similar to: [PATCH] daemon: selinux: Add setfiles -vv flags when verbose.

On Monday, 20 March 2017 19:15:01 CET Richard W.M. Jones wrote: > This shows which files are being relabelled. Also only use -q > (suppress non-error output) when we are not verbose. > --- > daemon/selinux-relabel.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/daemon/selinux-relabel.c b/daemon/selinux-relabel.c > index 2f48ee6..e7da42d

--- daemon/selinux-relabel.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/daemon/selinux-relabel.c b/daemon/selinux-relabel.c index 112bee1..2f48ee6 100644 --- a/daemon/selinux-relabel.c +++ b/daemon/selinux-relabel.c @@ -27,6 +27,8 @@ #include "actions.h" #include "optgroups.h" +#include "ignore-value.h" +

[ I realized that we were discussing adding this feature, in various private email, IRC, and this long bugzilla thread: https://bugzilla.redhat.com/show_bug.cgi?id=1060423 That's not how we should do things. Let's discuss it on the mailing list. ] One thing that virt-customize/virt-sysprep/virt-builder have to do is relabel SELinux guests. What we do at the moment

Rewrite the relabel API to read the policy configured in the guest, invoking setfiles (added as part of the appliance, as part of policycoreutils) to relabel the specified root. In case of failure at any point of the process, a touch of .autorelabel in the root is tried as last-attempt measure to do the relabel. Considering that running SELinux tools in the appliance might be affected by the

--- appliance/packagelist.in | 1 + daemon/Makefile.am | 1 + daemon/setfiles.c | 93 ++++++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 22 ++++++++++++ gobject/Makefile.inc | 2 ++ src/MAX_PROC_NR | 2 +- 6 files changed, 120 insertions(+), 1 deletion(-) create mode 100644 daemon/setfiles.c diff --git a/appliance/packagelist.in

v1 -> v2: - Add simple test of the setfiles API. - Use SELinux_relabel module in virt-v2v (instead of touch /.autorelabel). - Small fixes. Rich.

Fixes commit 9d205f1c284a69390907120ca44f5c723fecc244. --- daemon/selinux-relabel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemon/selinux-relabel.c b/daemon/selinux-relabel.c index daafe9e..cfc4cf8 100644 --- a/daemon/selinux-relabel.c +++ b/daemon/selinux-relabel.c @@ -92,7 +92,7 @@ do_selinux_relabel (const char *specfile, const char *path, ADD_ARG (argv, i,

We can use the setfiles(8) command to relabel the guest filesystem, even though we don't have a policy loaded nor SELinux enabled in the appliance kernel. This also deprecates or removes the old and broken SELinux support. This patch isn't quite complete - I would like to add some tests to the new API. I'm posting here to garner early feedback. Rich.

On Tuesday 27 May 2014 09:08:27 Richard W.M. Jones wrote: > On Mon, May 26, 2014 at 11:21:59AM +0200, Pino Toscano wrote: > > Rewrite the relabel API to read the policy configured in the guest, > > invoking setfiles (added as part of the appliance, as part of > > policycoreutils) to relabel the specified root. In case of failure > > at > > any point of the process,

> -----Original Message----- > From: Richard W.M. Jones [mailto:rjones@redhat.com] > Sent: Tuesday, March 6, 2018 11:49 AM > To: Зиновик Игорь Анатольевич <ZinovikIA@nspk.ru> > Cc: libguestfs@redhat.com > Subject: Re: [Libguestfs] virt-v2v 1.38 fails to convert .vmx VM: setfiles ... > Multiple same specifications for /.*. > > On Tue, Mar 06, 2018 at 08:40:51AM

[This email is either empty or too large to be displayed at this time]

On Tuesday 27 May 2014 14:25:08 Richard W.M. Jones wrote: > So I think an API which looks like this ... > > required params: > > None > > optional params: > > path => > Either a directory to be relabelled recursively, or a single > file (defaults to "/"). > > root => > Inspection root of guest. Optional, only

Hello, Richard. > -----Original Message----- > From: Richard W.M. Jones [mailto:rjones@redhat.com] > Sent: Monday, March 5, 2018 8:42 PM > To: Зиновик Игорь Анатольевич <ZinovikIA@nspk.ru> > Cc: libguestfs@redhat.com > Subject: Re: [Libguestfs] virt-v2v 1.38 fails to convert .vmx VM: setfiles ... > Multiple same specifications for /.*. > > On Mon, Mar 05, 2018 at

This is a simpler patch that removes GUESTFSD_EXT_CMD completely.

Replace GUESTFSD_EXT_CMD with a command line option ‘./guestfsd --print-external-commands’

btrfs-progs 4.11 is more strict with option parsing, so subcommand options must appear now before the subcommand arguments. --- daemon/btrfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/daemon/btrfs.c b/daemon/btrfs.c index 23513a9..ae2310b 100644 --- a/daemon/btrfs.c +++ b/daemon/btrfs.c @@ -2185,11 +2185,11 @@ do_btrfs_replace (const char *srcdev, const char

Add a new api xfs_repair for repairing an XFS filesystem. Signed-off-by: Wanlong Gao <gaowanlong at cn.fujitsu.com> --- daemon/xfs.c | 116 +++++++++++++++++++++++++++++++++++++++++ generator/generator_actions.ml | 23 ++++++++ gobject/Makefile.inc | 6 ++- po/POTFILES | 1 + src/MAX_PROC_NR | 2 +- 5 files changed, 145

Add new api xfs_admin to change parameters of an XFS filesystem. Signed-off-by: Wanlong Gao <gaowanlong at cn.fujitsu.com> --- daemon/xfs.c | 78 ++++++++++++++++++++++++++++++++++++++++++ generator/generator_actions.ml | 21 ++++++++++++ gobject/Makefile.inc | 6 ++-- guestfs-release-notes.txt | 1 + po/POTFILES | 1 + src/MAX_PROC_NR

New api xfs_growfs for expanding a XFS filesystem. Signed-off-by: Wanlong Gao <gaowanlong at cn.fujitsu.com> --- daemon/xfs.c | 119 +++++++++++++++++++++++++++++++++++++++++ generator/generator_actions.ml | 15 ++++++ gobject/Makefile.inc | 6 ++- po/POTFILES | 1 + src/MAX_PROC_NR | 2 +- 5 files changed, 140

While svirt_t can be used for sockets it does not always guarantee that it will be accessible from a virtual machine. The VM might be running under svirt_tcg_t context which will need a svirt_tcg_t label on the socket in order to access it. There is, however, another label, svirt_socket_t, which is accessible from virt_domain: # sesearch -A -s svirt_t -c unix_stream_socket -p connectto ...