>From 38d7c5a26e4c12a784619f1ed4fc993d9af82032 Mon Sep 17 00:00:00 2001
From: Daniel P. Berrange <berrange@redhat.com>
Date: Tue, 15 Jun 2010 17:44:19 +0100
Subject: [PATCH 07/10] Security driver params

---
 src/qemu/qemu_driver.c           |   85 +++++++++++++++++++-----------
 src/qemu/qemu_security_dac.c     |   44 +++++++++++-----
 src/qemu/qemu_security_stacked.c |  107 +++++++++++++++++++++++++-------------
 src/security/security_apparmor.c |   57 +++++++++++++-------
 src/security/security_driver.h   |   40 ++++++++++----
 src/security/security_selinux.c  |   56 +++++++++++++------
 6 files changed, 258 insertions(+), 131 deletions(-)

Index: libvirt-0.7.6/src/qemu/qemu_driver.c
===================================================================
--- libvirt-0.7.6.orig/src/qemu/qemu_driver.c
+++ libvirt-0.7.6/src/qemu/qemu_driver.c
@@ -870,7 +870,9 @@ qemuReconnectDomain(void *payload, const
 
     if (driver->securityDriver &&
         driver->securityDriver->domainReserveSecurityLabel &&
-        driver->securityDriver->domainReserveSecurityLabel(NULL, obj) < 0)
+        driver->securityDriver->domainReserveSecurityLabel(NULL,
+                                                           driver->securityDriver,
+                                                           obj) < 0)
         goto error;
 
     if (obj->def->id >= driver->nextvmid)
@@ -2582,12 +2584,16 @@ static int qemudStartVMDaemon(virConnect
        then generate a security label for isolation */
     if (driver->securityDriver &&
         driver->securityDriver->domainGenSecurityLabel &&
-        driver->securityDriver->domainGenSecurityLabel(conn, vm) < 0)
+        driver->securityDriver->domainGenSecurityLabel(conn,
+                                                       driver->securityDriver,
+                                                       vm) < 0)
         return -1;
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSecurityAllLabel &&
-        driver->securityDriver->domainSetSecurityAllLabel(conn, vm) < 0)
+        driver->securityDriver->domainSetSecurityAllLabel(conn,
+                                                          driver->securityDriver,
+                                                          vm) < 0)
         goto cleanup;
 
     /* Ensure no historical cgroup for this VM is lieing around bogus settings */
@@ -2816,10 +2822,14 @@ cleanup:
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityAllLabel)
-        driver->securityDriver->domainRestoreSecurityAllLabel(conn, vm);
+        driver->securityDriver->domainRestoreSecurityAllLabel(conn,
+                                                              driver->securityDriver,
+                                                              vm);
     if (driver->securityDriver &&
         driver->securityDriver->domainReleaseSecurityLabel)
-        driver->securityDriver->domainReleaseSecurityLabel(conn, vm);
+        driver->securityDriver->domainReleaseSecurityLabel(conn,
+                                                           driver->securityDriver,
+                                                           vm);
     qemuRemoveCgroup(conn, driver, vm, 0);
     if ((vm->def->ngraphics == 1) &&
         vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
@@ -2908,10 +2918,14 @@ static void qemudShutdownVMDaemon(virCon
     /* Reset Security Labels */
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityAllLabel)
-        driver->securityDriver->domainRestoreSecurityAllLabel(conn, vm);
+        driver->securityDriver->domainRestoreSecurityAllLabel(conn,
+                                                              driver->securityDriver,
+                                                              vm);
     if (driver->securityDriver &&
         driver->securityDriver->domainReleaseSecurityLabel)
-        driver->securityDriver->domainReleaseSecurityLabel(conn, vm);
+        driver->securityDriver->domainReleaseSecurityLabel(conn,
+                                                           driver->securityDriver,
+                                                           vm);
 
     /* Clear out dynamically assigned labels */
     if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) {
@@ -4006,7 +4020,10 @@ static int qemudDomainSave(virDomainPtr
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSavedStateLabel &&
-        driver->securityDriver->domainSetSavedStateLabel(dom->conn, vm, path) == -1)
+        driver->securityDriver->domainSetSavedStateLabel(dom->conn,
+                                                         driver->securityDriver,
+                                                         vm,
+                                                         path) == -1)
         goto endjob;
 
     if (header.compressed == QEMUD_SAVE_FORMAT_RAW) {
@@ -4031,7 +4048,10 @@ static int qemudDomainSave(virDomainPtr
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSavedStateLabel &&
-        driver->securityDriver->domainRestoreSavedStateLabel(dom->conn, vm, path) == -1)
+        driver->securityDriver->domainRestoreSavedStateLabel(dom->conn,
+                                                             driver->securityDriver,
+                                                             vm,
+                                                             path) == -1)
         goto endjob;
 
     ret = 0;
@@ -4128,7 +4148,10 @@ static int qemudDomainCoreDump(virDomain
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSavedStateLabel &&
-        driver->securityDriver->domainSetSavedStateLabel(dom->conn, vm, path) == -1)
+        driver->securityDriver->domainSetSavedStateLabel(dom->conn,
+                                                         driver->securityDriver,
+                                                         vm,
+                                                         path) == -1)
         goto endjob;
 
