- Devel - libvirt List Archives

[libvirt] [PATCH 0/6] security_selinux: Don't store XATTRs if FS fakes SELinux
by Michal Privoznik 30 Aug '19

30 Aug '19

For full explanation see 6/6, but here's a digest: GlusterFS via FUSE supports XATTRs but doesn't allow any SELinux label change (which is fortunate for us because migrations work at least). However, we need to treat this situation as "don't remember any seclabels" because if the source sets XATTRs and the migration destination tries to set different label this fails. Michal Prívozník (6): virSecuritySELinuxGetProcessLabel: Fix comment virSecuritySELinuxSetFileconImpl: Drop @optional argument security_selinux: DropvirSecuritySELinuxSetFileconOptional() security_selinux: Drop @optional from _virSecuritySELinuxContextItem security_selinux: Drop virSecuritySELinuxSetFileconHelper security_selinux: Play nicely with network FS that only emulates SELinux src/security/security_selinux.c | 141 ++++++++++++++++---------------- 1 file changed, 70 insertions(+), 71 deletions(-) -- 2.21.0

2 16

[libvirt] [PATCH] qemu: use 'bochs' video type by default for UEFI domains
by Jonathon Jongsma 30 Aug '19

30 Aug '19

The 'bochs' video device doesn't have any legacy vga emulation so the attack surface is much lower. It works with OVMF, so UEFI guests should not see any functional difference to VGA. https://bugzilla.redhat.com/show_bug.cgi?id=1707119 Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- NOTE: You may run into an error when trying to use the bochs video device. For example: error: internal error: process exited while connecting to monitor: 2019-08-28T21:32:20.134546Z qemu-system-x86_64: -device bochs-display,id=video0,vgamem=16384k,bus=pcie.0,addr=0x1: failed to find romfile "vgabios-bochs-display.bin" This should be solved in e.g. Fedora 31 with newer releases of seabios/qemu. As a temporary workaround, you can symlink the appropriate vgabios file under /usr/share/qemu/. src/qemu/qemu_domain.c | 19 +++++---- src/qemu/qemu_domain.h | 1 + .../video-default-nouefi.x86_64-latest.args | 36 +++++++++++++++++ .../qemuxml2argvdata/video-default-nouefi.xml | 20 ++++++++++ .../video-default-uefi.x86_64-latest.args | 40 +++++++++++++++++++ tests/qemuxml2argvdata/video-default-uefi.xml | 22 ++++++++++ tests/qemuxml2argvtest.c | 2 + 7 files changed, 133 insertions(+), 7 deletions(-) create mode 100644 tests/qemuxml2argvdata/video-default-nouefi.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/video-default-nouefi.xml create mode 100644 tests/qemuxml2argvdata/video-default-uefi.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/video-default-uefi.xml diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 4998474dc9..7ecb89ac84 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4584,6 +4584,14 @@ qemuDomainValidateCpuCount(const virDomainDef *def, } +static bool +qemuDomainDefIsUEFI(const virDomainDef *def) +{ + return ((def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI || + (def->os.loader && def->os.loader->type == + VIR_DOMAIN_LOADER_TYPE_PFLASH))); +} + static int qemuDomainDefValidate(const virDomainDef *def, virCapsPtr caps ATTRIBUTE_UNUSED, @@ -4606,10 +4614,7 @@ qemuDomainDefValidate(const virDomainDef *def, } /* On x86, UEFI requires ACPI */ - if ((def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI || - (def->os.loader && - def->os.loader->type == VIR_DOMAIN_LOADER_TYPE_PFLASH)) && - ARCH_IS_X86(def->os.arch) && + if (qemuDomainDefIsUEFI(def) && ARCH_IS_X86(def->os.arch) && def->features[VIR_DOMAIN_FEATURE_ACPI] != VIR_TRISTATE_SWITCH_ON) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("UEFI requires ACPI on this architecture")); @@ -4619,9 +4624,7 @@ qemuDomainDefValidate(const virDomainDef *def, /* On aarch64, ACPI requires UEFI */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON && def->os.arch == VIR_ARCH_AARCH64 && - (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI && - (!def->os.loader || - def->os.loader->type != VIR_DOMAIN_LOADER_TYPE_PFLASH))) { + !qemuDomainDefIsUEFI(def)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("ACPI requires UEFI on this architecture")); goto cleanup; @@ -7452,6 +7455,8 @@ qemuDomainDeviceVideoDefPostParse(virDomainVideoDefPtr video, qemuDomainIsRISCVVirt(def) || ARCH_IS_S390(def->os.arch)) video->type = VIR_DOMAIN_VIDEO_TYPE_VIRTIO; + else if (qemuDomainDefIsUEFI(def)) + video->type = VIR_DOMAIN_VIDEO_TYPE_BOCHS; else video->type = VIR_DOMAIN_VIDEO_TYPE_CIRRUS; } diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 37a00323a7..c6deab1c52 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -923,6 +923,7 @@ bool qemuDomainHasBuiltinIDE(const virDomainDef *def); bool qemuDomainNeedsFDC(const virDomainDef *def); bool