diff --git a/src/security/security_manager.c b/src/security/security_manager.c
index bb12e8ec2080fda86685fb6d6dcd1ba77fa78d38..06e5123db1181ede55bc68a4f625f72577026a79 100644
--- a/src/security/security_manager.c
+++ b/src/security/security_manager.c
@@ -331,6 +331,17 @@ virSecurityManagerGetRequireConfined(virSecurityManagerPtr mgr)
 }
 
 
+/**
+ * virSecurityManagerRestoreDiskLabel:
+ * @mgr: security manager object
+ * @vm: domain definition object
+ * @disk: disk definition to operate on
+ *
+ * Removes security label from the source image of the disk. Note that this
+ * function doesn't restore labels on backing chain elements of @disk.
+ *
+ * Returns: 0 on success, -1 on error.
+ */
 int
 virSecurityManagerRestoreDiskLabel(virSecurityManagerPtr mgr,
                                    virDomainDefPtr vm,
@@ -400,6 +411,17 @@ virSecurityManagerClearSocketLabel(virSecurityManagerPtr mgr,
 }
 
 
+/**
+ * virSecurityManagerSetDiskLabel:
+ * @mgr: security manager object
+ * @vm: domain definition object
+ * @disk: disk definition to operate on
+ *
+ * Labels the disk image and all images in the backing chain with the configured
+ * security label.
+ *
+ * Returns: 0 on success, -1 on error.
+ */
 int
 virSecurityManagerSetDiskLabel(virSecurityManagerPtr mgr,
                                virDomainDefPtr vm,