From 5ac2439a831037c2a861566cad1980b0a2f2907f Mon Sep 17 00:00:00 2001 From: Michal Privoznik Date: Wed, 9 Dec 2020 11:06:29 +0100 Subject: [PATCH] qemu_process: Release domain seclabel later in qemuProcessStop() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some secdrivers (typically SELinux driver) generate unique dynamic seclabel for each domain (unless a static one is requested in domain XML). This is achieved by calling qemuSecurityGenLabel() from qemuProcessPrepareDomain() which allocates unique seclabel and stores it in domain def->seclabels. The counterpart is qemuSecurityReleaseLabel() which releases the label and removes it from def->seclabels. Problem is, that with current code the qemuProcessStop() may still want to use the seclabel after it was released, e.g. when it wants to restore the label of a disk mirror. What is happening now, is that in qemuProcessStop() the qemuSecurityReleaseLabel() is called, which removes the SELinux seclabel from def->seclabels, yada yada yada and eventually qemuSecurityRestoreImageLabel() is called. This bubbles down to virSecuritySELinuxRestoreImageLabelSingle() which find no SELinux seclabel (using virDomainDefGetSecurityLabelDef()) and this returns early doing nothing. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1751664 Fixes: 8fa0374c5b8e834fcbdeae674cc6cc9e6bf9019f Signed-off-by: Michal Privoznik Reviewed-by: Daniel P. Berrangé --- src/qemu/qemu_process.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 69c517f7a9..f0a698ba3d 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7707,8 +7707,6 @@ void qemuProcessStop(virQEMUDriverPtr driver, qemuSecurityRestoreAllLabel(driver, vm, !!(flags & VIR_QEMU_PROCESS_STOP_MIGRATED)); - qemuSecurityReleaseLabel(driver->securityManager, vm->def); - for (i = 0; i < vm->def->ndisks; i++) { virDomainDeviceDef dev; virDomainDiskDefPtr disk = vm->def->disks[i]; @@ -7896,6 +7894,8 @@ void qemuProcessStop(virQEMUDriverPtr driver, } } + qemuSecurityReleaseLabel(driver->securityManager, vm->def); + /* clear all private data entries which are no longer needed */ qemuDomainObjPrivateDataClear(priv);