- Devel - libvirt List Archives

[libvirt] [PATCH] buf: protect against integer overflow
by Eric Blake 24 Jun '11

24 Jun '11

It's unlikely that we'll ever want to escape a string as long as INT_MAX/6, but adding this check can't hurt. * src/util/buf.c (virBufferEscapeSexpr, virBufferEscapeString): Check for (unlikely) overflow. --- src/util/buf.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/util/buf.c b/src/util/buf.c index 750e277..5002486 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -311,7 +311,8 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st return; } - if (VIR_ALLOC_N(escaped, 6 * len + 1) < 0) { + if (xalloc_oversized(6, len) || + VIR_ALLOC_N(escaped, 6 * len + 1) < 0) { virBufferSetError(buf); return; } @@ -398,7 +399,8 @@ virBufferEscapeSexpr(const virBufferPtr buf, return; } - if (VIR_ALLOC_N(escaped, 2 * len + 1) < 0) { + if (xalloc_oversized(2, len) || + VIR_ALLOC_N(escaped, 2 * len + 1) < 0) { virBufferSetError(buf); return; } -- 1.7.4.4

2 2

[libvirt] [PATCH 1/2] build: update gnulib
by Eric Blake 24 Jun '11

24 Jun '11

Done as a separate commit to make backporting the next patch easier. * .gnulib: Update, for syntax-check fix. --- If anyone needs to backport the next patch, it will be easier to add an appropriate INT_MULTIPLY_OVERFLOW macro in "internal.h" than to do a gnulib update, so I've separated these two tasks. .gnulib | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/.gnulib b/.gnulib index 478c2dc..25e4c2e 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 478c2dcc839e5f4765e6417684ce414e2d4973a8 +Subproject commit 25e4c2ec96602d132ad4429d6eaebaea1a8f504b -- 1.7.4.4

