The term "permitted list" is a better choice for the filtering logic applied. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- scripts/check-aclrules.py | 8 ++++---- scripts/check-file-access.py | 16 ++++++++-------- scripts/mock-noinline.py | 1 - tests/Makefile.am | 4 ++-- ...s_whitelist.txt => permitted_file_access.txt} | 6 +++--- 5 files changed, 17 insertions(+), 18 deletions(-) rename tests/{file_access_whitelist.txt => permitted_file_access.txt} (82%) diff --git a/scripts/check-aclrules.py b/scripts/check-aclrules.py index a1fa473174..2335e8cfdd 100755 --- a/scripts/check-aclrules.py +++ b/scripts/check-aclrules.py @@ -35,7 +35,7 @@ import re import sys -whitelist = { +permitted = { "connectClose": True, "connectIsEncrypted": True, "connectIsSecure": True, @@ -58,7 +58,7 @@ whitelist = { # XXX this vzDomainMigrateConfirm3Params looks # bogus - determine why it doesn't have a valid # ACL check. -implwhitelist = { +implpermitted = { "vzDomainMigrateConfirm3Params": True, } @@ -230,8 +230,8 @@ def process_file(filename): api not in ["no", "name"] and table != "virStateDriver"): if (impl not in acls and - api not in whitelist and - impl not in implwhitelist): + api not in permitted and + impl not in implpermitted): print(("%s:%d Missing ACL check in " + "function '%s' for '%s'") % (filename, lineno, impl, api), diff --git a/scripts/check-file-access.py b/scripts/check-file-access.py index dd39de2d79..aa120cafac 100755 --- a/scripts/check-file-access.py +++ b/scripts/check-file-access.py @@ -25,16 +25,16 @@ import re import sys if len(sys.argv) != 3: - print("syntax: %s ACCESS-FILE ACCESS-WHITELIST") + print("syntax: %s ACCESS-FILE PERMITTED-ACCESS-FILE") sys.exit(1) access_file = sys.argv[1] -whitelist_file = sys.argv[2] +permitted_file = sys.argv[2] known_actions = ["open", "fopen", "access", "stat", "lstat", "connect"] files = [] -whitelist = [] +permitted = [] with open(access_file, "r") as fh: for line in fh: @@ -52,7 +52,7 @@ with open(access_file, "r") as fh: else: raise Exception("Malformed line %s" % line) -with open(whitelist_file, "r") as fh: +with open(permitted_file, "r") as fh: for line in fh: line = line.rstrip("\n") @@ -70,7 +70,7 @@ with open(whitelist_file, "r") as fh: "progname": m.group(4), "testname": m.group(6), } - whitelist.append(rec) + permitted.append(rec) else: m = re.search(r'''^(\S*)(:\s*(\S*)(\s*:\s*(.*))?)?$''', line) if m is not None: @@ -81,18 +81,18 @@ with open(whitelist_file, "r") as fh: "progname": m.group(3), "testname": m.group(5), } - whitelist.append(rec) + permitted.append(rec) else: raise Exception("Malformed line %s" % line) -# Now we should check if %traces is included in $whitelist. For +# Now we should check if %traces is included in $permitted. For # now checking just keys is sufficient err = False for file in files: match = False - for rule in whitelist: + for rule in permitted: if not re.match("^" + rule["path"] + "$", file["path"]): continue diff --git a/scripts/mock-noinline.py b/scripts/mock-noinline.py index 4fc60c0be3..a8b7680c11 100644 --- a/scripts/mock-noinline.py +++ b/scripts/mock-noinline.py @@ -23,7 +23,6 @@ noninlined = {} mocked = {} # Functions in public header don't get the noinline annotation -# so whitelist them here noninlined["virEventAddTimeout"] = True # This one confuses the script as its defined in the mock file # but is actually just a local helper diff --git a/tests/Makefile.am b/tests/Makefile.am index 3505c40f42..65d1ceeefd 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -458,14 +458,14 @@ check-access: file-access-clean VIR_TEST_FILE_ACCESS=1 $(MAKE) $(AM_MAKEFLAGS) check $(RUNUTF8) $(PYTHON) $(top_srcdir)/scripts/check-file-access.py \ $(abs_builddir)/test_file_access.txt \ - $(abs_srcdir)/file_access_whitelist.txt | sort -u + $(abs_srcdir)/permitted_file_access.txt | sort -u file-access-clean: endif WITH_LINUX EXTRA_DIST += \ - file_access_whitelist.txt + permitted_file_access.txt if WITH_TESTS noinst_PROGRAMS = $(test_programs) $(test_helpers) diff --git a/tests/file_access_whitelist.txt b/tests/permitted_file_access.txt similarity index 82% rename from tests/file_access_whitelist.txt rename to tests/permitted_file_access.txt index 5ec7ee63bb..52292d56be 100644 --- a/tests/file_access_whitelist.txt +++ b/tests/permitted_file_access.txt @@ -1,6 +1,6 @@ -# This is a whitelist that allows accesses to files not in our -# build directory nor source directory. The records are in the -# following formats: +# This is a list of files not in our build directory nor source +# directory which are permitted to be accessed by tests. The +# records are in the following formats: # # $path: $progname: $testname # $path: $action: $progname: $testname -- 2.24.1

