There are some network file systems that do support XATTRs (e.g. gluster via FUSE). And they appear to support SELinux too. However, not really. Problem is, that it is impossible to change SELinux label of a file stored there, and yet we claim success (rightfully - hypervisor succeeds in opening the file). But this creates a problem for us - from XATTR bookkeeping POV, we haven't changed the label and thus if we remembered any label, we must roll back and remove it. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1740506 Signed-off-by: Michal Privoznik <mprivozn@xxxxxxxxxx> --- src/security/security_selinux.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 855eaafdda..4d0c7a46ae 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1384,12 +1384,22 @@ virSecuritySELinuxSetFilecon(virSecurityManagerPtr mgr, } } - if (virSecuritySELinuxSetFileconImpl(path, tcon, privileged) < 0) + if ((rc = virSecuritySELinuxSetFileconImpl(path, tcon, privileged)) < 0) goto cleanup; + /* At this point, we can claim success. However, + * virSecuritySELinuxSetFileconImpl() could returned 0 + * (SELinux label changed) or 1 (SELinux label NOT changed in + * a non-critical fashion). If the label was NOT changed, we + * must remove remembered label then - there's nothing to + * remember, is there? But of the label was changed, don't + * remove the remembered label. It's valid. */ + if (rc == 0) + rollback = false; + ret = 0; cleanup: - if (ret < 0 && rollback) { + if (rollback) { virErrorPtr origerr; virErrorPreserveLast(&origerr); -- 2.21.0 -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