2 5

[libvirt] [PATCH] build: avoid long line tests
by Eric Blake 24 Jun '11

24 Jun '11

'make syntax-check' regression introduced in commit 60b9c69. * tests/networkxml2argvdata/*.argv: Break long lines. --- Pushing under the build-breaker rule. tests/networkxml2argvdata/isolated-network.argv | 6 +++++- .../networkxml2argvdata/nat-network-dns-hosts.argv | 4 +++- .../nat-network-dns-txt-record.argv | 9 ++++++++- tests/networkxml2argvdata/nat-network.argv | 8 +++++++- tests/networkxml2argvdata/netboot-network.argv | 7 ++++++- .../networkxml2argvdata/netboot-proxy-network.argv | 6 +++++- tests/networkxml2argvdata/routed-network.argv | 3 ++- 7 files changed, 36 insertions(+), 7 deletions(-) diff --git a/tests/networkxml2argvdata/isolated-network.argv b/tests/networkxml2argvdata/isolated-network.argv index e0993fb..f801396 100644 --- a/tests/networkxml2argvdata/isolated-network.argv +++ b/tests/networkxml2argvdata/isolated-network.argv @@ -1 +1,5 @@ -/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= --except-interface lo --dhcp-option=3 --listen-address 192.168.152.1 --dhcp-range 192.168.152.2,192.168.152.254 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/private.leases --dhcp-lease-max=253 --dhcp-no-override \ No newline at end of file +/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= \ +--except-interface lo --dhcp-option=3 --listen-address 192.168.152.1 \ +--dhcp-range 192.168.152.2,192.168.152.254 \ +--dhcp-leasefile=/var/lib/libvirt/dnsmasq/private.leases --dhcp-lease-max=253 \ +--dhcp-no-override\ diff --git a/tests/networkxml2argvdata/nat-network-dns-hosts.argv b/tests/networkxml2argvdata/nat-network-dns-hosts.argv index d240bf4..dce075b 100644 --- a/tests/networkxml2argvdata/nat-network-dns-hosts.argv +++ b/tests/networkxml2argvdata/nat-network-dns-hosts.argv @@ -1 +1,3 @@ -/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= --except-interface lo --listen-address 192.168.122.1 --addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts \ No newline at end of file +/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= \ +--except-interface lo --listen-address 192.168.122.1 \ +--addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts\ diff --git a/tests/networkxml2argvdata/nat-network-dns-txt-record.argv b/tests/networkxml2argvdata/nat-network-dns-txt-record.argv index c000808..9d74543 100644 --- a/tests/networkxml2argvdata/nat-network-dns-txt-record.argv +++ b/tests/networkxml2argvdata/nat-network-dns-txt-record.argv @@ -1 +1,8 @@ -/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= --except-interface lo --txt-record=example,example value --listen-address 192.168.122.1 --listen-address 192.168.123.1 --listen-address 2001:db8:ac10:fe01::1 --listen-address 2001:db8:ac10:fd01::1 --listen-address 10.24.10.1 --dhcp-range 192.168.122.2,192.168.122.254 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases --dhcp-lease-max=253 --dhcp-no-override \ No newline at end of file +/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= \ +--except-interface lo --txt-record=example,example value \ +--listen-address 192.168.122.1 --listen-address 192.168.123.1 \ +--listen-address 2001:db8:ac10:fe01::1 \ +--listen-address 2001:db8:ac10:fd01::1 --listen-address 10.24.10.1 \ +--dhcp-range 192.168.122.2,192.168.122.254 \ +--dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases \ +--dhcp-lease-max=253 --dhcp-no-override\ diff --git a/tests/networkxml2argvdata/nat-network.argv b/tests/networkxml2argvdata/nat-network.argv