Add two new security label types

Curently security labels can be of type 'dynamic' or 'static'.
If no security label is given, then 'dynamic' is assumed. The
current code takes advantage of this default, and avoids even
saving <seclabel> elements with type='dynamic' to disk. This
means if you temporarily change security driver, the guests
can all still start.

With the introduction of sVirt to LXC though, there needs to be
a new default of 'none' to allow unconfined LXC containers.

This patch introduces two new security label types

 - default:  the host configuration decides whether to run the
             guest with type 'none' or 'dynamic' at guest start
 - none:     the guest will run unconfined by security policy

The 'none' label type will obviously be undesirable for some
deployments, so a new qemu.conf option allows a host admin to
mandate confined guests. It is also possible to turn off default
confinement

  security_default_confined = 1|0  (default == 1)
  security_require_confined = 1|0  (default == 0)

* src/conf/domain_conf.c, src/conf/domain_conf.h: Add new
  seclabel types
* src/security/security_manager.c, src/security/security_manager.h:
  Set default sec label types
* src/security/security_selinux.c: Handle 'none' seclabel type
* src/qemu/qemu.conf, src/qemu/qemu_conf.c, src/qemu/qemu_conf.h,
  src/qemu/libvirtd_qemu.aug: New security config options
* src/qemu/qemu_driver.c: Tell security driver about default
  config

diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 99152b6377516b98d19f79e287f9b38b6d3e032c..6bf64a6fb4316f83909debf0a3574b0758b4bd9c 100644 (file)
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -3539,16 +3539,18 @@ qemu-kvm -net nic,model=? /dev/null
 
     <p>
       The <code>seclabel</code> element allows control over the
-      operation of the security drivers. There are two basic
-      modes of operation, dynamic where libvirt automatically
-      generates a unique security label, or static where the
-      application/administrator chooses the labels. With dynamic
+      operation of the security drivers. There are three basic
+      modes of operation, 'dynamic' where libvirt automatically
+      generates a unique security label, 'static' where the
+      application/administrator chooses the labels, or 'none'
+      where confinement is disabled. With dynamic
       label generation, libvirt will always automatically
       relabel any resources associated with the virtual machine.
       With static label assignment, by default, the administrator
       or application must ensure labels are set correctly on any
       resources, however, automatic relabeling can be enabled
-      if desired.
+      if desired.  <span class="since">'dynamic' since 0.6.1, 'static'
+      since 0.6.2, and 'none' since 0.9.10.</span>
     </p>
 
     <p>
@@ -3570,8 +3572,17 @@ qemu-kvm -net nic,model=? /dev/null
   &lt;seclabel type='static' model='selinux' relabel='yes'&gt;
     &lt;label&gt;system_u:system_r:svirt_t:s0:c392,c662&lt;/label&gt;
   &lt;/seclabel&gt;
+
+  &lt;seclabel type='none'/&gt;
     </pre>
 
+    <p>
+      If no 'type' attribute is provided in the input XML, then
+      the security driver default setting will be used, which
+      may be either 'none' or 'dynamic'. If a 'baselabel' is set
+      but no 'type' is set, then the type is presumed to be 'dynamic'
+    </p>
+
     <p>
       When viewing the XML for a running guest with automatic
       resource relabeling active, an additional XML element,
@@ -3581,9 +3592,9 @@ qemu-kvm -net nic,model=? /dev/null
     </p>
     <dl>
       <dt><code>type</code></dt>
-      <dd>Either <code>static</code> or <code>dynamic</code> to determine
-        whether libvirt automatically generates a unique security label
-        or not.
+      <dd>Either <code>static</code>, <code>dynamic</code> or <code>none</code>
+        to determine whether libvirt automatically generates a unique security
+        label or not.
       </dd>
       <dt><code>model</code></dt>
       <dd>A valid security model name, matching the currently

diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 1576233706efd1d385d1b0724858dc277c7fb73f..8111045c03e7c08fac480c4dcf23fed5eaf34e65 100644 (file)
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -129,6 +129,11 @@
             </optional>
           </interleave>
         </group>
+        <group>
+          <attribute name='type'>
+            <value>none</value>
+          </attribute>
+        </group>
       </choice>
     </element>
   </define>

diff --git a/po/POTFILES.in b/po/POTFILES.in
index ba93334e09cfd4e65ddb560a57ff693eb4536979..cbe62dd0705b9c49cea04cfb1741fc22634dafe1 100644 (file)
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -90,6 +90,7 @@ src/secret/secret_driver.c
 src/security/security_apparmor.c
 src/security/security_dac.c
 src/security/security_driver.c
+src/security/security_manager.c
 src/security/security_selinux.c
 src/security/virt-aa-helper.c
 src/storage/parthelper.c

