From d869a6ea03eca6cffe8913a541161bb9bbedc8a1 Mon Sep 17 00:00:00 2001 From: Michal Privoznik Date: Wed, 3 Sep 2014 18:07:45 +0200 Subject: [PATCH] conf: Fix even implicit labels https://bugzilla.redhat.com/show_bug.cgi?id=1027096#c8 There are two ways in which security model can make it way into . One is as the @model attribute, the second one is via security_driver knob in qemu.conf. Then, while parsing several checks and fix ups of old, stale combinations are performed. However, iff @model is specified. They are not done in the latter case. So it's still possible to feed libvirt with senseless combinations (if qemu.conf is adjusted correctly). One example of a seclabel that needs some adjustment (in case security_driver=none in qemu.conf) is: The fixup code is copied from virSecurityLabelDefParseXML (covering the former case) into virSecurityLabelDefsParseXML (which handles the latter case). Signed-off-by: Michal Privoznik --- src/conf/domain_conf.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index efc2eb0286..9fe75f8db1 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4974,6 +4974,13 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, host->secModels[0].model); if (VIR_STRDUP(def->seclabels[0]->model, host->secModels[0].model) < 0) goto error; + + if (STREQ(def->seclabels[0]->model, "none") && + flags & VIR_DOMAIN_XML_INACTIVE) { + /* Fix older configurations */ + def->seclabels[0]->type = VIR_DOMAIN_SECLABEL_NONE; + def->seclabels[0]->relabel = false; + } } else { virReportError(VIR_ERR_XML_ERROR, "%s", _("missing security model in domain seclabel")); -- GitLab