diff --git a/tools/python/xen/util/security.py b/tools/python/xen/util/security.py
index e617ddf894..91c0badd74 100644
--- a/tools/python/xen/util/security.py
+++ b/tools/python/xen/util/security.py
@@ -601,8 +601,15 @@ def unify_resname(resource):
     """Makes all resource locations absolute. In case of physical
     resources, '/dev/' is added to local file names"""
 
+    if not resource:
+        return resource
+
     # sanity check on resource name
-    (type, resfile) = resource.split(":")
+    try:
+        (type, resfile) = resource.split(":")
+    except:
+        err("Resource spec '%s' contains no ':' delimiter" % resource)
+
     if type == "phy":
         if not resfile.startswith("/"):
             resfile = "/dev/" + resfile
diff --git a/tools/python/xen/xm/create.py b/tools/python/xen/xm/create.py
index 4b5cd3db7c..48486d8bfc 100644
--- a/tools/python/xen/xm/create.py
+++ b/tools/python/xen/xm/create.py
@@ -1143,6 +1143,8 @@ def config_security_check(config, verbose):
         except security.ACMError:
             print "   %s: DENIED" % (resource)
             (res_label, res_policy) = security.get_res_label(resource)
+            if not res_label:
+                res_label = ""
             print "   --> res:"+res_label+" ("+res_policy+")"
             print "   --> dom:"+domain_label+" ("+domain_policy+")"
             answer = 0
@@ -1181,7 +1183,7 @@ def main(argv):
         PrettyPrint.prettyprint(config)
     else:
         if not create_security_check(config):
-            raise OptionError('Security Configuration prevents domain from starting')
+            raise security.ACMError('Security Configuration prevents domain from starting')
         else:
             dom = make_domain(opts, config)
             if opts.vals.console_autoconnect: