Re: [libvirt] [PATCH v2] selinux: relabel tapfd in qemuPhysIfaceConnect

On 10/18/2012 09:08 AM, Guannan Ren wrote: > Relabeling tapfd right after the tap device is created. > qemuPhysIfaceConnect is common function called both for static > netdevs and for hotplug netdevs. > --- > src/qemu/qemu_command.c | 14 ++++++++++---- > 1 file changed, 10 insertions(+), 4 deletions(-) > > diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c > index 0c0c400..f727cb6 100644 > --- a/src/qemu/qemu_command.c > +++ b/src/qemu/qemu_command.c > @@ -171,11 +171,21 @@ qemuPhysIfaceConnect(virDomainDefPtr def, > virDomainNetGetActualBandwidth(net)); > if (rc >= 0) { > virDomainAuditNetDevice(def, net, res_ifname, true); > + > + if (virSecurityManagerSetTapFDLabel(driver->securityManager, > + def, rc) < 0) > + goto error; > + Hmm. Here, we now have a misleading audit, which says we successfully opened a net device, even though due to the relabel we are not using that device. I think you need to leave the successful audit point after the relabel attempt.