index d58672f..181623f 100644 --- a/tests/networkxml2argvdata/nat-network.argv +++ b/tests/networkxml2argvdata/nat-network.argv @@ -1 +1,7 @@ -/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= --except-interface lo --listen-address 192.168.122.1 --listen-address 192.168.123.1 --listen-address 2001:db8:ac10:fe01::1 --listen-address 2001:db8:ac10:fd01::1 --listen-address 10.24.10.1 --dhcp-range 192.168.122.2,192.168.122.254 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases --dhcp-lease-max=253 --dhcp-no-override \ No newline at end of file +/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= \ +--except-interface lo --listen-address 192.168.122.1 \ +--listen-address 192.168.123.1 --listen-address 2001:db8:ac10:fe01::1 \ +--listen-address 2001:db8:ac10:fd01::1 --listen-address 10.24.10.1 \ +--dhcp-range 192.168.122.2,192.168.122.254 \ +--dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases \ +--dhcp-lease-max=253 --dhcp-no-override\ diff --git a/tests/networkxml2argvdata/netboot-network.argv b/tests/networkxml2argvdata/netboot-network.argv index c5db9e0..27ffaa1 100644 --- a/tests/networkxml2argvdata/netboot-network.argv +++ b/tests/networkxml2argvdata/netboot-network.argv @@ -1 +1,6 @@ -/usr/sbin/dnsmasq --strict-order --bind-interfaces --domain example.com --conf-file= --except-interface lo --listen-address 192.168.122.1 --dhcp-range 192.168.122.2,192.168.122.254 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/netboot.leases --dhcp-lease-max=253 --dhcp-no-override --enable-tftp --tftp-root /var/lib/tftproot --dhcp-boot pxeboot.img \ No newline at end of file +/usr/sbin/dnsmasq --strict-order --bind-interfaces --domain example.com \ +--conf-file= --except-interface lo --listen-address 192.168.122.1 \ +--dhcp-range 192.168.122.2,192.168.122.254 \ +--dhcp-leasefile=/var/lib/libvirt/dnsmasq/netboot.leases \ +--dhcp-lease-max=253 --dhcp-no-override --enable-tftp \ +--tftp-root /var/lib/tftproot --dhcp-boot pxeboot.img\ diff --git a/tests/networkxml2argvdata/netboot-proxy-network.argv b/tests/networkxml2argvdata/netboot-proxy-network.argv index 06e5b08..3e0c5a5 100644 --- a/tests/networkxml2argvdata/netboot-proxy-network.argv +++ b/tests/networkxml2argvdata/netboot-proxy-network.argv @@ -1 +1,5 @@ -/usr/sbin/dnsmasq --strict-order --bind-interfaces --domain example.com --conf-file= --except-interface lo --listen-address 192.168.122.1 --dhcp-range 192.168.122.2,192.168.122.254 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/netboot.leases --dhcp-lease-max=253 --dhcp-no-override --dhcp-boot pxeboot.img,,10.20.30.40 \ No newline at end of file +/usr/sbin/dnsmasq --strict-order --bind-interfaces --domain example.com \ +--conf-file= --except-interface lo --listen-address 192.168.122.1 \ +--dhcp-range 192.168.122.2,192.168.122.254 \ +--dhcp-leasefile=/var/lib/libvirt/dnsmasq/netboot.leases \ +--dhcp-lease-max=253 --dhcp-no-override --dhcp-boot pxeboot.img,,10.20.30.40\ diff --git a/tests/networkxml2argvdata/routed-network.argv b/tests/networkxml2argvdata/routed-network.argv index bf5f579..d059630 100644 --- a/tests/networkxml2argvdata/routed-network.argv +++ b/tests/networkxml2argvdata/routed-network.argv @@ -1 +1,2 @@ -/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= --except-interface lo --listen-address 192.168.122.1 \ No newline at end of file +/usr/sbin/dnsmasq --strict-order --bind-interfaces --conf-file= \ +--except-interface lo --listen-address 192.168.122.1\ -- 1.7.4.4

