The /dev/iommu device is shared between all domains. Relabeling it with qemuSecuritySetImageFDLabel() can incorrectly add one domain's MCS categories onto that inode, blocking other domains' access.
Call qemuSecuritySetSharedImageFDLabel() instead when an iommufd is opened or inherited, which sets the desired labels while omitting the MCS categories. Signed-off-by: Omar Elghoul <[email protected]> --- src/qemu/qemu_process.c | 4 ++-- src/qemu/qemu_security.h | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index b2506edce0..e085a50a33 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7693,7 +7693,7 @@ qemuProcessOpenIommuFd(virDomainObj *vm) if ((iommufd = virIOMMUFDOpenDevice(priv->driver->privileged)) < 0) return -1; - if (qemuSecuritySetImageFDLabel(priv->driver->securityManager, vm->def, iommufd) < 0) + if (qemuSecuritySetSharedImageFDLabel(priv->driver->securityManager, vm->def, iommufd) < 0) return -1; priv->iommufd = qemuFDPassDirectNew("iommufd", &iommufd); @@ -7733,7 +7733,7 @@ qemuProcessGetPassedIommuFd(virDomainObj *vm) iommufd = dup(fdt->fds[0]); - if (qemuSecuritySetImageFDLabel(priv->driver->securityManager, vm->def, iommufd) < 0) + if (qemuSecuritySetSharedImageFDLabel(priv->driver->securityManager, vm->def, iommufd) < 0) return -1; priv->iommufd = qemuFDPassDirectNew("iommufd", &iommufd); diff --git a/src/qemu/qemu_security.h b/src/qemu/qemu_security.h index 36663cffde..882babf2e9 100644 --- a/src/qemu/qemu_security.h +++ b/src/qemu/qemu_security.h @@ -148,6 +148,7 @@ int qemuSecurityCommandRun(virQEMUDriver *driver, #define qemuSecuritySetChildProcessLabel virSecurityManagerSetChildProcessLabel #define qemuSecuritySetDaemonSocketLabel virSecurityManagerSetDaemonSocketLabel #define qemuSecuritySetImageFDLabel virSecurityManagerSetImageFDLabel +#define qemuSecuritySetSharedImageFDLabel virSecurityManagerSetSharedImageFDLabel #define qemuSecuritySetSavedStateLabel virSecurityManagerSetSavedStateLabel #define qemuSecuritySetSocketLabel virSecurityManagerSetSocketLabel #define qemuSecuritySetTapFDLabel virSecurityManagerSetTapFDLabel -- 2.55.0
