[libvirt] [PATCH for 1.2.8] selinux: properly label tap FDs with imagelabel
The cleanup in commit cf976d9d used secdef->label to label the tap FDs, but that is not possible since it's process-only label (svirt_t) and not a object label (e.g. svirt_image_t). Starting a domain failed with EPERM, but simply using secdef->label instead fixes it. Signed-off-by: Martin Kletzander <mkletzan@redhat.com> --- src/security/security_selinux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 5d18493..e8c13db 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -2340,7 +2340,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, if (!secdef || !secdef->label) return 0; - return virSecuritySELinuxFSetFilecon(fd, secdef->label); + return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel); } static char * -- 2.1.0
On 09/01/2014 03:31 PM, Martin Kletzander wrote:
The cleanup in commit cf976d9d used secdef->label to label the tap FDs, but that is not possible since it's process-only label (svirt_t) and not a object label (e.g. svirt_image_t). Starting a domain failed with EPERM, but simply using secdef->label instead fixes it.
s/label/imagelabel/
Signed-off-by: Martin Kletzander <mkletzan@redhat.com> --- src/security/security_selinux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 5d18493..e8c13db 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -2340,7 +2340,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, if (!secdef || !secdef->label) return 0;
- return virSecuritySELinuxFSetFilecon(fd, secdef->label); + return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel); }
static char *
ACK with that change Pavel
participants (2)
-
Martin Kletzander -
Pavel Hrdina