Re: [PATCH] qemu: Add audit entries for suspend and resume

6 Jan 2025

Happy new year everyone!

Any comments on this small patch?

Regards,
Jim

On 12/16/24 16:56, Jim Fehlig wrote:
...
We recently received a request from certification auditors to provide
audit entries for suspend and resume. This small patch uses the existing
virtDomainAudit{Start,Stop} functions with new reasons "suspended" and
"resumed".
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
---
For suspend, I initially wrote the following
virDomainAuditStart(vm, virDomainPausedReasonTypeToString(reason), true);
but I'm not sure it makes sense in resume, where we have reasons such as
VIR_DOMAIN_CRASHED_PANICKED. For symmetry, it seemed best to go with
"suspended" and "resumed".
src/qemu/qemu_driver.c | 2 ++
  1 file changed, 2 insertions(+)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index f1a633fdd3..c670bb681e 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -1682,6 +1682,7 @@ static int qemuDomainSuspend(virDomainPtr dom)
              goto endjob;
      }
      qemuDomainSaveStatus(vm);
+    virDomainAuditStart(vm, "suspended", true);
      ret = 0;
endjob:
@@ -1738,6 +1739,7 @@ static int qemuDomainResume(virDomainPtr dom)
          }
      }
      qemuDomainSaveStatus(vm);
+    virDomainAuditStop(vm, "resumed");
      ret = 0;
endjob:

    