Currently, if the primary security driver is 'none', we skip initializing caps->host.secModels. This means, later, when LXC domain XML is parsed and <seclabel type='none'/> is found (see virSecurityLabelDefsParseXML), the model name is not copied to the seclabel. This leads to subsequent crash in virSecurityManagerGenLabel where we call STREQ() over the model (note, that we are expecting model to be !NULL). --- src/lxc/lxc_conf.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/src/lxc/lxc_conf.c b/src/lxc/lxc_conf.c index 4e859c5..78b1559 100644 --- a/src/lxc/lxc_conf.c +++ b/src/lxc/lxc_conf.c @@ -114,16 +114,14 @@ virCapsPtr lxcCapsInit(virLXCDriverPtr driver) doi = virSecurityManagerGetDOI(driver->securityManager); model = virSecurityManagerGetModel(driver->securityManager); - if (STRNEQ(model, "none")) { - /* Allocate just the primary security driver for LXC. */ - if (VIR_ALLOC(caps->host.secModels) < 0) - goto error; - caps->host.nsecModels = 1; - if (VIR_STRDUP(caps->host.secModels[0].model, model) < 0) - goto error; - if (VIR_STRDUP(caps->host.secModels[0].doi, doi) < 0) - goto error; - } + /* Allocate the primary security driver for LXC. */ + if (VIR_ALLOC(caps->host.secModels) < 0) + goto error; + caps->host.nsecModels = 1; + if (VIR_STRDUP(caps->host.secModels[0].model, model) < 0) + goto error; + if (VIR_STRDUP(caps->host.secModels[0].doi, doi) < 0) + goto error; VIR_DEBUG("Initialized caps for security driver \"%s\" with " "DOI \"%s\"", model, doi);

While generating seclabels, we check the seclabel stack if required driver is in the stack. If not, an error is returned. However, it is possible for a seclabel to not have any model set (happens with LXC domains that have just <seclabel type='none'>). If that's the case, we should just skip the iteration instead of calling STREQ(NULL, ...) and SIGSEGV-ing subsequently. --- src/security/security_manager.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 6946637..411a909 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -436,6 +436,9 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, virObjectLock(mgr); for (i = 0; i < vm->nseclabels; i++) { + if (!vm->seclabels[i]->model) + continue; + for (j = 0; sec_managers[j]; j++) if (STREQ(vm->seclabels[i]->model, sec_managers[j]->drv->name)) break;