Re: [libvirt] [PATCHv2 4/8] audit: audit use of /dev/vhost-net

There are several devices for networking - With type=bridge or type=network, /dev/net/tun is opened to get a FD for a tap device instance - With type=direct, /dev/tap%d is opened to get an FD for a macvtap device instance In both cases, /dev/vhost-net can *also* be opened. The tun/macvtap device provides the connectivity to the host NIC. The vhost-net device provides kernel acceleration for the QEMU NIC backend So I think we need to be auditing all of these devices, if we're going todo any of them

> + if (!(vmname = virAuditEncode("vm", vmDef->name)) || > + !(devname = virAuditEncode("path", device)) || > + !(rdev = qemuAuditGetRdev(device))) { > + VIR_WARN0("OOM while encoding audit message"); > + goto cleanup; > + } > + > + VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success, > + "resrc=net reason=%s %s uuid=%s net='%s' %s %s", > + reason, vmname, uuidstr, > + macstr, devname, rdev); A similar thought here about rdev as per the earlier patch in the series