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index aba81c305e45559508bf66d6cf6de48881f106e1..aeef9db46c887dc54849a8ebea4b41605a407090 100644 (file)
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -564,6 +564,8 @@ VIR_ENUM_IMPL(virDomainCrashedReason, VIR_DOMAIN_CRASHED_LAST,
               "unknown")
 
 VIR_ENUM_IMPL(virDomainSeclabel, VIR_DOMAIN_SECLABEL_LAST,
+              "default",
+              "none",
               "dynamic",
               "static")
 
@@ -2585,13 +2587,15 @@ virSecurityLabelDefParseXML(virSecurityLabelDefPtr def,
                              "%s", _("missing security type"));
         goto error;
     }
+
     def->type = virDomainSeclabelTypeFromString(p);
     VIR_FREE(p);
-    if (def->type < 0) {
+    if (def->type <= 0) {
         virDomainReportError(VIR_ERR_XML_ERROR,
                              "%s", _("invalid security type"));
         goto error;
     }
+
     p = virXPathStringLimit("string(./seclabel/@relabel)",
                             VIR_SECURITY_LABEL_BUFLEN-1, ctxt);
     if (p != NULL) {
@@ -2612,8 +2616,15 @@ virSecurityLabelDefParseXML(virSecurityLabelDefPtr def,
                                  "%s", _("dynamic label type must use resource relabeling"));
             goto error;
         }
+        if (def->type == VIR_DOMAIN_SECLABEL_NONE &&
+            !def->norelabel) {
+            virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                                 "%s", _("resource relabeling is not compatible with 'none' label type"));
+            goto error;
+        }
     } else {
-        if (def->type == VIR_DOMAIN_SECLABEL_STATIC)
+        if (def->type == VIR_DOMAIN_SECLABEL_STATIC ||
+            def->type == VIR_DOMAIN_SECLABEL_NONE)
             def->norelabel = true;
         else
             def->norelabel = false;
@@ -2648,12 +2659,16 @@ virSecurityLabelDefParseXML(virSecurityLabelDefPtr def,
         def->imagelabel = p;
     }
 
-    /* Only parse baselabel, for dynamic label */
-    if (def->type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
+    /* Only parse baselabel, for dynamic or none label types */
+    if (def->type == VIR_DOMAIN_SECLABEL_DYNAMIC ||
+        def->type == VIR_DOMAIN_SECLABEL_NONE) {
         p = virXPathStringLimit("string(./seclabel/baselabel[1])",
                                 VIR_SECURITY_LABEL_BUFLEN-1, ctxt);
-        if (p != NULL)
+        if (p != NULL) {
             def->baselabel = p;
+            /* Forces none type to dynamic for back compat */
+            def->type = VIR_DOMAIN_SECLABEL_DYNAMIC;
+        }
     }
 
     /* Only parse model, if static labelling, or a base
@@ -9923,24 +9938,32 @@ virDomainLifecycleDefFormat(virBufferPtr buf,
 }
 
 
-static int
-virSecurityLabelDefFormat(virBufferPtr buf, virSecurityLabelDefPtr def,
-                          unsigned int flags)
+static void
+virSecurityLabelDefFormat(virBufferPtr buf, virSecurityLabelDefPtr def)
 {
     const char *sectype = virDomainSeclabelTypeToString(def->type);
-    int ret = -1;
 
     if (!sectype)
-        goto cleanup;
+        return;
+
+    if (def->type == VIR_DOMAIN_SECLABEL_DEFAULT)
+        return;
+
+    virBufferAsprintf(buf, "<seclabel type='%s'",
+                      sectype);
+    virBufferEscapeString(buf, " model='%s'", def->model);
+
+    virBufferAsprintf(buf, " relabel='%s'",
+                      def->norelabel ? "no" : "yes");
+
+    if (def->type == VIR_DOMAIN_SECLABEL_NONE) {
+        virBufferAddLit(buf, "/>\n");
+        return;
+    }
+
+    if (def->label || def->imagelabel || def->baselabel) {
+        virBufferAddLit(buf, ">\n");
 
