- Devel - libvirt List Archives

[PATCH] qemu: Add audit entries for suspend and resume
by Jim Fehlig 07 Jan '25

07 Jan '25

We recently received a request from certification auditors to provide audit entries for suspend and resume. This small patch uses the existing virtDomainAudit{Start,Stop} functions with new reasons "suspended" and "resumed". Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- For suspend, I initially wrote the following virDomainAuditStart(vm, virDomainPausedReasonTypeToString(reason), true); but I'm not sure it makes sense in resume, where we have reasons such as VIR_DOMAIN_CRASHED_PANICKED. For symmetry, it seemed best to go with "suspended" and "resumed". src/qemu/qemu_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f1a633fdd3..c670bb681e 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1682,6 +1682,7 @@ static int qemuDomainSuspend(virDomainPtr dom) goto endjob; } qemuDomainSaveStatus(vm); + virDomainAuditStart(vm, "suspended", true); ret = 0; endjob: @@ -1738,6 +1739,7 @@ static int qemuDomainResume(virDomainPtr dom) } } qemuDomainSaveStatus(vm); + virDomainAuditStop(vm, "resumed"); ret = 0; endjob: -- 2.43.0

3 4

[PATCH v2 0/4] fix AppArmor policy restore for runtime rules
by Georgia Garcia 07 Jan '25

07 Jan '25

Some rules are generated dynamically during boot and added to the AppArmor policy. An example of that is macvtap devices that call the AppArmorSetFDLabel hook to add a rule for the tap device path. Since this information is dynamic, it is not available in the xml config, therefore whenever a "Restore" hook is called, the entire profile is regenerated by virt-aa-helper based only the information from the VM definition, so the dynamic/runtime information is lost. This patchset fixes that by storing these rules in a different file called libvirt-uuid.runtime_files, which is included by libvirt-uuid.files that already exists. It also includes other fixes like memory leaks, adoption of the GLib API in the apparmor files and a fix on the AppArmor policy that incorrectly applies apparmor policy syntax. Georgia Garcia (4): security_apparmor: fix memleaks in AppArmorSetFDLabel security: replace uses of label and VIR_FREE by g_autofree apparmor: fix UUID specification virt-aa-helper: store dynamically generated rules .../usr.lib.libvirt.virt-aa-helper.in | 5 +- src/security/apparmor/usr.sbin.libvirtd.in | 7 +- src/security/security_apparmor.c | 83 +++++----- src/security/virt-aa-helper.c | 145 +++++++++--------- 4 files changed, 120 insertions(+), 120 deletions(-) -- 2.34.1

4 11

[PATCH] meson: remove unneeded dependency on libdevmapper for storage_disk
by Stefan Hellermann 07 Jan '25

07 Jan '25

In commit dfa0e11 the last direct usage of devmapper for storage_disk was removed. There is one stale include remaining, which is unused even longer since df1011ca. Remove the include and change meson.build so we can use storage_disk without devmapper. I'm running it right now with a stripped-down config on a small arm64 router with openwrt. Signed-off-by: Stefan Hellermann <stefan(a)the2masters.de> --- meson.build | 4 ++-- src/storage/parthelper.c | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/meson.build b/meson.build index ca1b915737..ffe91dbd46 100644 --- a/meson.build +++ b/meson.build @@ -1787,11 +1787,11 @@ if conf.has('WITH_LIBVIRTD') conf.set('WITH_STORAGE_DIR', 1) endif - if not get_option('storage_disk').disabled() and devmapper_dep.found() and libparted_dep.found() + if not get_option('storage_disk').disabled() and libparted_dep.found() use_storage = true conf.set('WITH_STORAGE_DISK', 1) elif get_option('storage_disk').enabled() - error('You must install libparted and libdevmapper to compile libvirt with disk storage driver') + error('You must install libparted to compile libvirt with disk storage driver') endif if not get_option('storage_fs').disabled() diff --git a/src/storage/parthelper.c b/src/storage/parthelper.c index ee07ba41bb..1169ebfb64 100644 --- a/src/storage/parthelper.c +++ b/src/storage/parthelper.c @@ -31,7 +31,6 @@ #include <config.h> #include <parted/parted.h> -#include <libdevmapper.h> #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> -- 2.47.1

