[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH v2] selinux: relabel tapfd in qemuPhysIfaceConnect



On 10/19/2012 12:42 AM, Eric Blake wrote:
On 10/18/2012 09:08 AM, Guannan Ren wrote:
Relabeling tapfd right after the tap device is created.
qemuPhysIfaceConnect is common function called both for static
netdevs and for hotplug netdevs.
---
  src/qemu/qemu_command.c | 14 ++++++++++----
  1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 0c0c400..f727cb6 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -171,11 +171,21 @@ qemuPhysIfaceConnect(virDomainDefPtr def,
          virDomainNetGetActualBandwidth(net));
      if (rc >= 0) {
          virDomainAuditNetDevice(def, net, res_ifname, true);
+
+        if (virSecurityManagerSetTapFDLabel(driver->securityManager,
+                                            def, rc) < 0)
+            goto error;
+
Hmm.  Here, we now have a misleading audit, which says we successfully
opened a net device, even though due to the relabel we are not using
that device.  I think you need to leave the successful audit point after
the relabel attempt.


    Thanks for the review.
    v3 sent out :)

    Guannan


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]