|
 |
e9d682 |
From 1f0a6e441617da6a95e2188408ad1ed2dd4665e4 Mon Sep 17 00:00:00 2001
|
|
|
e9d682 |
Message-Id: <1f0a6e441617da6a95e2188408ad1ed2dd4665e4@dist-git>
|
|
|
e9d682 |
From: Michal Privoznik <mprivozn@redhat.com>
|
|
|
e9d682 |
Date: Tue, 6 Sep 2022 13:37:23 +0200
|
|
|
e9d682 |
Subject: [PATCH] qemu_namespace: Tolerate missing ACLs when creating a path in
|
|
|
e9d682 |
namespace
|
|
|
e9d682 |
|
|
|
e9d682 |
When creating a path in a domain's mount namespace we try to set
|
|
|
e9d682 |
ACLs on it, so that it's a verbatim copy of the path in parent's
|
|
|
e9d682 |
namespace. The ACLs are queried upfront (by
|
|
|
e9d682 |
qemuNamespaceMknodItemInit()) but this is fault tolerant so the
|
|
|
e9d682 |
pointer to ACLs might be NULL (meaning no ACLs were queried, for
|
|
|
e9d682 |
instance because the underlying filesystem does not support
|
|
|
e9d682 |
them). But then we take this NULL and pass it to virFileSetACLs()
|
|
|
e9d682 |
which immediately returns an error because NULL is invalid value.
|
|
|
e9d682 |
|
|
|
e9d682 |
Mimic what we do with SELinux label - only set ACLs if they are
|
|
|
e9d682 |
non-NULL which includes symlinks.
|
|
|
e9d682 |
|
|
|
e9d682 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
e9d682 |
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
|
|
|
e9d682 |
(cherry picked from commit 687374959e160dc566bd4b6d43c7bf1beb470c59)
|
|
|
e9d682 |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2152083
|
|
|
e9d682 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
e9d682 |
---
|
|
|
e9d682 |
src/qemu/qemu_namespace.c | 3 +--
|
|
|
e9d682 |
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
e9d682 |
|
|
|
e9d682 |
diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
|
|
|
e9d682 |
index 98cd794666..71e3366ca5 100644
|
|
|
e9d682 |
--- a/src/qemu/qemu_namespace.c
|
|
|
e9d682 |
+++ b/src/qemu/qemu_namespace.c
|
|
|
e9d682 |
@@ -1040,8 +1040,7 @@ qemuNamespaceMknodOne(qemuNamespaceMknodItem *data)
|
|
|
e9d682 |
goto cleanup;
|
|
|
e9d682 |
}
|
|
|
e9d682 |
|
|
|
e9d682 |
- /* Symlinks don't have ACLs. */
|
|
|
e9d682 |
- if (!isLink &&
|
|
|
e9d682 |
+ if (data->acl &&
|
|
|
e9d682 |
virFileSetACLs(data->file, data->acl) < 0 &&
|
|
|
e9d682 |
errno != ENOTSUP) {
|
|
|
e9d682 |
virReportSystemError(errno,
|
|
|
e9d682 |
--
|
|
|
e9d682 |
2.39.0
|
|
|
e9d682 |
|