[PATCH] Fuse file system mounted at /proc/meminfo needs correct label.

[dwalsh@xxxxxxxxxx]

From: Dan Walsh <dwalsh@xxxxxxxxxx>

Currently the /proc/meminfo is labeled fusefs_t rather then proc_t.
SELinux blocks openshift instances from reading fusefs_t, this
patch sets the file to the default label of /proc/meminfo
---
 .gnulib                 |  2 +-
 src/lxc/lxc_container.c | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/.gnulib b/.gnulib
index 92f3a4c..819b1c3 160000
--- a/.gnulib
+++ b/.gnulib
@@ -1 +1 @@
-Subproject commit 92f3a4c8e52e64c233e260431d095dbf88554c14
+Subproject commit 819b1c38b9abd94d7d1ca2a77bbe16053b75029c
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index ac0f69c..854a9ef 100644
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -52,6 +52,10 @@
 # include <blkid/blkid.h>
 #endif
 
+#if WITH_SELINUX
+# include <selinux/selinux.h>
+#endif
+
 #include "virerror.h"
 #include "virlog.h"
 #include "lxc_container.h"
@@ -763,6 +767,27 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def,
                            def->name)) < 0)
         return ret;
 
+#if WITH_SELINUX
+    if (is_selinux_enabled() > 0)
+    {
+        security_context_t scon;
+        ret = getfilecon("/proc/meminfo", &scon);
+        if (ret) {
+            virReportSystemError(errno,
+                                 _("Failed to get security context of %s for /proc/meminfo mount point"),
+                                 meminfo_path);
+            return ret;
+        }
+        ret = setfilecon(meminfo_path,scon);
+        freecon(scon);
+        if (ret) {
+            virReportSystemError(errno,
+                                 _("Failed to set security context of %s for /proc/meminfo mount point"),
+                                 meminfo_path);
+            return ret;
+        }
+    }
+#endif
     if ((ret = mount(meminfo_path, "/proc/meminfo",
                      NULL, MS_BIND, NULL)) < 0) {
         virReportSystemError(errno,
-- 
1.8.2

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list