[Bug 1228849] [SELinux] various AVC denials related to libvirt
https://bugzilla.suse.com/show_bug.cgi?id=1228849 https://bugzilla.suse.com/show_bug.cgi?id=1228849#c15 Cathy Hu <cathy.hu@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #15 from Cathy Hu <cathy.hu@suse.com> --- Hi, sorry for the late reply, we have a lot of bugs currently.
The reason why I moved the images out of the default path was that any change to the VMs was included in the snapper snapshots of the root, so it made snapshots huge, and meant that rollbacks to avoid broken updates also rolled back the VMs, which was very bad.
/var is not included in the snapshots, see: https://documentation.suse.com/smart/systems-management/html/snapper-basic-c... You can check with `sudo btrfs subvolume list /` and if it *does* shows up, it does *not* get included in the snapshots. So can move your images there and it is the best practice imo. If /var/lib/libvirt/images / is included in the snapshots on your system, this is a bug with the snapper setup on the system.
fixfiles walks the filesystem by pulling mount points from /proc/self/mount. btrfs subvolumes which need labelling can, but not must, be there.
Not sure how you are mounting, but in the regular case the mount should be there. If you are mounting in private namespace you don't want fixfiles to touch it anyways. If you are mounting manually after boot, you have to relabel manually via restorecon as you found out, because autorelabel works during boot. If you put an entry into the fstab, autorelabel should work.
I'll push this upstream to policycoreutils if you are OK with that? Or perhaps you might be so kind as to escalate this for me? I feel like they might give you a bit more respect than some random nobody (me) who rolls in to tell them the tool they've had in production for 10+ years is broken :D
Please feel free to ask upstream about the behaviour, but I think it is intentional. They also don't know who I am, so I think you can just ask them if you have a question, don't worry about status stuff :D Generally, the recommended case is to put it into /var/lib/libvirt/images and that is what I would suggest, as it does not interfere with snapshots. I will close the bug, since it is an individual configuration choice. Hope that helps :) -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@suse.com