- Devel - libvirt List Archives

[libvirt] [PATCH 2/2] libvirtd: Remove indirect linking
by Guido Günther 09 Mar '11

09 Mar '11

as described at http://wiki.debian.org/ToolChain/DSOLinking https://fedoraproject.org/wiki/UnderstandingDSOLinkChange otherwise the build fails on current Debian unstable with: CCLD libvirtd /usr/bin/ld: ../src/.libs/libvirt_driver_lxc.a(libvirt_driver_lxc_la-lxc_container.o): undefined reference to symbol 'capng_apply' /usr/bin/ld: note: 'capng_apply' is defined in DSO //usr/lib/libcap-ng.so.0 so try adding it to the linker command line CCLD libvirtd /usr/bin/ld: ../src/.libs/libvirt_driver_storage.a(libvirt_driver_storage_la-storage_backend.o): undefined reference to symbol 'fgetfilecon' /usr/bin/ld: note: 'fgetfilecon' is defined in DSO //lib/libselinux.so.1 so try adding it to the linker command line //lib/libselinux.so.1: could not read symbols: Invalid operation O.k. to apply? Cheers, -- Guido --- daemon/Makefile.am | 10 +++++++++- 1 files changed, 9 insertions(+), 1 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 912440c..2083084 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -145,7 +145,15 @@ if WITH_NWFILTER endif endif -libvirtd_LDADD += ../src/libvirt.la +if WITH_SECDRIVER_SELINUX + libvirtd_LDADD += $(SELINUX_LIBS) +endif +if WITH_SECDRIVER_APPARMOR + libvirtd_LDADD += $(APPARMOR_LIBS) +endif + +libvirtd_LDADD += ../src/libvirt.la \ + $(CAPNG_LIBS) if HAVE_POLKIT if HAVE_POLKIT0 -- 1.7.4.1

2 4

[libvirt] [libvirt-snmp][PATCH] configure.ac: lower required minimal version of autoconf
by Michal Privoznik 09 Mar '11

09 Mar '11

so we can build even on rhel 5.6 where the original version is not yet. --- configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 468fb07..dcab0ae 100644 --- a/configure.ac +++ b/configure.ac @@ -2,7 +2,7 @@ AC_INIT([libvirt-snmp],[0.0.1],[libvir-list@redhat.com],[],[http://libvirt.org]) AM_INIT_AUTOMAKE([-Wall -Werror]) AC_CONFIG_HEADERS([config.h]) -AC_PREREQ([2.66]) +AC_PREREQ([2.50]) AC_CHECK_FUNCS([memset]) AC_CHECK_FUNCS([strdup]) AC_CHECK_HEADERS([stdlib.h]) -- 1.7.4

3 2

[libvirt] (no subject)
by Guido Günther 09 Mar '11

09 Mar '11

>From 4a3765d97c3f5049aa294a4b7b629eabfd9cf04d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx(a)sigxcpu.org> Date: Mon, 7 Mar 2011 22:22:36 +0100 Subject: [PATCH 1/2] Move rundir creation into separate function --- daemon/libvirtd.c | 31 ++++++++++++++++++++----------- 1 files changed, 20 insertions(+), 11 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 452566c..610e7fd 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -3150,6 +3150,24 @@ enum { OPT_VERSION = 129 }; + +/* Ensure the rundir exists (on tmpfs on some systems) */ +static int create_rundir (void) +{ + const char *rundir = LOCALSTATEDIR "/run/libvirt"; + int ret = 0; + + if (mkdir (rundir, 0755)) { + if (errno != EEXIST) { + char ebuf[1024]; + VIR_ERROR(_("unable to create rundir %s: %s"), rundir, + virStrerror(errno, ebuf, sizeof(ebuf))); + ret = VIR_DAEMON_ERR_RUNDIR; + } + } + return ret; +} + #define MAX_LISTEN 5 int main(int argc, char **argv) { struct qemud_server *server = NULL; @@ -3276,17 +3294,8 @@ int main(int argc, char **argv) { /* Ensure the rundir exists (on tmpfs on some systems) */ if (geteuid() == 0) { - const char *rundir = LOCALSTATEDIR "/run/libvirt"; - - if (mkdir (rundir, 0755)) { - if (errno != EEXIST) { - char ebuf[1024]; - VIR_ERROR(_("unable to create rundir %s: %s"), rundir, - virStrerror(errno, ebuf, sizeof(ebuf))); - ret = VIR_DAEMON_ERR_RUNDIR; - goto error; - } - } + if (create_rundir ()) + goto error; } /* Beyond this point, nothing should rely on using -- 1.7.4.1

