From 0a4652381fefa13f7fad5a1c4f0d699546ed3f42 Mon Sep 17 00:00:00 2001
From: Michal Privoznik <mprivozn@redhat.com>
Date: Thu, 19 Jan 2017 17:04:15 +0100
Subject: [PATCH] qemuDomainPrepareDisk: Fix ordering

The current ordering is as follows:
1) set label
2) create the device in namespace
3) allow device in the cgroup

While this might work for now, it will definitely not work if the
security driver would use transactions as in that case there
would be no device to relabel in the domain namespace as the
device is created in the second step.
Swap steps 1) and 2) to allow security driver to use more
transactions.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
---
 src/qemu/qemu_hotplug.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 57ecc02e43..8a4d20dba5 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -110,14 +110,14 @@ qemuDomainPrepareDisk(virQEMUDriverPtr driver,
                                 vm, disk) < 0)
         goto cleanup;
 
-    if (qemuSecuritySetDiskLabel(driver, vm, disk) < 0)
+    if (qemuDomainNamespaceSetupDisk(driver, vm, disk) < 0)
         goto rollback_lock;
 
-    if (qemuDomainNamespaceSetupDisk(driver, vm, disk) < 0)
-        goto rollback_label;
+    if (qemuSecuritySetDiskLabel(driver, vm, disk) < 0)
+        goto rollback_namespace;
 
     if (qemuSetupDiskCgroup(vm, disk) < 0)
-        goto rollback_namespace;
+        goto rollback_label;
 
     ret = 0;
     goto cleanup;
@@ -126,16 +126,16 @@ qemuDomainPrepareDisk(virQEMUDriverPtr driver,
     if (qemuTeardownDiskCgroup(vm, disk) < 0)
         VIR_WARN("Unable to tear down cgroup access on %s",
                  virDomainDiskGetSource(disk));
- rollback_namespace:
-    if (qemuDomainNamespaceTeardownDisk(driver, vm, disk) < 0)
-        VIR_WARN("Unable to remove /dev entry for %s",
-                 virDomainDiskGetSource(disk));
-
  rollback_label:
     if (qemuSecurityRestoreDiskLabel(driver, vm, disk) < 0)
         VIR_WARN("Unable to restore security label on %s",
                  virDomainDiskGetSource(disk));
 
+ rollback_namespace:
+    if (qemuDomainNamespaceTeardownDisk(driver, vm, disk) < 0)
+        VIR_WARN("Unable to remove /dev entry for %s",
+                 virDomainDiskGetSource(disk));
+
  rollback_lock:
     if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0)
         VIR_WARN("Unable to release lock on %s",
-- 
GitLab