qemuDomainSupportsPCI(virDomainDefPtr def, virQEMUCapsPtr qemuCaps); +bool qemuDomainIsUEFI(const virDomainDef *def); void qemuDomainUpdateCurrentMemorySize(virDomainObjPtr vm); diff --git a/tests/qemuxml2argvdata/video-default-nouefi.x86_64-latest.args b/tests/qemuxml2argvdata/video-default-nouefi.x86_64-latest.args new file mode 100644 index 0000000000..f0c9e36594 --- /dev/null +++ b/tests/qemuxml2argvdata/video-default-nouefi.x86_64-latest.args @@ -0,0 +1,36 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/tmp/lib/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/tmp/lib/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/tmp/lib/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/tmp/lib/domain--1-guest/.config \ +QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object secret,id=masterKey0,format=raw,\ +file=/tmp/lib/domain--1-guest/master-key.aes \ +-machine q35,accel=tcg,usb=off,dump-guest-core=off \ +-cpu Haswell \ +-m 1024 \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 26b73eb7-f8c4-4541-ae6f-06607a1b21c3 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server,nowait \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device pcie-root-port,port=0x10,chassis=1,id=pci.1,bus=pcie.0,\ +multifunction=on,addr=0x2 \ +-device pcie-root-port,port=0x11,chassis=2,id=pci.2,bus=pcie.0,addr=0x2.0x1 \ +-device qemu-xhci,id=usb,bus=pci.1,addr=0x0 \ +-device cirrus-vga,id=video0,bus=pcie.0,addr=0x1 \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\ +resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxml2argvdata/video-default-nouefi.xml b/tests/qemuxml2argvdata/video-default-nouefi.xml new file mode 100644 index 0000000000..7db2bedf6c --- /dev/null +++ b/tests/qemuxml2argvdata/video-default-nouefi.xml @@ -0,0 +1,20 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>26b73eb7-f8c4-4541-ae6f-06607a1b21c3</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='q35'>hvm</type> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom'> + <model>Haswell</model> + </cpu> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <memballoon model='none'/> + <video/> + </devices> +</domain> diff --git a/tests/qemuxml2argvdata/video-default-uefi.x86_64-latest.args b/tests/qemuxml2argvdata/video-default-uefi.x86_64-latest.args new file mode 100644 index 0000000000..75c599f321 --- /dev/null +++ b/tests/qemuxml2argvdata/video-default-uefi.x86_64-latest.args @@ -0,0 +1,40 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/tmp/lib/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/tmp/lib/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/tmp/lib/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/tmp/lib/domain--1-guest/.config \ +QEMU_AUDIO_DRV=none \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object secret,id=masterKey0,format=raw,\ +file=/tmp/lib/domain--1-guest/master-key.aes \ +-machine q35,accel=tcg,usb=off,dump-guest-core=off \ +-cpu Haswell \ +-drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,\ +readonly=on \ +-drive file=/var/lib/libvirt/qemu/nvram/guest_VARS.fd,if=pflash,format=raw,\ +unit=1 \ +-m 1024 \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 26b73eb7-f8c4-4541-ae6f-06607a1b21c3 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server,nowait \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device pcie-root-port,port=0x10,chassis=1,id=pci.1,bus=pcie.0,\ +multifunction=on,addr=0x2 \ +-device pcie-root-port,port=0x11,chassis=2,id=pci.2,bus=pcie.0,addr=0x2.0x1 \ +-device qemu-xhci,id=usb,bus=pci.1,addr=0x0 \ +-device bochs-display,id=video0,vgamem=16384k,bus=pcie.0,addr=0x1 \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\ +resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxml2argvdata/video-default-uefi.xml b/tests/qemuxml2argvdata/video-default-uefi.xml new file mode 100644 index 0000000000..59e880c78c --- /dev/null +++ b/tests/qemuxml2argvdata/video-default-uefi.xml @@ -0,0 +1,22 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>26b73eb7-f8c4-4541-ae6f-06607a1b21c3</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='q35'>hvm</type> + <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> + <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom'> + <model>Haswell</model> + </cpu> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <memballoon model='none'/> + <video/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 9395cc19a2..671e79e631 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -2045,6 +2045,8 @@ mymain(void) DO_TEST("video-none-device", QEMU_CAPS_VNC); DO_TEST_PARSE_ERROR("video-invalid-multiple-devices", NONE); + DO_TEST_CAPS_LATEST("video-default-uefi"); + DO_TEST_CAPS_LATEST("video-default-nouefi"); DO_TEST("virtio-rng-default", QEMU_CAPS_DEVICE_VIRTIO_RNG, -- 2.21.0