The term "access control list" better describes the concept involved. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- docs/internals/rpc.html.in | 9 ++++---- src/remote/libvirtd.conf.in | 6 +++--- src/remote/remote_daemon_dispatch.c | 4 ++-- src/rpc/virnetsaslcontext.c | 10 ++++----- src/rpc/virnetsaslcontext.h | 2 +- src/rpc/virnettlscontext.c | 32 ++++++++++++++--------------- src/rpc/virnettlscontext.h | 4 ++-- tests/virconfdata/libvirtd.conf | 6 +++--- tests/virconfdata/libvirtd.out | 6 +++--- 9 files changed, 40 insertions(+), 39 deletions(-) diff --git a/docs/internals/rpc.html.in b/docs/internals/rpc.html.in index 40d844f31c..129945bf1c 100644 --- a/docs/internals/rpc.html.in +++ b/docs/internals/rpc.html.in @@ -447,7 +447,8 @@ C &lt;-- |32| 8 | 1 | 3 | 1 | 1 | 0 | .o.oOo | &lt;-- S (reply) <dt><code>virNetSASLContextPtr</code> (virnetsaslcontext.h)</dt> <dd>The virNetSASLContext APIs maintain SASL state for a network service (server or client). This is primarily used on the server - to provide a whitelist of allowed SASL usernames for clients. + to provide an access control list of SASL usernames permitted as + clients. </dd> <dt><code>virNetSASLSessionPtr</code> (virnetsaslcontext.h)</dt> @@ -460,7 +461,7 @@ C &lt;-- |32| 8 | 1 | 3 | 1 | 1 | 0 | .o.oOo | &lt;-- S (reply) <dt><code>virNetTLSContextPtr</code> (virnettlscontext.h)</dt> <dd>The virNetTLSContext APIs maintain TLS state for a network service (server or client). This is primarily used on the server - to provide a whitelist of allowed x509 distinguished names, as + to provide an access control list of x509 distinguished names, as well as diffie-hellman keys. It can also do validation of x509 certificates prior to initiating a connection, in order to improve detection of configuration errors. @@ -760,8 +761,8 @@ C &lt;-- |32| 8 | 1 | 3 | 1 | 1 | 0 | .o.oOo | &lt;-- S (reply) next step is to decode the RPC header. The header is validated to ensure the request is sensible, ie the server should not receive a method reply from a client. If the client has not yet authenticated, - a security check is also applied to make sure the procedure is on the - whitelist of those allowed prior to auth. If the packet is a method + an access control list check is also performed to make sure the procedure + is one of those allowed prior to auth. If the packet is a method call, it will be placed on a global processing queue. The event loop thread is now done with the packet for the time being. </p> diff --git a/src/remote/libvirtd.conf.in b/src/remote/libvirtd.conf.in index 34741183cc..2607fbad86 100644 --- a/src/remote/libvirtd.conf.in +++ b/src/remote/libvirtd.conf.in @@ -253,11 +253,11 @@ # will be rejected. # # Default is to always verify. Uncommenting this will disable -# verification - make sure an IP whitelist is set +# verification. #tls_no_verify_certificate = 1 -# A whitelist of allowed x509 Distinguished Names +# An access control list of allowed x509 Distinguished Names # This list may contain wildcards such as # # "C=GB,ST=London,L=London,O=Red Hat,CN=*" @@ -282,7 +282,7 @@ @END@ -# A whitelist of allowed SASL usernames. The format for username +# An access control list of allowed SASL usernames. The format for username # depends on the SASL authentication mechanism. Kerberos usernames # look like username@REALM # diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c index 831e7d165c..67b86cff78 100644 --- a/src/remote/remote_daemon_dispatch.c +++ b/src/remote/remote_daemon_dispatch.c @@ -3861,7 +3861,7 @@ remoteDispatchAuthSaslStart(virNetServerPtr server, if (err == VIR_NET_SASL_CONTINUE) { ret->complete = 0; } else { - /* Check username whitelist ACL */ + /* Check username ACL */ if ((err = remoteSASLFinish(server, client)) < 0) { if (err == -2) goto authdeny; @@ -3957,7 +3957,7 @@ remoteDispatchAuthSaslStep(virNetServerPtr server, if (err == VIR_NET_SASL_CONTINUE) { ret->complete = 0; } else { - /* Check username whitelist ACL */ + /* Check username ACL */ if ((err = remoteSASLFinish(server, client)) < 0) { if (err == -2) goto authdeny; diff --git a/src/rpc/virnetsaslcontext.c b/src/rpc/virnetsaslcontext.c index e7ed8f4390..9253771787 100644 --- a/src/rpc/virnetsaslcontext.c +++ b/src/rpc/virnetsaslcontext.c @@ -36,7 +36,7 @@ VIR_LOG_INIT("rpc.netsaslcontext"); struct _virNetSASLContext { virObjectLockable parent; - const char *const*usernameWhitelist; + const char *const *usernameACL; }; struct _virNetSASLSession { @@ -121,7 +121,7 @@ virNetSASLContextPtr virNetSASLContextNewClient(void) return ctxt; } -virNetSASLContextPtr virNetSASLContextNewServer(const char *const*usernameWhitelist) +virNetSASLContextPtr virNetSASLContextNewServer(const char *const *usernameACL) { virNetSASLContextPtr ctxt; @@ -132,7 +132,7 @@ virNetSASLContextPtr virNetSASLContextNewServer(const char *const*usernameWhitel if (!(ctxt = virObjectLockableNew(virNetSASLContextClass))) return NULL; - ctxt->usernameWhitelist = usernameWhitelist; + ctxt->usernameACL = usernameACL; return ctxt; } @@ -146,7 +146,7 @@ int virNetSASLContextCheckIdentity(virNetSASLContextPtr ctxt, virObjectLock(ctxt); /* If the list is not set, allow any DN. */ - wildcards = ctxt->usernameWhitelist; + wildcards = ctxt->usernameACL; if (!wildcards) { ret = 1; /* No ACL, allow all */ goto cleanup; @@ -162,7 +162,7 @@ int virNetSASLContextCheckIdentity(virNetSASLContextPtr ctxt, } /* Denied */ - VIR_ERROR(_("SASL client identity '%s' not allowed in whitelist"), identity); + VIR_ERROR(_("SASL client identity '%s' not allowed by ACL"), identity); /* This is the most common error: make it informative. */ virReportError(VIR_ERR_SYSTEM_ERROR, "%s", diff --git a/src/rpc/virnetsaslcontext.h b/src/rpc/virnetsaslcontext.h index 4d1845e643..618230f42d 100644 --- a/src/rpc/virnetsaslcontext.h +++ b/src/rpc/virnetsaslcontext.h @@ -38,7 +38,7 @@ enum { }; virNetSASLContextPtr virNetSASLContextNewClient(void); -virNetSASLContextPtr virNetSASLContextNewServer(const char *const*usernameWhitelist); +virNetSASLContextPtr virNetSASLContextNewServer(const char *const *usernameACL); int virNetSASLContextCheckIdentity(virNetSASLContextPtr ctxt, const char *identity); diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index a8104cf484..168f3010ae 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -60,7 +60,7 @@ struct _virNetTLSContext { bool isServer; bool requireValidCert; - const char *const*x509dnWhitelist; + const char *const *x509dnACL; char *priority; }; @@ -356,8 +356,8 @@ static int virNetTLSContextCheckCertKeyPurpose(gnutls_x509_crt_t cert, /* Check DN is on tls_allowed_dn_list. */ static int -virNetTLSContextCheckCertDNWhitelist(const char *dname, - const char *const*wildcards) +virNetTLSContextCheckCertDNACL(const char *dname, + const char *const *wildcards) { while (*wildcards) { if (g_pattern_match_simple(*wildcards, dname)) @@ -367,7 +367,7 @@ virNetTLSContextCheckCertDNWhitelist(const char *dname, } /* Log the client's DN for debugging */ - VIR_DEBUG("Failed whitelist check for client DN '%s'", dname); + VIR_DEBUG("Failed ACL check for client DN '%s'", dname); /* This is the most common error: make it informative. */ virReportError(VIR_ERR_SYSTEM_ERROR, "%s", @@ -385,10 +385,10 @@ virNetTLSContextCheckCertDN(gnutls_x509_crt_t cert, const char *certFile, const char *hostname, const char *dname, - const char *const* whitelist) + const char *const *acl) { - if (whitelist && dname && - virNetTLSContextCheckCertDNWhitelist(dname, whitelist) <= 0) + if (acl && dname && + virNetTLSContextCheckCertDNACL(dname, acl) <= 0) return -1; if (hostname && @@ -675,7 +675,7 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert, const char *cacrl, const char *cert, const char *key, - const char *const*x509dnWhitelist, + const char *const *x509dnACL, const char *priority, bool sanityCheckCert, bool requireValidCert, @@ -740,7 +740,7 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert, } ctxt->requireValidCert = requireValidCert; - ctxt->x509dnWhitelist = x509dnWhitelist; + ctxt->x509dnACL = x509dnACL; ctxt->isServer = isServer; PROBE(RPC_TLS_CONTEXT_NEW, @@ -855,7 +855,7 @@ static int virNetTLSContextLocateCredentials(const char *pkipath, static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath, bool tryUserPkiPath, - const char *const*x509dnWhitelist, + const char *const *x509dnACL, const char *priority, bool sanityCheckCert, bool requireValidCert, @@ -869,7 +869,7 @@ static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath, return NULL; ctxt = virNetTLSContextNew(cacert, cacrl, cert, key, - x509dnWhitelist, priority, sanityCheckCert, + x509dnACL, priority, sanityCheckCert, requireValidCert, isServer); VIR_FREE(cacert); @@ -882,12 +882,12 @@ static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath, virNetTLSContextPtr virNetTLSContextNewServerPath(const char *pkipath, bool tryUserPkiPath, - const char *const*x509dnWhitelist, + const char *const *x509dnACL, const char *priority, bool sanityCheckCert, bool requireValidCert) { - return virNetTLSContextNewPath(pkipath, tryUserPkiPath, x509dnWhitelist, priority, + return virNetTLSContextNewPath(pkipath, tryUserPkiPath, x509dnACL, priority, sanityCheckCert, requireValidCert, true); } @@ -906,12 +906,12 @@ virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert, const char *cacrl, const char *cert, const char *key, - const char *const*x509dnWhitelist, + const char *const *x509dnACL, const char *priority, bool sanityCheckCert, bool requireValidCert) { - return virNetTLSContextNew(cacert, cacrl, cert, key, x509dnWhitelist, priority, + return virNetTLSContextNew(cacert, cacrl, cert, key, x509dnACL, priority, sanityCheckCert, requireValidCert, true); } @@ -1063,7 +1063,7 @@ static int virNetTLSContextValidCertificate(virNetTLSContextPtr ctxt, VIR_DEBUG("Peer DN is %s", dname); if (virNetTLSContextCheckCertDN(cert, "[session]", sess->hostname, dname, - ctxt->x509dnWhitelist) < 0) { + ctxt->x509dnACL) < 0) { gnutls_x509_crt_deinit(cert); goto authdeny; } diff --git a/src/rpc/virnettlscontext.h b/src/rpc/virnettlscontext.h index fe885aed9a..8ac84027b2 100644 --- a/src/rpc/virnettlscontext.h +++ b/src/rpc/virnettlscontext.h @@ -34,7 +34,7 @@ void virNetTLSInit(void); virNetTLSContextPtr virNetTLSContextNewServerPath(const char *pkipath, bool tryUserPkiPath, - const char *const*x509dnWhitelist, + const char *const *x509dnACL, const char *priority, bool sanityCheckCert, bool requireValidCert); @@ -49,7 +49,7 @@ virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert, const char *cacrl, const char *cert, const char *key, - const char *const*x509dnWhitelist, + const char *const *x509dnACL, const char *priority, bool sanityCheckCert, bool requireValidCert); diff --git a/tests/virconfdata/libvirtd.conf b/tests/virconfdata/libvirtd.conf index 791d6c972b..6d1fd33dcd 100644 --- a/tests/virconfdata/libvirtd.conf +++ b/tests/virconfdata/libvirtd.conf @@ -174,11 +174,11 @@ crl_file = "/etc/pki/CA/crl.pem" # will be rejected. # # Default is to always verify. Uncommenting this will disable -# verification - make sure an IP whitelist is set +# verification. tls_no_verify_certificate = 1 -# A whitelist of allowed x509 Distinguished Names +# An access control list of allowed x509 Distinguished Names # This list may contain wildcards such as # # "C=GB,ST=London,L=London,O=Red Hat,CN=*" @@ -194,7 +194,7 @@ tls_no_verify_certificate = 1 tls_allowed_dn_list = ["DN1", "DN2"] -# A whitelist of allowed SASL usernames. The format for usernames +# An access control list of allowed SASL usernames. The format for usernames # depends on the SASL authentication mechanism. Kerberos usernames # look like username@REALM # diff --git a/tests/virconfdata/libvirtd.out b/tests/virconfdata/libvirtd.out index cfdd23fd21..ce50480b8c 100644 --- a/tests/virconfdata/libvirtd.out +++ b/tests/virconfdata/libvirtd.out @@ -140,9 +140,9 @@ crl_file = "/etc/pki/CA/crl.pem" # will be rejected. # # Default is to always verify. Uncommenting this will disable -# verification - make sure an IP whitelist is set +# verification. tls_no_verify_certificate = 1 -# A whitelist of allowed x509 Distinguished Names +# An access control list of allowed x509 Distinguished Names # This list may contain wildcards such as # # "C=GB,ST=London,L=London,O=Red Hat,CN=*" @@ -156,7 +156,7 @@ tls_no_verify_certificate = 1 # # By default, no DN's are checked tls_allowed_dn_list = [ "DN1", "DN2" ] -# A whitelist of allowed SASL usernames. The format for usernames +# An access control list of allowed SASL usernames. The format for usernames # depends on the SASL authentication mechanism. Kerberos usernames # look like username@REALM # -- 2.24.1

