Bug 1066895

Summary:	Forbid multiple security labels of the same model
Product:	Red Hat Enterprise Linux 6	Reporter:	zhenfeng wang <zhwang>
Component:	libvirt	Assignee:	Michal Privoznik <mprivozn>
Status:	CLOSED WONTFIX	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	low	Docs Contact:
Priority:	low
Version:	6.5	CC:	acathrow, ajia, dyuan, gsun, jdenemar, juzhou, mzhan, ydu
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1066894	Environment:
Last Closed:	2014-04-04 21:26:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1066894
Bug Blocks:

Description zhenfeng wang 2014-02-19 10:13:51 UTC

+++ This bug was initially created as a clone of Bug #1066894 +++

Description of problem:
Implement for libvirt guest's xml that it should report error or left only one uniqure security label while there have two or more same Security label in the guest's xml

Version-Release number of selected component (if applicable):
kernel-3.10.0-88.el7.x86_64
qemu-kvm-rhev-1.5.3-47.el7.x86_64
libvirt-1.1.1-23.el7.x86_64
libselinux-2.2.2-6.el7.x86_64
selinux-policy-3.12.1-125.el7.noarch
How reproducible:
100%

Steps
1.Prepare a normal guest
# virsh list --all
 Id    Name                           State
----------------------------------------------------
 -     rhel75                         shut off

2.Edit the guest's xml, Add 5 or more same security label, save the guest's xml,
it didn't report error while edit the guest's xml, also it generate many same
seclabel in the guest's xml , i think we can do some implement for this issue
#virsh edit rhel75
--
<seclabel type='dynamic' model='selinux'/>
<seclabel type='dynamic' model='selinux'/>
<seclabel type='dynamic' model='selinux'/>
<seclabel type='dynamic' model='selinux'/>
<seclabel type='dynamic' model='selinux'/>
--

#virsh dumpxml rhel75|grep seclabel
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>

3.Start the guest, check the guest's xml, we can see only one seclabel work,
other seclabel didn't work
#virsh start rhel75
# virsh dumpxml rhel75 |grep seclabel -A 3
  <seclabel type='dynamic' model='selinux' relabel='yes'>
    <label>system_u:system_r:svirt_t:s0:c12,c756</label>
    <imagelabel>system_u:object_r:svirt_image_t:s0:c12,c756</imagelabel>
  </seclabel>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>
  <seclabel type='dynamic' model='selinux' relabel='yes'/>

Actual results:
As step 2

Expected results:
As Description

Comment 3 RHEL Program Management 2014-04-04 21:26:38 UTC

Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.