From: Jiri Denemark <jdenemar@redhat.com>
Date: Wed, 25 Jul 2012 12:38:27 +0000 (+0200)
Subject: security: Skip labeling resources when seclabel defaults to none
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=ce53382ba28179d3a504b29b4f888b6e130d53f0;p=libvirt.git

security: Skip labeling resources when seclabel defaults to none

If a domain is explicitly configured with <seclabel type="none"/> we
correctly ensure that no labeling will be done by setting
norelabel=true. However, if no seclabel element is present in domain XML
and hypervisor is configured not to confine domains by default, we only
set type to "none" without turning off relabeling. Thus if such a domain
is being started, security driver wants to relabel resources with
default label, which doesn't make any sense.

Moreover, with SELinux security driver, the generated image label lacks
"s0" sensitivity, which causes setfilecon() fail with EINVAL in
enforcing mode.
---

diff --git a/src/security/security_manager.c b/src/security/security_manager.c
index 2e1be4ddb6..44ab6fb2a7 100644
--- a/src/security/security_manager.c
+++ b/src/security/security_manager.c
@@ -309,10 +309,12 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr,
                                virDomainDefPtr vm)
 {
     if (vm->seclabel.type == VIR_DOMAIN_SECLABEL_DEFAULT) {
-        if (mgr->defaultConfined)
+        if (mgr->defaultConfined) {
             vm->seclabel.type = VIR_DOMAIN_SECLABEL_DYNAMIC;
-        else
+        } else {
             vm->seclabel.type = VIR_DOMAIN_SECLABEL_NONE;
+            vm->seclabel.norelabel = true;
+        }
     }
 
     if ((vm->seclabel.type == VIR_DOMAIN_SECLABEL_NONE) &&