Change in vdsm[master]: lvm: Set libvirt image selinux label on block devices backin...

danken at redhat.com danken at redhat.com
Tue Sep 30 14:18:04 UTC 2014


Dan Kenigsberg has posted comments on this change.

Change subject: lvm: Set libvirt image selinux label on block devices backing vdsm images
......................................................................


Patch Set 5: Code-Review-1

(1 comment)

http://gerrit.ovirt.org/#/c/33492/5/vdsm/storage/vdsm-lvm.rules.in
File vdsm/storage/vdsm-lvm.rules.in:

Line 23: # paused. This rule ensures that the label exist after device changes. See
Line 24: # https://bugzilla.redhat.com/1147910
Line 25: #
Line 26: # TODO: use SECLABEL{selinux}="@LIBVIRT_IMAGE_LABEL@" when this syntax is
Line 27: # supported. See https://bugzilla.redhat.com/1015300
Only after discussing this with Federico do I realize that this is a security issue - it removes sVirt's protection against cross-qemu attacks.

Since the systemd bug is unrelated to el6, this patch has net negative affect on el6 (which is still our main platform). Thus, it should not be merged as it is now.

For Fedora/EL7 we have two bad options:
* keep thin provisioning broken, until https://bugzilla.redhat.com/1147910 is fixed.
* effectively disable svirt. (which can be done in a simpler fashion, I suppose, with a libvirtd.conf tweak).
Line 28: 
Line 29: # "add" event is processed on coldplug only, so we need "change", too.
Line 30: ACTION!="add|change", GOTO="lvm_end"
Line 31: 


-- 
To view, visit http://gerrit.ovirt.org/33492
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I95f85c7b548b2c058693b20b1fa177714a6e1a10
Gerrit-PatchSet: 5
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Allon Mureinik <amureini at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-Reviewer: oVirt Jenkins CI Server
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list