On Mon, May 26, 2014 at 11:21:59AM +0200, Pino Toscano wrote:
Rewrite the relabel API to read the policy configured in the guest, invoking setfiles (added as part of the appliance, as part of policycoreutils) to relabel the specified root. In case of failure at any point of the process, a touch of .autorelabel in the root is tried as last-attempt measure to do the relabel.
Considering that running SELinux tools in the appliance might be affected by the SELinux state (leading to wrong results), selinux_relabel now bails out if SELinux is enabled in the appliance. As a result of this, virt-builder and virt-customize explicitly disable it if the relabel is enabled.
- g#set_selinux ops.flags.selinux_relabel; + (* If a relabel is needed, make sure to turn SELinux off to avoid + * awkward interactions with the relabel process. + *) + if ops.flags.selinux_relabel then g#set_selinux false;
This defaults to false, so AFAICT you could just remove this hunk. Or call g#set_selinux false unconditionally to make your intention explicit? (Same for the customize_main.ml hunk)
+ len = length_without_training_slash (root); + + if (asprintf (&selinux_config, "%s%.*s/etc/selinux/config", + sysroot, len, root) == -1) { + if (verbose) + fprintf (stderr, "asprintf/selinux_config failed\n"); + goto do_autorelabel; + } + + r = read_selinux_policy (selinux_config, &policy); + if (r == -1) { + if (verbose) + fprintf (stderr, "cannot read policy from %s\n", selinux_config); + goto do_autorelabel; + } + if (verbose) + fprintf (stderr, "policy in %s: %s\n", root, policy); + + if (policy[0] == '\0') + goto do_autorelabel;
You'll probably find this is much easier to write and a lot more robust using augeas calls. But yes, generally looks good. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://people.redhat.com/~rjones/virt-df/