[libvirt] [PATCH] selinux: relabel tapfd in qemuPhysIfaceConnect
Eric Blake
eblake at redhat.com
Thu Oct 18 13:55:28 UTC 2012
On 10/18/2012 07:30 AM, Guannan Ren wrote:
> Relabeling tapfd right after the tap device is created.
> qemuPhysIfaceConnect is common function called both for static
> netdevs and for hotplug netdevs.
> ---
> src/qemu/qemu_command.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
> index 0c0c400..b24e9b1 100644
> --- a/src/qemu/qemu_command.c
> +++ b/src/qemu/qemu_command.c
> @@ -170,6 +170,11 @@ qemuPhysIfaceConnect(virDomainDefPtr def,
> vmop, driver->stateDir,
> virDomainNetGetActualBandwidth(net));
> if (rc >= 0) {
> + if (virSecurityManagerSetTapFDLabel(driver->securityManager,
> + def, rc) < 0) {
> + VIR_FORCE_CLOSE(rc);
> + return -1;
> + }
> virDomainAuditNetDevice(def, net, res_ifname, true);
> VIR_FREE(net->ifname);
Looks like you leak net->ifname on error, not to mention that you are
skipping out on an audit point. I think you need to fix up the logic
here to avoid leaks on failure to relabel the fd.
--
Eric Blake eblake at redhat.com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 617 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20121018/d04abf4d/attachment-0001.sig>
More information about the libvir-list
mailing list