On Wed, Jun 21, 2023 at 02:43:03PM -0500, Jonathon Jongsma wrote:
When running libvirt from the build directory with the 'run'
script, it
will run as unconfined_t. This can result in unexpected behavior when
selinux is enforcing due to the fact that the selinux policies are
written assuming that libvirt is running with the
system_u:system_r:virtd_t context. This patch adds a new --selinux
option to the run script. When this option is specified, it will launch
the specified binary using the 'runcon' utility to set its selinux
context to the one mentioned above. Since this may require root
privileges, setting the selinux context is not the default behavior and
must be enabled with the command line switch.
Note that this uses argparse to parse the new option, but it does so in
a very limited way in order to avoid interfering with any arguments that
the user might want to pass on to libvirt. For example, we do not
provide a `--help` option for the run script.
Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com>
Reviewed-by: Martin Kletzander <mkletzan(a)redhat.com>