- Announce - libvirt List Archives

[Libvirt-announce] Release of libvirt-5.5.0
by Daniel Veillard 02 Jul '19

02 Jul '19

It's there, only one day late :-) tagged in git as with signed tarball and source rpms uploaded to the usual place: https://libvirt.org/sources/ I also released the python bindings that you can find at: https://libvirt.org/sources/python/ This is a rich release with security fixes, new APIs, some deprecated features and as usual improvements and bug fixes ! Security: - api: Prevent access to several APIs over read-only connections Certain APIs give root-equivalent access to the host, and as such should be limited to privileged users. CVE-2019-10161, CVE-2019-10166, CVE-2019-10167, CVE-2019-10168. New features: - qemu: Support SMMUv3 IOMMU SMMUv3 is an IOMMU implementation for ARM virt guests. - network: Introduce the network port API This new public API can be used by virtualization drivers to manage network resources associated with guests, and is a further step towards splitting libvirtd into multiple daemons. Removed features: - qemu: Remove support for virDomainQemuAttach and virConnectDomainXMLFromNative APIs The qemu implementations for the APIs mentioned above were removed and the APIs now return an error. The implementation was stale for a long time and did not work with modern QEMU command lines, generated from libvirt or otherwise. - Stop supporting migration of config files from pre-XDG layout The new layout was introduced with libvirt 0.9.13 (Jul 2012). - Remove Avahi mDNS support This feature was never used outside of virt-manager, which has itself stopped using it a while ago. Improvements: - sysinfo: Report SMBIOS information on aarch64 While SMBIOS support has historically been limited to x86_64, modern aarch64 machines often offer access to the same information as well, and libvirt now exposes it to the user when that's the case. - test driver: Expand API coverage Even more APIs that were missing from the test driver have now been implemented. - virt-xml-validate: Allow input to be read from stdin - qemu: Validate spapr-vio addresses as 32-bit libvirt has always considered these addresses (used for pSeries guests) as 64-bit, but the sPAPR specification says that they're 32-bit instead. Bug fixes: - qemu: Set process affinity correctly when using <numatune> libvirt would mistakenly interpret the nodeset attribute as a list of CPUs instead of as a list of NUMA node, and the process affinity would be set incorrectly as a result; this has now been fixed. Thanks everybody for your help with this release, be that with bugs, fixes, reviews, documentation, localisation, etc ... Enjoy the release, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[Libvirt-announce] Entering freeze for libvirt-5.5.0
by Daniel Veillard 30 Jun '19

30 Jun '19

As planned I tagged RC1 in git and pushed signed tarball and source rpm to the usual place: https://libvirt.org/sources/ I'm on the road with even less testing capacity than usual, but https://ci.centos.org/view/libvirt/ looks rather green except for some go bindings so I assume we are in pretty good shape, i.e. it will hopefully compile and run for most of you :-) I hope to be back on Fraiday and make an evening release again, then if all goes fine we can push on Mon or Tuesday, please give it some testing, thanks, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 1

[Libvirt-announce] LSN-2019-0007: virConnect*HypervisorCPU do not check for read-only connection
by Ján Tomko 24 Jun '19

