]> git.ipfire.org Git - thirdparty/libvirt.git/commit
security_selinux: Play nicely with network FS that only emulates SELinux
authorMichal Privoznik <mprivozn@redhat.com>
Thu, 22 Aug 2019 14:34:02 +0000 (16:34 +0200)
committerMichal Privoznik <mprivozn@redhat.com>
Fri, 30 Aug 2019 10:50:09 +0000 (12:50 +0200)
commit8fe953805a535097cf3b819b3b68fbfb166efed4
tree0b632009ad19fec7682b32efefe2fb080d05ac96
parenteaa2a064fa9a7cf6220349ac8706a22593cbf607
security_selinux: Play nicely with network FS that only emulates SELinux

There are some network file systems that do support XATTRs (e.g.
gluster via FUSE). And they appear to support SELinux too.
However, not really. Problem is, that it is impossible to change
SELinux label of a file stored there, and yet we claim success
(rightfully - hypervisor succeeds in opening the file). But this
creates a problem for us - from XATTR bookkeeping POV, we haven't
changed the label and thus if we remembered any label, we must
roll back and remove it.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1740506

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
src/security/security_selinux.c