The term "access control list" better describes the concept involved. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- docs/drvqemu.html.in | 12 ++++++------ docs/kbase/qemu-passthrough-security.rst | 3 ++- src/lxc/lxc_cgroup.c | 2 +- src/qemu/qemu.conf | 2 +- src/qemu/qemu_cgroup.c | 2 +- src/util/vircgroup.c | 2 +- 6 files changed, 12 insertions(+), 11 deletions(-) diff --git a/docs/drvqemu.html.in b/docs/drvqemu.html.in index b6d731bb59..31d3fee213 100644 --- a/docs/drvqemu.html.in +++ b/docs/drvqemu.html.in @@ -468,12 +468,12 @@ chmod o+x /path/to/directory for resource management. It is implemented via a number of "controllers", each controller covering a specific task/functional area. One of the available controllers is the "devices" controller, which is able to - setup whitelists of block/character devices that a cgroup should be - allowed to access. If the "devices" controller is mounted on a host, - then libvirt will automatically create a dedicated cgroup for each - QEMU virtual machine and setup the device whitelist so that the QEMU - process can only access shared devices, and explicitly disks images - backed by block devices. + setup access control lists of block/character devices that a cgroup + should be allowed to access. If the "devices" controller is mounted on a + host, then libvirt will automatically create a dedicated cgroup for each + QEMU virtual machine and setup the device access control list so that the + QEMU process can only access shared devices, and explicitly assigned disks + images backed by block devices. </p> <p> diff --git a/docs/kbase/qemu-passthrough-security.rst b/docs/kbase/qemu-passthrough-security.rst index 5f761cbfcb..4381d9f3a6 100644 --- a/docs/kbase/qemu-passthrough-security.rst +++ b/docs/kbase/qemu-passthrough-security.rst @@ -110,7 +110,8 @@ Granting access per VM policy on a per VM basis. * Cgroups - a custom cgroup is created per VM and this will either use the - ``devices`` controller or an ``BPF`` rule to whitelist a set of device nodes. + ``devices`` controller or an ``BPF`` rule to define an access control list + for the set of device nodes. There is no way to change this policy on a per VM basis. Disabling security protection per VM diff --git a/src/lxc/lxc_cgroup.c b/src/lxc/lxc_cgroup.c index e71f37d2b1..d13f2adde5 100644 --- a/src/lxc/lxc_cgroup.c +++ b/src/lxc/lxc_cgroup.c @@ -374,7 +374,7 @@ static int virLXCCgroupSetupDeviceACL(virDomainDefPtr def, return -1; } - VIR_DEBUG("Device whitelist complete"); + VIR_DEBUG("Device ACL setup complete"); return 0; } diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 404961c53e..f89dbd2c3a 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -464,7 +464,7 @@ # What cgroup controllers to make use of with QEMU guests # # - 'cpu' - use for scheduler tunables -# - 'devices' - use for device whitelisting +# - 'devices' - use for device access control # - 'memory' - use for memory tunables # - 'blkio' - use for block devices I/O tunables # - 'cpuset' - use for CPUs and memory nodes diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index d92202f847..57c5b6e69b 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -745,7 +745,7 @@ qemuSetupDevicesCgroup(virDomainObjPtr vm) if (rv < 0) { if (virLastErrorIsSystemErrno(EPERM)) { virResetLastError(); - VIR_WARN("Group devices ACL is not accessible, disabling whitelisting"); + VIR_WARN("Group devices ACL is not accessible, disabling filtering"); return 0; } diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index bb535df4f2..e20cc71c78 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -773,7 +773,7 @@ virCgroupSetPartitionSuffix(const char *path, char **res) return ret; for (i = 0; tokens[i] != NULL; i++) { - /* Whitelist the 3 top level fixed dirs + /* Special case the 3 top level fixed dirs * NB i == 0 is "", since we have leading '/' */ if (i == 1 && -- 2.24.1

