[PATCH for 1.2.8] selinux: properly label tap FDs with imagelabel

[Martin Kletzander <mkletzan@xxxxxxxxxx>]

The cleanup in commit cf976d9d used secdef->label to label the tap
FDs, but that is not possible since it's process-only label (svirt_t)
and not a object label (e.g. svirt_image_t).  Starting a domain failed
with EPERM, but simply using secdef->label instead fixes it.

Signed-off-by: Martin Kletzander <mkletzan@xxxxxxxxxx>
---
 src/security/security_selinux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 5d18493..e8c13db 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -2340,7 +2340,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
     if (!secdef || !secdef->label)
         return 0;

-    return virSecuritySELinuxFSetFilecon(fd, secdef->label);
+    return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel);
 }

 static char *
-- 
2.1.0

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list