Re: [libvirt] [PATCH 8/n] selinux: avoid memory overhead of matchpathcon
On 11/30/2010 08:54 PM, Eric Blake wrote:
* src/security/security_selinux.c
(SELinuxRestoreSecurityFileLabel): Use selabel_lookup instead of
matchpathcon.
Suggested by Daniel Walsh.
https://bugzilla.redhat.com/show_bug.cgi?id=658657
@@ -380,14 +382,16 @@ SELinuxRestoreSecurityFileLabel(const char
*path)
goto err;
}
- if (matchpathcon(newpath, buf.st_mode, &fcon) == 0) {
- rc = SELinuxSetFilecon(newpath, fcon);
+ if ((handle = selabel_open(SELABEL_CTX_FILE, NULL, 0)) == NULL ||
+ selabel_lookup(handle, &fcon, newpath, buf.st_mode) < 0) {
+ VIR_WARN("cannot lookup default selinux label for %s", newpath);
It may also make sense for a followup patch to do selabel_open once, as
part of opening the security driver, and reusing the handle throughout
the life of libvirtd, rather than repeatedly creating a new handle every
time this function is called. But I ran out of time today to try that.
--
Eric Blake eblake(a)redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org
Attachments:
- signature.asc (application/pgp-signature — 619 bytes)