2 2

[libvirt] [PATCH] Fix a wrong error message threw to user.
by Hu Tao 09 Mar '11

09 Mar '11

--- src/qemu/qemu_driver.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 0f7cbad..f26b1ef 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4209,8 +4209,8 @@ static int qemuDomainUpdateDeviceFlags(virDomainPtr dom, default: qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, - _("disk device type '%s' cannot be updated"), - virDomainDiskDeviceTypeToString(dev->data.disk->device)); + _("device type '%s' cannot be updated"), + virDomainDeviceTypeToString(dev->type)); break; } -- 1.7.3.1

2 1

[libvirt] [PATCH] security: ignore disk opening failure of DAC driver.
by Osier Yang 09 Mar '11

09 Mar '11

Which blocks the domain booting up if one of the disks can't be opened (e.g. doesn't exist). --- src/security/security_dac.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index fba2d1d..8bb5bc9 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -182,7 +182,7 @@ virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, return virDomainDiskDefForeachPath(disk, virSecurityManagerGetAllowDiskFormatProbing(mgr), - false, + true, virSecurityDACSetSecurityFileLabel, mgr); } -- 1.7.4

2 1

[libvirt] [PATCH] dynamic_ownership documentation
by Stephan Mueller 09 Mar '11

09 Mar '11

Hi, I would like to propose the following patch for the libvirtd.conf file to document sVirt and its usage. If you have suggestions to add better wording, please let me know. (If you reply with comments, could you please CC me as I am not on the list.) Ciao Stephan --- diff --git a/cc-config/cc/libvirtd.conf b/cc-config/cc/libvirtd.conf index 43e19d8..a9acc21 100644 --- a/cc-config/cc/libvirtd.conf +++ b/cc-config/cc/libvirtd.conf @@ -154,7 +154,52 @@ auth_unix_rw = "none" # mechanism as well, by using 'sasl' for this option #auth_tls = "none" - +################################################################# +# +# sVirt protection mechanisms +# +# The following options specify the separation of virtual machines +# based on SELinux categories. As virtual machines execute with the +# same user ID, an additional separation functionality is necessary +# to prevent different virtual machines from interfering with each other +# in case the simulation environment provided with QEMU is +# successfully broken by a rogue guest. +# +# The sVirt protection mechanism implements two modes of operation: +# dynamic assignment of SELinux categories +# static assignment of SELinux labels +# +# A dynamic assignment of categories implies that libvirt generates +# a unique SELinux category that the virtual machine and its resources +# are assigned to during the instantiation of the virtual machine. +# SELinux ensures that each virtual machine can only access resources +# labeled with the same category as the virtual machine itself. +# +# A static assignment of SELinux labels imply that the administrator +# manually configures the SELinux label of the virtual machine in +# /etc/libvirt/qemu/<VM-DESCRIPTOR> based on the following example: +# +# <seclabel model='selinux' type="static"> +# <label>system_u:system_r:qemu_t:s0:c210.c502</label> +# </seclabel> +# +# The <label> tag specifies a full SELinux label the virtual machine +# will be executed with. +# +# In addition to the setting of the SELinux label of the virtual +# machine, the administrator must manually set the SELinux label +# of all resources the virtual machine accesses appropriately. +# +# NOTE: The dynamic assignment of categories is only intended for +# systems with the targeted SELinux policy. Systems with the MLS +# SELinux policy MUST use the static assignment of labels. +# It is possible that static assignment is configured for +# systems with the targeted policy as well. +# +# dynamic_ownership: 0 == static assignment of SELinux labels +# 1 == dynamic assignment of SELinux labels +dynamic_ownership=1 +#

