Re: [PATCH 4/4] cr: add selinux support (v6)

["Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>]

Quoting Daniel J Walsh (dwalsh-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org):
> On 10/09/2009 04:57 PM, Serge E. Hallyn wrote:
> I think you need to be careful with this.  We do not want the process to
> start with the same MCS Label as when it stopped in case some other virtual
> machine has grabbed the MCS Label.  When the image is taken down it should
> give up probably give up its labels and allow the system to relabel to a
> known state.  When it starts the image again, new labels should be selected
> and set on disk and the process resumed with the new label.

With this patchset, the default behavior remains to simply run the
restarted task in whatever context is calculated by the usual TE
rules (i.e. current context unless the type of the 'restart' program
was an entry type to some domain and a domain transition was requested
or automatic).  The request to restore checkpointed labels is done with
a special flag.

What you actually are suggesting is the ability to make fine-grained
changes to some of the checkpointed labels, but to still restore
the checkpointed labels (with changes).  I think it is pretty
generally accepted that such things should be done by editing the
checkpoint image in userspace.  A pretty simple program could
run through the image looking for CKPT_HDR_SEC fields and
change the MCS labels where appropriate.

I haven't written such a program (or used MCS), but if you like
I'll certainly write it and I suspect Oren would be happy to have
it in user-cr/ (where the checkpoint and restart programs live) as
an example of how to make such substitutions generally.

thanks,
-serge