On 09/01/2014 03:31 PM, Martin Kletzander wrote: > The cleanup in commit cf976d9d used secdef->label to label the tap > FDs, but that is not possible since it's process-only label (svirt_t) > and not a object label (e.g. svirt_image_t). Starting a domain failed > with EPERM, but simply using secdef->label instead fixes it. s/label/imagelabel/ > > Signed-off-by: Martin Kletzander <mkletzan@xxxxxxxxxx> > --- > src/security/security_selinux.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c > index 5d18493..e8c13db 100644 > --- a/src/security/security_selinux.c > +++ b/src/security/security_selinux.c > @@ -2340,7 +2340,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, > if (!secdef || !secdef->label) > return 0; > > - return virSecuritySELinuxFSetFilecon(fd, secdef->label); > + return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel); > } > > static char * > ACK with that change Pavel -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list