-    if (def->type == VIR_DOMAIN_SECLABEL_DYNAMIC &&
-        !def->baselabel &&
-        (flags & VIR_DOMAIN_XML_INACTIVE)) {
-        /* This is the default for inactive xml, so nothing to output.  */
-    } else {
-        virBufferAsprintf(buf, "<seclabel type='%s' model='%s' relabel='%s'>\n",
-                          sectype, def->model,
-                          def->norelabel ? "no" : "yes");
         virBufferEscapeString(buf, "  <label>%s</label>\n",
                               def->label);
         if (!def->norelabel)
@@ -9950,10 +9973,9 @@ virSecurityLabelDefFormat(virBufferPtr buf, virSecurityLabelDefPtr def,
             virBufferEscapeString(buf, "  <baselabel>%s</baselabel>\n",
                                   def->baselabel);
         virBufferAddLit(buf, "</seclabel>\n");
+    } else {
+        virBufferAddLit(buf, "/>\n");
     }
-    ret = 0;
-cleanup:
-    return ret;
 }
 
 
@@ -11957,12 +11979,9 @@ virDomainDefFormatInternal(virDomainDefPtr def,
 
     virBufferAddLit(buf, "  </devices>\n");
 
-    if (def->seclabel.model) {
-        virBufferAdjustIndent(buf, 2);
-        if (virSecurityLabelDefFormat(buf, &def->seclabel, flags) < 0)
-            goto cleanup;
-        virBufferAdjustIndent(buf, -2);
-    }
+    virBufferAdjustIndent(buf, 2);
+    virSecurityLabelDefFormat(buf, &def->seclabel);
+    virBufferAdjustIndent(buf, -2);
 
     if (def->namespaceData && def->ns.format) {
         if ((def->ns.format)(buf, def->namespaceData) < 0)

diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index a60415531918ddd94de333219cfcda0d24429cf1..e3c9af861315d4c0af497e3ed4bd2bb55753f861 100644 (file)
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -175,6 +175,8 @@ struct _virDomainDeviceInfo {
 };
 
 enum virDomainSeclabelType {
+    VIR_DOMAIN_SECLABEL_DEFAULT,
+    VIR_DOMAIN_SECLABEL_NONE,
     VIR_DOMAIN_SECLABEL_DYNAMIC,
     VIR_DOMAIN_SECLABEL_STATIC,
 

diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug
index 078e9c41a7c96c4547bd02b33981305662663742..f6cec1fcfd21641ce2aec3618a63c9e3540ae62e 100644 (file)
--- a/src/qemu/libvirtd_qemu.aug
+++ b/src/qemu/libvirtd_qemu.aug
@@ -33,6 +33,8 @@ module Libvirtd_qemu =
                  | bool_entry "vnc_sasl"
                  | str_entry "vnc_sasl_dir"
                  | str_entry "security_driver"
+                 | bool_entry "security_default_confined"
+                 | bool_entry "security_require_confined"
                  | str_entry "user"
                  | str_entry "group"
                  | bool_entry "dynamic_ownership"

diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf
index 4ec5e6c0ffd52433cf3424daa8ef96231656ef7a..95428c1968ce3fc4ac02342e2ccc6d75b077af1f 100644 (file)
--- a/src/qemu/qemu.conf
+++ b/src/qemu/qemu.conf
@@ -138,6 +138,14 @@
 #
 # security_driver = "selinux"
 
+# If set to non-zero, then the default security labeling
+# will make guests confined. If set to zero, then guests
+# will be unconfined by default. Defaults to 1.
+# security_default_confined = 1
+
+# If set to non-zero, then attempts to create unconfined
+# guests will be blocked. Defaults to 0.
+# security_require_confined = 1
 
