From nobody Thu Apr 2 22:21:32 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1774525971; cv=none; d=zohomail.com; s=zohoarc; b=AR+L9PpXIgUMnO+EnPTM3JjVxF87DO4WpKHDd3e4ES2oDn4Ps/NfDDhBDLqCSE2DsW8ebcU8HwCG4zPtK288OEbra0zE8g9ph1RXN8/YkSptS0U/K7ujwnTwvZgUQB7+soJQO/jSzkj+DR84tiVXZf4JgoDtXvK62zZUTlQ1KPA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1774525971; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id:Cc; bh=hfqi2PHU7Gxm8MzwZcwikLIqi6mJjz2D1dUzi48knwM=; b=ZA2pgBsPcEbc+2+SVDV0zJjTwXWoDHW9bNaQYXuI+HnIrimvmpcReeYturnoqWLJLR7GAeevsTCYnhjou3N2oMYtOqlUI8VKm4tPjWdjMMxG5MH8iUZjg0p3ZdI6oE3aiiJMpCmVxHiQcS7IdSpAsbgQe+acH38Wp4tVUgPhXeI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1774525971253205.9863147269847; Thu, 26 Mar 2026 04:52:51 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 679843F835; Thu, 26 Mar 2026 07:52:50 -0400 (EDT) Received: from [172.19.199.12] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 8F28C418E4; Thu, 26 Mar 2026 07:51:38 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id DABF53F2F8; Thu, 26 Mar 2026 07:51:31 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 973653F309 for ; Thu, 26 Mar 2026 07:51:31 -0400 (EDT) Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-640-vEF06fCsO-W7E68xJbsqVQ-1; Thu, 26 Mar 2026 07:51:30 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6A4AF1956096 for ; Thu, 26 Mar 2026 11:51:29 +0000 (UTC) Received: from moe (unknown [10.43.3.236]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C70DE1955D71 for ; Thu, 26 Mar 2026 11:51:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-4.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HELO_MISC_IP,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774525891; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hfqi2PHU7Gxm8MzwZcwikLIqi6mJjz2D1dUzi48knwM=; b=EaSNgcPe7j+1JSUB0bEVn651xFW55X4LY8a//9yGZ466+ZynqxR8CEBsfTQHkXyFQojiF5 l792j3+uTG2IVqYJ/387Piqmj2JR/QvGDJ5QvYtao9E4VO/7lTUxcN/v8V1Xx3R4/C67yt rtjWbu34Qd35YiNOfrBWqFVsMesB8Co= X-MC-Unique: vEF06fCsO-W7E68xJbsqVQ-1 X-Mimecast-MFC-AGG-ID: vEF06fCsO-W7E68xJbsqVQ_1774525889 To: devel@lists.libvirt.org Subject: [PATCH 1/3] conf: Fix seclabel type parsing wrt default value Date: Thu, 26 Mar 2026 12:51:23 +0100 Message-ID: <2a314bacd108f921937dafff08fb4868678c7712.1774525799.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: ZmTrzdgEJDMKueHN1CY8f_9C97zxGs1fJK8RgSad2gc_1774525889 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: FYK5OQ3M7O4U6NMOHR4WKQITXNQ26URC X-Message-ID-Hash: FYK5OQ3M7O4U6NMOHR4WKQITXNQ26URC X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1774525972730158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik Prior to v7.10.0-rc1~26 seclabels defaulted to VIR_DOMAIN_SECLABEL_DYNAMIC (type=3D'dynamic'). But after switching the parser to virXMLPropEnum() the type is overwritten to VIR_DOMAIN_SECLABEL_DEFAULT because the first thing that the helper function does is to set variable that holds the result to zero. Switch to virXMLPropEnumDefault() to restore the previous behavior. Fixes: f7ff8556ad9ba8d81408e31649071941a6a849a3 Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- src/conf/domain_conf.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 84425ff39d..b1ee519ff6 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -7076,14 +7076,13 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, if (!