On Wed, 2010-03-03 at 13:49 -0600, Serge E. Hallyn wrote: > Quoting Nathan Lynch (ntl@xxxxxxxxx): > > On Tue, 2010-03-02 at 19:19 -0600, Serge E. Hallyn wrote: > > > Can you try the following patch? > > > > > > Also, to actually restore the LSM labels you need to add -k to your > > > restart flags, but without the -k you should get a sane default > > > security label. > > > > Thanks, the ipc/mq tests pass with this patch and restart -k. Without > > -k the tests still fail in the same manner (msgrcv fails). Is that the > > behavior you'd expect? > > Not really - the test runs as unconfined_u right? I added a ps -Z to test-mq.sh before thawing: # PATH=/root/cr/user-cr.git:$PATH bash test-mq.sh Using output dir ./cr_mq_6T8KIG6 XXX Test 1: simple restart with SYSVIPC msq check-mq: no process killed ../common.sh: line 45: 5173 Killed ( sleep $1; kill -s USR1 $$ ) LABEL PID TTY TIME CMD unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4358 pts/1 00:00:00 bash unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5151 pts/1 00:00:00 bash unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5172 pts/1 00:00:00 nsexec unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5175 pts/1 00:00:00 sleep unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5178 pts/1 00:00:00 check- unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5183 pts/1 00:00:00 ps PASS > I'd expect the > msg to get created with the same type both when you just run the > original program and when you restart it. If you just run the > checkpointed program and let it complete, doe sit also get a > denial at msgrcv? No, the msgrcv calls succeed if I alter the testcase to resume the original process instead of killing and restarting it. _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
