From 83fa1184585013e4c4b430e5ef7695e825b8d9ec Mon Sep 17 00:00:00 2001 From: Daniel Veillard Date: Thu, 18 Nov 2010 17:55:14 +0100 Subject: [PATCH] Fix a failure to restore SELinux label for character devices The code in SELinuxRestoreSecurityChardevLabel() was trying to use SELinuxSetFilecon directly for devices or file types while it should really use SELinuxRestoreSecurityFileLabel encapsulating routine, which avoid various problems like resolving symlinks, making sure he file exists and work around NFS problems --- src/security/security_selinux.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 936a1a6b9b..996177ac05 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -694,9 +694,10 @@ SELinuxRestoreSecurityChardevLabel(virDomainObjPtr vm, switch (dev->type) { case VIR_DOMAIN_CHR_TYPE_DEV: case VIR_DOMAIN_CHR_TYPE_FILE: - ret = SELinuxSetFilecon(dev->data.file.path, secdef->imagelabel); + if (SELinuxRestoreSecurityFileLabel(dev->data.file.path) < 0) + goto done; + ret = 0; break; - case VIR_DOMAIN_CHR_TYPE_PIPE: if ((virAsprintf(&out, "%s.out", dev->data.file.path) < 0) || (virAsprintf(&in, "%s.in", dev->data.file.path) < 0)) {