When listing CPU models, we need to filter the data based on sets of permitted and forbidden CPU models. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- src/qemu/qemu_capabilities.c | 18 +++++++++--------- src/qemu/qemu_capabilities.h | 4 ++-- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 484fff99e5..68fcbd3c4f 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -2256,8 +2256,8 @@ virQEMUCapsAddCPUDefinitions(virQEMUCapsPtr qemuCaps, static virDomainCapsCPUModelsPtr virQEMUCapsCPUDefsToModels(qemuMonitorCPUDefsPtr defs, - const char **modelWhitelist, - const char **modelBlacklist) + const char **modelAllowed, + const char **modelForbidden) { g_autoptr(virDomainCapsCPUModels) cpuModels = NULL; size_t i; @@ -2268,10 +2268,10 @@ virQEMUCapsCPUDefsToModels(qemuMonitorCPUDefsPtr defs, for (i = 0; i < defs->ncpus; i++) { qemuMonitorCPUDefInfoPtr cpu = defs->cpus + i; - if (modelWhitelist && !virStringListHasString(modelWhitelist, cpu->name)) + if (modelAllowed && !virStringListHasString(modelAllowed, cpu->name)) continue; - if (modelBlacklist && virStringListHasString(modelBlacklist, cpu->name)) + if (modelForbidden && virStringListHasString(modelForbidden, cpu->name)) continue; if (virDomainCapsCPUModelsAdd(cpuModels, cpu->name, cpu->usable, @@ -2286,15 +2286,15 @@ virQEMUCapsCPUDefsToModels(qemuMonitorCPUDefsPtr defs, virDomainCapsCPUModelsPtr virQEMUCapsGetCPUModels(virQEMUCapsPtr qemuCaps, virDomainVirtType type, - const char **modelWhitelist, - const char **modelBlacklist) + const char **modelAllowed, + const char **modelForbidden) { qemuMonitorCPUDefsPtr defs; if (!(defs = virQEMUCapsGetAccel(qemuCaps, type)->cpuModels)) return NULL; - return virQEMUCapsCPUDefsToModels(defs, modelWhitelist, modelBlacklist); + return virQEMUCapsCPUDefsToModels(defs, modelAllowed, modelForbidden); } @@ -5976,14 +5976,14 @@ virQEMUCapsFillDomainCPUCaps(virQEMUCapsPtr qemuCaps, if (virQEMUCapsIsCPUModeSupported(qemuCaps, hostarch, domCaps->virttype, VIR_CPU_MODE_CUSTOM, domCaps->machine)) { - const char *blacklist[] = { "host", NULL }; + const char *forbidden[] = { "host", NULL }; VIR_AUTOSTRINGLIST models = NULL; if (virCPUGetModels(domCaps->arch, &models) >= 0) { domCaps->cpu.custom = virQEMUCapsGetCPUModels(qemuCaps, domCaps->virttype, (const char **)models, - blacklist); + forbidden); } else { domCaps->cpu.custom = NULL; } diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 92d42ed80b..ad93816d41 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -629,8 +629,8 @@ int virQEMUCapsAddCPUDefinitions(virQEMUCapsPtr qemuCaps, virDomainCapsCPUUsable usable); virDomainCapsCPUModelsPtr virQEMUCapsGetCPUModels(virQEMUCapsPtr qemuCaps, virDomainVirtType type, - const char **modelWhitelist, - const char **modelBlacklist); + const char **modelAllowed, + const char **modelForbidden); int virQEMUCapsFetchCPUModels(qemuMonitorPtr mon, virArch arch, virDomainCapsCPUModelsPtr *cpuModels); -- 2.24.1

