Change in vdsm[ovirt-3.5]: lvm: Do not use udev to set permissions on vdsm images

ybronhei at redhat.com ybronhei at redhat.com
Sun Oct 12 10:57:01 UTC 2014


Yaniv Bronhaim has submitted this change and it was merged.

Change subject: lvm: Do not use udev to set permissions on vdsm images
......................................................................


lvm: Do not use udev to set permissions on vdsm images

udev has changed the rules recently, so setting USER, GROUP, or MODE
will change also the selinux label behind your back. This issue caused
vms to pause after extend, rendering thin provisioning disk useless.

We had a temporary fix, applying a static selinux label on vdsm images,
but this breaks libvirt security. This patch avoids this issue by not
using udev to set any permissions, thus preserving the secure selinux
labels set by libvirt.

This patch replaces the following commits with a simpler and hopefully
longer lasting fix which does not need any platform specific code.

d8d6c17 gitignore: Ingore vdsm-lvm.rule.tpl
00fbc83 lvm: Modify lv selinux label only if not labablled as libvirt image
b2268e4 spec: Enable lvm selinux fix for Fedora
75fc495 lvm: Set libvirt image selinux label on block devices backing vdsm images

Change-Id: I57d9987bf0be19e6e233baaeea10877918eb849b
Bug-Url: https://bugzilla.redhat.com/1149883
Relates-To: https://bugzilla.redhat.com/1147910
Signed-off-by: Nir Soffer <nsoffer at redhat.com>
Reviewed-on: http://gerrit.ovirt.org/33875
Reviewed-by: Federico Simoncelli <fsimonce at redhat.com>
Reviewed-on: http://gerrit.ovirt.org/33931
Reviewed-by: Sandro Bonazzola <sbonazzo at redhat.com>
Reviewed-by: Yaniv Bronhaim <ybronhei at redhat.com>
---
M .gitignore
M configure.ac
M vdsm.spec.in
M vdsm/storage/Makefile.am
D vdsm/storage/vdsm-chcon.in
R vdsm/storage/vdsm-lvm.rules.in
6 files changed, 9 insertions(+), 78 deletions(-)

Approvals:
  Sandro Bonazzola: Looks good to me, but someone else must approve
  Nir Soffer: Verified
  Yaniv Bronhaim: Looks good to me, approved
  Federico Simoncelli: Looks good to me, but someone else must approve



-- 
To view, visit http://gerrit.ovirt.org/33931
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I57d9987bf0be19e6e233baaeea10877918eb849b
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.5
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Allon Mureinik <amureini at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Eyal Edri <eedri at redhat.com>
Gerrit-Reviewer: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Jiří Moskovčák <jmoskovc at redhat.com>
Gerrit-Reviewer: Martin Sivák <msivak at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Sandro Bonazzola <sbonazzo at redhat.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei at redhat.com>
Gerrit-Reviewer: automation at ovirt.org


More information about the vdsm-patches mailing list