     /* Migrate will always stop the VM, so the resume condition is
@@ -4155,7 +4178,10 @@ static int qemudDomainCoreDump(virDomain
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSavedStateLabel &&
-        driver->securityDriver->domainRestoreSavedStateLabel(dom->conn, vm, path) == -1)
+        driver->securityDriver->domainRestoreSavedStateLabel(dom->conn,
+                                                             driver->securityDriver,
+                                                             vm,
+                                                             path) == -1)
         goto endjob;
 
 endjob:
@@ -4490,12 +4516,14 @@ static int qemudDomainGetSecurityLabel(v
      *   QEMU monitor hasn't seen SIGHUP/ERR on poll().
      */
     if (virDomainObjIsActive(vm)) {
-        if (driver->securityDriver && driver->securityDriver->domainGetSecurityProcessLabel) {
-            if (driver->securityDriver->domainGetSecurityProcessLabel(dom->conn, vm, seclabel) == -1) {
-                qemudReportError(dom->conn, dom, NULL, VIR_ERR_INTERNAL_ERROR,
-                                 "%s", _("Failed to get security label"));
-                goto cleanup;
-            }
+        if (driver->securityDriver &&
+            driver->securityDriver->domainGetSecurityProcessLabel &&
+            driver->securityDriver->domainGetSecurityProcessLabel(dom->conn,
+                                                                  driver->securityDriver,
+                                                                  vm, seclabel) < 0) {
+            qemudReportError(dom->conn, dom, NULL, VIR_ERR_INTERNAL_ERROR,
+                             "%s", _("Failed to get security label"));
+            goto cleanup;
         }
     }
 
@@ -5244,7 +5272,9 @@ static int qemudDomainChangeEjectableMed
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSecurityImageLabel &&
-        driver->securityDriver->domainSetSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainSetSecurityImageLabel(conn,
+                                                            driver->securityDriver,
+                                                            vm, disk) < 0)
         return -1;
 
     qemuDomainObjPrivatePtr priv = vm->privateData;
@@ -5270,7 +5300,10 @@ static int qemudDomainChangeEjectableMed
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityImageLabel &&
-        driver->securityDriver->domainRestoreSecurityImageLabel(conn, vm, origdisk) < 0)
+        driver->securityDriver->domainRestoreSecurityImageLabel(conn,
+                                                                driver->securityDriver,
+                                                                vm,
+                                                                origdisk) < 0)
         VIR_WARN("Unable to restore security label on ejected image %s", origdisk->src);
 
     VIR_FREE(origdisk->src);
@@ -5285,7 +5318,10 @@ static int qemudDomainChangeEjectableMed
 error:
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityImageLabel &&
-        driver->securityDriver->domainRestoreSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainRestoreSecurityImageLabel(conn,
+                                                                driver->securityDriver,
+                                                                vm,
+                                                                disk) < 0)
         VIR_WARN("Unable to restore security label on new media %s", disk->src);
     return -1;
 }
@@ -5313,7 +5349,10 @@ static int qemudDomainAttachPciDiskDevic
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSecurityImageLabel &&
-        driver->securityDriver->domainSetSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainSetSecurityImageLabel(conn,
+                                                            driver->securityDriver,
+                                                            vm,
+                                                            disk) < 0)
         return -1;
 
     if (qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE) {
@@ -5374,7 +5413,10 @@ error:
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityImageLabel &&
-        driver->securityDriver->domainRestoreSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainRestoreSecurityImageLabel(conn,
+                                                                driver->securityDriver,
+                                                                vm,
+                                                                disk) < 0)
         VIR_WARN("Unable to restore security label on %s", disk->src);
 
     return -1;
@@ -5509,7 +5551,10 @@ static int qemudDomainAttachSCSIDisk(vir
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSecurityImageLabel &&
-        driver->securityDriver->domainSetSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainSetSecurityImageLabel(conn,
+                                                            driver->securityDriver,
+                                                            vm,
+                                                            disk) < 0)
         return -1;
 
     /* We should have an address already, so make sure */
@@ -5586,7 +5631,10 @@ error:
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityImageLabel &&
-        driver->securityDriver->domainRestoreSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainRestoreSecurityImageLabel(conn,
+                                                                driver->securityDriver,
+                                                                vm,
+                                                                disk) < 0)
         VIR_WARN("Unable to restore security label on %s", disk->src);
 
     return -1;
@@ -5614,7 +5662,10 @@ static int qemudDomainAttachUsbMassstora
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSecurityImageLabel &&
-        driver->securityDriver->domainSetSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainSetSecurityImageLabel(conn,
+                                                            driver->securityDriver,
+                                                            vm,
+                                                            disk) < 0)
         return -1;
 
     if (!disk->src) {
@@ -5666,7 +5717,10 @@ error:
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityImageLabel &&
-        driver->securityDriver->domainRestoreSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityDriver->domainRestoreSecurityImageLabel(conn,
+                                                                driver->securityDriver,
+                                                                vm,
+                                                                disk) < 0)
         VIR_WARN("Unable to restore security label on %s", disk->src);
 
     return -1;
@@ -5959,7 +6013,10 @@ static int qemudDomainAttachHostDevice(v
 
     if (driver->securityDriver &&
         driver->securityDriver->domainSetSecurityHostdevLabel &&
-        driver->securityDriver->domainSetSecurityHostdevLabel(conn, vm, hostdev) < 0)
+        driver->securityDriver->domainSetSecurityHostdevLabel(conn,
+                                                              driver->securityDriver,
+                                                              vm,
+                                                              hostdev) < 0)
         return -1;
 
