[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH for 6.2 v4] nbd/server: Add --selinux-label option

From: Thomas Huth
Subject: Re: [PATCH for 6.2 v4] nbd/server: Add --selinux-label option
Date: Tue, 16 Nov 2021 08:06:03 +0100
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.3.0

On 15/11/2021 21.29, Eric Blake wrote:
From: "Richard W.M. Jones" <rjones@redhat.com>

Under SELinux, Unix domain sockets have two labels.  One is on the
disk and can be set with commands such as chcon(1).  There is a
different label stored in memory (called the process label).  This can
only be set by the process creating the socket.  When using SELinux +
SVirt and wanting qemu to be able to connect to a qemu-nbd instance,
you must set both labels correctly first.

For qemu-nbd the options to set the second label are awkward.  You can
create the socket in a wrapper program and then exec into qemu-nbd.
Or you could try something with LD_PRELOAD.

This commit adds the ability to set the label straightforwardly on the
command line, via the new --selinux-label flag.  (The name of the flag
is the same as the equivalent nbdkit option.)
@@ -3430,6 +3437,7 @@ summary_info += {'libdaxctl support': libdaxctl}
  summary_info += {'libudev':           libudev}
  # Dummy dependency, keep .found()
  summary_info += {'FUSE lseek':        fuse_lseek.found()}
+summary_info += {'selinux':           selinux.found()}

It's nicer if you do it like this (i.e. without the .found()):

summary_info += {'selinux':           selinux}

... then meson prints out the version of the library, too.

Apart from that, patch looks fine to me:

Reviewed-by: Thomas Huth <thuth@redhat.com>

reply via email to

[Prev in Thread] Current Thread [Next in Thread]