Don't canonicalise the resource inside res_security_check if security is off.

This had broken use of relative paths to refer to ISOs etc.

Signed-off-by: Ewan Mellor <ewan@xensource.com>

diff --git a/tools/python/xen/util/security.py b/tools/python/xen/util/security.py
index 04356085470827c12f5452d652841f7d249aa0e0..2702fd3dbbf8f6c008147b7f1dec070918bd6573 100644 (file)
--- a/tools/python/xen/util/security.py
+++ b/tools/python/xen/util/security.py
@@ -637,11 +637,11 @@ def res_security_check(resource, domain_label):
     """
     rtnval = 1
 
-    #build canonical resource name
-    resource = unify_resname(resource)
-
     # if security is on, ask the hypervisor for a decision
     if on():
+        #build canonical resource name
+        resource = unify_resname(resource)
+
         (label, ssidref, policy) = get_res_security_details(resource)
         domac = ['access_control']
         domac.append(['policy', active_policy])
@@ -660,6 +660,8 @@ def res_security_check(resource, domain_label):
 
     # security is off, make sure resource isn't labeled
     else:
+        # Note, we can't canonicalise the resource here, because people using
+        # xm without ACM are free to use relative paths.
         (label, policy) = get_res_label(resource)
         if policy != 'NULL':
             raise ACMError("Security is off, but '"+resource+"' is labeled")