24 Jun '19

Libvirt Security Notice: LSN-2019-0007 ====================================== Summary: virConnect*HypervisorCPU do not check for read-only connection Reported on: 20190604 Published on: 20190620 Fixed on: 20190620 Reported by: Ján Tomko <jtomko(a)redhat.com> Patched by: Ján Tomko <jtomko(a)redhat.com> See also: CVE-2019-10168 Description ----------- The virConnect*HypervisorCPU APIs allow reporting CPU capabilities from arbitrary emulator binaries without checking for a read-only connection. This allows unprivileged users to execute arbitrary binaries with elevated privileges. Impact ------ The default libvirt configuration allows all local user accounts read-only access to the libvirtd daemon. Any local user can provide an arbitrary emulator, executing arbitrary binaries as the configured QEMU user. Since v5.1.0, the emulator binary is run with CAP_DAC_OVERRIDE, essentially having root privileges. Workaround ---------- Edit the /etc/libvirt/libvirtd.conf configuration file, to set the 'unix_sock_ro_perms = "0700"' to prevent local users from connecting to libvirt. Alternatively setup a policy kit rule to prevent them access without first authenticating as root. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v4.4.0 Broken in: v4.5.0 Broken in: v4.6.0 Broken in: v4.7.0 Broken in: v4.8.0 Broken in: v4.9.0 Broken in: v4.10.0 Broken in: v5.0.0 Broken in: v5.1.0 Broken in: v5.2.0 Broken in: v5.3.0 Broken in: v5.4.0 Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: bf6c2830b6c338b1f5699b095df36f374777b291 Branch: v4.4-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: a6116fc8618300f6e2a082396812363310d1420f Branch: v4.5-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: 415cc5c0644304fd1e1bb721a092cf65e07be79f Branch: v4.6-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: 890965e8943a8837b41c3c6f366135ccfef48fb3 Branch: v4.7-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: f5ace9c05d59b70d4899199a187cb32ec6f600d8 Branch: v4.8-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: fc30929ffdf339d920b2e2183faf4373920bff6f Branch: v4.9-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: dd88b69a207c1ed6e89d7e9fa6b5f4a9ec4db97c Branch: v4.10-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: 09c2635d0deec198de0f250abc2958f2d1c09eaa Branch: v5.0-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: 1ef98539a655109480628c91feac48c3c69675ef Branch: v5.1-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: 2a3f95a40725f743b5189868bcc1a78d922517f6 Branch: v5.1.0-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Branch: v5.2-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: 45ae5e529d4e886f47dacca9dfe5a08d95a3425a Branch: v5.3-maint Broken by: 24a41aa6435045df2cf711d34cf399c2d74e4bf2 Broken by: 7d0a1efcd6087096671f3769ec2b850292465e9a Fixed by: d8e4d13446a0b04b757bd28c242a4cfecaaa8f1e

1 0

[Libvirt-announce] LSN-2019-0006: virConnectGetDomainCapabilities does not check for read-only connection
by Ján Tomko 24 Jun '19