3 4

[libvirt] how to install 'devel' module from source files...
by john alexander sanabria ordonez 09 Mar '11

09 Mar '11

Hi, I'm wondering how, when libvirt is installed from sources, to also install the 'development' files? I installed libvirt-0.8.8 with no problems and 'virsh' works OK. However, when I try to install, for instance libvirt-ruby, it asks me for libvirt development files. What extra step is required? Thanks,

2 1

[libvirt] [PATCH 1/2] build: fix build on cygwin
by Eric Blake 09 Mar '11

09 Mar '11

On cygwin: CC libvirt_util_la-cgroup.lo util/cgroup.c: In function 'virCgroupKillRecursiveInternal': util/cgroup.c:1458: warning: implicit declaration of function 'virCgroupNew' [-Wimplicit-function-declaration] * src/util/cgroup.c (virCgroupKill): Don't build on platforms where virCgroupNew is unsupported. --- Pushing under the build-breaker rule. And this time, it really was a cygwin failure ;) src/util/cgroup.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/util/cgroup.c b/src/util/cgroup.c index c5b8cdd..8551acd 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -1308,7 +1308,7 @@ int virCgroupGetFreezerState(virCgroupPtr group, char **state) } -#ifdef HAVE_KILL +#if defined HAVE_KILL && defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R static int virCgroupKillInternal(virCgroupPtr group, int signum, virHashTablePtr pids) { int rc; @@ -1523,7 +1523,7 @@ int virCgroupKillPainfully(virCgroupPtr group) return rc; } -#else /* HAVE_KILL */ +#else /* !(HAVE_KILL, HAVE_MNTENT_H, HAVE_GETMNTENT_R) */ int virCgroupKill(virCgroupPtr group ATTRIBUTE_UNUSED, int signum ATTRIBUTE_UNUSED) { @@ -1539,4 +1539,4 @@ int virCgroupKillPainfully(virCgroupPtr group ATTRIBUTE_UNUSED) { return -ENOSYS; } -#endif /* HAVE_KILL */ +#endif /* HAVE_KILL, HAVE_MNTENT_H, HAVE_GETMNTENT_R */ -- 1.7.4

1 1

[libvirt] [PATCH] build: fix building error when building without libvirtd
by Wen Congyang 09 Mar '11

09 Mar '11

When building libvirt without libvirtd, I receive the following errors: make[1]: Leaving directory `/home/wency/source/test/libvirt/src' (cd daemon && make top_distdir=../libvirt-0.8.8 distdir=../libvirt-0.8.8/daemon \ am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir) make[1]: Entering directory `/home/wency/source/test/libvirt/daemon' make[1]: *** No rule to make target `libvirtd.8.in', needed by `distdir'. Stop. make[1]: Leaving directory `/home/wency/source/test/libvirt/daemon' make: *** [distdir] Error 1 This bug was caused by commit 6db98a2d. Signed-off-by: Wen Congyang <wency(a)cn.fujitsu.com> --- daemon/Makefile.am | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 912440c..b4880a9 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -38,7 +38,6 @@ EXTRA_DIST = \ test_libvirtd.aug \ THREADING.txt \ libvirtd.pod.in \ - libvirtd.8.in \ libvirtd.stp \ $(AVAHI_SOURCES) \ $(DAEMON_SOURCES) @@ -47,6 +46,8 @@ BUILT_SOURCES = if WITH_LIBVIRTD +EXTRA_DIST += libvirtd.8.in + man8_MANS = libvirtd.8 sbin_PROGRAMS = libvirtd -- 1.7.1

2 3

[libvirt] [RFC PATCH] cgroup: allow fine-tuning of device ACL permissions
by Eric Blake 09 Mar '11

