From 0f1993aa15f281b3812806e29df729149a5b64c6 Mon Sep 17 00:00:00 2001
From: Jim Fehlig <jfehlig@suse.com>
Date: Wed, 16 Aug 2017 15:46:55 -0600
Subject: [PATCH] Don't autogenerate seclabels of type 'none'

When security drivers are active but confinement is not enabled,
there is no need to autogenerate <seclabel> elements when starting
a domain def that contains no <seclabel> elements. In fact,
autogenerating the elements can result in needless save/restore and
migration failures when the security driver is not active on the
restore/migration target.

This patch changes the virSecurityManagerGenLabel function in
src/security_manager.c to only autogenerate a <seclabel> element
if none is already defined for the domain *and* default
confinement is enabled. Otherwise the needless <seclabel>
autogeneration is skipped.

Resolves: https://bugzilla.opensuse.org/show_bug.cgi?id=1051017
---
 src/security/security_manager.c | 46 +++++++++++++++++----------------
 1 file changed, 24 insertions(+), 22 deletions(-)

diff --git a/src/security/security_manager.c b/src/security/security_manager.c
index 013bbc37ef..95b9952308 100644
--- a/src/security/security_manager.c
+++ b/src/security/security_manager.c
@@ -650,31 +650,33 @@ virSecurityManagerGenLabel(virSecurityManagerPtr mgr,
     for (i = 0; sec_managers[i]; i++) {
         generated = false;
         seclabel = virDomainDefGetSecurityLabelDef(vm, sec_managers[i]->drv->name);
-        if (!seclabel) {
-            if (!(seclabel = virSecurityLabelDefNew(sec_managers[i]->drv->name)))
-                goto cleanup;
-            generated = seclabel->implicit = true;
-        }
-
-        if (seclabel->type == VIR_DOMAIN_SECLABEL_DEFAULT) {
-            if (virSecurityManagerGetDefaultConfined(sec_managers[i])) {
-                seclabel->type = VIR_DOMAIN_SECLABEL_DYNAMIC;
+        if (seclabel == NULL) {
+            /* Only generate seclabel if confinement is enabled */
+            if (!virSecurityManagerGetDefaultConfined(sec_managers[i])) {
+                VIR_DEBUG("Skipping auto generated seclabel");
+                continue;
             } else {
-                seclabel->type = VIR_DOMAIN_SECLABEL_NONE;
-                seclabel->relabel = false;
+                if (!(seclabel = virSecurityLabelDefNew(sec_managers[i]->drv->name)))
+                    goto cleanup;
+                generated = seclabel->implicit = true;
+                seclabel->type = VIR_DOMAIN_SECLABEL_DYNAMIC;
+            }
+        } else {
+            if (seclabel->type == VIR_DOMAIN_SECLABEL_DEFAULT) {
+                if (virSecurityManagerGetDefaultConfined(sec_managers[i])) {
+                    seclabel->type = VIR_DOMAIN_SECLABEL_DYNAMIC;
+                } else {
+                    seclabel->type = VIR_DOMAIN_SECLABEL_NONE;
+                    seclabel->relabel = false;
+                }
             }
-        }
 
-        if (seclabel->type == VIR_DOMAIN_SECLABEL_NONE) {
-            if (virSecurityManagerGetRequireConfined(sec_managers[i])) {
-                virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
-                               _("Unconfined guests are not allowed on this host"));
-                goto cleanup;
-            } else if (vm->nseclabels && generated) {
-                VIR_DEBUG("Skipping auto generated seclabel of type none");
-                virSecurityLabelDefFree(seclabel);
-                seclabel = NULL;
-                continue;
+            if (seclabel->type == VIR_DOMAIN_SECLABEL_NONE) {
+                if (virSecurityManagerGetRequireConfined(sec_managers[i])) {
+                    virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                                   _("Unconfined guests are not allowed on this host"));
+                    goto cleanup;
+                }
             }
         }
 
-- 
2.39.5