24 Jun '19

Libvirt Security Notice: LSN-2019-0006 ====================================== Summary: virConnectGetDomainCapabilities does not check for read-only connection Reported on: 20190604 Published on: 20190620 Fixed on: 20190620 Reported by: Ján Tomko <jtomko(a)redhat.com> Patched by: Ján Tomko <jtomko(a)redhat.com> See also: CVE-2019-10167 Description ----------- The virConnectGetDomainCapabilities API reports the domain capabilities XML without checking for a read-only connection. This allows unprivileged users to execute arbitrary binaries with elevated privileges. Impact ------ The default libvirt configuration allows all local user accounts read-only access to the libvirtd daemon. Any local user can provide an arbitrary emulator, executing arbitrary binaries as the configured QEMU user. Since v5.1.0, the emulator binary is run with CAP_DAC_OVERRIDE, essentially having root privileges. Workaround ---------- Edit the /etc/libvirt/libvirtd.conf configuration file, to set the 'unix_sock_ro_perms = "0700"' to prevent local users from connecting to libvirt. Alternatively setup a policy kit rule to prevent them access without first authenticating as root. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v1.2.19 Broken in: v1.2.20 Broken in: v1.2.21 Broken in: v1.3.0 Broken in: v1.3.1 Broken in: v1.3.2 Broken in: v1.3.3 Broken in: v1.3.4 Broken in: v1.3.5 Broken in: v2.0.0 Broken in: v2.1.0 Broken in: v2.2.0 Broken in: v2.3.0 Broken in: v2.4.0 Broken in: v2.5.0 Broken in: v3.0.0 Broken in: v3.1.0 Broken in: v3.2.0 Broken in: v3.3.0 Broken in: v3.4.0 Broken in: v3.5.0 Broken in: v3.6.0 Broken in: v3.7.0 Broken in: v3.8.0 Broken in: v3.9.0 Broken in: v3.10.0 Broken in: v4.0.0 Broken in: v4.1.0 Broken in: v4.2.0 Broken in: v4.3.0 Broken in: v4.4.0 Broken in: v4.5.0 Broken in: v4.6.0 Broken in: v4.7.0 Broken in: v4.8.0 Broken in: v4.9.0 Broken in: v4.10.0 Broken in: v5.0.0 Broken in: v5.1.0 Broken in: v5.2.0 Broken in: v5.3.0 Broken in: v5.4.0 Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 8afa68bac0cf99d1f8aaa6566685c43c22622f26 Branch: v1.2.19-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 7d3b95b03880c8ade5f908dcb3d3c8b2d8e82a8f Branch: v1.2.20-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: c5cc88c32320d46f27521aac69027baa3d426ff2 Branch: v1.2.21-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: badcb3662a5b28d3ed01c8ceff496e6197d12e3c Branch: v1.3.0-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 6ba6bb236a7e293007eb21013d69f42dd1fb21c8 Branch: v1.3.1-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: be5d96d547ec54bc35e5eab6472ec900184ae837 Branch: v1.3.2-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: e433008df4867b43085961a0f8181ac9401e707b Branch: v1.3.3-maint Broken in: v1.3.3.1 Broken in: v1.3.3.2 Broken in: v1.3.3.3 Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: a663e28410aa853675b8b090a1ffafa7c8711ead Branch: v1.3.4-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: ab728b5658b307bcde90cf9e9d2e9c2cfb3e9de0 Branch: v1.3.5-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 5632ca00ef8b75ce600ebb7255d392339c07b967 Branch: v2.0-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 1e51b78a92fa2b381a5741599f4909c2516c0481 Branch: v2.1-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: e322b6f73dc2fb5eaab14406cc786361d17ffdc3 Branch: v2.2-maint Broken in: v2.2.1 Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: c97b296cf8b336ed1a3260af8c8bd79746cb2971 Branch: v3.0-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: bfea7de821a224782253061309e5005486b1b2f6 Branch: v3.2-maint Broken in: v3.2.1 Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 452fa3ae558bc842a88753fcdf0d1141a2fd212c Branch: v3.7-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: d47a396e995180fd54a0f84cf137f024159b7967 Branch: v4.1-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 585be8edbef5ce4ef30e6c20386358ca1ba8e344 Branch: v4.2-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 4ce590b007d80b41abd00aba95f73c04e71ff53b Branch: v4.3-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: f9b65fa812f6f121b7c5f5daa642f05310b4123c Branch: v4.4-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 15502d85dd21d7badeb230285898fa28f67cba9d Branch: v4.5-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: fd16bd525afeac6870ab3b747d9ee16002e2f1b2 Branch: v4.6-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 93edb0ea630556569320de83d45b100718f1391f Branch: v4.7-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 5441f05a42a90779b0df86518286bf527e94aafb Branch: v4.8-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 38a16f786794887cb2fd8e82d4b52e07a77d9f50 Branch: v4.9-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 6452b9fdff7988024a6157ca0a973ac3abf54468 Branch: v4.10-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: d238f132e6e0432a42d3cdff4571730dae3a85eb Branch: v5.0-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 58f237d696310f3ac62e98b3b5e9cb98e13064e9 Branch: v5.1-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: c5085b7a9031f899c7bef0d2630aa77c461b92a6 Branch: v5.1.0-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Branch: v5.2-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 4f50f36c0004af0faf0f535b46e2a1841c2443d8 Branch: v5.3-maint Broken by: e8d55172544c1fafe31a9e09346bdebca4f0d6f9 Fixed by: 97a737c58ff6080bd0e149830b860ef32b3d2acb

1 0

[Libvirt-announce] LSN-2019-0005: virDomainManagedSaveDefineXML does not check for read-only connection
by Ján Tomko 24 Jun '19

