[PATCH] Fix starting qemu instances when apparmor driver is enabled

[Jim Fehlig <jfehlig@xxxxxxxx>]

With the apparmor security driver enabled, qemu instances fail
to start

# grep ^security_driver /etc/libvirt/qemu.conf
security_driver = "apparmor"
# virsh start test-kvm
error: Failed to start domain test-kvm
error: internal error security label already defined for VM

The model field of virSecurityLabelDef object is always populated
by virDomainDefGetSecurityLabelDef(), so remove the check for a
NULL model when verifying if a label is already defined for the
instance.

Checking for a NULL model and populating it later in
AppArmorGenSecurityLabel() has been left in the code to be
consistent with virSecuritySELinuxGenSecurityLabel().
---
 src/security/security_apparmor.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
index ddc1fe4..2e6a57f 100644
--- a/src/security/security_apparmor.c
+++ b/src/security/security_apparmor.c
@@ -436,8 +436,7 @@ AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
         return rc;
     }
 
-    if ((secdef->label) ||
-        (secdef->model) || (secdef->imagelabel)) {
+    if (secdef->label || secdef->imagelabel) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
                        "%s",
                        _("security label already defined for VM"));
@@ -461,8 +460,7 @@ AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
         goto err;
     }
 
-    secdef->model = strdup(SECURITY_APPARMOR_NAME);
-    if (!secdef->model) {
+    if (!secdef->model && !(secdef->model = strdup(SECURITY_APPARMOR_NAME))) {
         virReportOOMError();
         goto err;
     }
-- 
1.8.0.1

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list