[libvirt] [PATCH 1/2] selinux: fix wrong tapfd relablling

[Guannan Ren]

On 10/17/2012 04:30 PM, Daniel P. Berrange wrote:
> On Wed, Oct 17, 2012 at 11:32:45AM +0800, Guannan Ren wrote:
>> It should relabel tapfd of virtual network of type VIR_DOMAIN_NET_TYPE_DIRECT
>> rather than VIR_DOMAIN_NET_TYPE_NETWORK and VIR_DOMAIN_NET_TYPE_BRIDGE
>> (commit ae368ebfcc4923d0b32e83d4ca96a6f599625785 introduced this bug)
> Why ?  IMHO, if we're going to trouble of relabelling TAP file descriptors
> with a MCS category, we should relabel *all* of them.
>
> Daniel

    Eric met a such AVC denied in this case where /dev/net/tun is 
relabelled with MCS.
    "libvirtd would now be assigning a label to /dev/net/tun, which 
makes it impossible
    for anyone else (like openvpn) to also open a tun device."

    type=AVC msg=audit(1350411375.542:759325): avc: denied { read } for 
pid=4773
    comm="openvpn" path="/dev/net/tun" dev=devtmpfs ino=9557
    scontext=system_u:system_r:openvpn_t:s0
    tcontext=system_u:object_r:tun_tap_device_t:s0:c1,c489
    tclass=chr_file