     switch (hostdev->source.subsys.type) {
@@ -5987,7 +6044,10 @@ static int qemudDomainAttachHostDevice(v
 error:
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityHostdevLabel &&
-        driver->securityDriver->domainRestoreSecurityHostdevLabel(conn, vm, hostdev) < 0)
+        driver->securityDriver->domainRestoreSecurityHostdevLabel(conn,
+                                                                  driver->securityDriver,
+                                                                  vm,
+                                                                  hostdev) < 0)
         VIR_WARN0("Unable to restore host device labelling on hotplug fail");
 
     return -1;
@@ -6207,7 +6267,10 @@ static int qemudDomainDetachPciDiskDevic
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityImageLabel &&
-        driver->securityDriver->domainRestoreSecurityImageLabel(conn, vm, dev->data.disk) < 0)
+        driver->securityDriver->domainRestoreSecurityImageLabel(conn,
+                                                                driver->securityDriver,
+                                                                vm,
+                                                                dev->data.disk) < 0)
         VIR_WARN("Unable to restore security label on %s", dev->data.disk->src);
 
     ret = 0;
@@ -6490,7 +6553,10 @@ static int qemudDomainDetachHostDevice(v
 
     if (driver->securityDriver &&
         driver->securityDriver->domainRestoreSecurityHostdevLabel &&
-        driver->securityDriver->domainRestoreSecurityHostdevLabel(conn, vm, dev->data.hostdev) < 0)
+        driver->securityDriver->domainRestoreSecurityHostdevLabel(conn,
+                                                                  driver->securityDriver,
+                                                                  vm,
+                                                                  dev->data.hostdev) < 0)
         VIR_WARN0("Failed to restore host device labelling");
 
     return ret;
Index: libvirt-0.7.6/src/qemu/qemu_security_dac.c
===================================================================
--- libvirt-0.7.6.orig/src/qemu/qemu_security_dac.c
+++ libvirt-0.7.6/src/qemu/qemu_security_dac.c
@@ -117,6 +117,7 @@ qemuSecurityDACSetSecurityFileLabel(virD
 
 static int
 qemuSecurityDACSetSecurityImageLabel(virConnectPtr conn,
+                                     virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                      virDomainObjPtr vm ATTRIBUTE_UNUSED,
                                      virDomainDiskDefPtr disk)
 
@@ -135,6 +136,7 @@ qemuSecurityDACSetSecurityImageLabel(vir
 
 static int
 qemuSecurityDACRestoreSecurityImageLabel(virConnectPtr conn,
+                                         virSecurityDriverPtr drv  ATTRIBUTE_UNUSED,
                                          virDomainObjPtr vm ATTRIBUTE_UNUSED,
                                          virDomainDiskDefPtr disk)
 {
@@ -181,6 +183,7 @@ qemuSecurityDACSetSecurityUSBLabel(virCo
 
 static int
 qemuSecurityDACSetSecurityHostdevLabel(virConnectPtr conn,
+                                       virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                        virDomainObjPtr vm,
                                        virDomainHostdevDefPtr dev)
 
@@ -257,6 +260,7 @@ qemuSecurityDACRestoreSecurityUSBLabel(v
 
 static int
 qemuSecurityDACRestoreSecurityHostdevLabel(virConnectPtr conn,
+                                           virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                            virDomainObjPtr vm ATTRIBUTE_UNUSED,
                                            virDomainHostdevDefPtr dev)
 
@@ -314,6 +318,7 @@ done:
 
 static int
 qemuSecurityDACRestoreSecurityAllLabel(virConnectPtr conn,
+                                       virSecurityDriverPtr drv,
                                        virDomainObjPtr vm)
 {
     int i;
@@ -325,12 +330,12 @@ qemuSecurityDACRestoreSecurityAllLabel(v
     VIR_DEBUG("Restoring security label on %s", vm->def->name);
 
     for (i = 0 ; i < vm->def->nhostdevs ; i++) {
-        if (qemuSecurityDACRestoreSecurityHostdevLabel(conn, vm,
+        if (qemuSecurityDACRestoreSecurityHostdevLabel(conn, drv, vm,
                                                        vm->def->hostdevs[i]) < 0)
             rc = -1;
     }
     for (i = 0 ; i < vm->def->ndisks ; i++) {
-        if (qemuSecurityDACRestoreSecurityImageLabel(conn, vm,
+        if (qemuSecurityDACRestoreSecurityImageLabel(conn, drv, vm,
                                                      vm->def->disks[i]) < 0)
             rc = -1;
     }
@@ -340,6 +345,7 @@ qemuSecurityDACRestoreSecurityAllLabel(v
 
 static int
 qemuSecurityDACSetSecurityAllLabel(virConnectPtr conn,
+                                   virSecurityDriverPtr drv,
                                    virDomainObjPtr vm)
 {
     int i;
@@ -351,11 +357,17 @@ qemuSecurityDACSetSecurityAllLabel(virCo
         /* XXX fixme - we need to recursively label the entriy tree :-( */
         if (vm->def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR)
             continue;
-        if (qemuSecurityDACSetSecurityImageLabel(conn, vm, vm->def->disks[i]) < 0)
+        if (qemuSecurityDACSetSecurityImageLabel(conn,
+                                                 drv,
+                                                 vm,
+                                                 vm->def->disks[i]) < 0)
             return -1;
     }
     for (i = 0 ; i < vm->def->nhostdevs ; i++) {
-        if (qemuSecurityDACSetSecurityHostdevLabel(conn, vm, vm->def->hostdevs[i]) < 0)
+        if (qemuSecurityDACSetSecurityHostdevLabel(conn,
+                                                   drv,
+                                                   vm,
+                                                   vm->def->hostdevs[i]) < 0)
             return -1;
     }
 