The concept we're really testing for is whether QEMU supports the seccomp syscall filter groups. We need to keep one place using the old term to deal with upgrades from existing hosts with running VMs. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- src/qemu/qemu.conf | 2 +- src/qemu/qemu_capabilities.c | 4 ++-- src/qemu/qemu_capabilities.h | 2 +- src/qemu/qemu_command.c | 4 ++-- src/qemu/qemu_domain.c | 10 +++++++--- tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 2 +- tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 2 +- tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 2 +- tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 2 +- tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_3.0.0.ppc64.xml | 2 +- tests/qemucapabilitiesdata/caps_3.0.0.riscv32.xml | 2 +- tests/qemucapabilitiesdata/caps_3.0.0.riscv64.xml | 2 +- tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml | 2 +- tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_3.1.0.ppc64.xml | 2 +- tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml | 2 +- tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml | 2 +- tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 2 +- tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml | 2 +- tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml | 2 +- tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 2 +- tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml | 2 +- tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml | 2 +- tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml | 2 +- tests/qemustatusxml2xmldata/backup-pull-in.xml | 2 +- tests/qemustatusxml2xmldata/blockjob-blockdev-in.xml | 2 +- tests/qemuxml2argvtest.c | 2 +- 37 files changed, 45 insertions(+), 41 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index f89dbd2c3a..99b9ce53e5 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -704,7 +704,7 @@ # If it is unset (or -1), then seccomp will be enabled # only if QEMU >= 2.11.0 is detected, otherwise it is # left disabled. This ensures the default config gets -# protection for new QEMU using the blacklist approach. +# protection for new QEMU with filter groups. # #seccomp_sandbox = 1 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 68fcbd3c4f..310be800e2 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -468,7 +468,7 @@ VIR_ENUM_IMPL(virQEMUCaps, /* 285 */ "qcow2-luks", "pcie-pci-bridge", - "seccomp-blacklist", + "seccomp-filter-groups", "query-cpus-fast", "disk-write-cache", @@ -3292,7 +3292,7 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = { { "vnc", "vnc", QEMU_CAPS_VNC_MULTI_SERVERS }, { "chardev", "reconnect", QEMU_CAPS_CHARDEV_RECONNECT }, { "sandbox", "enable", QEMU_CAPS_SECCOMP_SANDBOX }, - { "sandbox", "elevateprivileges", QEMU_CAPS_SECCOMP_BLACKLIST }, + { "sandbox", "elevateprivileges", QEMU_CAPS_SECCOMP_FILTER_GROUPS }, { "chardev", "fd", QEMU_CAPS_CHARDEV_FD_PASS }, { "overcommit", NULL, QEMU_CAPS_OVERCOMMIT }, { "smp-opts", "dies", QEMU_CAPS_SMP_DIES }, diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index ad93816d41..0ee3e357cb 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -448,7 +448,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ /* 285 */ QEMU_CAPS_QCOW2_LUKS, /* qcow2 format support LUKS encryption */ QEMU_CAPS_DEVICE_PCIE_PCI_BRIDGE, /* -device pcie-pci-bridge */ - QEMU_CAPS_SECCOMP_BLACKLIST, /* -sandbox.elevateprivileges */ + QEMU_CAPS_SECCOMP_FILTER_GROUPS, /* -sandbox.elevateprivileges */ QEMU_CAPS_QUERY_CPUS_FAST, /* query-cpus-fast command */ QEMU_CAPS_DISK_WRITE_CACHE, /* qemu block frontends support write-cache param */ diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index f27246b4c6..37113a433a 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -9517,8 +9517,8 @@ qemuBuildSeccompSandboxCommandLine(virCommandPtr cmd, return 0; } - /* Use blacklist by default if supported */ - if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_BLACKLIST)) { + /* Block undesirable syscall groups by default if supported */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_FILTER_GROUPS)) { virCommandAddArgList(cmd, "-sandbox", "on,obsolete=deny,elevateprivileges=deny," "spawn=deny,resourcecontrol=deny", diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 72874ee4fd..56ec5c0352 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -3851,9 +3851,13 @@ qemuDomainObjPrivateXMLParse(xmlXPathContextPtr ctxt, if (str) { int flag = virQEMUCapsTypeFromString(str); if (flag < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Unknown qemu capabilities flag %s"), str); - goto error; + if (g_str_equal(str, "seccomp-blacklist")) { + flag = QEMU_CAPS_SECCOMP_FILTER_GROUPS; + } else { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Unknown qemu capabilities flag %s"), str); + goto error; + } } virQEMUCapsSet(qemuCaps, flag); } diff --git a/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml index 0391f4b81e..9822f50827 100644 --- a/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml @@ -99,7 +99,7 @@ <flag name='virtio-mouse-ccw'/> <flag name='virtio-tablet-ccw'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> <flag name='pr-manager-helper'/> diff --git a/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml index 9eaafb4ba6..3e5e3b4ad3 100644 --- a/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml @@ -173,7 +173,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> <flag name='pr-manager-helper'/> diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml index a5d6dc3bef..3c5f8235fe 100644 --- a/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml @@ -134,7 +134,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml index d1ed9f6e28..e5a02c382e 100644 --- a/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml @@ -131,7 +131,7 @@ <flag name='machine.pseries.max-cpu-compat'/> <flag name='dump-completed'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml index cef6ebb9ad..238b05240c 100644 --- a/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml @@ -99,7 +99,7 @@ <flag name='virtio-mouse-ccw'/> <flag name='virtio-tablet-ccw'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml index 6d48699e3e..6011f2f4a2 100644 --- a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml @@ -170,7 +170,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_3.0.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_3.0.0.ppc64.xml index e4a560bac5..a1643260ab 100644 --- a/tests/qemucapabilitiesdata/caps_3.0.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_3.0.0.ppc64.xml @@ -130,7 +130,7 @@ <flag name='machine.pseries.max-cpu-compat'/> <flag name='dump-completed'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_3.0.0.riscv32.xml b/tests/qemucapabilitiesdata/caps_3.0.0.riscv32.xml index 71f9b0c37f..6d1e3d8cd5 100644 --- a/tests/qemucapabilitiesdata/caps_3.0.0.riscv32.xml +++ b/tests/qemucapabilitiesdata/caps_3.0.0.riscv32.xml @@ -75,7 +75,7 @@ <flag name='iscsi.password-secret'/> <flag name='dump-completed'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_3.0.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_3.0.0.riscv64.xml index 279078d541..a6994acac3 100644 --- a/tests/qemucapabilitiesdata/caps_3.0.0.riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_3.0.0.riscv64.xml @@ -75,7 +75,7 @@ <flag name='iscsi.password-secret'/> <flag name='dump-completed'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml b/tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml index f1ed34c612..4d80f9c6ba 100644 --- a/tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml @@ -101,7 +101,7 @@ <flag name='virtio-mouse-ccw'/> <flag name='virtio-tablet-ccw'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml index ae1836b28f..e31cb7c345 100644 --- a/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml @@ -172,7 +172,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_3.1.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_3.1.0.ppc64.xml index 0dc0393c22..d01de900c9 100644 --- a/tests/qemucapabilitiesdata/caps_3.1.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_3.1.0.ppc64.xml @@ -131,7 +131,7 @@ <flag name='machine.pseries.max-cpu-compat'/> <flag name='dump-completed'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml index d4ff21fdac..177dedbfb5 100644 --- a/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml @@ -172,7 +172,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml index 404a39af03..7afec03c2f 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml @@ -135,7 +135,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml index cb0232173c..81ed3b58de 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml @@ -138,7 +138,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml b/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml index 11475306f9..bfb38b6eae 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml @@ -139,7 +139,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml index 608590a35b..801a7c368e 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml @@ -139,7 +139,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml b/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml index f4d20169e0..0be526ce7f 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml @@ -101,7 +101,7 @@ <flag name='virtio-mouse-ccw'/> <flag name='virtio-tablet-ccw'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml index 0e66a4c847..930f508048 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml @@ -171,7 +171,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml index f2d3902e6c..e1481979e8 100644 --- a/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml @@ -171,7 +171,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml index 98cee36669..bc643545ac 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml @@ -137,7 +137,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml index 70c826e0cf..ed3c865747 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml @@ -138,7 +138,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml b/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml index 0b174ffeec..335a06d897 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml @@ -101,7 +101,7 @@ <flag name='virtio-mouse-ccw'/> <flag name='virtio-tablet-ccw'/> <flag name='qcow2-luks'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml index eaf71eb469..009536f0b4 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml @@ -172,7 +172,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml index f2d691734f..b2f6e0ed30 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml @@ -139,7 +139,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml index b3f673b0f6..c9cb2c0639 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml @@ -140,7 +140,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml index 3119f6deb7..75c2fbfd54 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml @@ -139,7 +139,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml index 6d1c779272..a01395cf53 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml @@ -172,7 +172,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml index 26a7985add..7c36716d88 100644 --- a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml @@ -172,7 +172,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemustatusxml2xmldata/backup-pull-in.xml b/tests/qemustatusxml2xmldata/backup-pull-in.xml index 1db978a3ac..76d723cf76 100644 --- a/tests/qemustatusxml2xmldata/backup-pull-in.xml +++ b/tests/qemustatusxml2xmldata/backup-pull-in.xml @@ -189,7 +189,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemustatusxml2xmldata/blockjob-blockdev-in.xml b/tests/qemustatusxml2xmldata/blockjob-blockdev-in.xml index cc17a17ff4..a4d9d57666 100644 --- a/tests/qemustatusxml2xmldata/blockjob-blockdev-in.xml +++ b/tests/qemustatusxml2xmldata/blockjob-blockdev-in.xml @@ -189,7 +189,7 @@ <flag name='dump-completed'/> <flag name='qcow2-luks'/> <flag name='pcie-pci-bridge'/> - <flag name='seccomp-blacklist'/> + <flag name='seccomp-filter-groups'/> <flag name='query-cpus-fast'/> <flag name='disk-write-cache'/> <flag name='nbd-tls'/> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index d5b2a21b5a..0989abd042 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -921,7 +921,7 @@ mymain(void) DO_TEST("minimal", NONE); DO_TEST("minimal-sandbox", - QEMU_CAPS_SECCOMP_BLACKLIST); + QEMU_CAPS_SECCOMP_FILTER_GROUPS); DO_TEST_PARSE_ERROR("minimal-no-memory", NONE); DO_TEST("minimal-msg-timestamp", QEMU_CAPS_MSG_TIMESTAMP); -- 2.24.1

