Change in vdsm[master]: lvm: Set libvirt image selinux label on block devices backin...

nsoffer at redhat.com nsoffer at redhat.com
Mon Sep 29 17:31:41 UTC 2014


Nir Soffer has posted comments on this change.

Change subject: lvm: Set libvirt image selinux label on block devices backing vdsm images
......................................................................


Patch Set 2:

(2 comments)

Allon: I verified when spm was el7 and el6, when there were two vms, one running on the el6 host and one on the el7 host.

http://gerrit.ovirt.org/#/c/33492/2//COMMIT_MSG
Commit Message:

Line 22: We don't know why the selinux label is lost, and lvm developers claim
Line 23: that relevant code was not changed recently. This issue may be caused by
Line 24: lower level components such as device mapper, multipath or iscsi.
Line 25: 
Line 26: This patch adds a temporary solution, by updating vdsm lvm rules to set
> Can we reproduce the label removal with
We can easily reproduce this, just chcon and run lvchagne --refresh to loose the label.

We can add use el6 specific rule without this - but we can also fix this later. It would be nice if we can get this fixed the release this week.
Line 27: the libvirt image selinux label on vdsm images.
Line 28: 
Line 29: Change-Id: I95f85c7b548b2c058693b20b1fa177714a6e1a10
Line 30: Bug-Url: https://bugzilla.redhat.com/1127460


Line 22: We don't know why the selinux label is lost, and lvm developers claim
Line 23: that relevant code was not changed recently. This issue may be caused by
Line 24: lower level components such as device mapper, multipath or iscsi.
Line 25: 
Line 26: This patch adds a temporary solution, by updating vdsm lvm rules to set
> Maybe libvirt is chcon'ing the device instead of setting a udev rule? In th
Libvirt does chcon the device - it assumes that the label is never removed, which is true on rhel6.

I believe this a platform bug, and should be solved in lower level layers.

I did not checked qemu code, the only effect I know is pausing the vm as it cannot read or write any more the volume without the label.
Line 27: the libvirt image selinux label on vdsm images.
Line 28: 
Line 29: Change-Id: I95f85c7b548b2c058693b20b1fa177714a6e1a10
Line 30: Bug-Url: https://bugzilla.redhat.com/1127460


-- 
To view, visit http://gerrit.ovirt.org/33492
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I95f85c7b548b2c058693b20b1fa177714a6e1a10
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Allon Mureinik <amureini at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-Reviewer: oVirt Jenkins CI Server
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list