@@ -365,6 +377,7 @@ qemuSecurityDACSetSecurityAllLabel(virCo
 
 static int
 qemuSecurityDACSetSavedStateLabel(virConnectPtr conn,
+                                  virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                   virDomainObjPtr vm ATTRIBUTE_UNUSED,
                                   const char *savefile)
 {
@@ -377,6 +390,7 @@ qemuSecurityDACSetSavedStateLabel(virCon
 
 static int
 qemuSecurityDACRestoreSavedStateLabel(virConnectPtr conn,
+                                      virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                       virDomainObjPtr vm ATTRIBUTE_UNUSED,
                                       const char *savefile)
 {
Index: libvirt-0.7.6/src/qemu/qemu_security_stacked.c
===================================================================
--- libvirt-0.7.6.orig/src/qemu/qemu_security_stacked.c
+++ libvirt-0.7.6/src/qemu/qemu_security_stacked.c
@@ -59,18 +59,23 @@ qemuSecurityStackedVerify(virConnectPtr
 
 static int
 qemuSecurityStackedGenLabel(virConnectPtr conn,
+                            virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                             virDomainObjPtr vm)
 {
     int rc = 0;
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainGenSecurityLabel &&
-        driver->securitySecondaryDriver->domainGenSecurityLabel(conn, vm) < 0)
+        driver->securitySecondaryDriver->domainGenSecurityLabel(conn,
+                                                                driver->securitySecondaryDriver,
+                                                                vm) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainGenSecurityLabel &&
-        driver->securityPrimaryDriver->domainGenSecurityLabel(conn, vm) < 0)
+        driver->securityPrimaryDriver->domainGenSecurityLabel(conn,
+                                                              driver->securitySecondaryDriver,
+                                                              vm) < 0)
         rc = -1;
 
     return rc;
@@ -79,18 +84,23 @@ qemuSecurityStackedGenLabel(virConnectPt
 
 static int
 qemuSecurityStackedReleaseLabel(virConnectPtr conn,
+                                virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                 virDomainObjPtr vm)
 {
     int rc = 0;
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainReleaseSecurityLabel &&
-        driver->securitySecondaryDriver->domainReleaseSecurityLabel(conn, vm) < 0)
+        driver->securitySecondaryDriver->domainReleaseSecurityLabel(conn,
+                                                                    driver->securitySecondaryDriver,
+                                                                    vm) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainReleaseSecurityLabel &&
-        driver->securityPrimaryDriver->domainReleaseSecurityLabel(conn, vm) < 0)
+        driver->securityPrimaryDriver->domainReleaseSecurityLabel(conn,
+                                                                  driver->securityPrimaryDriver,
+                                                                  vm) < 0)
         rc = -1;
 
     return rc;
@@ -99,18 +109,23 @@ qemuSecurityStackedReleaseLabel(virConne
 
 static int
 qemuSecurityStackedReserveLabel(virConnectPtr conn,
+                                virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                 virDomainObjPtr vm)
 {
     int rc = 0;
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainReserveSecurityLabel &&
-        driver->securitySecondaryDriver->domainReserveSecurityLabel(conn, vm) < 0)
+        driver->securitySecondaryDriver->domainReserveSecurityLabel(conn,
+                                                                    driver->securitySecondaryDriver,
+                                                                    vm) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainReserveSecurityLabel &&
-        driver->securityPrimaryDriver->domainReserveSecurityLabel(conn, vm) < 0)
+        driver->securityPrimaryDriver->domainReserveSecurityLabel(conn,
+                                                                  driver->securityPrimaryDriver,
+                                                                  vm) < 0)
         rc = -1;
 
     return rc;
@@ -119,6 +134,7 @@ qemuSecurityStackedReserveLabel(virConne
 
 static int
 qemuSecurityStackedSetSecurityImageLabel(virConnectPtr conn,
+                                         virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                          virDomainObjPtr vm,
                                          virDomainDiskDefPtr disk)
 {
@@ -126,12 +142,18 @@ qemuSecurityStackedSetSecurityImageLabel
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainSetSecurityImageLabel &&
-        driver->securitySecondaryDriver->domainSetSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securitySecondaryDriver->domainSetSecurityImageLabel(conn,
+                                                                     driver->securitySecondaryDriver,
+                                                                     vm,
+                                                                     disk) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainSetSecurityImageLabel &&
-        driver->securityPrimaryDriver->domainSetSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityPrimaryDriver->domainSetSecurityImageLabel(conn,
+                                                                   driver->securityPrimaryDriver,
+                                                                   vm,
+                                                                   disk) < 0)
         rc = -1;
 
     return rc;
@@ -140,6 +162,7 @@ qemuSecurityStackedSetSecurityImageLabel
 
 static int
 qemuSecurityStackedRestoreSecurityImageLabel(virConnectPtr conn,
+                                             virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                              virDomainObjPtr vm,
                                              virDomainDiskDefPtr disk)
 {
@@ -147,12 +170,18 @@ qemuSecurityStackedRestoreSecurityImageL
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainRestoreSecurityImageLabel &&
-        driver->securitySecondaryDriver->domainRestoreSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securitySecondaryDriver->domainRestoreSecurityImageLabel(conn,
+                                                                         driver->securitySecondaryDriver,
+                                                                         vm,
+                                                                         disk) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainRestoreSecurityImageLabel &&
-        driver->securityPrimaryDriver->domainRestoreSecurityImageLabel(conn, vm, disk) < 0)
+        driver->securityPrimaryDriver->domainRestoreSecurityImageLabel(conn,
+                                                                       driver->securityPrimaryDriver,
+                                                                       vm,
+                                                                       disk) < 0)
         rc = -1;
 
     return rc;
@@ -161,6 +190,7 @@ qemuSecurityStackedRestoreSecurityImageL
 
 static int
 qemuSecurityStackedSetSecurityHostdevLabel(virConnectPtr conn,
+                                           virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                            virDomainObjPtr vm,
                                            virDomainHostdevDefPtr dev)
 
