Change in vdsm[master]: lvm: Set libvirt image selinux label on block devices backin...

amureini at redhat.com amureini at redhat.com
Mon Sep 29 16:03:30 UTC 2014


Allon Mureinik has posted comments on this change.

Change subject: lvm: Set libvirt image selinux label on block devices backing vdsm images
......................................................................


Patch Set 2: Code-Review+1

(8 comments)

+1 on the code, see inline grammar comments.

@Nir - did you verify scenarios where SPM what EL7 and the HSM running the VM was EL6.5?

http://gerrit.ovirt.org/#/c/33492/2//COMMIT_MSG
Commit Message:

Line 5: CommitDate: 2014-09-29 18:01:31 +0300
Line 6: 
Line 7: lvm: Set libvirt image selinux label on block devices backing vdsm images
Line 8: 
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
s/such wat/in such a way/
Line 10: that domain can only access files which are labelled svirt_image_t
Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
Line 13: 


Line 6: 
Line 7: lvm: Set libvirt image selinux label on block devices backing vdsm images
Line 8: 
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
Line 10: that domain can only access files which are labelled svirt_image_t
s/domain/a domain/

also, s/files/devices/ no?
Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
Line 13: 
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost


Line 7: lvm: Set libvirt image selinux label on block devices backing vdsm images
Line 8: 
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
Line 10: that domain can only access files which are labelled svirt_image_t
Line 11: label. Libvirt set this label on block devices backing images when
s/set/sets/
Line 12: starting a vm.
Line 13: 
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way


Line 8: 
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
Line 10: that domain can only access files which are labelled svirt_image_t
Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
s/starting/it starts/
Line 13: 
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way
Line 16: to use the vm is to shut it down and start it again, which cause libvirt


Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
Line 13: 
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way
s/cause vm/causes the vm/
Line 16: to use the vm is to shut it down and start it again, which cause libvirt
Line 17: to setup the selinux label properly.
Line 18: 
Line 19: Practically this issue breaks thin provisioning on block storage on the


Line 12: starting a vm.
Line 13: 
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way
Line 16: to use the vm is to shut it down and start it again, which cause libvirt
s/cause/causes/
Line 17: to setup the selinux label properly.
Line 18: 
Line 19: Practically this issue breaks thin provisioning on block storage on the
Line 20: effected platforms.


http://gerrit.ovirt.org/#/c/33492/2/vdsm/storage/vdsm-lvm.rules.in
File vdsm/storage/vdsm-lvm.rules.in:

Line 18: #   DM_LV_LAYER - logical volume layer (blank if not set)
Line 19: #
Line 20: # The libvirt image label is required to allow qemu to access volumes. Libvirt
Line 21: # sets this label on volumes when starting a vm, but on recent EL and Fedora
Line 22: # releases, the label is lost after refreshing a logical volume, and vm get
s/vm get/the vm gets/
Line 23: # paused. This rule ensures that the label exist after device changes. See
Line 24: # https://bugzilla.redhat.com/1127460
Line 25: #
Line 26: # TODO: use SECLABEL{selinux}="@LIBVIRT_IMAGE_LABEL@" when this syntax is


Line 19: #
Line 20: # The libvirt image label is required to allow qemu to access volumes. Libvirt
Line 21: # sets this label on volumes when starting a vm, but on recent EL and Fedora
Line 22: # releases, the label is lost after refreshing a logical volume, and vm get
Line 23: # paused. This rule ensures that the label exist after device changes. See
s/exist/exists/
Line 24: # https://bugzilla.redhat.com/1127460
Line 25: #
Line 26: # TODO: use SECLABEL{selinux}="@LIBVIRT_IMAGE_LABEL@" when this syntax is
Line 27: # supported. See https://bugzilla.redhat.com/1015300


-- 
To view, visit http://gerrit.ovirt.org/33492
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I95f85c7b548b2c058693b20b1fa177714a6e1a10
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Allon Mureinik <amureini at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-Reviewer: oVirt Jenkins CI Server
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list