dustin/configpolicy
1
1
Fork 0
Code Issues Releases Activity

r/vmhost: Work around libvirt SELinux policy bug

Browse Source 
With the transition to modular _libvirt_ daemons, the SELinux policy is
a bit more granular.  Unfortunately, the new policy has a funny [bug]: it
assumes directories named `storage` under `/run/libvirt` must be for
_virtstoraged_ and labels them as such, which prevents _virtnetworkd_
from managing a virtual network named `storage`.

To work around this, we need to give `/run/libvirt/network` a special
label so that its children do not match the file transition pattern for
_virtstoraged_ and thus keep their `virtnetworkd_var_run_t` label.

[bug]: https://bugzilla.redhat.com/show_bug.cgi?id=2362040
This commit is contained in:
Dustin
2025-07-28 18:23:24 -05:00
parent 2ee86f6344
commit 3270011fee
2 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
roles/vmhost/files/fix-run-libvirt-network.conf Normal file
View File

@@ -0,0 +1,3 @@
[Service]
ExecStartPre=+/bin/mkdir -p %t/libvirt/network
ExecStartPre=+/bin/chcon -t virtnetworkd_var_run_t %t/libvirt/network