On 08/20/2013 07:04 AM, Daniel P. Berrange wrote:
On Mon, Aug 12, 2013 at 10:19:47PM -0600, Eric Blake wrote:
The solution is to separate the semantics of a chain that must not be labeled (which the user can set even on persistent domains) vs. the optimization of not attempting a relabel on cleanup (a live-only annotation), and using only the user's explicit notation rather than the optimization as the decision on whether to skip a label attempt in the first place. When upgrading an older libvirtd to a newer, an NFS volume will still attempt the relabel; but as the avoidance of a relabel was only an optimization, this shouldn't cause any problems.
ACK
I've pushed this and the followup testsuite securityselinuxlabeltest enhancement. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org