Re: [libvirt] [PATCH] security_selinux: Don't relabel /dev/net/tun

>> + if (!STRPREFIX(fd_path, "/dev/tap")) { > > Should this be "/dev/tap.", since... > >> + VIR_DEBUG("fd=%d points to %s not setting SELinux label", >> + fd, fd_path); >> + rc = 0; >> + goto cleanup; >> + } >> + >> if (getContext(mgr, "/dev/tap.*", buf.st_mode, &fcon) < 0) { > > ...you require a '.' in the context lookup? Without the '.' in the > filter, you would let the (unlikely) name '/dev/tapX' get through. > > ACK with that tweaked. > > In fact, /dev/tapX is what is created. getContext should be using it too as it accepts shell expendable names, not regular expressions. I'm adjusting getContext's argument too.