From 535e80fa87648fa5557676a2534134f13fb82960 Mon Sep 17 00:00:00 2001 From: Ewan Mellor Date: Tue, 2 Jan 2007 13:35:25 +0000 Subject: [PATCH] Don't canonicalise the resource inside res_security_check if security is off. This had broken use of relative paths to refer to ISOs etc. Signed-off-by: Ewan Mellor --- tools/python/xen/util/security.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/python/xen/util/security.py b/tools/python/xen/util/security.py index 0435608547..2702fd3dbb 100644 --- a/tools/python/xen/util/security.py +++ b/tools/python/xen/util/security.py @@ -637,11 +637,11 @@ def res_security_check(resource, domain_label): """ rtnval = 1 - #build canonical resource name - resource = unify_resname(resource) - # if security is on, ask the hypervisor for a decision if on(): + #build canonical resource name + resource = unify_resname(resource) + (label, ssidref, policy) = get_res_security_details(resource) domac = ['access_control'] domac.append(['policy', active_policy]) @@ -660,6 +660,8 @@ def res_security_check(resource, domain_label): # security is off, make sure resource isn't labeled else: + # Note, we can't canonicalise the resource here, because people using + # xm without ACM are free to use relative paths. (label, policy) = get_res_label(resource) if policy != 'NULL': raise ACMError("Security is off, but '"+resource+"' is labeled") -- 2.30.2