09 Mar '11

Adding audit points showed that we were granting too much privilege to qemu; it should not need any mknod rights to recreate any devices other than ptys. On the other hand, lxc should have all device privileges. The solution is adding a flag parameter. * src/util/cgroup.h (virCgroup*Device*): Adjust prototypes. * src/util/cgroup.c (virCgroupAllowDevice) (virCgroupAllowDeviceMajor, virCgroupAllowDevicePath) (virCgroupDenyDevice, virCgroupDenyDeviceMajor) (virCgroupDenyDevicePath): Add parameter. * src/qemu/qemu_cgroup.c: Update clients. * src/qemu/qemu_driver.c (qemudDomainSaveFlag): Likewise. * src/lxc/lxc_controller.c (lxcSetContainerResources): Likewise. --- https://bugzilla.redhat.com/show_bug.cgi?id=683163 was created based on my audit patches. RFC for two reasons: This patch won't apply unless you have my other pending qemu audit patches in place (I still need to post those, but ran out of time for now...) I need to do a followup patch to also restrict write access to a disk explicitly marked read-only from qemu's point of view. But I wanted to at least get this email posted to start feedback. src/lxc/lxc_controller.c | 9 +++++-- src/qemu/qemu_cgroup.c | 23 +++++++++++------- src/qemu/qemu_driver.c | 9 +++++-- src/util/cgroup.c | 55 +++++++++++++++++++++++++++++++++------------ src/util/cgroup.h | 26 ++++++++++++++++----- 5 files changed, 86 insertions(+), 36 deletions(-) diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index d2b113c..296b302 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2010 Red Hat, Inc. Copyright IBM Corp. 2008 + * Copyright (C) 2010-2011 Red Hat, Inc. + * Copyright IBM Corp. 2008 * * lxc_controller.c: linux container process controller * @@ -168,7 +169,8 @@ static int lxcSetContainerResources(virDomainDefPtr def) rc = virCgroupAllowDevice(cgroup, dev->type, dev->major, - dev->minor); + dev->minor, + VIR_CGROUP_DEVICE_RWM); if (rc != 0) { virReportSystemError(-rc, _("Unable to allow device %c:%d:%d for domain %s"), @@ -177,7 +179,8 @@ static int lxcSetContainerResources(virDomainDefPtr def) } } - rc = virCgroupAllowDeviceMajor(cgroup, 'c', LXC_DEV_MAJ_PTY); + rc = virCgroupAllowDeviceMajor(cgroup, 'c', LXC_DEV_MAJ_PTY, + VIR_CGROUP_DEVICE_RWM); if (rc != 0) { virReportSystemError(-rc, _("Unable to allow PYT devices for domain %s"), diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index ebf9ad5..3c124fd 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -66,7 +66,8 @@ qemuSetupDiskPathAllow(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, VIR_DEBUG("Process path %s for disk", path); /* XXX RO vs RW */ - rc = virCgroupAllowDevicePath(data->cgroup, path); + rc = virCgroupAllowDevicePath(data->cgroup, path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(data->vm, data->cgroup, "allow", path, rc); if (rc < 0) { if (rc == -EACCES) { /* Get this for root squash NFS */ @@ -106,8 +107,8 @@ qemuTeardownDiskPathDeny(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, int rc; VIR_DEBUG("Process path %s for disk", path); - /* XXX RO vs RW */ - rc = virCgroupDenyDevicePath(data->cgroup, path); + rc = virCgroupDenyDevicePath(data->cgroup, path, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupPath(data->vm, data->cgroup, "deny", path, rc); if (rc < 0) { if (rc == -EACCES) { /* Get this for root squash NFS */ @@ -150,7 +151,8 @@ qemuSetupChardevCgroup(virDomainDefPtr def, VIR_DEBUG("Process path '%s' for disk", dev->source.data.file.path); - rc = virCgroupAllowDevicePath(data->cgroup, dev->source.data.file.path); + rc = virCgroupAllowDevicePath(data->cgroup, dev->source.data.file.path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(data->vm, data->cgroup, "allow", dev->source.data.file.path, rc); if (rc < 0) { @@ -172,7 +174,8 @@ int qemuSetupHostUsbDeviceCgroup(usbDevice *dev ATTRIBUTE_UNUSED, int rc; VIR_DEBUG("Process path '%s' for USB device", path); - rc = virCgroupAllowDevicePath(data->cgroup, path); + rc = virCgroupAllowDevicePath(data->cgroup, path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(data->vm, data->cgroup, "allow", path, rc); if (rc < 0) { virReportSystemError(-rc, @@ -226,7 +229,8 @@ int qemuSetupCgroup(struct qemud_driver *driver, goto cleanup; } - rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_PTY_MAJOR); + rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_PTY_MAJOR, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupMajor(vm, cgroup, "allow", DEVICE_PTY_MAJOR, "pty", rc == 0); if (rc != 0) { @@ -240,7 +244,8 @@ int qemuSetupCgroup(struct qemud_driver *driver, ((vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && driver->vncAllowHostAudio) || (vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL)))) { - rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR); + rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupMajor(vm, cgroup, "allow", DEVICE_SND_MAJOR, "sound", rc == 0); if (rc != 0) { @@ -251,8 +256,8 @@ int qemuSetupCgroup(struct qemud_driver *driver, } for (i = 0; deviceACL[i] != NULL ; i++) { - rc = virCgroupAllowDevicePath(cgroup, - deviceACL[i]); + rc = virCgroupAllowDevicePath(cgroup, deviceACL[i], + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(vm, cgroup, "allow", deviceACL[i], rc); if (rc < 0 && rc != -ENOENT) { diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 1981cdf..7b4edc5 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1962,7 +1962,8 @@ static int qemudDomainSaveFlag(struct qemud_driver *driver, virDomainPtr dom, vm->def->name); goto endjob; } - rc = virCgroupAllowDevicePath(cgroup, path); + rc = virCgroupAllowDevicePath(cgroup, path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(vm, cgroup, "allow", path, rc); if (rc < 0) { virReportSystemError(-rc, @@ -2012,7 +2013,8 @@ static int qemudDomainSaveFlag(struct qemud_driver *driver, virDomainPtr dom, VIR_WARN("failed to restore save state label on %s", path); if (cgroup != NULL) { - rc = virCgroupDenyDevicePath(cgroup, path); + rc = virCgroupDenyDevicePath(cgroup, path, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupPath(vm, cgroup, "deny", path, rc); if (rc < 0) VIR_WARN("Unable to deny device %s for %s %d", @@ -2044,7 +2046,8 @@ endjob: } if (cgroup != NULL) { - rc = virCgroupDenyDevicePath(cgroup, path); + rc = virCgroupDenyDevicePath(cgroup, path, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupPath(vm, cgroup, "deny", path, rc); if (rc < 0) VIR_WARN("Unable to deny device %s for %s: %d", diff --git a/src/util/cgroup.c b/src/util/cgroup.c index a16b1ab..10e3143 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -1081,7 +1081,7 @@ int virCgroupGetSwapHardLimit(virCgroupPtr group, unsigned long long *kb) /** * virCgroupDenyAllDevices: * - * @group: The cgroup to deny devices for + * @group: The cgroup to deny all permissions, for all devices * * Returns: 0 on success */ @@ -1100,15 +1100,20 @@ int virCgroupDenyAllDevices(virCgroupPtr group) * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device * @minor: The minor number of the device + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to allow * * Returns: 0 on success */ -int virCgroupAllowDevice(virCgroupPtr group, char type, int major, int minor) +int virCgroupAllowDevice(virCgroupPtr group, char type, int major, int minor, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:%i rwm", type, major, minor) == -1) { + if (virAsprintf(&devstr, "%c %i:%i %s%s%s", type, major, minor, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1129,15 +1134,20 @@ out: * @group: The cgroup to allow an entire device major type for * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device type + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to allow * * Returns: 0 on success */ -int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major) +int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:* rwm", type, major) == -1) { + if (virAsprintf(&devstr, "%c %i:* %s%s%s", type, major, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1157,6 +1167,7 @@ int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major) * * @group: The cgroup to allow the device for * @path: the device to allow + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to allow * * Queries the type of device and its major/minor number, and * adds that to the cgroup ACL @@ -1165,7 +1176,7 @@ int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major) * negative errno value on failure */ #if defined(major) && defined(minor) -int virCgroupAllowDevicePath(virCgroupPtr group, const char *path) +int virCgroupAllowDevicePath(virCgroupPtr group, const char *path, int perms) { struct stat sb; @@ -1178,11 +1189,13 @@ int virCgroupAllowDevicePath(virCgroupPtr group, const char *path) return virCgroupAllowDevice(group, S_ISCHR(sb.st_mode) ? 