On a Friday in 2020, Daniel P. Berrangé wrote: While 'filter groups' describes the underlying QEMU functionality better, we only use it to deny syscalls. So using 'blocklist' as proposed in the RFC you linked would better show the contrast between this and the old approach. I'd just leave the XML as-is, to avoid introducing this special-casing. Jano

On a Friday in 2020, Daniel P. Berrangé wrote: Sigh, Jano

On Fri, Jun 19, 2020 at 03:05:40PM +0200, Peter Krempa wrote: Yes, that's what I'm already working on doing. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

On Fri, Jun 19, 2020 at 10:32:43 +0100, Daniel Berrange wrote: IMO this decreases the readability of the code.

On Fri, Jun 19, 2020 at 11:17:49 +0100, Daniel Berrange wrote: It still a parameter of a tool we use rather than our own. Since there is no technical reason for it and IMO makes the code worse I will not provide the R-B for this patch.

On Fri, Jun 19, 2020 at 12:09:07 +0100, Daniel Berrange wrote: I'll consider a net win if you describe/document the options used for the command regardless of which spelling is used.

On Fri, Jun 19, 2020 at 10:32:47 +0100, Daniel Berrange wrote: This may or may not make sence depending on how syntax check is ported to meson. You can use my R-b for this hunk if this survives the rewrite. IMO this change doesn't make sense in the light of the meson rewrite.

On Mon, Jun 22, 2020 at 12:14:56 +0100, Daniel Berrange wrote: [...] Main reason is to minimize conflicts with Pavel's effort. This hunk is here since 2012, so waiting even for amonth doesn't seem to be that much of a problem.

