[libvirt] [PATCH v2] selinux: relabel tapfd in qemuPhysIfaceConnect
Guannan Ren
gren at redhat.com
Thu Oct 18 17:05:10 UTC 2012
On 10/19/2012 12:42 AM, Eric Blake wrote:
> On 10/18/2012 09:08 AM, Guannan Ren wrote:
>> Relabeling tapfd right after the tap device is created.
>> qemuPhysIfaceConnect is common function called both for static
>> netdevs and for hotplug netdevs.
>> ---
>> src/qemu/qemu_command.c | 14 ++++++++++----
>> 1 file changed, 10 insertions(+), 4 deletions(-)
>>
>> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
>> index 0c0c400..f727cb6 100644
>> --- a/src/qemu/qemu_command.c
>> +++ b/src/qemu/qemu_command.c
>> @@ -171,11 +171,21 @@ qemuPhysIfaceConnect(virDomainDefPtr def,
>> virDomainNetGetActualBandwidth(net));
>> if (rc >= 0) {
>> virDomainAuditNetDevice(def, net, res_ifname, true);
>> +
>> + if (virSecurityManagerSetTapFDLabel(driver->securityManager,
>> + def, rc) < 0)
>> + goto error;
>> +
> Hmm. Here, we now have a misleading audit, which says we successfully
> opened a net device, even though due to the relabel we are not using
> that device. I think you need to leave the successful audit point after
> the relabel attempt.
>
Thanks for the review.
v3 sent out :)
Guannan
More information about the libvir-list
mailing list