1 0

[libvirt] [PATCH] Rename iface(G|S)etMacaddr to iface(G|S)etMacAddress for consistency
by Matthias Bolte 24 Jun '11

24 Jun '11

--- src/libvirt_private.syms | 4 ++-- src/util/interface.c | 26 +++++++++++++------------- src/util/interface.h | 4 ++-- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index f34ef9e..ea2414d 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -498,7 +498,7 @@ ifaceCheck; ifaceCtrl; ifaceGetFlags; ifaceGetIndex; -ifaceGetMacaddr; +ifaceGetMacAddress; ifaceGetNthParent; ifaceGetVlanID; ifaceIsUp; @@ -507,7 +507,7 @@ ifaceMacvtapLinkAdd; ifaceMacvtapLinkDump; ifaceReplaceMacAddress; ifaceRestoreMacAddress; -ifaceSetMacaddr; +ifaceSetMacAddress; # interface_conf.h diff --git a/src/util/interface.c b/src/util/interface.c index a5ab271..d51ceec 100644 --- a/src/util/interface.c +++ b/src/util/interface.c @@ -397,7 +397,7 @@ ifaceGetVlanID(const char *vlanifname ATTRIBUTE_UNUSED, #endif /* __linux__ */ /** - * ifaceGetMacaddr: + * ifaceGetMacAddress: * @ifname: interface name to set MTU for * @macaddr: MAC address (VIR_MAC_BUFLEN in size) * @@ -407,8 +407,8 @@ ifaceGetVlanID(const char *vlanifname ATTRIBUTE_UNUSED, */ #ifdef __linux__ int -ifaceGetMacaddr(const char *ifname, - unsigned char *macaddr) +ifaceGetMacAddress(const char *ifname, + unsigned char *macaddr) { struct ifreq ifr; int fd; @@ -435,8 +435,8 @@ ifaceGetMacaddr(const char *ifname, #else int -ifaceGetMacaddr(const char *ifname ATTRIBUTE_UNUSED, - unsigned char *macaddr ATTRIBUTE_UNUSED) +ifaceGetMacAddress(const char *ifname ATTRIBUTE_UNUSED, + unsigned char *macaddr ATTRIBUTE_UNUSED) { return ENOSYS; } @@ -444,7 +444,7 @@ ifaceGetMacaddr(const char *ifname ATTRIBUTE_UNUSED, #endif /* __linux__ */ /** - * ifaceSetMacaddr: + * ifaceSetMacAddress: * @ifname: interface name to set MTU for * @macaddr: MAC address (VIR_MAC_BUFLEN in size) * @@ -455,8 +455,8 @@ ifaceGetMacaddr(const char *ifname ATTRIBUTE_UNUSED, */ #ifdef __linux__ int -ifaceSetMacaddr(const char *ifname, - const unsigned char *macaddr) +ifaceSetMacAddress(const char *ifname, + const unsigned char *macaddr) { struct ifreq ifr; int fd; @@ -484,8 +484,8 @@ ifaceSetMacaddr(const char *ifname, #else int -ifaceSetMacaddr(const char *ifname ATTRIBUTE_UNUSED, - const unsigned char *macaddr ATTRIBUTE_UNUSED) +ifaceSetMacAddress(const char *ifname ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED) { return ENOSYS; } @@ -1027,7 +1027,7 @@ ifaceReplaceMacAddress(const unsigned char *macaddress, unsigned char oldmac[6]; int rc; - rc = ifaceGetMacaddr(linkdev, oldmac); + rc = ifaceGetMacAddress(linkdev, oldmac); if (rc) { virReportSystemError(rc, @@ -1054,7 +1054,7 @@ ifaceReplaceMacAddress(const unsigned char *macaddress, } } - rc = ifaceSetMacaddr(linkdev, macaddress); + rc = ifaceSetMacAddress(linkdev, macaddress); if (rc) { virReportSystemError(rc, _("Setting MAC address on '%s' to " @@ -1104,7 +1104,7 @@ ifaceRestoreMacAddress(const char *linkdev, } /*reset mac and remove file-ignore results*/ - rc = ifaceSetMacaddr(linkdev, oldmac); + rc = ifaceSetMacAddress(linkdev, oldmac); if (rc) { virReportSystemError(rc, _("Setting MAC address on '%s' to " diff --git a/src/util/interface.h b/src/util/interface.h index 663fabb..5cbf5c1 100644 --- a/src/util/interface.h +++ b/src/util/interface.h @@ -45,9 +45,9 @@ int ifaceGetIndex(bool reportError, const char *ifname, int *ifindex); int ifaceGetVlanID(const char *vlanifname, int *vlanid); -int ifaceSetMacaddr(const char *ifname, const unsigned char *macaddr); +int ifaceSetMacAddress(const char *ifname, const unsigned char *macaddr); -int ifaceGetMacaddr(const char *ifname, unsigned char *macaddr); +int ifaceGetMacAddress(const char *ifname, unsigned char *macaddr); int ifaceMacvtapLinkAdd(const char *type, const unsigned char *macaddress, int macaddrsize, -- 1.7.0.4

