NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

selinux: properly label tap FDs with imagelabel

Browse Source 
The cleanup in commit cf976d9d used secdef->label to label the tap
FDs, but that is not possible since it's process-only label (svirt_t)
and not a object label (e.g. svirt_image_t).  Starting a domain failed
with EPERM, but simply using secdef->imagelabel instead of
secdef->label fixes it.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
This commit is contained in:
Martin Kletzander
2014-09-01 15:27:00 +02:00
parent 0f03ca6d29
commit a443193139
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/security/security_selinux.c
View File

@@ -2340,7 +2340,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
if (!secdef || !secdef->label)
return 0;
return virSecuritySELinuxFSetFilecon(fd, secdef->label);
return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel);
}
static char *