On 04/23/2013 02:22 PM, [email protected] wrote: > From: Dan Walsh <[email protected]> > > Currently the /proc/meminfo is labeled fusefs_t rather then proc_t. > SELinux blocks openshift instances from reading fusefs_t, this > patch sets the file to the default label of /proc/meminfo > --- > .gnulib | 2 +- > src/lxc/lxc_container.c | 25 +++++++++++++++++++++++++ > 2 files changed, 26 insertions(+), 1 deletion(-) > > diff --git a/.gnulib b/.gnulib > index 92f3a4c..819b1c3 160000 > --- a/.gnulib > +++ b/.gnulib > @@ -1 +1 @@ > -Subproject commit 92f3a4c8e52e64c233e260431d095dbf88554c14 > +Subproject commit 819b1c38b9abd94d7d1ca2a77bbe16053b75029c
The .gnulib submodule update should not be part of this patch.
> @@ -763,6 +767,27 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def,
> def->name)) < 0)
> return ret;
>
> +#if WITH_SELINUX
> + if (is_selinux_enabled() > 0)
> + {
{ on the same line as the if()
> + security_context_t scon;
> + ret = getfilecon("/proc/meminfo", &scon);
> + if (ret) {
> + virReportSystemError(errno,
> + _("Failed to get security context of %s for
> /proc/meminfo mount point"),
> + meminfo_path);
> + return ret;
> + }
> + ret = setfilecon(meminfo_path,scon);
Space after comma.
> + freecon(scon);
> + if (ret) {
> + virReportSystemError(errno,
> + _("Failed to set security context of %s for
> /proc/meminfo mount point"),
> + meminfo_path);
> + return ret;
> + }
> + }
> +#endif
> if ((ret = mount(meminfo_path, "/proc/meminfo",
> NULL, MS_BIND, NULL)) < 0) {
> virReportSystemError(errno,
>
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/libvir-list