2 1

[PATCH] virtiofs: allow read only mode
by Adam Julis 07 Jan '25

07 Jan '25

Resolves: https://issues.redhat.com/browse/RHEL-72192 Signed-off-by: Adam Julis <ajulis(a)redhat.com> --- docs/formatdomain.rst | 2 +- src/qemu/qemu_validate.c | 11 ----- src/qemu/qemu_virtiofs.c | 3 ++ .../vhost-user-fs-readonly.x86_64-latest.args | 34 ++++++++++++++ .../vhost-user-fs-readonly.x86_64-latest.err | 1 - .../vhost-user-fs-readonly.x86_64-latest.xml | 45 +++++++++++++++++++ .../vhost-user-fs-readonly.xml | 1 + tests/qemuxmlconftest.c | 2 +- 8 files changed, 85 insertions(+), 14 deletions(-) create mode 100644 tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args delete mode 100644 tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 8d787ef59a..e8e8336708 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -3824,7 +3824,7 @@ A directory on the host that can be accessed directly from the guest. :since:`Since 10.0.0` ``readonly`` Enables exporting filesystem as a readonly mount for guest, by default - read-write access is given (currently only works for QEMU/KVM driver; not + read-write access is given (works for QEMU/KVM driver and :since:`Since 11.0.0` with virtiofs). ``space_hard_limit`` Maximum space available to this guest's filesystem. :since:`Since 0.9.13` diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index aaa056379e..086c66b602 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -4540,11 +4540,6 @@ qemuValidateDomainDeviceDefFS(virDomainFSDef *fs, case VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS: if (!fs->sock) { - if (fs->readonly) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("virtiofs does not yet support read-only mode")); - return -1; - } if (fs->accessmode != VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("virtiofs only supports passthrough accessmode")); @@ -4557,12 +4552,6 @@ qemuValidateDomainDeviceDefFS(virDomainFSDef *fs, } } - if (fs->readonly) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("virtiofs does not support read-only access")); - return -1; - } - if (fs->model != VIR_DOMAIN_FS_MODEL_DEFAULT) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("virtiofs does not support model")); diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c index 87226be288..dd3e0dd9fe 100644 --- a/src/qemu/qemu_virtiofs.c +++ b/src/qemu/qemu_virtiofs.c @@ -228,6 +228,9 @@ qemuVirtioFSBuildCommandLine(virQEMUDriverConfig *cfg, fs->idmap.gidmap[i].count); } + if (fs->readonly) + virCommandAddArg(cmd, "--readonly"); + return g_steal_pointer(&cmd); } diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args new file mode 100644 index 0000000000..d3c71544f8 --- /dev/null +++ b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args @@ -0,0 +1,34 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,acpi=off \ +-accel kvm \ +-cpu qemu64 \ +-m size=14680064k \ +-overcommit mem-lock=off \ +-smp 2,sockets=2,cores=1,threads=1 \ +-object '{"qom-type":"memory-backend-file","id":"ram-node0","mem-path":"/var/lib/libvirt/qemu/ram/-1-guest/ram-node0","share":true,"size":15032385536}' \ +-numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \ +-uuid 126f2720-6f8e-45ab-a886-ec9277079a67 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-chardev socket,id=chr-vu-fs0,path=/var/lib/libvirt/qemu/domain--1-guest/fs0-fs.sock \ +-device '{"driver":"vhost-user-fs-pci","id":"fs0","chardev":"chr-vu-fs0","queue-size":1024,"tag":"mount_tag","bus":"pci.0","addr":"0x2"}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err deleted file mode 100644 index fff45fac4b..0000000000 --- a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err +++ /dev/null @@ -1 +0,0 @@ -unsupported configuration: virtiofs does not yet support read-only mode diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml new file mode 100644 index 0000000000..c9c1e5c3d2 --- /dev/null +++ b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml @@ -0,0 +1,45 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>126f2720-6f8e-45ab-a886-ec9277079a67</uuid> + <memory unit='KiB'>14680064</memory> + <currentMemory unit='KiB'>14680064</currentMemory> + <memoryBacking> + <source type='file'/> + <access mode='shared'/> + </memoryBacking> + <vcpu placement='static'>2</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + <numa> + <cell id='0' cpus='0-1' memory='14680064' unit='KiB' memAccess='shared'/> + </numa> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='pci' index='0' model='pci-root'/> + <filesystem type='mount' accessmode='passthrough'> + <driver type='virtiofs' queue='1024'/> + <binary path='/usr/libexec/virtiofsd' xattr='on'> + <cache mode='always'/> + <lock posix='off' flock='off'/> + </binary> + <source dir='/path'/> + <target dir='mount_tag'/> + <readonly/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </filesystem> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml b/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml index 003ed41eb3..c9c1e5c3d2 100644 --- a/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml +++ b/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml @@ -39,6 +39,7 @@ </filesystem> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> <memballoon model='none'/> </devices> </domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 21b56dc94e..6a46bfc7a3 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2880,7 +2880,7 @@ mymain(void) DO_TEST_CAPS_LATEST("vhost-user-fs-fd-memory"); DO_TEST_CAPS_LATEST("vhost-user-fs-fd-openfiles"); DO_TEST_CAPS_LATEST("vhost-user-fs-hugepages"); - DO_TEST_CAPS_LATEST_PARSE_ERROR("vhost-user-fs-readonly"); + DO_TEST_CAPS_LATEST("vhost-user-fs-readonly"); DO_TEST_CAPS_ARCH_LATEST("vhost-user-fs-ccw", "s390x"); DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("vhost-user-fs-ccw-bootindex", "s390x"); -- 2.47.1

