I know I've sent several versions like ages ago, so this should not start with v1, but hey, this is completely new approach, so I'm gonna start from 1. Here, the virtlockd is misused to hold the original seclabels (although only DAC label is implemented so far). Even more, it does a reference counting, so that only the last label restore does the job, not the previous ones. Michal Privoznik (10): locking: Allow seclabel remembering locking: Implement seclabel stubs for NOP domain_lock: Introduce seclabel APIs locking: Add virLockSeclabelProtocol driver_lockd: Implement seclabel APIs lock_daemon: Implement server dispatch lock_daemon: Implement seclabel APIs security_dac: Cleanup virSecurityDACSetOwnershipInternal usage virSecurityManagerNew: Add virLockManagerPluginPtr security_dac: Keep original label .gitignore | 2 + src/Makefile.am | 34 ++- src/libvirt_private.syms | 4 + src/lock_seclabel_protocol-structs | 21 ++ src/locking/domain_lock.c | 65 ++++++ src/locking/domain_lock.h | 10 + src/locking/lock_daemon.c | 388 ++++++++++++++++++++++++++++++++++- src/locking/lock_daemon.h | 8 + src/locking/lock_daemon_dispatch.c | 77 +++++++ src/locking/lock_daemon_dispatch.h | 3 + src/locking/lock_driver.h | 43 ++++ src/locking/lock_driver_lockd.c | 118 ++++++++++- src/locking/lock_driver_nop.c | 22 ++ src/locking/lock_manager.c | 26 +++ src/locking/lock_manager.h | 9 + src/locking/lock_seclabel_protocol.x | 53 +++++ src/lxc/lxc_controller.c | 2 +- src/lxc/lxc_driver.c | 3 +- src/qemu/qemu_driver.c | 7 +- src/security/security_dac.c | 145 ++++++++++--- src/security/security_manager.c | 25 ++- src/security/security_manager.h | 6 +- tests/Makefile.am | 1 + tests/qemuhotplugtest.c | 2 +- tests/seclabeltest.c | 2 +- tests/securityselinuxlabeltest.c | 2 +- tests/securityselinuxtest.c | 2 +- 27 files changed, 1028 insertions(+), 52 deletions(-) create mode 100644 src/lock_seclabel_protocol-structs create mode 100644 src/locking/lock_seclabel_protocol.x -- 1.8.5.5 -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list