[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH 1/2] selinux: fix wrong tapfd relablling



On 10/17/2012 04:30 PM, Daniel P. Berrange wrote:
On Wed, Oct 17, 2012 at 11:32:45AM +0800, Guannan Ren wrote:
It should relabel tapfd of virtual network of type VIR_DOMAIN_NET_TYPE_DIRECT
rather than VIR_DOMAIN_NET_TYPE_NETWORK and VIR_DOMAIN_NET_TYPE_BRIDGE
(commit ae368ebfcc4923d0b32e83d4ca96a6f599625785 introduced this bug)
Why ?  IMHO, if we're going to trouble of relabelling TAP file descriptors
with a MCS category, we should relabel *all* of them.

Daniel

Eric met a such AVC denied in this case where /dev/net/tun is relabelled with MCS. "libvirtd would now be assigning a label to /dev/net/tun, which makes it impossible
   for anyone else (like openvpn) to also open a tun device."

type=AVC msg=audit(1350411375.542:759325): avc: denied { read } for pid=4773
   comm="openvpn" path="/dev/net/tun" dev=devtmpfs ino=9557
   scontext=system_u:system_r:openvpn_t:s0
   tcontext=system_u:object_r:tun_tap_device_t:s0:c1,c489
   tclass=chr_file


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]