- Devel - libvirt List Archives

[PATCH] util: virFileChownFiles: do not follow symlinks
by Daniel P. Berrangé 28 Jul '26

28 Jul '26

From: HE WEI（ギカク） <skyexpoc(a)gmail.com> virFileChownFiles() selected entries with virFileIsRegular() (stat(), follows symlinks) and changed ownership with chown() (follows symlinks). A component that owns the target directory at a lower privilege (e.g. the swtpm/tss state directory) can plant a symlink to an arbitrary regular file and have the root caller chown that file. Use lstat() to skip non-regular entries and fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink final component is never followed. Fixes: CVE-2026-63622 Signed-off-by: HE WEI（ギカク） <skyexpoc(a)gmail.com> [DB: use g_lstat instead of stat; use lchown instead of fchownat for portability; added comment] Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virfile.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/util/virfile.c b/src/util/virfile.c index a0c6cb8048..c9d838eeeb 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -3306,6 +3306,12 @@ int virDirIsEmpty(const char *path, * * Change ownership of all regular files in a directory. * + * This will NOT follow any symlinks, to avoid security risks. + * It is assumed the process using content under @name will + * be unprivileged, thus less trusted than libvirt. If it is + * compromised it might attempt to create symlinks in @name to + * escalate privileges on a subsequent call to virFileChownFiles. + * * Returns -1 on error, with error already reported, 0 on success. */ #ifndef WIN32 @@ -3322,13 +3328,19 @@ int virFileChownFiles(const char *name, while ((direrr = virDirRead(dir, &ent, name)) > 0) { g_autofree char *path = NULL; + struct stat sb; path = g_build_filename(name, ent->d_name, NULL); - if (!virFileIsRegular(path)) + if (g_lstat(path, &sb) < 0) { + virReportSystemError(errno, _("cannot stat '%1$s'"), path); + return -1; + } + + if (!S_ISREG(sb.st_mode)) continue; - if (chown(path, uid, gid) < 0) { + if (lchown(path, uid, gid) < 0) { virReportSystemError(errno, _("cannot chown '%1$s' to (%2$u, %3$u)"), ent->d_name, (unsigned int) uid, -- 2.55.0

1 0

[PATCH] storage: create images with a private umask during qemu-img create/convert
by Daniel P. Berrangé 28 Jul '26

28 Jul '26

From: HE WEI（ギカク） <skyexpoc(a)gmail.com> On the local (non-NETFS) path virStorageBackendCreateExecCommand() ran qemu-img with umask 0, so the destination image was created world-readable (0644) and the full source disk was written into it before libvirt tightened the mode with a later chmod(). This is the same class as CVE-2025-13193; apply the same fix by setting a 0077 umask so qemu-img creates the file private from the start. Fixes: CVE-2026-63623 Reported-by: HE WEI（ギカク） <skyexpoc(a)gmail.com> Signed-off-by: HE WEI（ギカク） <skyexpoc(a)gmail.com> [DB: merged the two virCommandSetUmask to one] Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/storage/storage_util.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/storage/storage_util.c b/src/storage/storage_util.c index 78dc9f9f1c..9e6b266842 100644 --- a/src/storage/storage_util.c +++ b/src/storage/storage_util.c @@ -464,6 +464,7 @@ virStorageBackendCreateExecCommand(virStoragePoolObj *pool, bool filecreated = false; int ret = -1; + virCommandSetUmask(cmd, S_IRWXUGO ^ mode); if ((def->type == VIR_STORAGE_POOL_NETFS) && (((geteuid() == 0) && (vol->target.perms->uid != (uid_t)-1) @@ -473,7 +474,6 @@ virStorageBackendCreateExecCommand(virStoragePoolObj *pool, virCommandSetUID(cmd, vol->target.perms->uid); virCommandSetGID(cmd, vol->target.perms->gid); - virCommandSetUmask(cmd, S_IRWXUGO ^ mode); if (virCommandRun(cmd, NULL) == 0) { /* command was successfully run, check if the file was created */ @@ -505,7 +505,6 @@ virStorageBackendCreateExecCommand(virStoragePoolObj *pool, /* don't change uid/gid/mode if we retry */ virCommandSetUID(cmd, -1); virCommandSetGID(cmd, -1); - virCommandSetUmask(cmd, 0); if (virCommandRun(cmd, NULL) < 0) goto cleanup; -- 2.55.0

1 0

Incorrent lookup function argument types in libvirt-python API binding
by Krzysztoff 28 Jul '26