6 6

[libvirt] [ocaml PATCH 0/4] Minor cleanups/fixes
by Pino Toscano 29 Aug '19

29 Aug '19

Small cleanups in the build system, no changes in the code/binding. Pino Toscano (4): build: stop generating a config.h build: drop broken NSIS leftovers build: remove manual OCaml dependencies build: remove the list_secrets binary on clean .gitignore | 2 -- MANIFEST | 1 - Makefile.in | 26 ++------------------------ configure.ac | 1 - libvirt/Makefile.in | 6 ------ libvirt/generator.pl | 2 -- 6 files changed, 2 insertions(+), 36 deletions(-) -- 2.21.0

2 7

[libvirt] Rust, new release v0.2.11
by Sahid Orentino Ferdjaoui 29 Aug '19

29 Aug '19

Just A small note to indicate that a new release v0.2.11 has been published. https://docs.rs/virt/0.2.11/virt/ Thanks to Sage Imel for its contribution to a bug fix: e737a93 virDomainGetAutostart takes a pointer that it writes the output value to s.

1 0

[libvirt] [PATCH] qemu: extract function qemuDomainDefIsUEFI()
by Jonathon Jongsma 29 Aug '19

29 Aug '19

Rather than repeating the conditions in a couple places, extract it into a separate function for detecting whether a domain definition uses UEFI. Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- As requested by Andrea, I've extracted this little bit of refactoring from my bochs display patch and am sending it separately. src/qemu/qemu_domain.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 4998474dc9..ed4b5c666d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4584,6 +4584,14 @@ qemuDomainValidateCpuCount(const virDomainDef *def, } +static bool +qemuDomainDefIsUEFI(const virDomainDef *def) +{ + return ((def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI || + (def->os.loader && def->os.loader->type == + VIR_DOMAIN_LOADER_TYPE_PFLASH))); +} + static int qemuDomainDefValidate(const virDomainDef *def, virCapsPtr caps ATTRIBUTE_UNUSED, @@ -4606,10 +4614,7 @@ qemuDomainDefValidate(const virDomainDef *def, } /* On x86, UEFI requires ACPI */ - if ((def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI || - (def->os.loader && - def->os.loader->type == VIR_DOMAIN_LOADER_TYPE_PFLASH)) && - ARCH_IS_X86(def->os.arch) && + if (qemuDomainDefIsUEFI(def) && ARCH_IS_X86(def->os.arch) && def->features[VIR_DOMAIN_FEATURE_ACPI] != VIR_TRISTATE_SWITCH_ON) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("UEFI requires ACPI on this architecture")); @@ -4619,9 +4624,7 @@ qemuDomainDefValidate(const virDomainDef *def, /* On aarch64, ACPI requires UEFI */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON && def->os.arch == VIR_ARCH_AARCH64 && - (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI && - (!def->os.loader || - def->os.loader->type != VIR_DOMAIN_LOADER_TYPE_PFLASH))) { + !qemuDomainDefIsUEFI(def)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("ACPI requires UEFI on this architecture")); goto cleanup; -- 2.21.0

2 1

[libvirt] [PATCH REPOST] Revert "lxc: Try harder to stop/reboot containers"
by Daniel P. Berrangé 29 Aug '19

