On Thu, Nov 29, 2018 at 02:52:25PM +0100, Michal Privoznik wrote: > Now that we have seclabel remembering we can safely restore > labels for shared and RO disks. In fact we need to do that to > keep seclabel refcount stored in XATTRs in sync with reality. > > Signed-off-by: Michal Privoznik <mprivozn@xxxxxxxxxx> > --- > src/security/security_dac.c | 8 -------- > 1 file changed, 8 deletions(-) > > diff --git a/src/security/security_dac.c b/src/security/security_dac.c > index 9d31faa9d4..60adfaf526 100644 > --- a/src/security/security_dac.c > +++ b/src/security/security_dac.c > @@ -921,14 +921,6 @@ virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr mgr, > if (!priv->dynamicOwnership) > return 0; > > - /* Don't restore labels on readoly/shared disks, because other VMs may > - * still be accessing these. Alternatively we could iterate over all > - * running domains and try to figure out if it is in use, but this would > - * not work for clustered filesystems, since we can't see running VMs using > - * the file on other nodes. Safest bet is thus to skip the restore step. */ > - if (src->readonly || src->shared) > - return 0; > - > secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME); > if (secdef && !secdef->relabel) > return 0; Reviewed-by: Daniel P. Berrangé <berrange@xxxxxxxxxx> though I'd probably squash this into the previous commit, otherwise the bisection has a point in time where it leaks attrs for shared/readonly disk Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