 # The user ID for QEMU processes run by the system instance.
 #user = "root"

diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
index bc0a646b6c36ffb2839824314cdbe8e7cc726560..e95c7a55e043927c92d4391b5916ce0bde398b92 100644 (file)
--- a/src/qemu/qemu_conf.c
+++ b/src/qemu/qemu_conf.c
@@ -75,6 +75,8 @@ int qemudLoadDriverConfig(struct qemud_driver *driver,
     int i;
 
     /* Setup critical defaults */
+    driver->securityDefaultConfined = true;
+    driver->securityRequireConfined = false;
     driver->dynamicOwnership = 1;
     driver->clearEmulatorCapabilities = 1;
 
@@ -195,6 +197,15 @@ int qemudLoadDriverConfig(struct qemud_driver *driver,
         }
     }
 
+    p = virConfGetValue (conf, "security_default_confined");
+    CHECK_TYPE ("security_default_confined", VIR_CONF_LONG);
+    if (p) driver->securityDefaultConfined = p->l;
+
+    p = virConfGetValue (conf, "security_require_confined");
+    CHECK_TYPE ("security_require_confined", VIR_CONF_LONG);
+    if (p) driver->securityRequireConfined = p->l;
+
+
     p = virConfGetValue (conf, "vnc_sasl");
     CHECK_TYPE ("vnc_sasl", VIR_CONF_LONG);
     if (p) driver->vncSASL = p->l;

diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h
index 0b65d7df9793a4ec0253c68b0fc10d6c90468908..36f1c4c4b622db7572e6305d39429ada5dd7f680 100644 (file)
--- a/src/qemu/qemu_conf.h
+++ b/src/qemu/qemu_conf.h
@@ -115,6 +115,8 @@ struct qemud_driver {
     virDomainEventStatePtr domainEventState;
 
     char *securityDriverName;
+    bool securityDefaultConfined;
+    bool securityRequireConfined;
     virSecurityManagerPtr securityManager;
 
     char *saveImageFormat;

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index d66140b83d89e629151564787f98f62916ef3ff0..1e5069a49b24572052fa89171ff5f1a7d40e69fe 100644 (file)
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -210,7 +210,10 @@ static int
 qemuSecurityInit(struct qemud_driver *driver)
 {
     virSecurityManagerPtr mgr = virSecurityManagerNew(driver->securityDriverName,
-                                                      driver->allowDiskFormatProbing);
+                                                      driver->allowDiskFormatProbing,
+                                                      driver->securityDefaultConfined,
+                                                      driver->securityRequireConfined);
+
     if (!mgr)
         goto error;
 
@@ -218,6 +221,8 @@ qemuSecurityInit(struct qemud_driver *driver)
         virSecurityManagerPtr dac = virSecurityManagerNewDAC(driver->user,
                                                              driver->group,
                                                              driver->allowDiskFormatProbing,
+                                                             driver->securityDefaultConfined,
+                                                             driver->securityRequireConfined,
                                                              driver->dynamicOwnership);
         if (!dac)
             goto error;

diff --git a/src/security/security_manager.c b/src/security/security_manager.c
index 2e4956a0ee1a502999a261bb8f0fb36f0e3f0e3d..d0bafae062a5b27341eeaa108e217fe6cc647c03 100644 (file)
--- a/src/security/security_manager.c
+++ b/src/security/security_manager.c
@@ -36,10 +36,14 @@
 struct _virSecurityManager {
     virSecurityDriverPtr drv;
     bool allowDiskFormatProbing;
+    bool defaultConfined;
+    bool requireConfined;
 };
 
 static virSecurityManagerPtr virSecurityManagerNewDriver(virSecurityDriverPtr drv,
-                                                         bool allowDiskFormatProbing)
+                                                         bool allowDiskFormatProbing,
+                                                         bool defaultConfined,
+                                                         bool requireConfined)
 {
     virSecurityManagerPtr mgr;
 
