• L
    security: properly chown/label bidirectional and unidirectional fifos · 46e8dc71
    Laine Stump 提交于
    This patch fixes the regression with using named pipes for qemu serial
    devices noted in:
    
      https://bugzilla.redhat.com/show_bug.cgi?id=740478
    
    The problem was that, while new code in libvirt looks for a single
    bidirectional fifo of the name given in the config, then relabels that
    and continues without looking for / relabelling the two unidirectional
    fifos named ${name}.in and ${name}.out, qemu looks in the opposite
    order. So if the user had naively created all three fifos, libvirt
    would relabel the bidirectional fifo to allow qemu access, but qemu
    would attempt to use the two unidirectional fifos and fail (because it
    didn't have proper permissions/rights).
    
    This patch changes the order that libvirt looks for the fifos to match
    what qemu does - first it looks for the dual fifos, then it looks for
    the single bidirectional fifo. If it finds the dual unidirectional
    fifos first, it labels/chowns them and ignores any possible
    bidirectional fifo.
    
    (Note commit d37c6a3a (which first appeared in libvirt-0.9.2) added
    the code that checked for a bidirectional fifo. Prior to that commit,
    bidirectional fifos for serial devices didn't work because libvirt
    always required the ${name}.(in|out) fifos to exist, and qemu would
    always prefer those.
    46e8dc71
security_selinux.c 39.3 KB