63 lines
2.5 KiB
Diff
63 lines
2.5 KiB
Diff
|
From 667ac7026fdf98ab9fe4158aa101026fb9dc40c8 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Michal Privoznik <mprivozn@redhat.com>
|
||
|
|
Date: Wed, 9 Dec 2020 11:06:29 +0100
|
||
|
|
Subject: [PATCH 089/108] qemu_process: Release domain seclabel later in
|
||
|
|
qemuProcessStop()
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
Some secdrivers (typically SELinux driver) generate unique
|
||
|
|
dynamic seclabel for each domain (unless a static one is
|
||
|
|
requested in domain XML). This is achieved by calling
|
||
|
|
qemuSecurityGenLabel() from qemuProcessPrepareDomain() which
|
||
|
|
allocates unique seclabel and stores it in domain def->seclabels.
|
||
|
|
The counterpart is qemuSecurityReleaseLabel() which releases the
|
||
|
|
label and removes it from def->seclabels. Problem is, that with
|
||
|
|
current code the qemuProcessStop() may still want to use the
|
||
|
|
seclabel after it was released, e.g. when it wants to restore the
|
||
|
|
label of a disk mirror.
|
||
|
|
|
||
|
|
What is happening now, is that in qemuProcessStop() the
|
||
|
|
qemuSecurityReleaseLabel() is called, which removes the SELinux
|
||
|
|
seclabel from def->seclabels, yada yada yada and eventually
|
||
|
|
qemuSecurityRestoreImageLabel() is called. This bubbles down to
|
||
|
|
virSecuritySELinuxRestoreImageLabelSingle() which find no SELinux
|
||
|
|
seclabel (using virDomainDefGetSecurityLabelDef()) and this
|
||
|
|
returns early doing nothing.
|
||
|
|
|
||
|
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1751664
|
||
|
|
Fixes: 8fa0374c5b8e834fcbdeae674cc6cc9e6bf9019f
|
||
|
|
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
||
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
(cherry picked from commit 5ac2439a831037c2a861566cad1980b0a2f2907f)
|
||
|
|
---
|
||
|
|
src/qemu/qemu_process.c | 4 ++--
|
||
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
|
||
|
|
index 890603f66b..bf5375bcde 100644
|
||
|
|
--- a/src/qemu/qemu_process.c
|
||
|
|
+++ b/src/qemu/qemu_process.c
|
||
|
|
@@ -7449,8 +7449,6 @@ void qemuProcessStop(virQEMUDriverPtr driver,
|
||
|
|
qemuSecurityRestoreAllLabel(driver, vm,
|
||
|
|
!!(flags & VIR_QEMU_PROCESS_STOP_MIGRATED));
|
||
|
|
|
||
|
|
- qemuSecurityReleaseLabel(driver->securityManager, vm->def);
|
||
|
|
-
|
||
|
|
for (i = 0; i < vm->def->ndisks; i++) {
|
||
|
|
virDomainDeviceDef dev;
|
||
|
|
virDomainDiskDefPtr disk = vm->def->disks[i];
|
||
|
|
@@ -7625,6 +7623,8 @@ void qemuProcessStop(virQEMUDriverPtr driver,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
+ qemuSecurityReleaseLabel(driver->securityManager, vm->def);
|
||
|
|
+
|
||
|
|
/* clear all private data entries which are no longer needed */
|
||
|
|
qemuDomainObjPrivateDataClear(priv);
|
||
|
|
|
||
|
|
--
|
||
|
|
2.33.0
|
||
|
|
|