2 1

Plans for 11.0.0 release (freeze on Thursday 09 Jan)
by Jiri Denemark 07 Jan '25

07 Jan '25

We are getting close to 11.0.0 release of libvirt. To aim for the release on Wednesday 15 Jan I suggest entering the freeze on Thursday 09 Jan and tagging RC2 on Monday 13 Jan. I hope this works for everyone. Jirka

1 0

[libvirt PATCH v2 0/2] conf: Adjust hyperv tlbflush formatting
by Ján Tomko 07 Jan '25

07 Jan '25

Including the refactor. Ján Tomko (1): conf: refactor hyperv features formatting Martin Kletzander (1): conf: Adjust hyperv tlbflush formatting src/conf/domain_conf.c | 57 ++++++++++--------- .../qemuxmlconfdata/hyperv.x86_64-latest.xml | 5 +- 2 files changed, 33 insertions(+), 29 deletions(-) -- 2.47.0

2 3

[PATCH] security: apparmor: Remove hardcoded "libvirtd" profile name
by Jim Fehlig 06 Jan '25

06 Jan '25

The apparmor driver probe function checks for an active profile matching the full path of the running daemon binary. If not found, it checks for a profile named "libvirtd". This works fine when the running daemon is the old monolithic libvirtd, but fails with modular daemons. Remove the check for a hardcoded "libvirtd" profile and replace with the basename of the running daemon binary. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/security/security_apparmor.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index c8e77c6cd2..eed0f265d6 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -239,7 +239,9 @@ use_apparmor(void) */ rc = profile_status(libvirt_daemon, 1); if (rc < 0) { - rc = profile_status("libvirtd", 1); + g_autofree char *basename = g_path_get_basename(libvirt_daemon); + + rc = profile_status(basename, 1); /* Error or unconfined should all result in -1 */ if (rc < 0) rc = -1; -- 2.43.0

