]> git.ipfire.org Git - thirdparty/libvirt.git/commit
security: don't fail if built without attr support v6.4.0-rc1
authorChristian Ehrhardt <christian.ehrhardt@canonical.com>
Tue, 26 May 2020 07:33:38 +0000 (09:33 +0200)
committerChristian Ehrhardt <christian.ehrhardt@canonical.com>
Wed, 27 May 2020 09:22:50 +0000 (11:22 +0200)
commit55029d93150e33d70b02b6de2b899c05054c5d3a
treefe118739f204d5373a826aeba11452f3b07d613c
parent4eda71a8d05d968e73ab9b0fdc8a90123c57d39e
security: don't fail if built without attr support

If built without attr support removing any image will trigger
 qemuBlockRemoveImageMetadata (the one that emits the warning)
   -> qemuSecurityMoveImageMetadata
     -> virSecurityManagerMoveImageMetadata
       -> virSecurityDACMoveImageMetadata
         -> virSecurityDACMoveImageMetadataHelper
           -> virProcessRunInFork (spawns subprocess)
             -> virSecurityMoveRememberedLabel

In there due to !HAVE_LIBATTR virFileGetXAttrQuiet will return
ENOSYS and from there the chain will error out.

That is wrong and looks like:
  libvirtd[6320]: internal error: child reported (status=125):
  libvirtd[6320]: Unable to remove disk metadata on vm testguest from
  /var/lib/uvtool/libvirt/images/testguest.qcow (disk target vda)

This change makes virSecurityDACMoveImageMetadataHelper and
virSecuritySELinuxMoveImageMetadataHelper accept that
error code gracefully and in that sense it is an extension of:
5214b2f1a3f "security: Don't skip label restore on file systems lacking XATTRs"
which does the same for other call chains into the virFile*XAttr functions.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
src/security/security_dac.c
src/security/security_selinux.c