Bug 239572

Description of problem:

If creation of /var/run/tap/tapctrlread1 fails, then the blktapctrl process
itself dies.  The consequence of this is that any further attempts to create
domains cause the domains to not be able to see any of their tap disks.

I discovered this as a side-effect of bug 239449.

Version-Release number of selected component (if applicable):

xen-3.1.0-0.rc7.1.fc7

How reproducible:

Always on my test machine.

Steps to Reproduce:

1. Boot machine either with setenforce Enforcing (or change SELinux to Enforcing
after boot).  Notice that blktapctrl process is running as you would expect.

2. Use virt-manager to create a new domain.  Use a disk image for storage.  This
will fail (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239449#c2) - and
you should see that blktapctrl process has now disappeared.

3. Change SELinux to Permissive and use virt-manager to create another domain. 
Again, use a disk image for storage.
  
Actual results:

The second install in step 3 will fail because the domain will be unable to see
its disk.

Expected results:

Domain should be able to see its disk, or virt-manager should produce an error
because blktapctrl is unavailable.

Additional info:

Rebooting or running service xend restart fixes the problem by restarting
blktapctrl.

AVC failure (NB: only the first one because Enforcing):

audit(1178723555.374:16): avc:  denied  { create } for  pid=2981
comm="blktapctrl" name="tapctrlread1" scontext=system_u:system_r:xend_t:s0
tcontext=system_u:object_r:var_run_t:s0 tclass=fifo_file

audit2allow on the above:

#============= xend_t ==============
allow xend_t var_run_t:fifo_file create;