On Thu, Nov 29, 2018 at 02:52:25PM +0100, Michal Privoznik wrote: > Now that we have seclabel remembering we can safely restore > labels for shared and RO disks. In fact we need to do that to > keep seclabel refcount stored in XATTRs in sync with reality. > > Signed-off-by: Michal Privoznik <mpriv...@redhat.com> > --- > src/security/security_dac.c | 8 -------- > 1 file changed, 8 deletions(-) > > diff --git a/src/security/security_dac.c b/src/security/security_dac.c > index 9d31faa9d4..60adfaf526 100644 > --- a/src/security/security_dac.c > +++ b/src/security/security_dac.c > @@ -921,14 +921,6 @@ virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr > mgr, > if (!priv->dynamicOwnership) > return 0; > > - /* Don't restore labels on readoly/shared disks, because other VMs may > - * still be accessing these. Alternatively we could iterate over all > - * running domains and try to figure out if it is in use, but this would > - * not work for clustered filesystems, since we can't see running VMs > using > - * the file on other nodes. Safest bet is thus to skip the restore step. > */ > - if (src->readonly || src->shared) > - return 0; > - > secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME); > if (secdef && !secdef->relabel) > return 0;
Reviewed-by: Daniel P. Berrangé <berra...@redhat.com> though I'd probably squash this into the previous commit, otherwise the bisection has a point in time where it leaks attrs for shared/readonly disk Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list