2 2

[libvirt] [PATCH] Fix typo in libvirt_private.syms
by Matthias Bolte 24 Jun '11

24 Jun '11

Triggered a linker error on MinGW. --- I'm pushing this one under the build breaker rule. src/libvirt_private.syms | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 070b4c1..da7e186 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -507,7 +507,7 @@ ifaceLinkDel; ifaceMacvtapLinkAdd; ifaceMacvtapLinkDump; ifaceReplaceMacAddress; -ifaceRestoreMacaddress; +ifaceRestoreMacAddress; ifaceSetMacaddr; -- 1.7.0.4

1 0

[libvirt] [PATCH v6 0/5] Add TXT record and hosts support for DNS service and dnsmasq command-line regression testing
by Michal Novotny 24 Jun '11

24 Jun '11

Hi, this is the 6th (and hopefully the last) version of my patch to introduce the TXT record and DNS hosts support for the DNS service on the virtual network. This can be defined using the txt subelement in the dns element of the network XML description. The definition of TXT record names containing spaces is rejected with the error message that TXT record names in DNS doesn't support spaces. Also, regression testing for the dnsmasq command line has been added to test whether the dnsmasq command-line is correct or not. The new XML definition syntax is: <dns> <txt name="example" value="example value" /> <host ip='192.168.122.1'> <hostname>gateway</hostname> <hostname>host</hostname> </host> </dns> Where multiple host elements can be defined to put the aliases. The <dns> element have to be present on the <ip> level, i.e. one level upper than it was in version 2 of the patch since the definition affects all the IP addresses on the network. The patch series has been tested for the configuration and it was working fine and also RelaxNG schema with the tests have been both altered to add test cases to test those patches. This is the new version for latest libvirt codebase so please review the patchset. Some fixes and code optimizations were done by Laine Stump, so I'm adding him into the SOB clause as well ;-) Please review. Thanks, Michal Signed-off-by: Michal Novotny <minovotn(a)redhat.com> Signed-off-by: Laine Stump <lstump(a)redhat.com> Michal Novotny (5): Add TXT record support for virtual DNS service Network: Add regression tests for the command-line arguments Network: Move dnsmasqContext creation to networkSaveDnsmasqHostsfile() Network: Add additional hosts internal infrastructure Network: Add support for DNS hosts definition to the network XML docs/formatnetwork.html.in | 29 ++- docs/schemas/network.rng | 28 ++ src/Makefile.am | 7 +- src/conf/network_conf.c | 206 ++++++++++++++ src/conf/network_conf.h | 26 ++ src/libvirt_network.syms | 6 + src/libvirt_private.syms | 1 + src/network/bridge_driver.c | 123 ++++++--- src/network/bridge_driver.h | 3 + src/util/dnsmasq.c | 285 ++++++++++++++++++-- src/util/dnsmasq.h | 22 ++- tests/Makefile.am | 10 + tests/networkxml2argvdata/isolated-network.argv | 1 + tests/networkxml2argvdata/isolated-network.xml | 11 + .../networkxml2argvdata/nat-network-dns-hosts.argv | 1 + .../networkxml2argvdata/nat-network-dns-hosts.xml | 14 + .../nat-network-dns-txt-record.argv | 1 + .../nat-network-dns-txt-record.xml | 24 ++ tests/networkxml2argvdata/nat-network.argv | 1 + tests/networkxml2argvdata/nat-network.xml | 21 ++ tests/networkxml2argvdata/netboot-network.argv | 1 + tests/networkxml2argvdata/netboot-network.xml | 14 + .../networkxml2argvdata/netboot-proxy-network.argv | 1 + .../networkxml2argvdata/netboot-proxy-network.xml | 13 + tests/networkxml2argvdata/routed-network.argv | 1 + tests/networkxml2argvdata/routed-network.xml | 9 + tests/networkxml2argvtest.c | 109 ++++++++ tests/networkxml2xmlin/nat-network-dns-hosts.xml | 14 + .../nat-network-dns-txt-record.xml | 24 ++ tests/networkxml2xmlout/nat-network-dns-hosts.xml | 14 + .../nat-network-dns-txt-record.xml | 24 ++ tests/networkxml2xmltest.c | 2 + 32 files changed, 990 insertions(+), 56 deletions(-) create mode 100644 src/libvirt_network.syms create mode 100644 tests/networkxml2argvdata/isolated-network.argv create mode 100644 tests/networkxml2argvdata/isolated-network.xml create mode 100644 tests/networkxml2argvdata/nat-network-dns-hosts.argv create mode 100644 tests/networkxml2argvdata/nat-network-dns-hosts.xml create mode 100644 tests/networkxml2argvdata/nat-network-dns-txt-record.argv create mode 100644 tests/networkxml2argvdata/nat-network-dns-txt-record.xml create mode 100644 tests/networkxml2argvdata/nat-network.argv create mode 100644 tests/networkxml2argvdata/nat-network.xml create mode 100644 tests/networkxml2argvdata/netboot-network.argv create mode 100644 tests/networkxml2argvdata/netboot-network.xml create mode 100644 tests/networkxml2argvdata/netboot-proxy-network.argv create mode 100644 tests/networkxml2argvdata/netboot-proxy-network.xml create mode 100644 tests/networkxml2argvdata/routed-network.argv create mode 100644 tests/networkxml2argvdata/routed-network.xml create mode 100644 tests/networkxml2argvtest.c create mode 100644 tests/networkxml2xmlin/nat-network-dns-hosts.xml create mode 100644 tests/networkxml2xmlin/nat-network-dns-txt-record.xml create mode 100644 tests/networkxml2xmlout/nat-network-dns-hosts.xml create mode 100644 tests/networkxml2xmlout/nat-network-dns-txt-record.xml -- 1.7.3.2

3 12

[libvirt] [PATCH] python: Don't declare Py_ssize_t for Python 2.6
by Matthias Bolte 24 Jun '11

24 Jun '11

Commit cd48c3f4e95597 added a Py_ssize_t typedef for Python < 2.7. But Py_ssize_t was added in Python 2.5. This makes the build fail for Python 2.6. Adjust the check to match Python < 2.5 to fix this. --- python/typewrappers.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/python/typewrappers.h b/python/typewrappers.h index 70c15d9..87ea1e5 100644 --- a/python/typewrappers.h +++ b/python/typewrappers.h @@ -22,7 +22,7 @@ #endif /* Work around really old python. */ -#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 7 +#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5 typedef ssize_t Py_ssize_t; #endif -- 1.7.0.4

