fcon) < 0) { + /* Any user >> created path likely does not have a default label, + * which >> makes this an expected non error + */ VIR_WARN("cannot lookup >> default selinux label for %s", newpath); + rc = 0; > > In the case where there is no default label to restore, shouldn't we > still be removing our sVirt label rather than just ignoring the failure > but leaving our label intact? > I don't know if we can just 'remove' a label, we have to replace it with a different label, right? If I create a file under /mnt/foo the catch all label is unconfined_u:object_r:file_t:s0 but not sure if we can hardcode that. dwalsh, is there a way to programmatically determine the fallback default label? - Cole

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlCGd0YACgkQrlYvE4MpobORcACgg8Ctj7tX5qtlSEtyOzaOArvw rWUAniGx8b73oIhFJpssbid3oexmO46i =Vz87 -----END PGP SIGNATURE-----