24 Jun '19

Libvirt Security Notice: LSN-2019-0005 ====================================== Summary: virDomainManagedSaveDefineXML does not check for read-only connection Reported on: 20190604 Published on: 20190620 Fixed on: 20190620 Reported by: Matthias Gerstner <mgerstner(a)suse.de> Patched by: Ján Tomko <jtomko(a)redhat.com> See also: CVE-2019-10166 Description ----------- The virDomainManagedSaveDefineXML API redefines the manage-saved domain XML without checking for a read-only connection. This allows unprivileged users to check for existence of arbitrary files or executing arbitrary binaries with elevated privileges. Impact ------ The default libvirt configuration allows all local user accounts read-only access to the libvirtd daemon. Any local user can provide an arbitrary emulator, executing arbitrary binaries as the configured QEMU user. Since v5.1.0, the emulator binary is run with CAP_DAC_OVERRIDE, essentially having root privileges. Workaround ---------- Edit the /etc/libvirt/libvirtd.conf configuration file, to set the 'unix_sock_ro_perms = "0700"' to prevent local users from connecting to libvirt. Alternatively setup a policy kit rule to prevent them access without first authenticating as root. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v3.7.0 Broken in: v3.8.0 Broken in: v3.9.0 Broken in: v3.10.0 Broken in: v4.0.0 Broken in: v4.1.0 Broken in: v4.2.0 Broken in: v4.3.0 Broken in: v4.4.0 Broken in: v4.5.0 Broken in: v4.6.0 Broken in: v4.7.0 Broken in: v4.8.0 Broken in: v4.9.0 Broken in: v4.10.0 Broken in: v5.0.0 Broken in: v5.1.0 Broken in: v5.2.0 Broken in: v5.3.0 Broken in: v5.4.0 Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: db0b78457f183e4c7ac45bc94de86044a1e2056a Branch: v3.7-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: e7d9c8899fc7751201b46b6cf6bff4eadb38af2f Branch: v4.1-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: d9a1f3debad411756f53ab8ab81e44ab0bb50e0a Branch: v4.2-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 1813138f6b00058285e325191d50c41ace39e5b3 Branch: v4.3-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 9816854ac4e5ccd87cf82320b4550671e75f6509 Branch: v4.4-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: e777cce08e069e29deedec540d463ed70c29e92c Branch: v4.5-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: d025c10d54975fe98927be85f33146e780c28d52 Branch: v4.6-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 00e673c93fc3d0cfed274cc7a1ec2c52260c8262 Branch: v4.7-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 6da721ea37bf3624ff9922637cfa657d2dcb20f9 Branch: v4.8-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 6dc29a174ae204b1ae13fed0f533818ad6d24b9f Branch: v4.9-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 0a744e15517d727c7f473fabe32ca6b0dbb7b7d1 Branch: v4.10-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 3f744efec31959f7643849f6a3708198bcdfc6ae Branch: v5.0-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: a064d492272bcb0029b140ec4e18fce1ac0ec5b2 Branch: v5.1-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 58c7c3fc4a0f15544c2054ed4682ff5d740681ab Branch: v5.1.0-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Branch: v5.2-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: 96bca3af450cc62183b91a361f7024f93126bc49 Branch: v5.3-maint Broken by: 1558f2584fd9b32c7903238bff2c9f12ba406ba6 Fixed by: f4dabe99f7f46520f2967f3e068fcbeb54e617df

1 0

[Libvirt-announce] LSN-2019-0004 virDomainSaveImageGetXMLDesc does not check for read-only connection
by Ján Tomko 24 Jun '19