2 1

[PATCH] conf: Adjust hyperv tlbflush formatting
by Martin Kletzander 06 Jan '25

06 Jan '25

Commi 247357cc292a added support for direct and extended modes for tlbflush, but forgot to do the formatting as well. Instead of rewriting the whole hyperv feature formatting to use yet another attribute and child buffers, just fix it in a way the other features are and leave the refactoring to later. One reason for that is that we should fix this ASAP since without this patch the features will be stripped when formatting the XML on the disk and lost after next daemon reload. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/conf/domain_conf.c | 20 ++++++++++++++++++- .../qemuxmlconfdata/hyperv.x86_64-latest.xml | 5 ++++- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 785eb0e539b4..ae56b292ad1e 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -27972,7 +27972,6 @@ virDomainDefFormatFeatures(virBuffer *buf, case VIR_DOMAIN_HYPERV_RESET: case VIR_DOMAIN_HYPERV_FREQUENCIES: case VIR_DOMAIN_HYPERV_REENLIGHTENMENT: - case VIR_DOMAIN_HYPERV_TLBFLUSH: case VIR_DOMAIN_HYPERV_IPI: case VIR_DOMAIN_HYPERV_EVMCS: case VIR_DOMAIN_HYPERV_AVIC: @@ -28016,6 +28015,25 @@ virDomainDefFormatFeatures(virBuffer *buf, def->hyperv_vendor_id); break; + case VIR_DOMAIN_HYPERV_TLBFLUSH: + if (def->hyperv_features[j] != VIR_TRISTATE_SWITCH_ON) { + virBufferAddLit(&childBuf, "/>\n"); + break; + } + if (def->hyperv_tlbflush_direct == VIR_TRISTATE_SWITCH_ON || + def->hyperv_tlbflush_extended == VIR_TRISTATE_SWITCH_ON) { + virBufferAddLit(&childBuf, ">\n"); + virBufferAdjustIndent(&childBuf, 2); + if (def->hyperv_tlbflush_direct == VIR_TRISTATE_SWITCH_ON) + virBufferAddLit(&childBuf, "<direct state='on'/>\n"); + if (def->hyperv_tlbflush_extended == VIR_TRISTATE_SWITCH_ON) + virBufferAddLit(&childBuf, "<extended state='on'/>\n"); + virBufferAdjustIndent(&childBuf, -2); + virBufferAddLit(&childBuf, "</tlbflush>\n"); + } else { + virBufferAddLit(&childBuf, "/>\n"); + } + case VIR_DOMAIN_HYPERV_LAST: break; } diff --git a/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml b/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml index 36d9161fa811..49537188af3f 100644 --- a/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml @@ -22,7 +22,10 @@ <vendor_id state='on' value='KVM Hv'/> <frequencies state='on'/> <reenlightenment state='on'/> - <tlbflush state='on'/> + <tlbflush state='on'> + <direct state='on'/> + <extended state='on'/> + </tlbflush> <ipi state='on'/> <evmcs state='on'/> <avic state='on'/> -- 2.47.1

2 1

[PATCH v2 1/3] Revert "qemu: explicit swtpm state locking"
by marcandre.lureau＠redhat.com 06 Jan '25

