On 11/30/2010 08:54 PM, Eric Blake wrote: > * src/security/security_selinux.c > (SELinuxRestoreSecurityFileLabel): Use selabel_lookup instead of > matchpathcon. > Suggested by Daniel Walsh. https://bugzilla.redhat.com/show_bug.cgi?id=658657 > @@ -380,14 +382,16 @@ SELinuxRestoreSecurityFileLabel(const char *path) > goto err; > } > > - if (matchpathcon(newpath, buf.st_mode, &fcon) == 0) { > - rc = SELinuxSetFilecon(newpath, fcon); > + if ((handle = selabel_open(SELABEL_CTX_FILE, NULL, 0)) == NULL || > + selabel_lookup(handle, &fcon, newpath, buf.st_mode) < 0) { > + VIR_WARN("cannot lookup default selinux label for %s", newpath); It may also make sense for a followup patch to do selabel_open once, as part of opening the security driver, and reusing the handle throughout the life of libvirtd, rather than repeatedly creating a new handle every time this function is called. But I ran out of time today to try that. -- Eric Blake eblake@xxxxxxxxxx +1-801-349-2682 Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list