diff --git a/ChangeLog b/ChangeLog
index 0dcf9865c5aae6001f39ad699456c34f79e1aa7b..fd50683fe3a11b03e27b0622dcdffce2db44e5da 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+Thu Jun 25 10:32:22 BST 2009 Daniel P. Berrange <berrange@redhat.com>
+
+	Fix broken dominfo command when no security driver is implemented
+	* src/libvirt.c: Clarify semantics of return value for
+	virDomainGetSecurityLabel and virNodeGetSecurityModel
+	* src/remote_internal.c src/qemu_driver.c: memset seclabel
+	to zero
+	* src/virsh.c: Check VIR_ERR_NO_SUPPORT when querying security
+	labels in dominfo command.
+
 Wed Jun 24 19:40:43 CEST 2009 Daniel Veillard <veillard@redhat.com>
 
 	* po/*: update a lot of translations, and regenerate the po* files
diff --git a/po/bn_IN.po b/po/bn_IN.po
index 2d9827d3ede35143d0548702ca839517f95297da..77717550bdf8847155017c3ec15a8c1806849fc2 100644
--- a/po/bn_IN.po
+++ b/po/bn_IN.po
@@ -4042,7 +4042,7 @@ msgid "returned buffer is not same size as requested"
 msgstr "প্রাপ্ত বাফারের মাপ অনুরোধ করা মাপের সমান নয়"
 
 # comment from maintainer:
-# Peek is the operation of reading something in that context. 
+# Peek is the operation of reading something in that context.
 #: src/remote_internal.c:3225
 #, c-format
 msgid "memory peek request too large for remote protocol, %zi > %d"
diff --git a/src/libvirt.c b/src/libvirt.c
index bf49018cd12f393f39f11752d0e0cbaeab0516ae..ecf56f9eb2978670cff95c432d3dcab38fb8315d 100644
--- a/src/libvirt.c
+++ b/src/libvirt.c
@@ -4386,11 +4386,11 @@ error:
  * @domain: a domain object
  * @seclabel: pointer to a virSecurityLabel structure
  *
- * Extract security label of an active domain.
+ * Extract security label of an active domain. The 'label' field
+ * in the @seclabel argument will be initialized to the empty
+ * string if the domain is not running under a security model.
  *
- * Returns 0 in case of success, -1 in case of failure, and -2
- * if the operation is not supported (caller decides if that's
- * an error).
+ * Returns 0 in case of success, -1 in case of failure
  */
 int
 virDomainGetSecurityLabel(virDomainPtr domain, virSecurityLabelPtr seclabel)
@@ -4421,10 +4421,11 @@ virDomainGetSecurityLabel(virDomainPtr domain, virSecurityLabelPtr seclabel)
  * @conn: a connection object
  * @secmodel: pointer to a virSecurityModel structure
  *
- * Extract the security model of a hypervisor.
+ * Extract the security model of a hypervisor. The 'model' field
+ * in the @secmodel argument may be initialized to the empty
+ * string if the driver has not activated a security model.
  *
- * Returns 0 in case of success, -1 in case of failure, and -2 if the
- * operation is not supported (caller decides if that's an error).
+ * Returns 0 in case of success, -1 in case of failure
  */
 int
 virNodeGetSecurityModel(virConnectPtr conn, virSecurityModelPtr secmodel)
diff --git a/src/qemu_driver.c b/src/qemu_driver.c
index 4e3e531b4e755f6023e3371b4133c057b3577eb0..89c252d017277c1be6ca9ab0f383a15cf4b4a80f 100644
--- a/src/qemu_driver.c
+++ b/src/qemu_driver.c
@@ -3070,6 +3070,8 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, dom->uuid);
 
+    memset(seclabel, 0, sizeof(*seclabel));
+
     if (!vm) {
         char uuidstr[VIR_UUID_STRING_BUFLEN];
         virUUIDFormat(dom->uuid, uuidstr);
@@ -3127,7 +3129,7 @@ static int qemudNodeGetSecurityModel(virConnectPtr conn,
 
     qemuDriverLock(driver);
     if (!driver->securityDriver) {
-        ret = -2;
+        memset(secmodel, 0, sizeof (*secmodel));
         goto cleanup;
     }
 
diff --git a/src/remote_internal.c b/src/remote_internal.c
index 19d0ac84bf4a4351793020de3ca504c21d7b20f8..9dc9bc144a5c54e8080da232c6cc1b243df283b0 100644
--- a/src/remote_internal.c
+++ b/src/remote_internal.c
@@ -2323,6 +2323,8 @@ remoteDomainGetSecurityLabel (virDomainPtr domain, virSecurityLabelPtr seclabel)
 
     make_nonnull_domain (&args.dom, domain);
     memset (&ret, 0, sizeof ret);
+    memset (seclabel, 0, sizeof (*seclabel));
+
     if (call (domain->conn, priv, 0, REMOTE_PROC_DOMAIN_GET_SECURITY_LABEL,
               (xdrproc_t) xdr_remote_domain_get_security_label_args, (char *)&args,
               (xdrproc_t) xdr_remote_domain_get_security_label_ret, (char *)&ret) == -1) {
@@ -2356,6 +2358,8 @@ remoteNodeGetSecurityModel (virConnectPtr conn, virSecurityModelPtr secmodel)
     remoteDriverLock(priv);
 
     memset (&ret, 0, sizeof ret);
+    memset (secmodel, 0, sizeof (*secmodel));
+
     if (call (conn, priv, 0, REMOTE_PROC_NODE_GET_SECURITY_MODEL,
               (xdrproc_t) xdr_void, NULL,
               (xdrproc_t) xdr_remote_node_get_security_model_ret, (char *)&ret) == -1) {
diff --git a/src/virsh.c b/src/virsh.c
index f5248d9e56b14ae5e62b2bfd46f9a3d12e5e42f8..5623499b6f564d7821a7e39b3fe201349420690c 100644
--- a/src/virsh.c
+++ b/src/virsh.c
@@ -1643,8 +1643,10 @@ cmdDominfo(vshControl *ctl, const vshCmd *cmd)
     /* Security model and label information */
     memset(&secmodel, 0, sizeof secmodel);
     if (virNodeGetSecurityModel(ctl->conn, &secmodel) == -1) {
-        virDomainFree(dom);
-        return FALSE;
+        if (last_error->code != VIR_ERR_NO_SUPPORT) {
+            virDomainFree(dom);
+            return FALSE;
+        }
     } else {
         /* Only print something if a security model is active */
         if (secmodel.model[0] != '\0') {