Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-03-03 Thread Daniel P. Berrange
On Fri, Feb 27, 2009 at 03:37:55PM -0500, Daniel J Walsh wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Another patch off latest repository. This patch does not require the XML to include a label, although this is still supported. Implemented most of the comments from Jim. make

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-03-03 Thread Daniel P. Berrange
On Fri, Feb 27, 2009 at 03:37:55PM -0500, Daniel J Walsh wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Another patch off latest repository. This patch does not require the XML to include a label, although this is still supported. Implemented most of the comments from Jim. make

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-03-03 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daniel P. Berrange wrote: On Fri, Feb 27, 2009 at 03:37:55PM -0500, Daniel J Walsh wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Another patch off latest repository. This patch does not require the XML to include a label, although this

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-03-03 Thread Daniel P. Berrange
On Tue, Mar 03, 2009 at 09:08:20AM -0500, Daniel J Walsh wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daniel P. Berrange wrote: On Fri, Feb 27, 2009 at 03:37:55PM -0500, Daniel J Walsh wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Another patch off latest repository.

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-03-02 Thread Daniel P. Berrange
On Mon, Mar 02, 2009 at 09:18:05AM +1100, James Morris wrote: On Fri, 27 Feb 2009, Daniel J Walsh wrote: I think we need a mechanism in libvirtd.conf to turn this off. And allow perhaps three modes. svirt=Disabled. No Security Driver. svirt=MLS (Requires context in xml, no relabel

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-03-02 Thread Cole Robinson
Daniel P. Berrange wrote: On Mon, Mar 02, 2009 at 09:18:05AM +1100, James Morris wrote: On Fri, 27 Feb 2009, Daniel J Walsh wrote: I think we need a mechanism in libvirtd.conf to turn this off. And allow perhaps three modes. svirt=Disabled. No Security Driver. svirt=MLS (Requires

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-03-01 Thread James Morris
On Fri, 27 Feb 2009, Daniel J Walsh wrote: I think we need a mechanism in libvirtd.conf to turn this off. And allow perhaps three modes. svirt=Disabled. No Security Driver. svirt=MLS (Requires context in xml, no relabel of disks) svirt=Standard, (If no XML label, then random generate

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-28 Thread Daniel P. Berrange
On Fri, Feb 27, 2009 at 03:37:55PM -0500, Daniel J Walsh wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Another patch off latest repository. This patch does not require the XML to include a label, although this is still supported. Implemented most of the comments from Jim. make

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-27 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Another patch off latest repository. This patch does not require the XML to include a label, although this is still supported. Implemented most of the comments from Jim. make check and make syntax-check passes, Added seclabeltest.c to run in tests,

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-26 Thread Daniel P. Berrange
On Fri, Feb 20, 2009 at 02:38:05PM +, Daniel P. Berrange wrote: I think we need to move place where we set the exec context to after the fork() call, ideally to be the very last call made before the actual execve(). We do not currently have an easy way todo this, but I have the exact

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-23 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jim Meyering wrote: Daniel P. Berrange wrote: Just spotted one serious problem we need to address. The method 'qemudStartVMDaemon' quoted here is where we set the security label: ... Good catch. To use this, we'd make qemudStartVM() pass in

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-21 Thread Jim Meyering
Daniel P. Berrange wrote: Just spotted one serious problem we need to address. The method 'qemudStartVMDaemon' quoted here is where we set the security label: ... Good catch. To use this, we'd make qemudStartVM() pass in a virExecHook callback which does the call to

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-20 Thread Daniel P. Berrange
Just spotted one serious problem we need to address. The method 'qemudStartVMDaemon' quoted here is where we set the security label: On Tue, Feb 17, 2009 at 11:20:17AM -0500, Daniel J Walsh wrote: @@ -1178,6 +1237,16 @@ static int qemudStartVMDaemon(virConnect return -1; } +

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-20 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daniel P. Berrange wrote: Just spotted one serious problem we need to address. The method 'qemudStartVMDaemon' quoted here is where we set the security label: On Tue, Feb 17, 2009 at 11:20:17AM -0500, Daniel J Walsh wrote: @@ -1178,6 +1237,16

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-17 Thread Jim Meyering
Daniel J Walsh dwa...@redhat.com wrote: [I removed the 1900+ lines of useless context] Ok, I have added your patches and make syntax-check succeeds except it does not like po_check --- po/POTFILES.in +++ po/POTFILES.in @@ -22,8 +22,6 @@ src/qemu_conf.c src/qemu_driver.c

Re: [libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version

2009-02-17 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jim Meyering wrote: Daniel J Walsh dwa...@redhat.com wrote: [I removed the 1900+ lines of useless context] Ok, I have added your patches and make syntax-check succeeds except it does not like po_check --- po/POTFILES.in +++ po/POTFILES.in