'c' : 'b', major(sb.st_rdev), - minor(sb.st_rdev)); + minor(sb.st_rdev), + perms); } #else int virCgroupAllowDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *path ATTRIBUTE_UNUSED) + const char *path ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) { return -ENOSYS; } @@ -1196,15 +1209,20 @@ int virCgroupAllowDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device * @minor: The minor number of the device + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to deny * * Returns: 0 on success */ -int virCgroupDenyDevice(virCgroupPtr group, char type, int major, int minor) +int virCgroupDenyDevice(virCgroupPtr group, char type, int major, int minor, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:%i rwm", type, major, minor) == -1) { + if (virAsprintf(&devstr, "%c %i:%i %s%s%s", type, major, minor, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1225,15 +1243,20 @@ out: * @group: The cgroup to deny an entire device major type for * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device type + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to deny * * Returns: 0 on success */ -int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, int major) +int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, int major, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:* rwm", type, major) == -1) { + if (virAsprintf(&devstr, "%c %i:* %s%s%s", type, major, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1249,7 +1272,7 @@ int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, int major) } #if defined(major) && defined(minor) -int virCgroupDenyDevicePath(virCgroupPtr group, const char *path) +int virCgroupDenyDevicePath(virCgroupPtr group, const char *path, int perms) { struct stat sb; @@ -1262,11 +1285,13 @@ int virCgroupDenyDevicePath(virCgroupPtr group, const char *path) return virCgroupDenyDevice(group, S_ISCHR(sb.st_mode) ? 'c' : 'b', major(sb.st_rdev), - minor(sb.st_rdev)); + minor(sb.st_rdev), + perms); } #else int virCgroupDenyDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *path ATTRIBUTE_UNUSED) + const char *path ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) { return -ENOSYS; } diff --git a/src/util/cgroup.h b/src/util/cgroup.h index b3c5f27..16ffb46 100644 --- a/src/util/cgroup.h +++ b/src/util/cgroup.h @@ -60,27 +60,41 @@ int virCgroupGetMemorySoftLimit(virCgroupPtr group, unsigned long long *kb); int virCgroupSetSwapHardLimit(virCgroupPtr group, unsigned long long kb); int virCgroupGetSwapHardLimit(virCgroupPtr group, unsigned long long *kb); +enum { + VIR_CGROUP_DEVICE_READ = 1, + VIR_CGROUP_DEVICE_WRITE = 2, + VIR_CGROUP_DEVICE_MKNOD = 4, + VIR_CGROUP_DEVICE_RW = VIR_CGROUP_DEVICE_READ | VIR_CGROUP_DEVICE_WRITE, + VIR_CGROUP_DEVICE_RWM = VIR_CGROUP_DEVICE_RW | VIR_CGROUP_DEVICE_MKNOD, +}; + int virCgroupDenyAllDevices(virCgroupPtr group); int virCgroupAllowDevice(virCgroupPtr group, char type, int major, - int minor); + int minor, + int perms); int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, - int major); + int major, + int perms); int virCgroupAllowDevicePath(virCgroupPtr group, - const char *path); + const char *path, + int perms); int virCgroupDenyDevice(virCgroupPtr group, char type, int major, - int minor); + int minor, + int perms); int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, - int major); + int major, + int perms); int virCgroupDenyDevicePath(virCgroupPtr group, - const char *path); + const char *path, + int perms); int virCgroupSetCpuShares(virCgroupPtr group, unsigned long long shares); int virCgroupGetCpuShares(virCgroupPtr group, unsigned long long *shares); -- 1.7.4

1 0