24 Jun '19

Libvirt Security Notice: LSN-2019-0004 ====================================== Summary: virDomainSaveImageGetXMLDesc does not check for read-only connection Reported on: 20190604 Published on: 20190620 Fixed on: 20190620 Reported by: Matthias Gerstner <mgerstner(a)suse.de> Patched by: Ján Tomko <Ján Tomko> See also: CVE-2019-10161 Description ----------- The virDomainSaveImageGetXMLDesc accesses and parses arbitrary files without checking for the read-only connection. This allows unprivileged users to check for existence of arbitrary files or executing arbitrary binaries with elevated privileges. Impact ------ The default libvirt configuration allows all local user accounts read-only access to the libvirtd daemon. Any local user can check for the existence of an arbitrary file by watching for a different error message. Additionally, since v1.2.19, by providing a crafted save file pointing to an arbitrary emulator, executing arbitrary binaries as the configured QEMU user is possible. Since v5.1.0, the emulator binary is run with CAP_DAC_OVERRIDE, essentially having root privileges. Workaround ---------- Edit the /etc/libvirt/libvirtd.conf configuration file, to set the 'unix_sock_ro_perms = "0700"' to prevent local users from connecting to libvirt. Alternatively setup a policy kit rule to prevent them access without first authenticating as root. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v0.9.4 Broken in: v0.9.5 Broken in: v0.9.6 Broken in: v0.9.7 Broken in: v0.9.8 Broken in: v0.9.9 Broken in: v0.9.10 Broken in: v0.9.11 Broken in: v0.9.12 Broken in: v0.9.13 Broken in: v0.10.0 Broken in: v0.10.1 Broken in: v0.10.2 Broken in: v1.0.0 Broken in: v1.0.1 Broken in: v1.0.2 Broken in: v1.0.3 Broken in: v1.0.4 Broken in: v1.0.5 Broken in: v1.0.6 Broken in: v1.1.0 Broken in: v1.1.1 Broken in: v1.1.2 Broken in: v1.1.3 Broken in: v1.1.4 Broken in: v1.2.0 Broken in: v1.2.1 Broken in: v1.2.2 Broken in: v1.2.3 Broken in: v1.2.4 Broken in: v1.2.5 Broken in: v1.2.6 Broken in: v1.2.7 Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Broken in: v1.2.11 Broken in: v1.2.12 Broken in: v1.2.13 Broken in: v1.2.14 Broken in: v1.2.15 Broken in: v1.2.16 Broken in: v1.2.17 Broken in: v1.2.18 Broken in: v1.2.19 Broken in: v1.2.20 Broken in: v1.2.21 Broken in: v1.3.0 Broken in: v1.3.1 Broken in: v1.3.2 Broken in: v1.3.3 Broken in: v1.3.4 Broken in: v1.3.5 Broken in: v2.0.0 Broken in: v2.1.0 Broken in: v2.2.0 Broken in: v2.3.0 Broken in: v2.4.0 Broken in: v2.5.0 Broken in: v3.0.0 Broken in: v3.1.0 Broken in: v3.2.0 Broken in: v3.3.0 Broken in: v3.4.0 Broken in: v3.5.0 Broken in: v3.6.0 Broken in: v3.7.0 Broken in: v3.8.0 Broken in: v3.9.0 Broken in: v3.10.0 Broken in: v4.0.0 Broken in: v4.1.0 Broken in: v4.2.0 Broken in: v4.3.0 Broken in: v4.4.0 Broken in: v4.5.0 Broken in: v4.6.0 Broken in: v4.7.0 Broken in: v4.8.0 Broken in: v4.9.0 Broken in: v4.10.0 Broken in: v5.0.0 Broken in: v5.1.0 Broken in: v5.2.0 Broken in: v5.3.0 Broken in: v5.4.0 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: aed6a032cead4386472afb24b16196579e239580 Branch: v0.9.6-maint Broken in: v0.9.6.1 Broken in: v0.9.6.2 Broken in: v0.9.6.3 Broken in: v0.9.6.4 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v0.9.11-maint Broken in: v0.9.11.1 Broken in: v0.9.11.2 Broken in: v0.9.11.3 Broken in: v0.9.11.4 Broken in: v0.9.11.5 Broken in: v0.9.11.6 Broken in: v0.9.11.7 Broken in: v0.9.11.8 Broken in: v0.9.11.9 Broken in: v0.9.11.10 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v0.9.12-maint Broken in: v0.9.12.1 Broken in: v0.9.12.2 Broken in: v0.9.12.3 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v0.10.2-maint Broken in: v0.10.2.1 Broken in: v0.10.2.2 Broken in: v0.10.2.3 Broken in: v0.10.2.4 Broken in: v0.10.2.5 Broken in: v0.10.2.6 Broken in: v0.10.2.7 Broken in: v0.10.2.8 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.0.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.0.1-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.0.2-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.0.3-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.0.4-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.0.5-maint Broken in: v1.0.5.1 Broken in: v1.0.5.2 Broken in: v1.0.5.3 Broken in: v1.0.5.4 Broken in: v1.0.5.5 Broken in: v1.0.5.6 Broken in: v1.0.5.7 Broken in: v1.0.5.8 Broken in: v1.0.5.9 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.0.6-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.1.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.1.1-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.1.2-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.1.3-maint Broken in: v1.1.3.1 Broken in: v1.1.3.2 Broken in: v1.1.3.3 Broken in: v1.1.3.4 Broken in: v1.1.3.5 Broken in: v1.1.3.6 Broken in: v1.1.3.7 Broken in: v1.1.3.8 Broken in: v1.1.3.9 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.1.4-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.1-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.2-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.3-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.4-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.5-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.6-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.7-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.8-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken in: v1.2.9.2 Broken in: v1.2.9.3 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.10-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.11-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.12-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.13-maint Broken in: v1.2.13.1 Broken in: v1.2.13.2 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.14-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.15-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.16-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.17-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.18-maint Broken in: v1.2.18.1 Broken in: v1.2.18.2 Broken in: v1.2.18.3 Broken in: v1.2.18.4 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v1.2.19-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 4e16e7a3fc44a14f27eda23e75bae75992339b3a Branch: v1.2.20-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 99ac102b8310adf50d16b62c533405eee6544cf2 Branch: v1.2.21-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: fa2016e751452163aa2e93baa6c9bfc239e31885 Branch: v1.3.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 470d6f5546fd027f9945845f6aad72f33c829be9 Branch: v1.3.1-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 980109c41c8bb55fd105809f2e063667721feaea Branch: v1.3.2-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 221397df7a5164bcc4d28f3157867db4894000d3 Branch: v1.3.3-maint Broken in: v1.3.3.1 Broken in: v1.3.3.2 Broken in: v1.3.3.3 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: b22baef31258621b3bdb5036a84772bc6b6ec0a4 Branch: v1.3.4-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: a8ae178438be285b91c4871251ad1482c4e396df Branch: v1.3.5-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 70e83151456d386580708ade404ada41afac41dd Branch: v2.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: a9e40f23207f464c322f4250b1373ff50ca71a85 Branch: v2.1-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: dea40b42188e883c4118b02527f5c02a6fbbac59 Branch: v2.2-maint Broken in: v2.2.1 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 97829dcb3889fd0a64ff32a72710303f59d7d5bf Branch: v3.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: fb8c9f1305d108e5a43e83b72a86e41abfdeda86 Branch: v3.2-maint Broken in: v3.2.1 Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: ff5c64b94133b7b54e7359c63e1c2972531a4f5f Branch: v3.7-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 8cf159fed436634a7607964eeecefee59be63b33 Branch: v4.1-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 1f8129c5db3952a57900b8cd1d94e629068e6aa5 Branch: v4.2-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 7312304ec0a50db539c6e1714f2c9b3a9e38daa7 Branch: v4.3-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 8832b8a44f960229c5aa0a803d26c0ab4aa827af Branch: v4.4-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: bafe00de3c62f3638e449ba62d4d88b56188bafe Branch: v4.5-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 6a028b6e8228dd19283042e5edef3a45133630e8 Branch: v4.6-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: a27659643b8ae9b26b52fc857cdc5b301184e26e Branch: v4.7-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 3352c8af264a7b9b741208790ecca0bbc6733f42 Branch: v4.8-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 56fadbbb25190d8ce0dcc54c550cc736a2fc5412 Branch: v4.9-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 568c735d7b0ccb55f9476c86f8603eb3a5c9fc5c Branch: v4.10-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 3572564893d1710beb1862797fe32cc2e9cb1e38 Branch: v5.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 6aa0c85be9f840a32fcec282185b5ed2513a3aa5 Branch: v5.1-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 111bb6555c5082ebba3de8e73a4e21a1573a5409 Branch: v5.1.0-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Branch: v5.2-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: 3d9c8914663549e0cc0e822fa29b0a3a5bbc0fbd Branch: v5.3-maint Broken by: d2a929d4b371a382d5508ae6bef80e392a34f8b9 Fixed by: dae676751cee86eaad880ee9c654823ce0e021ad

