On 08/30/2011 11:03 AM, Daniel P. Berrange wrote:
This is non-trivial code. While we've already determined that
SELinux doesn't need SetProcessFDLabel, is there any chance that
app-armor still needs this approach? If so, that would argue for
keeping the function, but making it a no-op stub for SELinux, and
still calling it in all the right places for the benefit of
app-armor.
I'm not familiar enough with app-armor theory of operation to answer
this question, and without an answer, I can't give ack or nack.
The app armour code here was just copied from the similarly name
SetImageFDLabel, which resolves the FD into a file path using
/proc/self/fd/$FDNUM. This actually never worked for TCP sockets
with apparmour, so I don't believe I'm making anything worse.
Fair enough. If we actually need something for tcp socket labeling in
apparmor, then we can add a working solution later; disabling the
questionable code now is okay. You've given me an answer good enough
that I feel comfortable for:
ACK.
--
Eric Blake eblake@xxxxxxxxxx +1-801-349-2682
Libvirt virtualization library http://libvirt.org
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list