@@ -169,12 +199,18 @@ qemuSecurityStackedSetSecurityHostdevLab
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainSetSecurityHostdevLabel &&
-        driver->securitySecondaryDriver->domainSetSecurityHostdevLabel(conn, vm, dev) < 0)
+        driver->securitySecondaryDriver->domainSetSecurityHostdevLabel(conn,
+                                                                       driver->securitySecondaryDriver,
+                                                                       vm,
+                                                                       dev) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainSetSecurityHostdevLabel &&
-        driver->securityPrimaryDriver->domainSetSecurityHostdevLabel(conn, vm, dev) < 0)
+        driver->securityPrimaryDriver->domainSetSecurityHostdevLabel(conn,
+                                                                     driver->securityPrimaryDriver,
+                                                                     vm,
+                                                                     dev) < 0)
         rc = -1;
 
     return rc;
@@ -183,6 +219,7 @@ qemuSecurityStackedSetSecurityHostdevLab
 
 static int
 qemuSecurityStackedRestoreSecurityHostdevLabel(virConnectPtr conn,
+                                               virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                                virDomainObjPtr vm,
                                                virDomainHostdevDefPtr dev)
 
@@ -191,12 +228,18 @@ qemuSecurityStackedRestoreSecurityHostde
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel &&
-        driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel(conn, vm, dev) < 0)
+        driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel(conn,
+                                                                           driver->securitySecondaryDriver,
+                                                                           vm,
+                                                                           dev) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel &&
-        driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel(conn, vm, dev) < 0)
+        driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel(conn,
+                                                                         driver->securityPrimaryDriver,
+                                                                         vm,
+                                                                         dev) < 0)
         rc = -1;
 
     return rc;
@@ -205,18 +248,23 @@ qemuSecurityStackedRestoreSecurityHostde
 
 static int
 qemuSecurityStackedSetSecurityAllLabel(virConnectPtr conn,
+                                       virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                        virDomainObjPtr vm)
 {
     int rc = 0;
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainSetSecurityAllLabel &&
-        driver->securitySecondaryDriver->domainSetSecurityAllLabel(conn, vm) < 0)
+        driver->securitySecondaryDriver->domainSetSecurityAllLabel(conn,
+                                                                   driver->securitySecondaryDriver,
+                                                                   vm) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainSetSecurityAllLabel &&
-        driver->securityPrimaryDriver->domainSetSecurityAllLabel(conn, vm) < 0)
+        driver->securityPrimaryDriver->domainSetSecurityAllLabel(conn,
+                                                                 driver->securityPrimaryDriver,
+                                                                 vm) < 0)
         rc = -1;
 
     return rc;
@@ -225,18 +273,23 @@ qemuSecurityStackedSetSecurityAllLabel(v
 
 static int
 qemuSecurityStackedRestoreSecurityAllLabel(virConnectPtr conn,
+                                           virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                            virDomainObjPtr vm)
 {
     int rc = 0;
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainRestoreSecurityAllLabel &&
-        driver->securitySecondaryDriver->domainRestoreSecurityAllLabel(conn, vm) < 0)
+        driver->securitySecondaryDriver->domainRestoreSecurityAllLabel(conn,
+                                                                       driver->securitySecondaryDriver,
+                                                                       vm) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainRestoreSecurityAllLabel &&
-        driver->securityPrimaryDriver->domainRestoreSecurityAllLabel(conn, vm) < 0)
+        driver->securityPrimaryDriver->domainRestoreSecurityAllLabel(conn,
+                                                                     driver->securityPrimaryDriver,
+                                                                     vm) < 0)
         rc = -1;
 
     return rc;
@@ -245,6 +298,7 @@ qemuSecurityStackedRestoreSecurityAllLab
 
 static int
 qemuSecurityStackedSetSavedStateLabel(virConnectPtr conn,
+                                      virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                       virDomainObjPtr vm,
                                       const char *savefile)
 {
@@ -252,12 +306,18 @@ qemuSecurityStackedSetSavedStateLabel(vi
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainSetSavedStateLabel &&
-        driver->securitySecondaryDriver->domainSetSavedStateLabel(conn, vm, savefile) < 0)
+        driver->securitySecondaryDriver->domainSetSavedStateLabel(conn,
+                                                                  driver->securitySecondaryDriver,
+                                                                  vm,
+                                                                  savefile) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainSetSavedStateLabel &&
-        driver->securityPrimaryDriver->domainSetSavedStateLabel(conn, vm, savefile) < 0)
+        driver->securityPrimaryDriver->domainSetSavedStateLabel(conn,
+                                                                driver->securityPrimaryDriver,
+                                                                vm,
+                                                                savefile) < 0)
         rc = -1;
 
     return rc;
@@ -266,6 +326,7 @@ qemuSecurityStackedSetSavedStateLabel(vi
 
 static int
 qemuSecurityStackedRestoreSavedStateLabel(virConnectPtr conn,
+                                          virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                           virDomainObjPtr vm,
                                           const char *savefile)
 {
@@ -273,12 +334,18 @@ qemuSecurityStackedRestoreSavedStateLabe
 
     if (driver->securitySecondaryDriver &&
         driver->securitySecondaryDriver->domainRestoreSavedStateLabel &&
-        driver->securitySecondaryDriver->domainRestoreSavedStateLabel(conn, vm, savefile) < 0)
+        driver->securitySecondaryDriver->domainRestoreSavedStateLabel(conn,
+                                                                      driver->securitySecondaryDriver,
+                                                                      vm,
+                                                                      savefile) < 0)
         rc = -1;
 