29 Aug '19

This reverts commit 14b6a1854fb4c02c5fb2f51679f8ff099f28f53c. If virLXCDomainSetRunlevel returns -1 this indicates a serious error / failure that must be propagated to the caller. We must not carry on with other shutdown methods in this case. If virLXCDomainSetRunlevel return 0, this indicates that no initctl was found and it is thus reasonable to fallback to sending SIGTERM. The commit being reverted is broken because it would fallback to SIGTERM when virLXCDomainSetRunlevel returns -1, and would not fallback when virLXCDomainSetRunlevel returns 0. ie it did the exact opposite of what was required. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/lxc/lxc_driver.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 5453f49064..ca0090de59 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -3271,7 +3271,7 @@ lxcDomainShutdownFlags(virDomainPtr dom, virLXCDomainObjPrivatePtr priv; virDomainObjPtr vm; int ret = -1; - int rc = -1; + int rc; virCheckFlags(VIR_DOMAIN_SHUTDOWN_INITCTL | VIR_DOMAIN_SHUTDOWN_SIGNAL, -1); @@ -3300,17 +3300,19 @@ lxcDomainShutdownFlags(virDomainPtr dom, (flags & VIR_DOMAIN_SHUTDOWN_INITCTL)) { int command = VIR_INITCTL_RUNLEVEL_POWEROFF; - if ((rc = virLXCDomainSetRunlevel(vm, command)) < 0) { - if (flags != 0 && - (flags & VIR_DOMAIN_SHUTDOWN_INITCTL)) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("Container does not provide an initctl pipe")); - goto endjob; - } + if ((rc = virLXCDomainSetRunlevel(vm, command)) < 0) + goto endjob; + if (rc == 0 && flags != 0 && + ((flags & ~VIR_DOMAIN_SHUTDOWN_INITCTL) == 0)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("Container does not provide an initctl pipe")); + goto endjob; } + } else { + rc = 0; } - if (rc < 0 && + if (rc == 0 && (flags == 0 || (flags & VIR_DOMAIN_SHUTDOWN_SIGNAL))) { if (kill(priv->initpid, SIGTERM) < 0 && @@ -3347,7 +3349,7 @@ lxcDomainReboot(virDomainPtr dom, virLXCDomainObjPrivatePtr priv; virDomainObjPtr vm; int ret = -1; - int rc = -1; + int rc; virCheckFlags(VIR_DOMAIN_REBOOT_INITCTL | VIR_DOMAIN_REBOOT_SIGNAL, -1); @@ -3376,17 +3378,19 @@ lxcDomainReboot(virDomainPtr dom, (flags & VIR_DOMAIN_REBOOT_INITCTL)) { int command = VIR_INITCTL_RUNLEVEL_REBOOT; - if ((rc = virLXCDomainSetRunlevel(vm, command)) < 0) { - if (flags != 0 && - (flags & VIR_DOMAIN_REBOOT_INITCTL)) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("Container does not provide an initctl pipe")); - goto endjob; - } + if ((rc = virLXCDomainSetRunlevel(vm, command)) < 0) + goto endjob; + if (rc == 0 && flags != 0 && + ((flags & ~VIR_DOMAIN_SHUTDOWN_INITCTL) == 0)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("Container does not provide an initctl pipe")); + goto endjob; } + } else { + rc = 0; } - if (rc < 0 && + if (rc == 0 && (flags == 0 || (flags & VIR_DOMAIN_REBOOT_SIGNAL))) { if (kill(priv->initpid, SIGHUP) < 0 && -- 2.21.0

2 1

[libvirt] [PATCH] qemu: agent: fix potential leak in qemuAgentGetFSInfo()
by Jonathon Jongsma 29 Aug '19

29 Aug '19

On error paths, info_ret could potentially leak. Make sure it's freed. --- Thanks to John Ferlan for the catch. Apparently this got missed before the patch was merged src/qemu/qemu_agent.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c index c63db968c6..a4113460bd 100644 --- a/src/qemu/qemu_agent.c +++ b/src/qemu/qemu_agent.c @@ -2208,6 +2208,7 @@ qemuAgentGetFSInfo(qemuAgentPtr mon, virDomainFSInfoFree(info_ret[i]); } VIR_FREE(agentinfo); + VIR_FREE(info_ret); return ret; } -- 2.21.0

2 3

[libvirt] [PATCH v2 0/9] qemu: Blockdevize external snapshot creation (blokcdev-add saga)
by Peter Krempa 29 Aug '19