28 Jul '26

For some time now I've been developing an app using the libvirt-python package. I think I might have spotted an issue with *lookupByUUID* and *lookupByUUIDString* functions. First of all, when these functions are passed an argument (machine UUID) they require it to be in a specific format (16 byte string), however, *there is virtually no information about this in the documentation* about this - I managed to find out about this by testing it manually. Hypothetically - let's take *machine_uuid* of type UUID. 1. This will throw an error: [...].lookupByUUID(machine_uuid) 2. This will work properly: [...].lookupByUUID(machine_uuid.*bytes*) Secondly, in the newest version of libvirt-python (12.5.0) the expected argument type of function *lookupByUUID* has been changed to *str*. This causes Python interpreter to highlight all occurrences of lookupByUUID and show errors: Argument of type "bytes" cannot be assigned to parameter "uuid" of type > "str" in function "lookupByUUID" > "bytes" is not assignable to "str" Weirdly enough, no actual runtime error is thrown and the lookups work perfectly fine. However if the argument is actually casted to str the lookup fails with virDomainLookupByUUIDString() failed error. More importantly - this change in the argument type makes absolutely no sense, since now the function lookupByUUID requires exactly the same argument as lookupByUUIDString - I suppose these functions were supposed to do different things but now they work exactly the same. def lookupByUUID(self, uuid: "str") -> "virDomain": > """Try to lookup a domain on the given hypervisor based on its > UUID. """ > ret = libvirtmod.virDomainLookupByUUID(self._o, uuid) > if ret is None: > raise libvirtError('virDomainLookupByUUID() failed') > __tmp = virDomain(self, _obj=ret) > return __tmp > > def lookupByUUIDString(self, uuidstr: "str") -> "virDomain": > """Try to lookup a domain on the given hypervisor based on its UUID > virDomainFree should be used to free the resources after the > domain object is no longer needed. """ > ret = libvirtmod.virDomainLookupByUUIDString(self._o, uuidstr) > if ret is None: > raise libvirtError('virDomainLookupByUUIDString() failed') > __tmp = virDomain(self, _obj=ret) > return __tmp Best regards, Krzysztoff

2 2

[PATCH] bhyve: Fix version of implementation of some APIs
by Michal Privoznik 27 Jul '26

27 Jul '26

From: Michal Privoznik <mprivozn(a)redhat.com> The following APIs where all implemented in 12.5.0 timeframe: - virDomainGetTime(), virDomainSetTime() -> v12.5.0-rc1~66 - virDomainSetUserPassword() -> v12.5.0-rc1~65 - virDomainAuthorizedSSHKeysGet(), virDomainAuthorizedSSHKeysSet() -> v12.5.0-rc1~64 But respective comments suggest they were implemented in 12.6.0 timeframe. Fix those comments. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/bhyve/bhyve_driver.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 8628a48621..4abcd70aba 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -2880,11 +2880,11 @@ static virHypervisorDriver bhyveHypervisorDriver = { .domainGetMemoryParameters = bhyveDomainGetMemoryParameters, /* 12.4.0 */ .domainSetMemoryParameters = bhyveDomainSetMemoryParameters, /* 12.4.0 */ .domainGetFSInfo = bhyveDomainGetFSInfo, /* 12.5.0 */ - .domainGetTime = bhyveDomainGetTime, /* 12.6.0 */ - .domainSetTime = bhyveDomainSetTime, /* 12.6.0 */ - .domainSetUserPassword = bhyveDomainSetUserPassword, /* 12.6.0 */ - .domainAuthorizedSSHKeysGet = bhyveDomainAuthorizedSSHKeysGet, /* 12.6.0 */ - .domainAuthorizedSSHKeysSet = bhyveDomainAuthorizedSSHKeysSet, /* 12.6.0 */ + .domainGetTime = bhyveDomainGetTime, /* 12.5.0 */ + .domainSetTime = bhyveDomainSetTime, /* 12.5.0 */ + .domainSetUserPassword = bhyveDomainSetUserPassword, /* 12.5.0 */ + .domainAuthorizedSSHKeysGet = bhyveDomainAuthorizedSSHKeysGet, /* 12.5.0 */ + .domainAuthorizedSSHKeysSet = bhyveDomainAuthorizedSSHKeysSet, /* 12.5.0 */ .domainRename = bhyveDomainRename, /* 12.6.0 */ }; -- 2.54.0

