From mboxrd@z Thu Jan 1 00:00:00 1970 From: George Dunlap Subject: Re: [PATCH 1/7] tools/hotplug: remove SELinux options from var-lib-xenstored.mount Date: Tue, 15 Sep 2015 09:55:13 +0100 Message-ID: References: <1418988333-5404-1-git-send-email-olaf@aepfle.de> <1418988333-5404-2-git-send-email-olaf@aepfle.de> <20150911063100.GA9276@aepfle.de> <55F6F629.3040409@citrix.com> <20150914183357.GA13426@aepfle.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20150914183357.GA13426@aepfle.de> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Olaf Hering Cc: Wei Liu , Ian Campbell , "Luis R. Rodriguez" , Stefano Stabellini , Ian Jackson , George Dunlap , "xen-devel@lists.xen.org" , M A Young , Anthony PERARD List-Id: xen-devel@lists.xenproject.org On Mon, Sep 14, 2015 at 7:33 PM, Olaf Hering wrote: > On Mon, Sep 14, George Dunlap wrote: > >> Well if you "know nothing about SELinux", and you don't use it, and >> don't have any test systems that use it, then why did you assert >> "The proper place to specify [an SELinux mount context] is /etc/fstab"? >> This patchset was accepted because you represented it as the "right" >> way of doing things. > > Because at that time the way SELinux was handled failed on systems which > had SELinux disabled, or which did not recognize the option. > And I still think that mount options have to go into fstab. It's very reasonable for you to expect it to be fixed on non-SELinux systems. But what you did is fix it for non-SELinux systems by simply breaking it on SELinux systems -- that's not at all reasonable. And I'm not really familiar enough with the standards around fstab and whatever to have a strong opinion on the "right" way to do things; but "fiddle with fstab and pray that the added lines fit the system policies" is definitely not my idea of the Right Way to do things. In any case, it looks like adding manual mount options isn't actually the Right Way to do fix things for SELinux, no matter where you put them -- it requires your mount options to be kept in sync with the global SELinux policy, which is more fragile. The way most other tmpfs things get dealt with, as I said, is running "restorecon", which updates labels from the master SELinux policy. -George