From: Michal Privoznik Date: Tue, 25 Sep 2018 11:33:28 +0000 (+0200) Subject: virSecurityDACRestoreImageLabelInt: Restore even shared/RO disks X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=d7420430ce6d887ad8b669eeb5d6c2222de5b80f;p=libvirt.git virSecurityDACRestoreImageLabelInt: Restore even shared/RO disks Now that we have seclabel remembering we can safely restore labels for shared and RO disks. In fact we need to do that to keep seclabel refcount stored in XATTRs in sync with reality. Signed-off-by: Michal Privoznik Reviewed-by: Daniel P. Berrangé Reviewed-by: Ján Tomko --- diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 3264a2967c..533d990de1 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -932,14 +932,6 @@ virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr mgr, if (!priv->dynamicOwnership) return 0; - /* Don't restore labels on readoly/shared disks, because other VMs may - * still be accessing these. Alternatively we could iterate over all - * running domains and try to figure out if it is in use, but this would - * not work for clustered filesystems, since we can't see running VMs using - * the file on other nodes. Safest bet is thus to skip the restore step. */ - if (src->readonly || src->shared) - return 0; - secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME); if (secdef && !secdef->relabel) return 0;