On Fri, Jun 19, 2020 at 01:43:46PM +0200, Ján Tomko wrote: This comment is against the code that deals with the old style QEMU seccomp code, which rquires an explicit opt-in. The new style seccom is further up above the diff hunk context seen here. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

Two methods needs to deal with the fixed filename prefix on the NIC name used by bond devices. The code is clearer if they both make use of a defined constant. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- src/interface/interface_backend_udev.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index e388f98536..f0594aa59c 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -527,8 +527,16 @@ udevInterfaceLookupByMACString(virConnectPtr conn, const char *macstr) return ret; } +/* + * Name prefix for sysfs symlinks that indicate which + * NICs are part of the bonded device + */ +#define BOND_NIC_PREFIX "slave_" + /** - * Helper function for finding bond slaves using scandir() + * Helper function for finding NICs that are members of a + * bond device by using scandir() over the sysfs net interface + * dir * * @param entry - directory entry passed by scandir() * @@ -542,7 +550,7 @@ udevBondScanDirFilter(const struct dirent *entry) * interface sysfs entry and references the slaves as slave_eth0 for * example. */ - if (STRPREFIX(entry->d_name, "slave_")) + if (STRPREFIX(entry->d_name, BOND_NIC_PREFIX)) return 1; return 0; @@ -763,21 +771,15 @@ udevGetIfaceDefBond(struct udev *udev, ifacedef->data.bond.nbItf = slave_count; for (i = 0; i < slave_count; i++) { - /* Names are slave_interface. e.g. slave_eth0 - * so we use the part after the _ - */ - tmp_str = strchr(slave_list[i]->d_name, '_'); - if (!tmp_str || strlen(tmp_str) < 2) { + if (!STRPREFIX(nic_list[i]->d_name, BOND_NIC_PREFIX)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Invalid enslaved interface name '%s' seen for " "bond '%s'"), slave_list[i]->d_name, name); goto error; } - /* go past the _ */ - tmp_str++; ifacedef->data.bond.itf[i] = - udevGetIfaceDef(udev, tmp_str); + udevGetIfaceDef(udev, nic_list[i]->d_name + strlen(BOND_NIC_PREFIX)); if (!ifacedef->data.bond.itf[i]) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get interface information for '%s', which is " -- 2.24.1

We can't change the filenames used in sysfs, but we don't have to use that terminology in our code processing the list of NICs. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- docs/schemas/interface.rng | 2 +- src/interface/interface_backend_udev.c | 43 ++++++++++++-------------- 2 files changed, 21 insertions(+), 24 deletions(-) diff --git a/docs/schemas/interface.rng b/docs/schemas/interface.rng index a4fddaaedc..2530077190 100644 --- a/docs/schemas/interface.rng +++ b/docs/schemas/interface.rng @@ -237,7 +237,7 @@ </optional> <oneOrMore> - <!-- The slave interfaces --> + <!-- The attached interfaces --> <ref name="bare-ethernet-interface"/> </oneOrMore> </interleave> diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index f0594aa59c..f5961a93df 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -546,9 +546,7 @@ static int udevBondScanDirFilter(const struct dirent *entry) { /* This is ugly so if anyone has a better suggestion, please improve - * this. Unfortunately the kernel stores everything in the top level - * interface sysfs entry and references the slaves as slave_eth0 for - * example. + * this. */ if (STRPREFIX(entry->d_name, BOND_NIC_PREFIX)) return 1; @@ -591,8 +589,8 @@ udevGetIfaceDefBond(struct udev *udev, const char *name, virInterfaceDef *ifacedef) { - struct dirent **slave_list = NULL; - int slave_count = 0; + struct dirent **nic_list = NULL; + int nic_count = 0; size_t i; const char *tmp_str; int tmp_int; @@ -754,27 +752,26 @@ udevGetIfaceDefBond(struct udev *udev, } ifacedef->data.bond.target = g_strdup(tmp_str); - /* Slaves of the bond */ - /* Get each slave in the bond */ - slave_count = scandir(udev_device_get_syspath(dev), &slave_list, + /* Get each NIC that is a member of the bond */ + nic_count = scandir(udev_device_get_syspath(dev), &nic_list, udevBondScanDirFilter, alphasort); - if (slave_count < 0) { + if (nic_count < 0) { virReportSystemError(errno, - _("Could not get slaves of bond '%s'"), name); + _("Could not get interfaces for bond '%s'"), name); goto error; } - /* Allocate our list of slave devices */ - if (VIR_ALLOC_N(ifacedef->data.bond.itf, slave_count) < 0) + /* Allocate our list of bonded devices */ + if (VIR_ALLOC_N(ifacedef->data.bond.itf, nic_count) < 0) goto error; - ifacedef->data.bond.nbItf = slave_count; + ifacedef->data.bond.nbItf = nic_count; - for (i = 0; i < slave_count; i++) { + for (i = 0; i < nic_count; i++) { if (!STRPREFIX(nic_list[i]->d_name, BOND_NIC_PREFIX)) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("Invalid enslaved interface name '%s' seen for " - "bond '%s'"), slave_list[i]->d_name, name); + _("Invalid bonded interface name '%s' seen for " + "bond '%s'"), nic_list[i]->d_name, name); goto error; } @@ -782,21 +779,21 @@ udevGetIfaceDefBond(struct udev *udev, udevGetIfaceDef(udev, nic_list[i]->d_name + strlen(BOND_NIC_PREFIX)); if (!ifacedef->data.bond.itf[i]) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("Could not get interface information for '%s', which is " - "a enslaved in bond '%s'"), slave_list[i]->d_name, name); + _("Could not get interface information for '%s', which " + "is part of bond '%s'"), nic_list[i]->d_name, name); goto error; } - VIR_FREE(slave_list[i]); + VIR_FREE(nic_list[i]); } - VIR_FREE(slave_list); + VIR_FREE(nic_list); return 0; error: - for (i = 0; slave_count != -1 && i < slave_count; i++) - VIR_FREE(slave_list[i]); - VIR_FREE(slave_list); + for (i = 0; nic_count != -1 && i < nic_count; i++) + VIR_FREE(nic_list[i]); + VIR_FREE(nic_list); return -1; } -- 2.24.1

On Fri, Jun 19, 2020 at 12:25:49PM +0200, Peter Krempa wrote: Opps, yes, will fix. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

On Fri, Jun 19, 2020 at 10:32:58 +0100, Daniel Berrange wrote: [...] I'm not persuaded that it's worth diverging the internal names from the XML names since we have to stick with those. NACK