Fix starting qemu instances when apparmor driver is enabled

With the apparmor security driver enabled, qemu instances fail
to start

# grep ^security_driver /etc/libvirt/qemu.conf
security_driver = "apparmor"
# virsh start test-kvm
error: Failed to start domain test-kvm
error: internal error security label already defined for VM

The model field of virSecurityLabelDef object is always populated
by virDomainDefGetSecurityLabelDef(), so remove the check for a
NULL model when verifying if a label is already defined for the
instance.

Checking for a NULL model and populating it later in
AppArmorGenSecurityLabel() has been left in the code to be
consistent with virSecuritySELinuxGenSecurityLabel().

diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
index ddc1fe4b4b6cba597fb049b87506bba756070a2d..2e6a57f77f946488efd9efbffa0be615d0d3cb9a 100644 (file)
--- a/src/security/security_apparmor.c
+++ b/src/security/security_apparmor.c
@@ -436,8 +436,7 @@ AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
         return rc;
     }
 
-    if ((secdef->label) ||
-        (secdef->model) || (secdef->imagelabel)) {
+    if (secdef->label || secdef->imagelabel) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
                        "%s",
                        _("security label already defined for VM"));
@@ -461,8 +460,7 @@ AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
         goto err;
     }
 
-    secdef->model = strdup(SECURITY_APPARMOR_NAME);
-    if (!secdef->model) {
+    if (!secdef->model && !(secdef->model = strdup(SECURITY_APPARMOR_NAME))) {
         virReportOOMError();
         goto err;
     }