3 2

Entering freeze for libvirt-12.6.0
by Jiri Denemark 27 Jul '26

27 Jul '26

I have just tagged v12.6.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 0

[PATCH] bhyve: clean up event thread
by Roman Bogorodskiy 27 Jul '26

27 Jul '26

Currently, eventThread cleanup is missing. Fix that by calling virBhyveDomainObjStopWorker() in virBhyveProcessStop() and un-referring the eventThread in bhyveDomainObjPrivateFree(). Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- I think it would be nice to get this in before 12.6.0. src/bhyve/bhyve_domain.c | 5 +++++ src/bhyve/bhyve_process.c | 2 ++ 2 files changed, 7 insertions(+) diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index d5bb22501c..b6344185b7 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -54,6 +54,11 @@ bhyveDomainObjPrivateFree(void *data) virDomainPCIAddressSetFree(priv->pciaddrs); + if (priv->eventThread) { + VIR_ERROR(_("Unexpected event thread still active during domain deletion")); + g_object_unref(priv->eventThread); + } + g_free(priv); } diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 636d74afcc..81f00954c2 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -675,6 +675,8 @@ virBhyveProcessStop(struct _bhyveConn *driver, if ((priv != NULL) && (priv->mon != NULL)) g_clear_pointer(&priv->mon, bhyveMonitorClose); + virBhyveDomainObjStopWorker(vm); + cmd = virBhyveProcessBuildDestroyCmd(driver, vm->def); if (virCommandRun(cmd, NULL) < 0) { /* Only failure of the actual destroy command warrants unsuccessful return code, -- 2.52.0

2 1

[PATCH] NEWS: document bhyve changes for 12.6.0
by Roman Bogorodskiy 27 Jul '26

27 Jul '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..c874a5443e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,11 @@ v12.6.0 (unreleased) * **New features** + * bhyve: implement ``virDomainRename()`` + + The bhyve driver now implements the ``virDomainRename()`` API + for renaming of a domain (``virsh domrename``). + * **Improvements** * **Bug fixes** -- 2.52.0

2 1

[PATCH 0/3] bhyve: fix a few memory leaks
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Roman Bogorodskiy (3): bhyve: fix memory leak in bhyveBuildVirtioSerialControllerArgStr() network: pf: fix memory leaks bhyve: fix memory leak in bhyveStateCleanup() src/bhyve/bhyve_command.c | 4 +++- src/bhyve/bhyve_driver.c | 1 + src/network/network_pf.c | 20 +++++++++++++------- 3 files changed, 17 insertions(+), 8 deletions(-) -- 2.52.0

2 4

[PATCH] NEWS: Update with recent feature additions
by Jim Fehlig 25 Jul '26

25 Jul '26

From: Jim Fehlig <jfehlig(a)suse.com> Add NEWS entries for the new libvirtd build option and new sanlock plugin setting. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..e986cf8c9a 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,17 @@ v12.6.0 (unreleased) * **New features** + * build: Add option to control building libvirtd + + Meson option ``libvirtd`` has been added to control building the monolithic + libvirtd, independent from the stateful, daemon-based drivers. + + * sanlock: Add option to check ownership of disk leases + + The sanlock lock driver plugin now supports the ``check_disk_lease_owner`` + setting in sanlock.conf. When enabled, the sanlock plugin will check that + leases are owned by the domain attempting to acquire them. + * **Improvements** * **Bug fixes** -- 2.51.0

2 2

[PATCH 1/2] util: Guard against integer overflow in nexttimer
by Yong Chen 24 Jul '26

24 Jul '26

The 'nexttimer' variable is a static int that starts at 1 and is incremented every time a new timeout is registered via virEventGLibTimeoutAdd. After running for a long period of time (many months/years with frequent client connections), nexttimer can overflow past INT_MAX and become negative. A negative timer ID causes multiple problems: 1. virKeepAliveStart: 'if (ka->timer < 0)' returns true, skipping virObjectRef() which is needed to hold the timer's reference to the keepalive object. This leads to premature object freeing. 2. virKeepAliveStop: 'if (ka->timer > 0)' returns false, skipping virEventRemoveTimeout(). The GSource is never destroyed, causing a use-after-free when the timer fires on the freed object. 3. virNetServerClientNew: 'if (client->sockTimer < 0)' returns true, causing client creation to fail with 'Connection reset by peer'. In a production environment running for 1 year and 8 months, nexttimer overflowed and accumulated 282 million leaked timer entries, consuming 19.6GB of memory. Fix by resetting nexttimer to 1 when it overflows below 1, ensuring timer IDs are always positive. Signed-off-by: Yong Chen <410664530(a)qq.com> --- src/util/vireventglib.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/util/vireventglib.c b/src/util/vireventglib.c index 6c54f62123..6fe23b3b7d 100644 --- a/src/util/vireventglib.c +++ b/src/util/vireventglib.c @@ -341,6 +341,9 @@ virEventGLibTimeoutAdd(int interval, data = g_new0(struct virEventGLibTimeout, 1); data->timer = nexttimer++; + /* Guard against integer overflow: timer IDs must be positive */ + if (nexttimer < 1) + nexttimer = 1; data->interval = interval; data->cb = cb; data->opaque = opaque; -- 2.55.0.windows.3

2 1