Re: [libvirt] [PATCH] selinux: relabel tapfd in qemuPhysIfaceConnect

On 10/18/2012 07:30 AM, Guannan Ren wrote: > Relabeling tapfd right after the tap device is created. > qemuPhysIfaceConnect is common function called both for static > netdevs and for hotplug netdevs. > --- > src/qemu/qemu_command.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c > index 0c0c400..b24e9b1 100644 > --- a/src/qemu/qemu_command.c > +++ b/src/qemu/qemu_command.c > @@ -170,6 +170,11 @@ qemuPhysIfaceConnect(virDomainDefPtr def, > vmop, driver->stateDir, > virDomainNetGetActualBandwidth(net)); > if (rc >= 0) { > + if (virSecurityManagerSetTapFDLabel(driver->securityManager, > + def, rc) < 0) { > + VIR_FORCE_CLOSE(rc); > + return -1; > + } > virDomainAuditNetDevice(def, net, res_ifname, true); > VIR_FREE(net->ifname); Looks like you leak net->ifname on error, not to mention that you are skipping out on an audit point. I think you need to fix up the logic here to avoid leaks on failure to relabel the fd.