2 2

[libvirt] [PATCH] tests: Improve IPv6 detection for virNetSocket tests
by Matthias Bolte 24 Jun '11

24 Jun '11

getifaddrs can return an IPv6 address, but getaddrinfo can fail for an IPv6 address. Cover this combination. --- This is only tested on my system with broken IPv6. Could someone test this on an IPv6 capable system and ensure that the IPv6 tests aren't skipped now by running cd tests make virnetsockettest PATH=`pwd`:$PATH LIBVIRT_DEBUG=1 ./virnetsockettest This should print something like this 17:35:09.810: 4102: debug : checkProtocols:83 : Protocols: v4 1 v6 1 on an IPv6 capable system. tests/virnetsockettest.c | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-) diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c index f686a15..f6c7274 100644 --- a/tests/virnetsockettest.c +++ b/tests/virnetsockettest.c @@ -45,12 +45,16 @@ checkProtocols(bool *hasIPv4, bool *hasIPv6, int *freePort) { struct ifaddrs *ifaddr = NULL, *ifa; + struct addrinfo hints; + struct addrinfo *ai = NULL; struct sockaddr_in in4; struct sockaddr_in6 in6; int s4 = -1, s6 = -1; int i; int ret = -1; + memset(&hints, 0, sizeof hints); + *hasIPv4 = *hasIPv6 = false; *freePort = 0; @@ -67,6 +71,15 @@ checkProtocols(bool *hasIPv4, bool *hasIPv6, *hasIPv6 = true; } + hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG; + hints.ai_family = AF_INET6; + hints.ai_socktype = SOCK_STREAM; + + if (getaddrinfo("::1", "5672", &hints, &ai) != 0) + *hasIPv6 = false; + + freeaddrinfo(ai); + VIR_DEBUG("Protocols: v4 %d v6 %d\n", *hasIPv4, *hasIPv6); freeifaddrs(ifaddr); -- 1.7.0.4

2 2

[libvirt] [PATCH] Move load of AppArmor profile to GenLabel()
by Jamie Strandboge 24 Jun '11

24 Jun '11

Commit 12317957ecd6c37a2fb16275dcdeeacfe25c517 introduced an incompatible architectural change for the AppArmor security driver. Specifically, virSecurityManagerSetAllLabel() is now called much later in src/qemu/qemu_process.c:qemuProcessStart(). Previously, SetAllLabel() was called immediately after GenLabel() such that after the dynamic label (profile name) was generated, SetAllLabel() would be called to create and load the AppArmor profile into the kernel before qemuProcessHook() was executed. With 12317957ecd6c37a2fb16275dcdeeacfe25c517, qemuProcessHook() is now called before SetAllLabel(), such that aa_change_profile() ends up being called before the AppArmor profile is loaded into the kernel (via ProcessLabel() in qemuProcessHook()). This patch addresses the change by making GenLabel() load the AppArmor profile into the kernel after the label (profile name) is generated. SetAllLabel() is then adjusted to only reload_profile() and append stdin_fn to the profile when it is specified. This also makes the AppArmor driver work like its SELinux counterpart with regard to SetAllLabel() and stdin_fn. Passes its part of 'check' and 'syntax-check' (though libvirt_net_rpc_la-virnetmessage.lo failed to compile and po_check failed the syntax check for unrelated reasons). Prior to writing this patch, the issue was discussed on IRC with Daniel Berrange and Eric Blake. Other discussed alternatives were to do a 2 stage qemuProcessHook(), where ProcessLabel() was only called in the second stage after the handshake. In attempting this, it still didn't address the fact that aa_change_profile() was being called on an unloaded profile so it was abandoned. Another idea was to create a second private API call that the AppArmor driver would use to load the profile that would be a no-op for the SElinux driver. I started to go this route, but in the end it was both unneeded and too complicated once I realized I could simply load the profile in GenLabel() and still use SetAllLabel() to reload the profile when stdin_path was specified. The current fix is implemented wholly within the AppArmor driver and I think much cleaner. Reference: https://launchpad.net/bugs/795800 -- Jamie Strandboge | http://www.canonical.com

2 1

[libvirt] [PATCH 0/3] Fix security driver integration for lock manager
by Daniel P. Berrange 24 Jun '11

24 Jun '11

This series ensures we correctly label the sanlock socket that gets leaked to QEMU

3 9