@@ -50,6 +54,8 @@ static virSecurityManagerPtr virSecurityManagerNewDriver(virSecurityDriverPtr dr
 
     mgr->drv = drv;
     mgr->allowDiskFormatProbing = allowDiskFormatProbing;
+    mgr->defaultConfined = defaultConfined;
+    mgr->requireConfined = requireConfined;
 
     if (drv->open(mgr) < 0) {
         virSecurityManagerFree(mgr);
@@ -64,7 +70,9 @@ virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary,
 {
     virSecurityManagerPtr mgr =
         virSecurityManagerNewDriver(&virSecurityDriverStack,
-                                    virSecurityManagerGetAllowDiskFormatProbing(primary));
+                                    virSecurityManagerGetAllowDiskFormatProbing(primary),
+                                    virSecurityManagerGetDefaultConfined(primary),
+                                    virSecurityManagerGetRequireConfined(primary));
 
     if (!mgr)
         return NULL;
@@ -78,11 +86,15 @@ virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary,
 virSecurityManagerPtr virSecurityManagerNewDAC(uid_t user,
                                                gid_t group,
                                                bool allowDiskFormatProbing,
+                                               bool defaultConfined,
+                                               bool requireConfined,
                                                bool dynamicOwnership)
 {
     virSecurityManagerPtr mgr =
         virSecurityManagerNewDriver(&virSecurityDriverDAC,
-                                    allowDiskFormatProbing);
+                                    allowDiskFormatProbing,
+                                    defaultConfined,
+                                    requireConfined);
 
     if (!mgr)
         return NULL;
@@ -95,13 +107,18 @@ virSecurityManagerPtr virSecurityManagerNewDAC(uid_t user,
 }
 
 virSecurityManagerPtr virSecurityManagerNew(const char *name,
-                                            bool allowDiskFormatProbing)
+                                            bool allowDiskFormatProbing,
+                                            bool defaultConfined,
+                                            bool requireConfined)
 {
     virSecurityDriverPtr drv = virSecurityDriverLookup(name);
     if (!drv)
         return NULL;
 
-    return virSecurityManagerNewDriver(drv, allowDiskFormatProbing);
+    return virSecurityManagerNewDriver(drv,
+                                       allowDiskFormatProbing,
+                                       defaultConfined,
+                                       requireConfined);
 }
 
 
@@ -149,6 +166,16 @@ bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr)
     return mgr->allowDiskFormatProbing;
 }
 
+bool virSecurityManagerGetDefaultConfined(virSecurityManagerPtr mgr)
+{
+    return mgr->defaultConfined;
+}
+
+bool virSecurityManagerGetRequireConfined(virSecurityManagerPtr mgr)
+{
+    return mgr->requireConfined;
+}
+
 int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr,
                                         virDomainDefPtr vm,
                                         virDomainDiskDefPtr disk)
@@ -248,6 +275,20 @@ int virSecurityManagerRestoreSavedStateLabel(virSecurityManagerPtr mgr,
 int virSecurityManagerGenLabel(virSecurityManagerPtr mgr,
                                virDomainDefPtr vm)
 {
+    if (vm->seclabel.type == VIR_DOMAIN_SECLABEL_DEFAULT) {
+        if (mgr->defaultConfined)
+            vm->seclabel.type = VIR_DOMAIN_SECLABEL_DYNAMIC;
+        else
+            vm->seclabel.type = VIR_DOMAIN_SECLABEL_NONE;
+    }
+
+    if ((vm->seclabel.type == VIR_DOMAIN_SECLABEL_NONE) &&
+        mgr->requireConfined) {
+        virSecurityReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                               _("Unconfined guests are not allowed on this host"));
+        return -1;
+    }
+
     if (mgr->drv->domainGenSecurityLabel)
         return mgr->drv->domainGenSecurityLabel(mgr, vm);
 

diff --git a/src/security/security_manager.h b/src/security/security_manager.h
index 6731d59690ebb0d801453477909e20d9961b6816..32c8c3bf41d6f64a8b899e8dc543933c5801a984 100644 (file)
--- a/src/security/security_manager.h
+++ b/src/security/security_manager.h
@@ -32,7 +32,9 @@ typedef struct _virSecurityManager virSecurityManager;
 typedef virSecurityManager *virSecurityManagerPtr;
 
 virSecurityManagerPtr virSecurityManagerNew(const char *name,
-                                            bool allowDiskFormatProbing);
+                                            bool allowDiskFormatProbing,
+                                            bool defaultConfined,
+                                            bool requireConfined);
 
 virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary,
                                                  virSecurityManagerPtr secondary);
@@ -40,6 +42,8 @@ virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary,
 virSecurityManagerPtr virSecurityManagerNewDAC(uid_t user,
                                                gid_t group,
                                                bool allowDiskFormatProbing,
+                                               bool defaultConfined,
+                                               bool requireConfined,
                                                bool dynamicOwnership);
 
 void *virSecurityManagerGetPrivateData(virSecurityManagerPtr mgr);
@@ -49,6 +53,8 @@ void virSecurityManagerFree(virSecurityManagerPtr mgr);
 const char *virSecurityManagerGetDOI(virSecurityManagerPtr mgr);
 const char *virSecurityManagerGetModel(virSecurityManagerPtr mgr);
 bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr);
+bool virSecurityManagerGetDefaultConfined(virSecurityManagerPtr mgr);
+bool virSecurityManagerGetRequireConfined(virSecurityManagerPtr mgr);
 
 int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr,
                                         virDomainDefPtr def,

diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index cb41a17c52f12c06bac84fcc96e65f04469f777d..15b80c4d71574199d9494f3e0544938ae64f5dd0 100644 (file)
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -171,6 +171,7 @@ SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
     int c1 = 0;
     int c2 = 0;
     context_t ctx = NULL;
+    const char *range;
 
     if ((def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) &&
         !def->seclabel.baselabel &&
@@ -201,7 +202,8 @@ SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
         return rc;
     }
 
-    if (def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) {
+    switch (def->seclabel.type) {
+    case VIR_DOMAIN_SECLABEL_STATIC:
         if (!(ctx = context_new(def->seclabel.label)) ) {
             virReportSystemError(errno,
                                  _("unable to allocate socket security context '%s'"),
@@ -209,13 +211,15 @@ SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
             return rc;
         }
 
-        const char *range = context_range_get(ctx);
+        range = context_range_get(ctx);
         if (!range ||
             !(mcs = strdup(range))) {
             virReportOOMError();
             goto cleanup;
         }
-    } else {
+        break;
+
+    case VIR_DOMAIN_SECLABEL_DYNAMIC:
         do {
             c1 = virRandomBits(10);
             c2 = virRandomBits(10);
@@ -247,14 +251,28 @@ SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                    _("cannot generate selinux context for %s"), mcs);
             goto cleanup;
         }
-    }
-    def->seclabel.imagelabel = SELinuxGenNewContext(default_image_context, mcs);
-    if (!def->seclabel.imagelabel)  {
+        break;
+
+    case VIR_DOMAIN_SECLABEL_NONE:
+        /* no op */
+        break;
+
+    default:
         virSecurityReportError(VIR_ERR_INTERNAL_ERROR,
-                               _("cannot generate selinux context for %s"), mcs);
+                               _("unexpected security label type '%s'"),
+                               virDomainSeclabelTypeToString(def->seclabel.type));
         goto cleanup;
     }
 
+    if (!def->seclabel.norelabel) {
+        def->seclabel.imagelabel = SELinuxGenNewContext(default_image_context, mcs);
+        if (!def->seclabel.imagelabel)  {
+            virSecurityReportError(VIR_ERR_INTERNAL_ERROR,
+                                   _("cannot generate selinux context for %s"), mcs);
+            goto cleanup;
+        }
+    }
+
     if (!def->seclabel.model &&
         !(def->seclabel.model = strdup(SECURITY_SELINUX_NAME))) {
         virReportOOMError();

diff --git a/tests/seclabeltest.c b/tests/seclabeltest.c
index 5d877890af6323b93be9685ed8b96168bf7a9a20..1898c3e91d14fb6b119f93cdc679c29e99c5767a 100644 (file)
--- a/tests/seclabeltest.c
+++ b/tests/seclabeltest.c
@@ -13,7 +13,7 @@ main (int argc ATTRIBUTE_UNUSED, char **argv ATTRIBUTE_UNUSED)
     virSecurityManagerPtr mgr;
     const char *doi, *model;
 
-    mgr = virSecurityManagerNew(NULL, false);
+    mgr = virSecurityManagerNew(NULL, false, true, true);
     if (mgr == NULL) {
         fprintf (stderr, "Failed to start security driver");
         exit (-1);