On 04/23/2013 02:22 PM, dwalsh@xxxxxxxxxx wrote:
> From: Dan Walsh <dwalsh@xxxxxxxxxx>
>
> Currently the /proc/meminfo is labeled fusefs_t rather then proc_t.
> SELinux blocks openshift instances from reading fusefs_t, this
> patch sets the file to the default label of /proc/meminfo
> ---
> .gnulib | 2 +-
> src/lxc/lxc_container.c | 25 +++++++++++++++++++++++++
> 2 files changed, 26 insertions(+), 1 deletion(-)
>
> diff --git a/.gnulib b/.gnulib
> index 92f3a4c..819b1c3 160000
> --- a/.gnulib
> +++ b/.gnulib
> @@ -1 +1 @@
> -Subproject commit 92f3a4c8e52e64c233e260431d095dbf88554c14
> +Subproject commit 819b1c38b9abd94d7d1ca2a77bbe16053b75029c
The .gnulib submodule update should not be part of this patch.
> @@ -763,6 +767,27 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def,
> def->name)) < 0)
> return ret;
>
> +#if WITH_SELINUX
> + if (is_selinux_enabled() > 0)
> + {
{ on the same line as the if()
> + security_context_t scon;
> + ret = getfilecon("/proc/meminfo", &scon);
> + if (ret) {
> + virReportSystemError(errno,
> + _("Failed to get security context of %s for /proc/meminfo mount point"),
> + meminfo_path);
> + return ret;
> + }
> + ret = setfilecon(meminfo_path,scon);
Space after comma.
> + freecon(scon);
> + if (ret) {
> + virReportSystemError(errno,
> + _("Failed to set security context of %s for /proc/meminfo mount point"),
> + meminfo_path);
> + return ret;
> + }
> + }
> +#endif
> if ((ret = mount(meminfo_path, "/proc/meminfo",
> NULL, MS_BIND, NULL)) < 0) {
> virReportSystemError(errno,
>
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list