06 Jan '25

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> This reverts commit bb5e26749fe5b5856a3541be2cbe147701e6e121. swtpm-setup doesn't have "tpmstate-lock", only swtpm. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com> --- src/qemu/qemu_tpm.c | 11 ++--------- src/util/virtpm.c | 1 - src/util/virtpm.h | 1 - tests/testutilsqemu.c | 1 - 4 files changed, 2 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index f5e0184e54..476e3dd224 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -344,23 +344,16 @@ static char * qemuTPMGetSwtpmSetupStateArg(const virDomainTPMSourceType source_type, const char *source_path) { - const char *lock = ",lock"; - - if (!virTPMSwtpmSetupCapsGet(VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK)) { - VIR_WARN("This swtpm version doesn't support explicit locking"); - lock = ""; - } - switch (source_type) { case VIR_DOMAIN_TPM_SOURCE_TYPE_FILE: /* the file:// prefix is supported since swtpm_setup 0.7.0 */ /* assume the capability check for swtpm is redundant. */ - return g_strdup_printf("file://%s%s", source_path, lock); + return g_strdup_printf("file://%s", source_path); case VIR_DOMAIN_TPM_SOURCE_TYPE_DIR: case VIR_DOMAIN_TPM_SOURCE_TYPE_DEFAULT: case VIR_DOMAIN_TPM_SOURCE_TYPE_LAST: default: - return g_strdup_printf("%s%s", source_path, lock); + return g_strdup_printf("%s", source_path); } } diff --git a/src/util/virtpm.c b/src/util/virtpm.c index 4016ad8fc4..f90839debe 100644 --- a/src/util/virtpm.c +++ b/src/util/virtpm.c @@ -53,7 +53,6 @@ VIR_ENUM_IMPL(virTPMSwtpmSetupFeature, "cmdarg-reconfigure-pcr-banks", "tpm-1.2", "tpm-2.0", - "tpmstate-opt-lock", "cmdarg-profile", ); diff --git a/src/util/virtpm.h b/src/util/virtpm.h index 03fb92629a..4119a903e5 100644 --- a/src/util/virtpm.h +++ b/src/util/virtpm.h @@ -45,7 +45,6 @@ typedef enum { VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONFIGURE_PCR_BANKS, VIR_TPM_SWTPM_SETUP_FEATURE_TPM_1_2, VIR_TPM_SWTPM_SETUP_FEATURE_TPM_2_0, - VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK, VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PROFILE, VIR_TPM_SWTPM_SETUP_FEATURE_LAST diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index 5caccbc6b4..abc425b9b7 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -71,7 +71,6 @@ virTPMSwtpmSetupCapsGet(virTPMSwtpmSetupFeature cap) case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_CREATE_CONFIG_FILES: case VIR_TPM_SWTPM_SETUP_FEATURE_TPM12_NOT_NEED_ROOT: case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONFIGURE_PCR_BANKS: - case VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK: case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PROFILE: case VIR_TPM_SWTPM_SETUP_FEATURE_LAST: break; -- 2.47.0

4 6

[PATCH] apparmor: Allow running loongarch64 VMs on Debian 12
by Xianglai Li 06 Jan '25

06 Jan '25

Allows to load firmware in the qemu-efi-loongarch64 directory Allows the binary qemu-system-loongarch64 to be run This makes it impossible to run loongarch64 VMs when AppArmor is enabled Signed-off-by: Xianglai Li <lixianglai(a)loongson.cn> --- src/security/apparmor/libvirt-qemu.in | 1 + src/security/virt-aa-helper.c | 1 + 2 files changed, 2 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu.in b/src/security/apparmor/libvirt-qemu.in index 694da26dea..c63077574e 100644 --- a/src/security/apparmor/libvirt-qemu.in +++ b/src/security/apparmor/libvirt-qemu.in @@ -144,6 +144,7 @@ /usr/bin/qemu-system-hppa rmix, /usr/bin/qemu-system-i386 rmix, /usr/bin/qemu-system-lm32 rmix, + /usr/bin/qemu-system-loongarch64 rmix, /usr/bin/qemu-system-m68k rmix, /usr/bin/qemu-system-microblaze rmix, /usr/bin/qemu-system-microblazeel rmix, diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 1cf9d7ad3d..94a28bf331 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -481,6 +481,7 @@ valid_path(const char *path, const bool readonly) "/usr/share/AAVMF/", "/usr/share/qemu-efi/", /* for AAVMF images */ "/usr/share/qemu-efi-aarch64/", + "/usr/share/qemu-efi-loongarch64/", "/usr/share/qemu-efi-riscv64/", "/usr/share/qemu/", /* SUSE path for OVMF and AAVMF images */ "/usr/lib/u-boot/", -- 2.39.1

3 5