Quoting Russell Coker (russell@xxxxxxxxxxxx): > I'm thinking of setting up a Linux virtual machine server for SE Linux > training, and with most COW setups the initial relabel of the filesystem will > put all the meta-data into a separate copy. So ideally there would be a way > of deduplicating this. Also there's no guarantee that the disk blocks used > would be the same so a simple un-COW operation on LVM or something probably > wouldn't be a viable option. Here's an idea - you could create the base fs as a qcow2 block device. Create copy-on-write images based on that for i in `seq 1 20`; do qemu-img create -f qcow2 -b selinux-base.img selinux-vm$i.img done Then use qemu-nbd to export those as /dev/nbdX devices for i in `seq 1 20`; do qemu-nbd -c /dev/nbd$i selinux-vm$i done I'm guessing at the commands as I haven't quite done it. But then your containers or VMS or chroots or whatever can mount /dev/nbd$i like a normal block device, COW based on the same base image. I'm not sure that would suffice though, if there are a lot of small files, since presumably the xattrs will be spread out along with the data. So if that does not suffice (I'd love to hear a report if anyone tests this), then I think we have another motivator for pushing a 'xattr_file=' mount option, where the specified file has (inode_num,name,value) triplets for the inodes on the fs, i.e. 25,security.selinux,root_u:root_r:root_t 25,security.capabilities,<whatever> 30,security.selinux,user_u:user_r:serge_t That way the base fs wouldn't need to change much at all for each of your VMs. The other motivator of course is common filesystems which don't support xattrs like squashfs and CIFS. I wonder what sort of reception such a patch would receive... "welcome back to year 2000"? -serge -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