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainRestoreSavedStateLabel &&
-        driver->securityPrimaryDriver->domainRestoreSavedStateLabel(conn, vm, savefile) < 0)
+        driver->securityPrimaryDriver->domainRestoreSavedStateLabel(conn,
+                                                                    driver->securityPrimaryDriver,
+                                                                    vm,
+                                                                    savefile) < 0)
         rc = -1;
 
     return rc;
@@ -311,6 +378,7 @@ qemuSecurityStackedSetProcessLabel(virCo
 
 static int
 qemuSecurityStackedGetProcessLabel(virConnectPtr conn,
+                                   virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                    virDomainObjPtr vm,
                                    virSecurityLabelPtr seclabel)
 {
@@ -319,6 +387,7 @@ qemuSecurityStackedGetProcessLabel(virCo
     if (driver->securityPrimaryDriver &&
         driver->securityPrimaryDriver->domainGetSecurityProcessLabel &&
         driver->securityPrimaryDriver->domainGetSecurityProcessLabel(conn,
+                                                                     driver->securityPrimaryDriver,
                                                                      vm,
                                                                      seclabel) < 0)
         rc = -1;
Index: libvirt-0.7.6/src/security/security_apparmor.c
===================================================================
--- libvirt-0.7.6.orig/src/security/security_apparmor.c
+++ libvirt-0.7.6/src/security/security_apparmor.c
@@ -148,7 +148,10 @@ profile_status_file(const char *str)
  * load (add) a profile. Will create one if necessary
  */
 static int
-load_profile(virConnectPtr conn, const char *profile, virDomainObjPtr vm,
+load_profile(virConnectPtr conn,
+             virSecurityDriverPtr drv,
+             const char *profile,
+             virDomainObjPtr vm,
              virDomainDiskDefPtr disk)
 {
     int rc = -1, status, ret;
@@ -323,7 +326,9 @@ AppArmorSecurityDriverOpen(virConnectPtr
  * called on shutdown.
 */
 static int
-AppArmorGenSecurityLabel(virConnectPtr conn, virDomainObjPtr vm)
+AppArmorGenSecurityLabel(virConnectPtr conn,
+                         virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
+                         virDomainObjPtr vm)
 {
     int rc = -1;
     char *profile_name = NULL;
@@ -377,14 +382,16 @@ AppArmorGenSecurityLabel(virConnectPtr c
 }
 
 static int
-AppArmorSetSecurityAllLabel(virConnectPtr conn, virDomainObjPtr vm)
+AppArmorSetSecurityAllLabel(virConnectPtr conn,
+                            virSecurityDriverPtr drv,
+                            virDomainObjPtr vm)
 {
     if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC)
         return 0;
 
     /* if the profile is not already loaded, then load one */
     if (profile_loaded(vm->def->seclabel.label) < 0) {
-        if (load_profile(conn, vm->def->seclabel.label, vm, NULL) < 0) {
+        if (load_profile(conn, drv, vm->def->seclabel.label, vm, NULL) < 0) {
             virSecurityReportError(conn, VIR_ERR_INTERNAL_ERROR,
                                    _("cannot generate AppArmor profile "
                                    "\'%s\'"), vm->def->seclabel.label);
@@ -400,7 +407,9 @@ AppArmorSetSecurityAllLabel(virConnectPt
  */
 static int
 AppArmorGetSecurityProcessLabel(virConnectPtr conn,
-                                virDomainObjPtr vm, virSecurityLabelPtr sec)
+                                virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
+                                virDomainObjPtr vm,
+                                virSecurityLabelPtr sec)
 {
     int rc = -1;
     char *profile_name = NULL;
@@ -432,7 +441,9 @@ AppArmorGetSecurityProcessLabel(virConne
  * more details. Currently called via qemudShutdownVMDaemon.
  */
 static int
-AppArmorReleaseSecurityLabel(virConnectPtr conn ATTRIBUTE_UNUSED, virDomainObjPtr vm)
+AppArmorReleaseSecurityLabel(virConnectPtr conn ATTRIBUTE_UNUSED,
+                             virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
+                             virDomainObjPtr vm)
 {
     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
 
@@ -445,7 +456,9 @@ AppArmorReleaseSecurityLabel(virConnectP
 
 
 static int
-AppArmorRestoreSecurityAllLabel(virConnectPtr conn, virDomainObjPtr vm)
+AppArmorRestoreSecurityAllLabel(virConnectPtr conn,
+                                virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
+                                virDomainObjPtr vm)
 {
     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
     int rc = 0;
@@ -501,6 +514,7 @@ AppArmorSetSecurityProcessLabel(virConne
 /* Called when hotplugging */
 static int
 AppArmorRestoreSecurityImageLabel(virConnectPtr conn,
+                                  virSecurityDriverPtr drv,
                                   virDomainObjPtr vm,
                                   virDomainDiskDefPtr disk ATTRIBUTE_UNUSED)
 {
@@ -516,7 +530,7 @@ AppArmorRestoreSecurityImageLabel(virCon
 
