https://bugzilla.redhat.com/show_bug.cgi?id=1027096#c8 There are two ways in which security model can make it way into <seclabel/>. One is as the @model attribute, the second one is via security_driver knob in qemu.conf. Then, while parsing <seclabel/> several checks and fix ups of old, stale combinations are performed. However, iff @model is specified. They are not done in the latter case. So it's still possible to feed libvirt with senseless combinations (if qemu.conf is adjusted correctly). One example of a seclabel that needs some adjustment (in case security_driver=none in qemu.conf) is: <seclabel type='dynamic' relabel='yes'/> The fixup code is copied from virSecurityLabelDefParseXML (covering the former case) into virSecurityLabelDefsParseXML (which handles the latter case). Signed-off-by: Michal Privoznik <mprivozn@xxxxxxxxxx> --- src/conf/domain_conf.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 53ef694..4a74f2a 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4974,6 +4974,13 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, host->secModels[0].model); if (VIR_STRDUP(def->seclabels[0]->model, host->secModels[0].model) < 0) goto error; + + if (STREQ(def->seclabels[0]->model, "none") && + flags & VIR_DOMAIN_XML_INACTIVE) { + /* Fix older configurations */ + def->seclabels[0]->type = VIR_DOMAIN_SECLABEL_NONE; + def->seclabels[0]->relabel = false; + } } else { virReportError(VIR_ERR_XML_ERROR, "%s", _("missing security model in domain seclabel")); -- 1.8.5.5 -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list