-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/16/2013 12:09 PM, Daniel P. Berrange wrote:
> On Thu, May 16, 2013 at 05:04:06PM +0100, Daniel P. Berrange wrote:
>> On Wed, May 15, 2013 at 10:35:48AM -0400, dwalsh@xxxxxxxxxx wrote:
>>> From: Dan Walsh <dwalsh@xxxxxxxxxx>
>>>
>>> We do not want to allow contained applications to be able to read
>>> fusefs_t. So we want /proc/meminfo label to match the system default
>>> proc_t.
>>>
>>> Fix checking of error codes --- src/lxc/lxc_container.c | 24
>>> ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
>>>
>>> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index
>>> 8e1d10a..8c0edb0 100644 --- a/src/lxc/lxc_container.c +++
>>> b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h>
>>> #endif
>>>
>>> +#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include
>>> "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -761,6
>>> +765,26 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def,
>>> def->name)) < 0) return ret;
>>>
>>> +#if WITH_SELINUX + if (is_selinux_enabled() > 0) { +
>>> security_context_t scon; + ret = getfilecon("/proc/meminfo",
>>> &scon); + if (ret < 0) { +
>>> virReportSystemError(errno, + _("Failed
>>> to get security context of %s for /proc/meminfo mount point"), +
>>> meminfo_path); + return ret; + } + ret =
>>> setfilecon(meminfo_path, scon); + freecon(scon); + if
>>> (ret < 0) { + virReportSystemError(errno, +
>>> _("Failed to set security context of %s for /proc/meminfo mount
>>> point"), + meminfo_path);
>>
>> So I'm not unable to start any containers with this patch applied:
>>
>> 2013-05-16 16:01:47.835+0000: 1: error : lxcContainerMountProcFuse:787 :
>> Failed to set security context of
>> /.oldroot//run/libvirt/lxc/busy.fuse/meminfo for /proc/meminfo mount
>> point: Operation not supported
>>
>>
>> What distro + kernel version did you test this with ? I'm using current
>> F19 with kernel 3.9.0-0.rc8.git0.2.fc19.x86_64 when I see the failure
>
> Indeed, even trying to change it manually fails
>
> # chcon system_u:object_r:proc_t:s0 /proc/8180/root/proc/meminfo chcon:
> failed to change context of ‘/proc/8180/root/proc/meminfo’ to
> ‘system_u:object_r:proc_t:s0’: Operation not supported
>
>
>
> Daniel
>
Revert the patch, I could swear this was working before, but it is not now.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlGVSSYACgkQrlYvE4MpobMxAQCgwgqT48d06kj5pnndBcAB+FHn
0TkAn3bBKSduOnIIrNTcTkAOLBtpWjje
=gVQV
-----END PGP SIGNATURE-----
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list