1 0

[Libvirt-announce] Release of libvirt-5.4.0
by Daniel Veillard 03 Jun '19

03 Jun '19

It's out ! The release is tagged in git, and I provided signed tarball and source rpms to the usual place: https://libvirt.org/sources/ I also cut off a 5.4.0 release of the python bindings but code is same a 5.3.0 one, you can find signed tarball and source rpms at: https://libvirt.org/sources/python/ Main theme of this release is security, there is a set of advisory covered so users are invited to update, along with some improvements and bug fixes. Security: - cpu: Introduce support for the md-clear CPUID bit This bit is set when microcode provides the mechanism to invoke a flush of various exploitable CPU buffers by invoking the x86 VERW instruction. CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091. - Restrict user access to virt-admin, virtlogd and virtlockd The intended users for these facilities are the root user and the libvirtd service respectively, but these restrictions were not enforced correctly. CVE-2019-10132. Improvements: - test driver: Expand API coverage Several APIs that were missing from the test driver have now been implemented. - Avoid unnecessary static linking Most binaries shipped as part of libvirt, for example virtlogd and libvirt_iohelper, were embedding parts of the library even though they also linked against the libvirt.so dynamic library. This is no longer the case, which results in both the disk and memory footprint being reduced. - qemu: Report stat-htlb-pgalloc and stat-htlb-pgfail balloon stats These stats have been introduced in QEMU 3.0. Bug fixes: - qemu: Fix emulator scheduler support Setting the scheduler for QEMU's main thread before QEMU had a chance to start up other threads was misleading as it would affect other threads (vCPU and I/O) as well. In some particular situations this could also lead to an error when the thread for vCPU #0 was being moved to its cpu,cpuacct cgroup. This was fixed so that the scheduler for the main thread is set after QEMU starts. - apparmor: Allow hotplug of vhost-scsi devices Thanks everybody who contributed to this release, be it with bug reports, patches, reviews, docs ... Enjoy ! Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[Libvirt-announce] Entering freeze for libvirt 5.4.0
by Daniel Veillard 31 May '19

