From: Daniel Veillard <veillard@redhat.com>
Date: Thu, 18 Nov 2010 16:55:14 +0000 (+0100)
Subject: Fix a failure to restore SELinux label for character devices
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=83fa1184585013e4c4b430e5ef7695e825b8d9ec;p=libvirt.git

Fix a failure to restore SELinux label for character devices

The code in SELinuxRestoreSecurityChardevLabel() was trying to
use SELinuxSetFilecon directly for devices or file types while
it should really use SELinuxRestoreSecurityFileLabel encapsulating
routine, which avoid various problems like resolving symlinks,
making sure he file exists and work around NFS problems
---

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 936a1a6b9b..996177ac05 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -694,9 +694,10 @@ SELinuxRestoreSecurityChardevLabel(virDomainObjPtr vm,
     switch (dev->type) {
     case VIR_DOMAIN_CHR_TYPE_DEV:
     case VIR_DOMAIN_CHR_TYPE_FILE:
-        ret = SELinuxSetFilecon(dev->data.file.path, secdef->imagelabel);
+        if (SELinuxRestoreSecurityFileLabel(dev->data.file.path) < 0)
+            goto done;
+        ret = 0;
         break;
-
     case VIR_DOMAIN_CHR_TYPE_PIPE:
         if ((virAsprintf(&out, "%s.out", dev->data.file.path) < 0) ||
             (virAsprintf(&in, "%s.in", dev->data.file.path) < 0)) {