On 03/25/2011 03:56 PM, Eric Blake wrote: > On 03/10/2011 05:14 AM, Daniel P. Berrange wrote: >> On Wed, Mar 09, 2011 at 07:18:30PM -0700, Eric Blake wrote: >>> Direct access to an open file is so much simpler than passing >>> everything through a pipe! >> >> Did you test with SELinux in enforcing mode - there's a very >> slight chance this could impact things, though I think we >> do label all FDs correctly these days. > > Yes, I did, and things still worked to a local disk (where I'm assuming > SELinux enforcing would have stopped me). In fact, when passing the fd > via SCM_RIGHTS, things still worked even without relabeling the file > (although I have no idea if that's a hole in SELinux enforcing). Then again, my testing was done via running just-built daemon/libvirtd, which probably means I was in an unconfined context, where transitions just work. I guess that means I need to retest with libvirtd running as a service under its normal SELinux settings, which might make a difference. -- Eric Blake eblake@xxxxxxxxxx +1-801-349-2682 Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list