Change in vdsm[master]: lvm: Set libvirt image selinux label on block devices backin...
amureini at redhat.com
amureini at redhat.com
Mon Sep 29 16:03:30 UTC 2014
Allon Mureinik has posted comments on this change.
Change subject: lvm: Set libvirt image selinux label on block devices backing vdsm images
......................................................................
Patch Set 2: Code-Review+1
(8 comments)
+1 on the code, see inline grammar comments.
@Nir - did you verify scenarios where SPM what EL7 and the HSM running the VM was EL6.5?
http://gerrit.ovirt.org/#/c/33492/2//COMMIT_MSG
Commit Message:
Line 5: CommitDate: 2014-09-29 18:01:31 +0300
Line 6:
Line 7: lvm: Set libvirt image selinux label on block devices backing vdsm images
Line 8:
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
s/such wat/in such a way/
Line 10: that domain can only access files which are labelled svirt_image_t
Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
Line 13:
Line 6:
Line 7: lvm: Set libvirt image selinux label on block devices backing vdsm images
Line 8:
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
Line 10: that domain can only access files which are labelled svirt_image_t
s/domain/a domain/
also, s/files/devices/ no?
Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
Line 13:
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 7: lvm: Set libvirt image selinux label on block devices backing vdsm images
Line 8:
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
Line 10: that domain can only access files which are labelled svirt_image_t
Line 11: label. Libvirt set this label on block devices backing images when
s/set/sets/
Line 12: starting a vm.
Line 13:
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way
Line 8:
Line 9: The SELinux sVirt protection for QEMU virtual machines is setup such way
Line 10: that domain can only access files which are labelled svirt_image_t
Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
s/starting/it starts/
Line 13:
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way
Line 16: to use the vm is to shut it down and start it again, which cause libvirt
Line 11: label. Libvirt set this label on block devices backing images when
Line 12: starting a vm.
Line 13:
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way
s/cause vm/causes the vm/
Line 16: to use the vm is to shut it down and start it again, which cause libvirt
Line 17: to setup the selinux label properly.
Line 18:
Line 19: Practically this issue breaks thin provisioning on block storage on the
Line 12: starting a vm.
Line 13:
Line 14: On Fedora 19, 20 and EL 7, the selinux label on the block device is lost
Line 15: after refreshing a logical volume. This cause vm to pause. The only way
Line 16: to use the vm is to shut it down and start it again, which cause libvirt
s/cause/causes/
Line 17: to setup the selinux label properly.
Line 18:
Line 19: Practically this issue breaks thin provisioning on block storage on the
Line 20: effected platforms.
http://gerrit.ovirt.org/#/c/33492/2/vdsm/storage/vdsm-lvm.rules.in
File vdsm/storage/vdsm-lvm.rules.in:
Line 18: # DM_LV_LAYER - logical volume layer (blank if not set)
Line 19: #
Line 20: # The libvirt image label is required to allow qemu to access volumes. Libvirt
Line 21: # sets this label on volumes when starting a vm, but on recent EL and Fedora
Line 22: # releases, the label is lost after refreshing a logical volume, and vm get
s/vm get/the vm gets/
Line 23: # paused. This rule ensures that the label exist after device changes. See
Line 24: # https://bugzilla.redhat.com/1127460
Line 25: #
Line 26: # TODO: use SECLABEL{selinux}="@LIBVIRT_IMAGE_LABEL@" when this syntax is
Line 19: #
Line 20: # The libvirt image label is required to allow qemu to access volumes. Libvirt
Line 21: # sets this label on volumes when starting a vm, but on recent EL and Fedora
Line 22: # releases, the label is lost after refreshing a logical volume, and vm get
Line 23: # paused. This rule ensures that the label exist after device changes. See
s/exist/exists/
Line 24: # https://bugzilla.redhat.com/1127460
Line 25: #
Line 26: # TODO: use SECLABEL{selinux}="@LIBVIRT_IMAGE_LABEL@" when this syntax is
Line 27: # supported. See https://bugzilla.redhat.com/1015300
--
To view, visit http://gerrit.ovirt.org/33492
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I95f85c7b548b2c058693b20b1fa177714a6e1a10
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Allon Mureinik <amureini at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-Reviewer: oVirt Jenkins CI Server
Gerrit-HasComments: Yes
More information about the vdsm-patches
mailing list