31 May '19

This is tagged in git, I have put the signed tarball and source RPM at the usual place: https://libvirt.org/sources/ I did not build the binaries rpms, first it broke because I was still on F28 c.f. Jan's patch, and second it's true to provides little value, it's doubtful people would just install my binaries as is. Will likely stick to sources as part of releases in the future. Release looks fine in my limited testing, https://ci.centos.org/view/libvirt/ is of a rare uniform green color, which is promising too ! Please give it a try, I will likely cut RC2 on Thrusday, and then if everything goes fine push the GA over the w.e. or Monday, thanks, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 1

[Libvirt-announce] LSN-2019-0003: Insecure permissions for systemd socket for virtlockd/virtlogd
by Daniel P. Berrangé 21 May '19

21 May '19

Libvirt Security Notice: LSN-2019-0003 ====================================== Summary: Insecure permissions for systemd socket for virtlockd/virtlogd Reported on: 20190430 Published on: 20190421 Fixed on: 20190421 Reported by: Daniel P. Berrangé <berrange(a)redhat.com> Patched by: Daniel P. Berrangé <berrange(a)redhat.com> See also: CVE-2019-10132 Description ----------- The virtlockd-admin.socket and virtlogd-admin.socket unit files do not set the SocketMode parameter and thus create a world accessible UNIX domain socket. Furthermore the code fails to validate the identity of clients connecting to these sockets. Impact ------ An unprivileged user is able to connect to the virtlockd or virtlogd daemons and use the administrative RPC commands to elevate their privileges Workaround ---------- Disable the virtlockd-admin.socket and virtlogd-admin.socket units in systemd. Alternative customize them to add SocketMode=0600 locally. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v4.1.0 Broken in: v4.2.0 Broken in: v4.3.0 Broken in: v4.4.0 Broken in: v4.5.0 Broken in: v4.6.0 Broken in: v4.7.0 Broken in: v4.8.0 Broken in: v4.9.0 Broken in: v4.10.0 Broken in: v5.0.0 Broken in: v5.1.0 Broken in: v5.2.0 Broken in: v5.3.0 Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 96f41cd765c9e525fe28ee5abbfbf4a79b3720c7 Fixed by: f111e09468693909b1f067aa575efdafd9a262a1 Fixed by: e37bd65f9948c1185456b2cdaa3bd6e875af680f Branch: v4.1-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 39fb5ab3125d1669344bab94ccb71bce814d9ae2 Fixed by: 41f06e6095e17b61b2af35821d204afc5c34777c Fixed by: f0e014133104cdb5af5c7d96a7aa6dc0f1bbb03c Branch: v4.2-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 9bef445981a244622bfd64086d91016868656978 Fixed by: 63095b01eb9d9629c34a8a7c8a4b5ffd611b51c3 Fixed by: f845754de1b44375879bae4937acfb5d0965ac08 Branch: v4.3-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: acf17630336568984e3e00d356fd75cdf2b1f09c Fixed by: 93d9f05684c818fb5eab9ffef7a4f9f9adbd7d02 Fixed by: 59fe946efccc1fe28a734a91de27550ece9467d5 Branch: v4.4-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: ebc49c1dff2fc1999963dd225c3f9a7beb90e87b Fixed by: 13d340b328ad2d567f2878cfeedacd114a9172a7 Fixed by: faac7d474ad696f7e105ba776167f8d18d78d5d7 Branch: v4.5-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: d1017aeee9da6d3db4389141b0f07f0a8204303d Fixed by: 618358632b6bfe93e46f038656609cf79b471bef Fixed by: ec58805400e8d394169af2355168bc439586f414 Branch: v4.6-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 99decb0a65227aac7b072f9e1751b75ac50a62a5 Fixed by: 223167124cf5c056c12d7c174307e490aa5fd2b3 Fixed by: 0a9c2082e65579ab814fce701e58f91a71a73c11 Branch: v4.7-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: dfd22fc50f8f268b9810d2ef21adada021f740eb Fixed by: 54005b84b0165b62b2ef88c7df229bddbaa29e76 Fixed by: 030fdf57255f97289a407529194bf26c77548acb Branch: v4.8-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 4369e90f8cacb24b55a22321923954874c14b44b Fixed by: 257c5589fe5138fdb36d434162b97599cc470f9b Fixed by: 5c3dcd0dd416f28520ce3a8fd33222b01c5a33a1 Branch: v4.9-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: b0f788c2d3d9930015258a7df95dde80a498e657 Fixed by: ea014c9fcf19539c75a7cb6926b14858426746a7 Fixed by: a474f18dceed61d562508980999e5f2d7445d683 Branch: v4.10-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 8d12118171a250150f2cb16448c49271a1dcb077 Fixed by: a712f01682078f48d3c258bff8cd523ab9100b0d Fixed by: f8d8a7a182c0854fa50d3976077b3a3d8de8980f Branch: v5.0-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 78a00c539d271a250c62260bbf2c2594714b7e9b Fixed by: 5aa8b8d1b118f52bb2209c87482824b3ffac74c2 Fixed by: be311e1ba9b7ac7f17a0f3d1a34496de50a7b914 Branch: v5.1-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: 44a0bcdb107eb7ac251f9aa5a316f4c161f43542 Fixed by: 771a7f2fa86a736770c3470f2a0fccd60cce3e9f Fixed by: 4aa6ce7dad1a0b66afd32f02fa17319762bb12b1 Branch: v5.2-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: de48bfbe09a00d743eef4b3a7b03b1af0e26fa9d Fixed by: 16a5284eb1be6b0c00e277b604e62f394b426fbc Fixed by: c909c8e185a14bbab82564f219c0bb492a81ca43 Branch: v5.3-maint Broken by: 85d45ff05db4a41ac3678ee0d4457b6b3323597e Broken by: ce7ae55ea1113bc574c5b5a61828e67fbd0e506f Fixed by: fd48a871a9dcdb8b8b1eb39612e5df870a7e2c3c Fixed by: 8c2c611df31d3b37f149385e4597c47300ae1489 Fixed by: a968b3103c503db8a9fb6c9d64f0dd49d3b6f2a3 Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[Libvirt-announce] RElease of libvirt-5.3.0
by Daniel Veillard 04 May '19