(seclabel =3D virSecurityLabelDefNew(model))) return NULL; =20 - /* set default value */ - seclabel->type =3D VIR_DOMAIN_SECLABEL_DYNAMIC; - - if (virXMLPropEnum(ctxt->node, "type", - virDomainSeclabelTypeFromString, - VIR_XML_PROP_NONZERO, - &seclabel->type) < 0) + if (virXMLPropEnumDefault(ctxt->node, "type", + virDomainSeclabelTypeFromString, + VIR_XML_PROP_NONZERO, + &seclabel->type, + VIR_DOMAIN_SECLABEL_DYNAMIC) < 0) { return NULL; + } =20 if (seclabel->type =3D=3D VIR_DOMAIN_SECLABEL_STATIC || seclabel->type =3D=3D VIR_DOMAIN_SECLABEL_NONE) --=20 2.52.0 From nobody Thu Apr 2 22:21:32 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1774526002; cv=none; d=zohomail.com; s=zohoarc; b=PZLKmWOftB69MgcJxdqBnLItpS7/1xUTPQR5yja7k3r9so46u+9fkw+7UJ0UjnkuZPPvSXHa3F6qwyjWFqxZlPu3tfirQqgFps88wXEGPW+18DOgdSMImIfISqGauXCDKS47GShYH7N360TPqDumXPYt75m0MqxYlAIm2E0RhIA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1774526002; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id:Cc; bh=fCvdxbaLYoMhJhtLScrWZp51L4EVjBqLEwdOA6ZAIrI=; b=JpQleUFa3iK3rQ4JwRw2dmLNu3I4rFFlxVxonKlZF5GDvTJ62ifDqRe7s+TwNlVjHJCsFBkjk+PfATMN2oYwDmgliyUjeXXWBL51jezd5GroOG9wirxEeSOHDkUSULrpglcfMr3H/AJ6nKAF6CvGwMlaDZynzZaSLoCBpHv5O0A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1774526002265570.8838501458505; Thu, 26 Mar 2026 04:53:22 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 7B5F23F86B; Thu, 26 Mar 2026 07:53:21 -0400 (EDT) Received: from [172.19.199.12] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 6932C4194A; Thu, 26 Mar 2026 07:51:40 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 450FA3F2F8; Thu, 26 Mar 2026 07:51:33 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id C2BA73F309 for ; Thu, 26 Mar 2026 07:51:32 -0400 (EDT) Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-178-QXYa7Vs2M6Sw535FboAtYQ-1; Thu, 26 Mar 2026 07:51:31 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6837418005BE for ; Thu, 26 Mar 2026 11:51:30 +0000 (UTC) Received: from moe (unknown [10.43.3.236]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C55731955D71 for ; Thu, 26 Mar 2026 11:51:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-4.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HELO_MISC_IP,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774525892; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fCvdxbaLYoMhJhtLScrWZp51L4EVjBqLEwdOA6ZAIrI=; b=iz9dC+zR+hTpt26CB/wmy87lr5PR4xbMBdtVBqffGQ6QGmYol69ann1F16hbJR0v+kPN6y htgmrChTppYrwYVGmmJWbpVtiYJuvAWFvjiIufBi/sCoYVcAr9A58nRJK70RgyE2UERIqm ytPZJJOGR2uZTc0yqdEKEtqcte+K6WU= X-MC-Unique: QXYa7Vs2M6Sw535FboAtYQ-1 X-Mimecast-MFC-AGG-ID: QXYa7Vs2M6Sw535FboAtYQ_1774525890 To: devel@lists.libvirt.org Subject: [PATCH 2/3] security: Rewrite virSecurityManagerCheckModel() to use g_autofree Date: Thu, 26 Mar 2026 12:51:24 +0100 Message-ID: <1c2e81430dd5623ab65f4262b4d62c878a24482a.1774525799.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: OJSWnQj5TQVDQoYH7Vw57mzNIEsJWN6QfNSbFPw7pKM_1774525890 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: LDMS3QIMGPMNY2YKCT2M5LYPSTFITNNB X-Message-ID-Hash: LDMS3QIMGPMNY2YKCT2M5LYPSTFITNNB X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1774526002873158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik Let's use automatic memory freeing inside of virSecurityManagerCheckModel() as it will simplify future commits. Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko Reviewed-by: Peter Krempa --- src/security/security_manager.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/src/security/security_manager.c b/src/security/security_manage= r.c index 5fc4eb4872..f2f3bb4f19 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -729,9 +729,8 @@ virSecurityManagerReleaseLabel(virSecurityManager *mgr, static int virSecurityManagerCheckModel(virSecurityManager *mgr, char *secmodel) { - int ret =3D -1; + g_autofree virSecurityManager **sec_managers =3D NULL; size_t i; - virSecurityManager **sec_managers =3D NULL; =20 if (STREQ_NULLABLE(secmodel, "none")) return 0; @@ -741,17 +740,14 @@ static int virSecurityManagerCheckModel(virSecurityMa= nager *mgr, =20 for (i =3D 0; sec_managers[i]; i++) { if (STREQ_NULLABLE(secmodel, sec_managers[i]->drv->name)) { - ret =3D 0; - goto cleanup; + return 0; } } =20 virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Security driver model '%1$s' is not available"), secmodel); - cleanup: - VIR_FREE(sec_managers); - return ret; + return -1; } =20 =20 --=20 2.52.0 From nobody Thu Apr 2 22:21:32 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1774526039; cv=none; d=zohomail.com; s=zohoarc; b=Wbo+AxG2a0MpuyWTu8Cia04hUnP5DGwJ9fQ5Yq+M3JKY56izXS3VWmolyAsV82mBDLoopv5PXk/kMrxSxhigfaCJSnQ2X3T7LKZNXrhWjnLvDzSrPB2YRu42+1uvk7zuOLe681R4/HOtwydqyxPAmTZURzzmhIcZXE6sZVvcKOU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1774526039; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id:Cc; bh=P0gLymI+e9wrtk2eY1csDR375Q2lfP3yjvkqZpD1Yf8=; b=ZNzKbEHlklRb5+2VuRXBb8LvzsBk6pVp08vIWbagOB/kmqVmJEH/LmNOsBkcUZUbqUj7opREFo4Ral4bEfVZvXxAm7p2eNbI9u4tpSAnOoSbsDKkZETqi3lT6FTZr1bXoPx3qLpb6eWJaMkCeFPgX7RgxQKt1R3VjRe/jTHO/sg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1774526039025262.1151651507631; Thu, 26 Mar 2026 04:53:59 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 46FEA3F351; Thu, 26 Mar 2026 07:53:58 -0400 (EDT) Received: from [172.19.199.12] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id DBEE3419A9; Thu, 26 Mar 2026 07:51:41 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 0DBDC3F328; Thu, 26 Mar 2026 07:51:34 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id AFF5E3F2F8 for ; Thu, 26 Mar 2026 07:51:33 -0400 (EDT) Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-606-160A2sSPNH6gCyo7G6HN1w-1; Thu, 26 Mar 2026 07:51:32 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 760EF1800616 for ; Thu, 26 Mar 2026 11:51:31 +0000 (UTC) Received: from moe (unknown [10.43.3.236]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CE6A21955D84 for ; Thu, 26 Mar 2026 11:51:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-4.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HELO_MISC_IP,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774525893; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=P0gLymI+e9wrtk2eY1csDR375Q2lfP3yjvkqZpD1Yf8=; b=iAUYEpJw1TdcQdsTopP+dAPf/5UzYJdg1EqP1APMAIVqxeefo1iN0dCnuIGiQIZqnVYsPr b/DFGitFBo15QhjXLQDyfd2LNgeGsUZztlRU8pUmi7fqsYLONH3YJsVwNAD9HsoFGNCbZR K3JpJ72WrIi0O0NFxziXf6BqljWfgcs= X-MC-Unique: 160A2sSPNH6gCyo7G6HN1w-1 X-Mimecast-MFC-AGG-ID: 160A2sSPNH6gCyo7G6HN1w_1774525891 To: devel@lists.libvirt.org Subject: [PATCH 3/3] security: Don't error out on seclabels of type='none' Date: Thu, 26 Mar 2026 12:51:25 +0100 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 