The cleanup in commit cf976d9d used secdef->label to label the tap FDs, but that is not possible since it's process-only label (svirt_t) and not a object label (e.g. svirt_image_t). Starting a domain failed with EPERM, but simply using secdef->label instead fixes it. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com&gt; --- src/security/security_selinux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 5d18493..e8c13db 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -2340,7 +2340,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, if (!secdef || !secdef->label) return 0; - return virSecuritySELinuxFSetFilecon(fd, secdef->label); + return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel); } static char * -- 2.1.0