[libvirt] [PATCH] Make SELinuxSecurityDriverProbe() fail on Fedora 10

Running "make check" on F10, I get: libvir: Security Labeling error : SELinuxInitialize: cannot open SELinux virtual domain context file /etc/selinux/targeted/contexts/virtual_domain_context: No such file or directory Failed to start security driverFAIL: seclabeltest Seems virtual_domain_context isn't available on F10. Haven't investigated further, just want to have "make check" pass. Signed-off-by: Mark McLoughlin <markmc@redhat.com> --- src/security_selinux.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/src/security_selinux.c b/src/security_selinux.c index ac317d7..c0b4a67 100644 --- a/src/security_selinux.c +++ b/src/security_selinux.c @@ -218,7 +218,13 @@ done: static int SELinuxSecurityDriverProbe(void) { - return is_selinux_enabled() ? SECURITY_DRIVER_ENABLE : SECURITY_DRIVER_DISABLE; + if (!is_selinux_enabled()) + return SECURITY_DRIVER_DISABLE; + + if (!virFileExists(selinux_virtual_domain_context_path())) + return SECURITY_DRIVER_DISABLE; + + return SECURITY_DRIVER_ENABLE; } static int -- 1.6.0.6

On Thu, Apr 16, 2009 at 11:44:48AM +0100, Mark McLoughlin wrote:
Running "make check" on F10, I get:
libvir: Security Labeling error : SELinuxInitialize: cannot open SELinux virtual domain context file /etc/selinux/targeted/contexts/virtual_domain_context: No such file or directory Failed to start security driverFAIL: seclabeltest
Seems virtual_domain_context isn't available on F10.
IMHO that's a Fedora packaging bug. We already probe for the presence fo the selinux_virtual_domain_context_path() method, which didn't exist in Fedora 10. So if that method has now appeared, but without the files it requires in order to work that seems like a policy bug to me. Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

On 04/16/2009 06:54 AM, Daniel P. Berrange wrote:
On Thu, Apr 16, 2009 at 11:44:48AM +0100, Mark McLoughlin wrote:
Running "make check" on F10, I get:
libvir: Security Labeling error : SELinuxInitialize: cannot open SELinux virtual domain context file /etc/selinux/targeted/contexts/virtual_domain_context: No such file or directory Failed to start security driverFAIL: seclabeltest
Seems virtual_domain_context isn't available on F10.
IMHO that's a Fedora packaging bug. We already probe for the presence fo the selinux_virtual_domain_context_path() method, which didn't exist in Fedora 10. So if that method has now appeared, but without the files it requires in order to work that seems like a policy bug to me.
Daniel Yes it is a policy bug, libselinux versus selinux-policy. Working on backporting the F11 policy into F10.
participants (3)
-
Daniel J Walsh
-
Daniel P. Berrange
-
Mark McLoughlin