[libvirt] [PATCH v2] selinux: relabel tapfd in qemuPhysIfaceConnect

[Eric Blake]

On 10/18/2012 09:08 AM, Guannan Ren wrote:
> Relabeling tapfd right after the tap device is created.
> qemuPhysIfaceConnect is common function called both for static
> netdevs and for hotplug netdevs.
> ---
>  src/qemu/qemu_command.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
> index 0c0c400..f727cb6 100644
> --- a/src/qemu/qemu_command.c
> +++ b/src/qemu/qemu_command.c
> @@ -171,11 +171,21 @@ qemuPhysIfaceConnect(virDomainDefPtr def,
>          virDomainNetGetActualBandwidth(net));
>      if (rc >= 0) {
>          virDomainAuditNetDevice(def, net, res_ifname, true);
> +
> +        if (virSecurityManagerSetTapFDLabel(driver->securityManager,
> +                                            def, rc) < 0)
> +            goto error;
> +

Hmm.  Here, we now have a misleading audit, which says we successfully
opened a net device, even though due to the relabel we are not using
that device.  I think you need to leave the successful audit point after
the relabel attempt.

>          VIR_FREE(net->ifname);
>          net->ifname = res_ifname;
>      }
>  
>      return rc;
> +
> +error:
> +    VIR_FREE(res_ifname);
> +    VIR_FORCE_CLOSE(rc);
> +    return -1;
>  }
>  
>  
> @@ -5425,10 +5435,6 @@ qemuBuildCommandLine(virConnectPtr conn,
>                  if (tapfd < 0)
>                      goto error;
>  
> -                if (virSecurityManagerSetTapFDLabel(driver->securityManager,
> -                                                    def, tapfd) < 0)
> -                    goto error;
> -
>                  last_good_net = i;
>                  virCommandTransferFD(cmd, tapfd);
>  
> 

-- 
Eric Blake   eblake at redhat.com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 617 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20121018/fefc6f38/attachment-0001.sig>