On 10/19/2012 12:42 AM, Eric Blake wrote:
Relabeling tapfd right after the tap device is created. qemuPhysIfaceConnect is common function called both for static netdevs and for hotplug netdevs. --- src/qemu/qemu_command.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 0c0c400..f727cb6 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -171,11 +171,21 @@ qemuPhysIfaceConnect(virDomainDefPtr def, virDomainNetGetActualBandwidth(net)); if (rc >= 0) { virDomainAuditNetDevice(def, net, res_ifname, true); + + if (virSecurityManagerSetTapFDLabel(driver->securityManager, + def, rc) < 0) + goto error; + Hmm. Here, we now have a misleading audit, which says we successfully opened a net device, even though due to the relabel we are not using
On 10/18/2012 09:08 AM, Guannan Ren wrote: that device. I think you need to leave the successful audit point after the relabel attempt.
Thanks for the review. v3 sent out :) Guannan