[PATCH 6/6] security_selinux: Play nicely with network FS that only emulates SELinux

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



There are some network file systems that do support XATTRs (e.g.
gluster via FUSE). And they appear to support SELinux too.
However, not really. Problem is, that it is impossible to change
SELinux label of a file stored there, and yet we claim success
(rightfully - hypervisor succeeds in opening the file). But this
creates a problem for us - from XATTR bookkeeping POV, we haven't
changed the label and thus if we remembered any label, we must
roll back and remove it.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1740506

Signed-off-by: Michal Privoznik <mprivozn@xxxxxxxxxx>
---
 src/security/security_selinux.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 855eaafdda..4d0c7a46ae 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -1384,12 +1384,22 @@ virSecuritySELinuxSetFilecon(virSecurityManagerPtr mgr,
         }
     }
 
-    if (virSecuritySELinuxSetFileconImpl(path, tcon, privileged) < 0)
+    if ((rc = virSecuritySELinuxSetFileconImpl(path, tcon, privileged)) < 0)
         goto cleanup;
 
+    /* At this point, we can claim success. However,
+     * virSecuritySELinuxSetFileconImpl() could returned 0
+     * (SELinux label changed) or 1 (SELinux label NOT changed in
+     * a non-critical fashion). If the label was NOT changed, we
+     * must remove remembered label then - there's nothing to
+     * remember, is there? But of the label was changed, don't
+     * remove the remembered label. It's valid. */
+    if (rc == 0)
+        rollback = false;
+
     ret = 0;
  cleanup:
-    if (ret < 0 && rollback) {
+    if (rollback) {
         virErrorPtr origerr;
 
         virErrorPreserveLast(&origerr);
-- 
2.21.0

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list



[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux