On 10/18/2012 09:08 AM, Guannan Ren wrote:
> Relabeling tapfd right after the tap device is created.
> qemuPhysIfaceConnect is common function called both for static
> netdevs and for hotplug netdevs.
> ---
> src/qemu/qemu_command.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
> index 0c0c400..f727cb6 100644
> --- a/src/qemu/qemu_command.c
> +++ b/src/qemu/qemu_command.c
> @@ -171,11 +171,21 @@ qemuPhysIfaceConnect(virDomainDefPtr def,
> virDomainNetGetActualBandwidth(net));
> if (rc >= 0) {
> virDomainAuditNetDevice(def, net, res_ifname, true);
> +
> + if (virSecurityManagerSetTapFDLabel(driver->securityManager,
> + def, rc) < 0)
> + goto error;
> +
Hmm. Here, we now have a misleading audit, which says we successfully
opened a net device, even though due to the relabel we are not using
that device. I think you need to leave the successful audit point after
the relabel attempt.
> VIR_FREE(net->ifname);
> net->ifname = res_ifname;
> }
>
> return rc;
> +
> +error:
> + VIR_FREE(res_ifname);
> + VIR_FORCE_CLOSE(rc);
> + return -1;
> }
>
>
> @@ -5425,10 +5435,6 @@ qemuBuildCommandLine(virConnectPtr conn,
> if (tapfd < 0)
> goto error;
>
> - if (virSecurityManagerSetTapFDLabel(driver->securityManager,
> - def, tapfd) < 0)
> - goto error;
> -
> last_good_net = i;
> virCommandTransferFD(cmd, tapfd);
>
>
--
Eric Blake eblake@xxxxxxxxxx +1-919-301-3266
Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list