     /* Update the profile only if it is loaded */
     if (profile_loaded(secdef->imagelabel) >= 0) {
-        if (load_profile(conn, secdef->imagelabel, vm, NULL) < 0) {
+        if (load_profile(conn, drv, secdef->imagelabel, vm, NULL) < 0) {
             virSecurityReportError(conn, VIR_ERR_INTERNAL_ERROR,
                                    _("cannot update AppArmor profile "
                                      "\'%s\'"),
@@ -535,7 +549,9 @@ AppArmorRestoreSecurityImageLabel(virCon
 /* Called when hotplugging */
 static int
 AppArmorSetSecurityImageLabel(virConnectPtr conn,
-                              virDomainObjPtr vm, virDomainDiskDefPtr disk)
+                              virSecurityDriverPtr drv,
+                              virDomainObjPtr vm,
+                              virDomainDiskDefPtr disk)
 {
     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
     int rc = -1;
@@ -560,7 +576,7 @@ AppArmorSetSecurityImageLabel(virConnect
 
         /* update the profile only if it is loaded */
         if (profile_loaded(secdef->imagelabel) >= 0) {
-            if (load_profile(conn, secdef->imagelabel, vm, disk) < 0) {
+            if (load_profile(conn, drv, secdef->imagelabel, vm, disk) < 0) {
                 virSecurityReportError(conn, VIR_ERR_INTERNAL_ERROR,
                                      _("cannot update AppArmor profile "
                                      "\'%s\'"),
@@ -595,7 +611,8 @@ AppArmorSecurityVerify(virConnectPtr con
 
 static int
 AppArmorReserveSecurityLabel(virConnectPtr conn ATTRIBUTE_UNUSED,
-                            virDomainObjPtr vm ATTRIBUTE_UNUSED)
+                             virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
+                             virDomainObjPtr vm ATTRIBUTE_UNUSED)
 {
     /* NOOP. Nothing to reserve with AppArmor */
     return 0;
@@ -603,6 +620,7 @@ AppArmorReserveSecurityLabel(virConnectP
 
 static int
 AppArmorSetSecurityHostdevLabel(virConnectPtr conn ATTRIBUTE_UNUSED,
+                                virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                 virDomainObjPtr vm,
                                 virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED)
 
@@ -618,6 +636,7 @@ AppArmorSetSecurityHostdevLabel(virConne
 
 static int
 AppArmorRestoreSecurityHostdevLabel(virConnectPtr conn ATTRIBUTE_UNUSED,
+                                    virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                     virDomainObjPtr vm,
                                     virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED)
 
Index: libvirt-0.7.6/src/security/security_driver.h
===================================================================
--- libvirt-0.7.6.orig/src/security/security_driver.h
+++ libvirt-0.7.6/src/security/security_driver.h
@@ -32,34 +32,46 @@ typedef virSecurityDriverStatus (*virSec
 typedef int (*virSecurityDriverOpen) (virConnectPtr conn,
                                       virSecurityDriverPtr drv);
 typedef int (*virSecurityDomainRestoreImageLabel) (virConnectPtr conn,
+                                                   virSecurityDriverPtr drv,
                                                    virDomainObjPtr vm,
                                                    virDomainDiskDefPtr disk);
 typedef int (*virSecurityDomainSetImageLabel) (virConnectPtr conn,
+                                               virSecurityDriverPtr drv,
                                                virDomainObjPtr vm,
                                                virDomainDiskDefPtr disk);
 typedef int (*virSecurityDomainRestoreHostdevLabel) (virConnectPtr conn,
+                                                     virSecurityDriverPtr drv,
                                                      virDomainObjPtr vm,
                                                      virDomainHostdevDefPtr dev);
 typedef int (*virSecurityDomainSetHostdevLabel) (virConnectPtr conn,
+                                                 virSecurityDriverPtr drv,
                                                  virDomainObjPtr vm,
                                                  virDomainHostdevDefPtr dev);
 typedef int (*virSecurityDomainSetSavedStateLabel) (virConnectPtr conn,
+                                                    virSecurityDriverPtr drv,
                                                     virDomainObjPtr vm,
                                                     const char *savefile);
 typedef int (*virSecurityDomainRestoreSavedStateLabel) (virConnectPtr conn,
+                                                        virSecurityDriverPtr drv,
                                                         virDomainObjPtr vm,
                                                         const char *savefile);
 typedef int (*virSecurityDomainGenLabel) (virConnectPtr conn,
+                                          virSecurityDriverPtr drv,
                                           virDomainObjPtr sec);
 typedef int (*virSecurityDomainReserveLabel) (virConnectPtr conn,
+                                              virSecurityDriverPtr drv,
                                               virDomainObjPtr sec);
 typedef int (*virSecurityDomainReleaseLabel) (virConnectPtr conn,
+                                              virSecurityDriverPtr drv,
                                               virDomainObjPtr sec);
 typedef int (*virSecurityDomainSetAllLabel) (virConnectPtr conn,
+                                             virSecurityDriverPtr drv,
                                              virDomainObjPtr sec);
 typedef int (*virSecurityDomainRestoreAllLabel) (virConnectPtr conn,
+                                                 virSecurityDriverPtr drv,
                                                  virDomainObjPtr vm);
 typedef int (*virSecurityDomainGetProcessLabel) (virConnectPtr conn,
+                                                 virSecurityDriverPtr drv,
                                                  virDomainObjPtr vm,
                                                  virSecurityLabelPtr sec);
 typedef int (*virSecurityDomainSetProcessLabel) (virConnectPtr conn,
Index: libvirt-0.7.6/src/security/security_selinux.c
===================================================================
--- libvirt-0.7.6.orig/src/security/security_selinux.c
+++ libvirt-0.7.6/src/security/security_selinux.c
@@ -157,6 +157,7 @@ SELinuxInitialize(virConnectPtr conn)
 
