[libvirt] [PATCH] selinux: relabel tapfd in qemuPhysIfaceConnect

[Guannan Ren]

On 10/18/2012 09:55 PM, Eric Blake wrote:
> On 10/18/2012 07:30 AM, Guannan Ren wrote:
>> Relabeling tapfd right after the tap device is created.
>> qemuPhysIfaceConnect is common function called both for static
>> netdevs and for hotplug netdevs.
>> ---
>>   src/qemu/qemu_command.c | 9 +++++----
>>   1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
>> index 0c0c400..b24e9b1 100644
>> --- a/src/qemu/qemu_command.c
>> +++ b/src/qemu/qemu_command.c
>> @@ -170,6 +170,11 @@ qemuPhysIfaceConnect(virDomainDefPtr def,
>>           vmop, driver->stateDir,
>>           virDomainNetGetActualBandwidth(net));
>>       if (rc >= 0) {
>> +        if (virSecurityManagerSetTapFDLabel(driver->securityManager,
>> +                                            def, rc) < 0) {
>> +            VIR_FORCE_CLOSE(rc);
>> +            return -1;
>> +        }
>>           virDomainAuditNetDevice(def, net, res_ifname, true);
>>           VIR_FREE(net->ifname);
> Looks like you leak net->ifname on error, not to mention that you are
> skipping out on an audit point.  I think you need to fix up the logic
> here to avoid leaks on failure to relabel the fd.
>
      In case of failure of relabel, I leaked char *res_ifname.
      Shall we need to do the audit on failure of tapfd relabelling?
      I don't think it is necessary to do it, is it?