Re: [libvirt] [PATCH] selinux: relabel tapfd in qemuPhysIfaceConnect

Relabeling tapfd right after the tap device is created. qemuPhysIfaceConnect is common function called both for static netdevs and for hotplug netdevs. --- src/qemu/qemu_command.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 0c0c400..b24e9b1 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -170,6 +170,11 @@ qemuPhysIfaceConnect(virDomainDefPtr def, vmop, driver->stateDir, virDomainNetGetActualBandwidth(net)); if (rc >= 0) { + if (virSecurityManagerSetTapFDLabel(driver->securityManager, + def, rc) < 0) { + VIR_FORCE_CLOSE(rc); + return -1; + } virDomainAuditNetDevice(def, net, res_ifname, true); VIR_FREE(net->ifname);