From b6ad2c2334398ba45a6011af7527478d3455e3cc Mon Sep 17 00:00:00 2001 From: Viktor Mihajlovski Date: Mon, 20 Aug 2012 16:12:14 +0200 Subject: [PATCH] selinux: Fix incorrect object label generation. This is a fix for the object label generation. It uses a new flag for virSecuritySELinuxGenNewContext that specifies whether the context is for an object. If so the context role remains unchanged. Without this fix it is not possible to start domains with image file or block device backed storage when selinux is enabled. Signed-off-by: Viktor Mihajlovski --- src/security/security_selinux.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 48fd78b169..cf69040ba9 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -141,7 +141,9 @@ cleanup: static char * -virSecuritySELinuxGenNewContext(const char *basecontext, const char *mcs) +virSecuritySELinuxGenNewContext(const char *basecontext, + const char *mcs, + bool isObjectContext) { context_t context = NULL; char *ret = NULL; @@ -176,10 +178,11 @@ virSecuritySELinuxGenNewContext(const char *basecontext, const char *mcs) goto cleanup; } - if (context_role_set(context, + if (!isObjectContext && + context_role_set(context, context_role_get(ourContext)) != 0) { virReportSystemError(errno, - _("Unable to set SELinux context user '%s'"), + _("Unable to set SELinux context role '%s'"), context_role_get(ourContext)); goto cleanup; } @@ -421,7 +424,8 @@ virSecuritySELinuxGenSecurityLabel(virSecurityManagerPtr mgr, if (!(def->seclabel.label = virSecuritySELinuxGenNewContext(def->seclabel.baselabel ? def->seclabel.baselabel : - data->domain_context, mcs))) + data->domain_context, + mcs, false))) goto cleanup; break; @@ -438,7 +442,7 @@ virSecuritySELinuxGenSecurityLabel(virSecurityManagerPtr mgr, if (!def->seclabel.norelabel) { if (!(def->seclabel.imagelabel = - virSecuritySELinuxGenNewContext(data->file_context, mcs))) + virSecuritySELinuxGenNewContext(data->file_context, mcs, true))) goto cleanup; } @@ -1639,7 +1643,8 @@ virSecuritySELinuxGenImageLabel(virSecurityManagerPtr mgr, virReportOOMError(); goto cleanup; } - if (!(label = virSecuritySELinuxGenNewContext(data->file_context, mcs))) + if (!(label = virSecuritySELinuxGenNewContext(data->file_context, + mcs, true))) goto cleanup; } } -- GitLab