From: Cole Robinson <crobinso@redhat.com>
Date: Tue, 14 Oct 2025 17:41:45 +0000 (-0400)
Subject: conf: never reject <disk> <seclabel relabel='no'> overrides
X-Git-Tag: v11.9.0-rc1~20
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f6ea64f18204069e91e18e8229951b012a7f6bff;p=thirdparty%2Flibvirt.git

conf: never reject <disk> <seclabel relabel='no'> overrides

Trying to disable <seclabel> for the whole <domain> and _also_
disable <seclabel> at the <disk> level will fail with:

  error: unsupported configuration: label overrides require relabeling to be enabled at the domain level

which seems wrong. Instead skip the validation when disk seclabel
has relabel='no', that config should always be valid.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
---

diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 93a2bc9b01..eea9b38b21 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -303,6 +303,11 @@ virSecurityDeviceLabelDefValidate(virSecurityDeviceLabelDef **seclabels,
     for (i = 0; i < nseclabels; i++) {
         seclabel = seclabels[i];
 
+        /* relabel='no' is always valid to request, regardless of
+         * domain level <seclabel> config */
+        if (!seclabel->relabel)
+            continue;
+
         /* find the security label that it's being overridden */
         for (j = 0; j < nvmSeclabels; j++) {
             if (STRNEQ_NULLABLE(vmSeclabels[j]->model, seclabel->model))
diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args
new file mode 100644
index 0000000000..23beb54806
--- /dev/null
+++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args
@@ -0,0 +1,35 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \
+USER=test \
+LOGNAME=test \
+XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \
+XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \
+XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
+/usr/bin/qemu-system-x86_64 \
+-name guest=QEMUGuest1,debug-threads=on \
+-S \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
+-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
+-accel tcg \
+-cpu qemu64 \
+-m size=219136k \
+-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
+-overcommit mem-lock=off \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
+-mon chardev=charmonitor,id=monitor,mode=control \
+-rtc base=utc \
+-no-shutdown \
+-boot strict=on \
+-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \
+-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \
+-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \
+-audiodev '{"id":"audio1","driver":"none"}' \
+-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
+-msg timestamp=on
diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml
new file mode 100644
index 0000000000..15049a8a32
--- /dev/null
+++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml
@@ -0,0 +1,43 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu>
+  <os>
+    <type arch='x86_64' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <cpu mode='custom' match='exact' check='none'>
+    <model fallback='forbid'>qemu64</model>
+  </cpu>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'>
+        <seclabel model='selinux' relabel='no'/>
+      </source>
+      <target dev='hda' bus='ide'/>
+      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
+    </disk>
+    <controller type='usb' index='0' model='piix3-uhci'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='ide' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <audio id='1' type='none'/>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+    </memballoon>
+  </devices>
+  <seclabel type='none' model='selinux'/>
+</domain>
diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml
new file mode 100644
index 0000000000..2a174e8495
--- /dev/null
+++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml
@@ -0,0 +1,30 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu>
+  <os>
+    <type arch='x86_64' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <disk type='block' device='disk'>
+      <source dev='/dev/HostVG/QEMUGuest1'>
+        <seclabel model='selinux' relabel='no'/>
+      </source>
+      <target dev='hda' bus='ide'/>
+      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
+    </disk>
+    <controller type='usb' index='0'/>
+    <controller type='ide' index='0'/>
+    <controller type='pci' index='0' model='pci-root'/>
+    <memballoon model='virtio'/>
+  </devices>
+  <seclabel type='none' model='selinux'/>
+</domain>
diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
index aa6e1ad167..dd55c1ef28 100644
--- a/tests/qemuxmlconftest.c
+++ b/tests/qemuxmlconftest.c
@@ -2611,6 +2611,7 @@ mymain(void)
     DO_TEST_CAPS_LATEST("seclabel-static-labelskip");
     DO_TEST_CAPS_LATEST("seclabel-none");
     DO_TEST_CAPS_LATEST("seclabel-dac-none");
+    DO_TEST_CAPS_LATEST("seclabel-selinux-none-override");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-multiple");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-duplicates");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-relabel-invalid");