29 Aug '19

Patches 1-5 of the original series were already pushed. Patches 1-3 of this series are new and deal with fixing of a image locking bug which was added during the blockdev-add saga as we've changed the handling of the 'readonly' flag of an image. Patch 4 is new and should solve review feedback which complained about function naming. The rest of the series is almost exactly as in previous posting with following exceptions: 1) Review feedback incorporated and R-b's applied. 2) Patch 6/9 has a different summary 3) Patch 8/9 fixes a memory leak/crash as a part of the cleanup was misplaced out of the cleaning loop (while still using the 'i' to dereference arrays). 4) Conflicts with 4/9 resolved. Peter Krempa (9): qemu: snapshot: Fix image lock handling when taking a snapshot qemu: snapshot: Save status and config XMLs only on success qemu: snapshot: Move error preservation to qemuDomainSnapshotDiskDataCleanup qemu: snapshot: Rename external disk snapshot handling functions qemu: Disband qemuDomainSnapshotCreateSingleDiskActive qemu: Merge use of 'reuse' flag in qemuDomainSnapshotDiskPrepareOne qemu: snapshot: Skip overlay file creation/interogation if unsupported qemu: Add -blockdev support for external snapshots qemu: Defer support checks for external active snapshots to blockdev code or qemu src/qemu/qemu_driver.c | 276 +++++++++++++++++++++++++---------------- 1 file changed, 171 insertions(+), 105 deletions(-) -- 2.21.0

1 9

[libvirt] [PATCH 0/2] [for-5.7.0] qemu: Honor qemu's request to use all vCPU props
by Peter Krempa 29 Aug '19

29 Aug '19

qemu documents that we should pass in all fields of 'CpuInstanceProperties' back when hotplugging cpus, but we didn't do that. It turns out that qemu wanted to add new fields which were mandatory and thus broke the interop with libvirt. Let's honor their reques. Peter Krempa (2): qemu: Extract and store vCPU properties as qemu returned them qemu: command: Use all vCPU properties when creating args for vCPU hotplug src/qemu/qemu_command.c | 19 +++---------------- src/qemu/qemu_domain.c | 3 +++ src/qemu/qemu_domain.h | 3 +++ src/qemu/qemu_monitor.c | 2 ++ src/qemu/qemu_monitor.h | 6 ++++++ src/qemu/qemu_monitor_json.c | 4 ++++ .../x86-modern-bulk-monitor.json | 8 ++++---- .../x86-modern-individual-add-monitor.json | 4 ++-- 8 files changed, 27 insertions(+), 22 deletions(-) -- 2.21.0

2 3

[libvirt] [PATCH 1/1] security_util: verify xattrs only if ref is present
by Nikolay Shirokovskiy 29 Aug '19

29 Aug '19

After 7cfb7aab573 commit starting a domain pullutes logs with warnings like [1]. The reason is resource files do not have timestamp before starting a domain and after destroying domain the timestamp is cleared. Let's check the timestamp only if attribute with refcounter is found. [1] warning : virSecurityValidateTimestamp:198 : Invalid XATTR timestamp detected on \ /some/path secdriver=dac Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy(a)virtuozzo.com> --- src/security/security_util.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/src/security/security_util.c b/src/security/security_util.c index 31f41cedfd..f33fe9dd7b 100644 --- a/src/security/security_util.c +++ b/src/security/security_util.c @@ -269,13 +269,9 @@ virSecurityGetRememberedLabel(const char *name, VIR_AUTOFREE(char *) attr_name = NULL; VIR_AUTOFREE(char *) value = NULL; unsigned int refcount = 0; - int rc; *label = NULL; - if ((rc = virSecurityValidateTimestamp(name, path)) < 0) - return rc; - if (!(ref_name = virSecurityGetRefCountAttrName(name))) return -1; @@ -288,6 +284,14 @@ virSecurityGetRememberedLabel(const char *name, ref_name, path); return -1; + } else { + int rc; + + if ((rc = virSecurityValidateTimestamp(name, path)) < 0) + return rc; + + if (rc == 1) + return -2; } if (virStrToLong_ui(value, NULL, 10, &refcount) < 0) { @@ -357,10 +361,6 @@ virSecuritySetRememberedLabel(const char *name, VIR_AUTOFREE(char *) attr_name = NULL; VIR_AUTOFREE(char *) value = NULL; unsigned int refcount = 0; - int rc; - - if ((rc = virSecurityValidateTimestamp(name, path)) < 0) - return rc; if (!(ref_name = virSecurityGetRefCountAttrName(name))) return -1; @@ -375,6 +375,14 @@ virSecuritySetRememberedLabel(const char *name, path); return -1; } + } else { + int rc; + + if ((rc = virSecurityValidateTimestamp(name, path)) < 0) + return rc; + + if (rc == 1) + VIR_FREE(value); } if (value && -- 2.23.0

2 1