 static int
 SELinuxGenSecurityLabel(virConnectPtr conn,
+                        virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                         virDomainObjPtr vm)
 {
     int rc = -1;
@@ -222,6 +223,7 @@ done:
 
 static int
 SELinuxReserveSecurityLabel(virConnectPtr conn,
+                            virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                             virDomainObjPtr vm)
 {
     security_context_t pctx;
@@ -278,6 +280,7 @@ SELinuxSecurityDriverOpen(virConnectPtr
 
 static int
 SELinuxGetSecurityProcessLabel(virConnectPtr conn,
+                               virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                virDomainObjPtr vm,
                                virSecurityLabelPtr sec)
 {
@@ -382,6 +385,7 @@ err:
 
 static int
 SELinuxRestoreSecurityImageLabel(virConnectPtr conn,
+                                 virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                  virDomainObjPtr vm,
                                  virDomainDiskDefPtr disk)
 {
@@ -432,6 +436,7 @@ SELinuxSetSecurityFileLabel(virDomainDis
 
 static int
 SELinuxSetSecurityImageLabel(virConnectPtr conn,
+                             virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                              virDomainObjPtr vm,
                              virDomainDiskDefPtr disk)
 
@@ -474,6 +479,7 @@ SELinuxSetSecurityUSBLabel(virConnectPtr
 
 static int
 SELinuxSetSecurityHostdevLabel(virConnectPtr conn,
+                               virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                virDomainObjPtr vm,
                                virDomainHostdevDefPtr dev)
 
@@ -549,6 +555,7 @@ SELinuxRestoreSecurityUSBLabel(virConnec
 
 static int
 SELinuxRestoreSecurityHostdevLabel(virConnectPtr conn,
+                                   virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                                    virDomainObjPtr vm,
                                    virDomainHostdevDefPtr dev)
 
@@ -606,6 +613,7 @@ done:
 
 static int
 SELinuxRestoreSecurityAllLabel(virConnectPtr conn,
+                               virSecurityDriverPtr drv,
                                virDomainObjPtr vm)
 {
     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
@@ -618,11 +626,12 @@ SELinuxRestoreSecurityAllLabel(virConnec
         return 0;
 
     for (i = 0 ; i < vm->def->nhostdevs ; i++) {
-        if (SELinuxRestoreSecurityHostdevLabel(conn, vm, vm->def->hostdevs[i]) < 0)
+        if (SELinuxRestoreSecurityHostdevLabel(conn, drv, vm,
+                                               vm->def->hostdevs[i]) < 0)
             rc = -1;
     }
     for (i = 0 ; i < vm->def->ndisks ; i++) {
-        if (SELinuxRestoreSecurityImageLabel(conn, vm,
+        if (SELinuxRestoreSecurityImageLabel(conn, drv, vm,
                                              vm->def->disks[i]) < 0)
             rc = -1;
     }
@@ -632,6 +641,7 @@ SELinuxRestoreSecurityAllLabel(virConnec
 
 static int
 SELinuxReleaseSecurityLabel(virConnectPtr conn ATTRIBUTE_UNUSED,
+                            virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                             virDomainObjPtr vm)
 {
     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
@@ -655,6 +665,7 @@ SELinuxReleaseSecurityLabel(virConnectPt
 
 static int
 SELinuxSetSavedStateLabel(virConnectPtr conn,
+                          virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                           virDomainObjPtr vm,
                           const char *savefile)
 {
@@ -669,6 +680,7 @@ SELinuxSetSavedStateLabel(virConnectPtr
 
 static int
 SELinuxRestoreSavedStateLabel(virConnectPtr conn,
+                              virSecurityDriverPtr drv ATTRIBUTE_UNUSED,
                               virDomainObjPtr vm,
                               const char *savefile)
 {
@@ -729,6 +741,7 @@ SELinuxSetSecurityProcessLabel(virConnec
 
 static int
 SELinuxSetSecurityAllLabel(virConnectPtr conn,
+                           virSecurityDriverPtr drv,
                            virDomainObjPtr vm)
 {
     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
@@ -744,11 +757,13 @@ SELinuxSetSecurityAllLabel(virConnectPtr
                      vm->def->disks[i]->src, vm->def->disks[i]->dst);
             continue;
         }
-        if (SELinuxSetSecurityImageLabel(conn, vm, vm->def->disks[i]) < 0)
+        if (SELinuxSetSecurityImageLabel(conn, drv,
+                                         vm, vm->def->disks[i]) < 0)
             return -1;
     }
     for (i = 0 ; i < vm->def->nhostdevs ; i++) {
-        if (SELinuxSetSecurityHostdevLabel(conn, vm, vm->def->hostdevs[i]) < 0)
+        if (SELinuxSetSecurityHostdevLabel(conn, drv,
+                                           vm, vm->def->hostdevs[i]) < 0)
             return -1;
     }
 