04 May '19

A bit late, sorry I was in vacations, but the release is now tagged in git and I pushed the signed tarball and rpms to the normal place: https://libvirt.org/sources/ Please note that following discussion on last release the FTP server will soon be shutdown. I also pushed the related libvirt-python release that you can find in git and at https://libvirt.org/sources/python/ This is a balanced release, one thing to note is the removal of the support for the old 4.x VirtualBox releases New feature: - qemu: Add support for setting the emulator scheduler parameters I/O threads and vCPU threads already support setting schedulers, but until now it was impossible to do so for the main QEMU thread (emulator thread in the libvirt naming). This is, however, requested for some very specific scenarios, for example when vCPU threads are running at such priority that could starve the main thread. Removed feature: - vbox: Drop support for VirtualBox 4.x releases Support for all the 4.x releases was ended by VirtualBox maintainers in December 2015. Therefore, libvirt support for these releases is dropped. Improvements: - qemu: Use PCI by default for RISC-V guests PCI support for RISC-V guests was already available in libvirt 5.1.0, but it required the user to opt-in by manually assigning PCI addresses: with this release, RISC-V guests will use PCI automatically when running against a recent enough (4.0.0+) QEMU release. - qemu: Advertise firmware autoselection in domain capabilities The firmware autoselection feature is now exposed in domain capabilities and management applications can query for accepted values, i.e. values that are accepted and for which libvirt found firmware descriptor files. Firmware Secure Boot support is also advertised. - Drop YAJL 1 support YAJL 2 is widely adopted and maintaining side by side support for two versions is unnecessary. Bug fixes: - rpc: cleanup in virNetTLSContextNew Failed new gnutls context allocations in virNetTLSContextNew function results in double free and segfault. Occasional memory leaks may also occur. - virsh: various completers fixes There were some possible crashers, memory leaks, etc. which are now fixed. - qemu: Make hugepages work with memfd backend Due to a bug in command line generation libvirt did not honor hugepages setting with memfd backend. - Enforce ACL write permission for getting guest time & hostname Getting the guest time and hostname both require use of guest agent commands. These must not be allowed for read-only users, so the permissions check must validate "write" permission not "read". Thanks everybody for your help bringing this release up, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0