diff options
author | Colin Walters <walters@verbum.org> | 2017-04-14 13:17:15 -0400 |
---|---|---|
committer | Atomic Bot <atomic-devel@projectatomic.io> | 2017-04-25 16:52:33 +0000 |
commit | e8efd1c8dcaad8fbd3b05c400972d237406263e7 (patch) | |
tree | be96281a1f0437d16af803e84a74245503af113f /src/libostree/ostree-sepolicy-private.h | |
parent | 654b0c4877d42b3b15a87114408722e843687ded (diff) | |
download | ostree-e8efd1c8dcaad8fbd3b05c400972d237406263e7.tar.gz |
checkout: Add SELinux labeling for checkout, use in deploy
This is a variant of the efforts in https://github.com/ostreedev/ostree/pull/741
Working on `rpm-ostree livefs`, I realized though I needed to just
check out *new* files directly into the live `/etc` (and possibly
delete obsolete files).
The way the current `/etc` merge works is fundamentally different from
that. So my plan currently is to probably do something like:
- Compute diff
- Check out each *new* file individually (as a copy)
- Optionally delete obsolete files
Also, a few other things become more important - in the current deploy code, we
copy all of the files, then relabel them. But we shouldn't expose to *live*
systems the race conditions of doing that, plus we should only relabel files we
checked out.
By converting the deploy's /etc code to use this, we fix the same TODO item
there around atomically having the label set up as we create files. And further,
if we kill the `/var` relabeling which I think is unnecessary since Anaconda
does it, we could delete large chunks of code there.
In the implementation, there are two types of things: regular files, and
symlinks. For regular files, in the `O_TMPFILE` case, we have the ability to
do *everything* atomically (including SELinux labeling) before linking it into
place. So let's just use that. For symlinks, we use `setfscreatecon()`.
Closes: #797
Approved by: jlebon
Diffstat (limited to 'src/libostree/ostree-sepolicy-private.h')
-rw-r--r-- | src/libostree/ostree-sepolicy-private.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/libostree/ostree-sepolicy-private.h b/src/libostree/ostree-sepolicy-private.h index 55d49eaf..def8ab74 100644 --- a/src/libostree/ostree-sepolicy-private.h +++ b/src/libostree/ostree-sepolicy-private.h @@ -37,5 +37,6 @@ gboolean _ostree_sepolicy_preparefscreatecon (OstreeSepolicyFsCreatecon *con, guint32 mode, GError **error); +GVariant *_ostree_filter_selinux_xattr (GVariant *xattrs); G_END_DECLS |