|
 |
2cf05b |
From 7c7ec6e6c20675a99abe8685c715dc95e7e8dbff Mon Sep 17 00:00:00 2001
|
|
|
2cf05b |
Message-Id: <7c7ec6e6c20675a99abe8685c715dc95e7e8dbff@dist-git>
|
|
|
2cf05b |
From: Michal Privoznik <mprivozn@redhat.com>
|
|
|
2cf05b |
Date: Tue, 6 Sep 2022 13:37:23 +0200
|
|
|
2cf05b |
Subject: [PATCH] qemu_namespace: Tolerate missing ACLs when creating a path in
|
|
|
2cf05b |
namespace
|
|
|
2cf05b |
|
|
|
2cf05b |
When creating a path in a domain's mount namespace we try to set
|
|
|
2cf05b |
ACLs on it, so that it's a verbatim copy of the path in parent's
|
|
|
2cf05b |
namespace. The ACLs are queried upfront (by
|
|
|
2cf05b |
qemuNamespaceMknodItemInit()) but this is fault tolerant so the
|
|
|
2cf05b |
pointer to ACLs might be NULL (meaning no ACLs were queried, for
|
|
|
2cf05b |
instance because the underlying filesystem does not support
|
|
|
2cf05b |
them). But then we take this NULL and pass it to virFileSetACLs()
|
|
|
2cf05b |
which immediately returns an error because NULL is invalid value.
|
|
|
2cf05b |
|
|
|
2cf05b |
Mimic what we do with SELinux label - only set ACLs if they are
|
|
|
2cf05b |
non-NULL which includes symlinks.
|
|
|
2cf05b |
|
|
|
2cf05b |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
2cf05b |
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
|
|
|
2cf05b |
(cherry picked from commit 687374959e160dc566bd4b6d43c7bf1beb470c59)
|
|
|
2cf05b |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
|
|
|
2cf05b |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
2cf05b |
---
|
|
|
2cf05b |
src/qemu/qemu_namespace.c | 3 +--
|
|
|
2cf05b |
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
2cf05b |
|
|
|
2cf05b |
diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
|
|
|
2cf05b |
index 94453033f5..4bff325a2c 100644
|
|
|
2cf05b |
--- a/src/qemu/qemu_namespace.c
|
|
|
2cf05b |
+++ b/src/qemu/qemu_namespace.c
|
|
|
2cf05b |
@@ -1023,8 +1023,7 @@ qemuNamespaceMknodOne(qemuNamespaceMknodItem *data)
|
|
|
2cf05b |
goto cleanup;
|
|
|
2cf05b |
}
|
|
|
2cf05b |
|
|
|
2cf05b |
- /* Symlinks don't have ACLs. */
|
|
|
2cf05b |
- if (!isLink &&
|
|
|
2cf05b |
+ if (data->acl &&
|
|
|
2cf05b |
virFileSetACLs(data->file, data->acl) < 0 &&
|
|
|
2cf05b |
errno != ENOTSUP) {
|
|
|
2cf05b |
virReportSystemError(errno,
|
|
|
2cf05b |
--
|
|
|
2cf05b |
2.38.0
|
|
|
2cf05b |
|