|
 |
9119d9 |
From aafeeb2c9fec1a916cbb1625348bc5d8153c664f Mon Sep 17 00:00:00 2001
|
|
|
9119d9 |
Message-Id: <aafeeb2c9fec1a916cbb1625348bc5d8153c664f@dist-git>
|
|
|
9119d9 |
From: Shivaprasad G Bhat <shivaprasadbhat@gmail.com>
|
|
|
9119d9 |
Date: Tue, 30 Sep 2014 17:41:01 +0200
|
|
|
9119d9 |
Subject: [PATCH] selinux: Avoid label reservations for type = none
|
|
|
9119d9 |
MIME-Version: 1.0
|
|
|
9119d9 |
Content-Type: text/plain; charset=UTF-8
|
|
|
9119d9 |
Content-Transfer-Encoding: 8bit
|
|
|
9119d9 |
|
|
|
9119d9 |
https://bugzilla.redhat.com/show_bug.cgi?id=1138487
|
|
|
9119d9 |
|
|
|
9119d9 |
For security type='none' libvirt according to the docs should not
|
|
|
9119d9 |
generate seclabel be it for selinux or any model. So, skip the
|
|
|
9119d9 |
reservation of labels when type is none.
|
|
|
9119d9 |
|
|
|
9119d9 |
Signed-off-by: Shivaprasad G Bhat <sbhat@linux.vnet.ibm.com>
|
|
|
9119d9 |
(cherry picked from commit a48362cdfeb5c948218a2e4bf7cc9354082fc1b6)
|
|
|
9119d9 |
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
|
|
9119d9 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
9119d9 |
---
|
|
|
9119d9 |
src/security/security_selinux.c | 4 +++-
|
|
|
9119d9 |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
9119d9 |
|
|
|
9119d9 |
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
|
|
|
9119d9 |
index 85ad073..7413701 100644
|
|
|
9119d9 |
--- a/src/security/security_selinux.c
|
|
|
9119d9 |
+++ b/src/security/security_selinux.c
|
|
|
9119d9 |
@@ -731,7 +731,9 @@ virSecuritySELinuxReserveSecurityLabel(virSecurityManagerPtr mgr,
|
|
|
9119d9 |
virSecurityLabelDefPtr seclabel;
|
|
|
9119d9 |
|
|
|
9119d9 |
seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
|
|
|
9119d9 |
- if (!seclabel || seclabel->type == VIR_DOMAIN_SECLABEL_STATIC)
|
|
|
9119d9 |
+ if (!seclabel ||
|
|
|
9119d9 |
+ seclabel->type == VIR_DOMAIN_SECLABEL_NONE ||
|
|
|
9119d9 |
+ seclabel->type == VIR_DOMAIN_SECLABEL_STATIC)
|
|
|
9119d9 |
return 0;
|
|
|
9119d9 |
|
|
|
9119d9 |
if (getpidcon_raw(pid, &pctx) == -1) {
|
|
|
9119d9 |
--
|
|
|
9119d9 |
2.1.2
|
|
|
9119d9 |
|