mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-09-09 09:14:57 +00:00
selinux: properly label tap FDs with imagelabel
The cleanup in commit cf976d9d
used secdef->label to label the tap
FDs, but that is not possible since it's process-only label (svirt_t)
and not a object label (e.g. svirt_image_t). Starting a domain failed
with EPERM, but simply using secdef->imagelabel instead of
secdef->label fixes it.
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
This commit is contained in:
parent
0f03ca6d29
commit
a443193139
@ -2340,7 +2340,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
|
||||
if (!secdef || !secdef->label)
|
||||
return 0;
|
||||
|
||||
return virSecuritySELinuxFSetFilecon(fd, secdef->label);
|
||||
return virSecuritySELinuxFSetFilecon(fd, secdef->imagelabel);
|
||||
}
|
||||
|
||||
static char *
|
||||
|
Loading…
Reference in New Issue
Block a user