9eREp7DbIBD7ckmdzdKvN2BybunDAqvihw4dBk8fjRU_1774525891 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: QC2GK5O5X5M3CIQC77B4U6H52NB3OBLE X-Message-ID-Hash: QC2GK5O5X5M3CIQC77B4U6H52NB3OBLE X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1774526041094158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik Ever since of commit v1.2.13-rc1~66 the model attribute of a is validated against secdriver names enabled. In nearly all cases this is something users want so that domain XML does not claim to set seclabels of a model that's not enabled. However, consider the following seclabel: It tells us to not bother setting selinux labels on given domain. A mgmt app might format this into domain XML if it sees selinux is disabled on the host. But if that's the case, selinux driver is not loaded and this virSecurityManagerCheckModel() doesn't find it and reports an error. Well, the error doesn't need to be reported as we will just ignore selinux as each driver callback checks if relabel is false (which it is for type=3D'none'). This is true for other secdrivers too. Resolves: https://redhat.atlassian.net/browse/RHEL-156689 Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko Tested-by: Richard W.M. Jones --- src/security/security_manager.c | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/src/security/security_manager.c b/src/security/security_manage= r.c index f2f3bb4f19..7023ac2db8 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -727,7 +727,8 @@ virSecurityManagerReleaseLabel(virSecurityManager *mgr, =20 =20 static int virSecurityManagerCheckModel(virSecurityManager *mgr, - char *secmodel) + char *secmodel, + bool relabel) { g_autofree virSecurityManager **sec_managers =3D NULL; size_t i; @@ -744,6 +745,19 @@ static int virSecurityManagerCheckModel(virSecurityMan= ager *mgr, } } =20 + if (relabel =3D=3D false) { + const char * const knownModels[] =3D { + "none", "apparmor", "dac", "selinux" + }; + + for (i =3D 0; i < G_N_ELEMENTS(knownModels); i++) { + if (STREQ_NULLABLE(secmodel, knownModels[i])) { + VIR_INFO("Ignoring seclabel with model %s and relabel=3Dno= ", secmodel); + return 0; + } + } + } + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Security driver model '%1$s' is not available"), secmodel); @@ -758,8 +772,11 @@ virSecurityManagerCheckDomainLabel(virSecurityManager = *mgr, size_t i; =20 for (i =3D 0; i < def->nseclabels; i++) { - if (virSecurityManagerCheckModel(mgr, def->seclabels[i]->model) < = 0) + if (virSecurityManagerCheckModel(mgr, + def->seclabels[i]->model, + def->seclabels[i]->relabel) < 0) { return -1; + } } =20 return 0; @@ -773,8 +790,11 @@ virSecurityManagerCheckDiskLabel(virSecurityManager *m= gr, size_t i; =20 for (i =3D 0; i < disk->src->nseclabels; i++) { - if (virSecurityManagerCheckModel(mgr, disk->src->seclabels[i]->mod= el) < 0) + if (virSecurityManagerCheckModel(mgr, + disk->src->seclabels[i]->model, + disk->src->seclabels[i]->relabel)= < 0) { return -1; + } } =20 return 0; @@ -788,8 +808,11 @@ virSecurityManagerCheckChardevLabel(virSecurityManager= *mgr, size_t i; =20 for (i =3D 0; i < dev->source->nseclabels; i++) { - if (virSecurityManagerCheckModel(mgr, dev->source->seclabels[i]->m= odel) < 0) + if (virSecurityManagerCheckModel(mgr, + dev->source->seclabels[i]->model, + dev->source->seclabels[i]->relabe= l) < 0) { return -1; + } } =20 return 0; --=20 2.52.0