Re: [PATCH v3] nbd/server: Add --selinux-label option

[Vladimir Sementsov-Ogievskiy]

9/30/21 21:37, Richard W.M. Jones wrote:
> On Thu, Sep 30, 2021 at 02:00:11PM -0300, Willian Rampazzo wrote:
> > On Thu, Sep 30, 2021 at 5:55 AM Vladimir Sementsov-Ogievskiy
> > <vsementsov@virtuozzo.com> wrote:
> > > 9/30/21 11:47, Richard W.M. Jones wrote:
> > > > Under SELinux, Unix domain sockets have two labels.  One is on the
> > > > disk and can be set with commands such as chcon(1).  There is a
> > > > different label stored in memory (called the process label).  This can
> > > > only be set by the process creating the socket.  When using SELinux +
> > > > SVirt and wanting qemu to be able to connect to a qemu-nbd instance,
> > > > you must set both labels correctly first.
> > > >
> > > > For qemu-nbd the options to set the second label are awkward.  You can
> > > > create the socket in a wrapper program and then exec into qemu-nbd.
> > > > Or you could try something with LD_PRELOAD.
> > > >
> > > > This commit adds the ability to set the label straightforwardly on the
> > > > command line, via the new --selinux-label flag.  (The name of the flag
> > > > is the same as the equivalent nbdkit option.)
> > > >
> > > > A worked example showing how to use the new option can be found in
> > > > this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1984938
> > > >
> > > > Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1984938
> > > > Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
> > > > Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
> > > > Signed-off-by: Eric Blake <eblake@redhat.com>
> > >
> > > this should be Reviewed-by?
> >
> > Maybe, because of this:
> > https://lists.gnu.org/archive/html/qemu-devel/2021-09/msg07081.html
> >
> > I got confused with this v3.
>
> Yes, I'd somehow lost the original patch and picked it up from Eric's
> queue to make v3.

Than it's probably correct. Still a bit strange to send own patch with another 
s-o-b in the end.

> Having said that I'm not sure what the objection above means.  Do you
> mean Eric's tag should be Reviewed-by instead of S-o-b?  (And why?)

I thought you just accidentally used s-o-b instead of r-b.

--
Best regards,
Vladimir