|
 |
ab7a78 |
From 8806d4dd0f0c7c20a42513b2a1ff310455decdc6 Mon Sep 17 00:00:00 2001
|
|
|
ab7a78 |
Message-Id: <8806d4dd0f0c7c20a42513b2a1ff310455decdc6@dist-git>
|
|
|
ab7a78 |
From: Michal Privoznik <mprivozn@redhat.com>
|
|
|
ab7a78 |
Date: Tue, 6 Sep 2022 13:37:23 +0200
|
|
|
ab7a78 |
Subject: [PATCH] qemu_namespace: Tolerate missing ACLs when creating a path in
|
|
|
ab7a78 |
namespace
|
|
|
ab7a78 |
|
|
|
ab7a78 |
When creating a path in a domain's mount namespace we try to set
|
|
|
ab7a78 |
ACLs on it, so that it's a verbatim copy of the path in parent's
|
|
|
ab7a78 |
namespace. The ACLs are queried upfront (by
|
|
|
ab7a78 |
qemuNamespaceMknodItemInit()) but this is fault tolerant so the
|
|
|
ab7a78 |
pointer to ACLs might be NULL (meaning no ACLs were queried, for
|
|
|
ab7a78 |
instance because the underlying filesystem does not support
|
|
|
ab7a78 |
them). But then we take this NULL and pass it to virFileSetACLs()
|
|
|
ab7a78 |
which immediately returns an error because NULL is invalid value.
|
|
|
ab7a78 |
|
|
|
ab7a78 |
Mimic what we do with SELinux label - only set ACLs if they are
|
|
|
ab7a78 |
non-NULL which includes symlinks.
|
|
|
ab7a78 |
|
|
|
ab7a78 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
ab7a78 |
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
|
|
|
ab7a78 |
(cherry picked from commit 687374959e160dc566bd4b6d43c7bf1beb470c59)
|
|
|
ab7a78 |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2132177
|
|
|
ab7a78 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
ab7a78 |
---
|
|
|
ab7a78 |
src/qemu/qemu_namespace.c | 3 +--
|
|
|
ab7a78 |
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
ab7a78 |
|
|
|
ab7a78 |
diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
|
|
|
ab7a78 |
index 94453033f5..4bff325a2c 100644
|
|
|
ab7a78 |
--- a/src/qemu/qemu_namespace.c
|
|
|
ab7a78 |
+++ b/src/qemu/qemu_namespace.c
|
|
|
ab7a78 |
@@ -1023,8 +1023,7 @@ qemuNamespaceMknodOne(qemuNamespaceMknodItem *data)
|
|
|
ab7a78 |
goto cleanup;
|
|
|
ab7a78 |
}
|
|
|
ab7a78 |
|
|
|
ab7a78 |
- /* Symlinks don't have ACLs. */
|
|
|
ab7a78 |
- if (!isLink &&
|
|
|
ab7a78 |
+ if (data->acl &&
|
|
|
ab7a78 |
virFileSetACLs(data->file, data->acl) < 0 &&
|
|
|
ab7a78 |
errno != ENOTSUP) {
|
|
|
ab7a78 |
virReportSystemError(errno,
|
|
|
ab7a78 |
--
|
|
|
ab7a78 |
2.37.2
|
|
|
ab7a78 |
|