]> git.ipfire.org Git - thirdparty/libvirt.git/commit
Honour current user and role in SELinux label generation
authorDaniel P. Berrange <berrange@redhat.com>
Thu, 9 Aug 2012 16:20:25 +0000 (17:20 +0100)
committerDaniel P. Berrange <berrange@redhat.com>
Tue, 14 Aug 2012 14:31:26 +0000 (15:31 +0100)
commitb77e9814e4a626f5b26aacc784a2919d8f73b4e9
treeabab725c912ccc3005731cba725480fe98c152c2
parentcbe67ff9b0a5a94911afd4d12388bf182bcca86c
Honour current user and role in SELinux label generation

When generating an SELinux context for a VM from the template
"system_u:system_r:svirt_t:s0", copy the role + user from the
current process instead of the template context. So if the
current process is

   unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

then the VM context ends up as

  unconfined_u:unconfined_r:svirt_t:s0:c386,c703

instead of

   system_u:system_r:svirt_t:s0:c177,c424

Ideally the /etc/selinux/targeted/contexts/virtual_domain_context
file would have just shown the 'svirt_t' type, and not the full
context, but that can't be changed now for compatibility reasons.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
src/security/security_selinux.c