On 19.06.2013 19:00, Daniel P. Berrange wrote: s/ == -1/ < 0/ here and in others Michal

On 19.06.2013 19:00, Daniel P. Berrange wrote: or: } else { ret->driver = NULL; if (res == VIR_DRV_OPEN_ERROR) goto failed; } But I can live with both. Michal

On 19.06.2013 19:00, Daniel P. Berrange wrote: Huh, I didn't know selinux can be used as ACL. I think you want to add these as you add the corresponding drivers. Michal

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Introduce an access control driver that uses the SELinux framework for validating API authorization. Each libvirt object is represented as a new class in SELinux policy, along with all permissions. The actual policy is not included here, it has to be part of the core SELinux policy dist, since you can't define new object classes/permissions in external loadable modules As well as going to the audit system, all SELinux AVC denials also get reported in libvirtd system logs Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- m4/virt-compile-warnings.m4 | 1 + m4/virt-selinux.m4 | 2 + po/POTFILES.in | 1 + src/Makefile.am | 9 + src/access/viraccessdriverselinux.c | 565 ++++++++++++++++++++++++++++++++++++ src/access/viraccessdriverselinux.h | 28 ++ src/access/viraccessmanager.c | 6 + src/internal.h | 4 + src/util/virlog.c | 3 +- src/util/virlog.h | 1 + 10 files changed, 619 insertions(+), 1 deletion(-) create mode 100644 src/access/viraccessdriverselinux.c create mode 100644 src/access/viraccessdriverselinux.h diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index ce4e244..979424f 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -105,6 +105,7 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ if test $lv_cv_gcc_pragma_push_works = no; then dontwarn="$dontwarn -Wmissing-prototypes" dontwarn="$dontwarn -Wmissing-declarations" + dontwarn="$dontwarn -Wmissing-format-attribute" dontwarn="$dontwarn -Wcast-align" else AC_DEFINE_UNQUOTED([WORKING_PRAGMA_PUSH], 1, diff --git a/m4/virt-selinux.m4 b/m4/virt-selinux.m4 index abb0d12..f849858 100644 --- a/m4/virt-selinux.m4 +++ b/m4/virt-selinux.m4 @@ -43,6 +43,8 @@ AC_DEFUN([LIBVIRT_CHECK_SELINUX],[ dnl We prefer to use <selinux/label.h> and selabel_open, but can fall dnl back to matchpathcon for the sake of RHEL 5's version of libselinux. AC_CHECK_HEADERS([selinux/label.h]) + + AC_CHECK_FUNCS([security_deny_unknown]) fi ]) diff --git a/po/POTFILES.in b/po/POTFILES.in index af7fd7f..1b27deb 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -7,6 +7,7 @@ daemon/stream.c gnulib/lib/gai_strerror.c gnulib/lib/regcomp.c src/access/viraccessdriverpolkit.c +src/access/viraccessdriverselinux.c src/access/viraccessmanager.c src/conf/cpu_conf.c src/conf/device_conf.c diff --git a/src/Makefile.am b/src/Makefile.am index 9c118a9..a099d7a 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -800,6 +800,9 @@ ACCESS_DRIVER_SOURCES = \ ACCESS_DRIVER_POLKIT_SOURCES = \ access/viraccessdriverpolkit.h access/viraccessdriverpolkit.c +ACCESS_DRIVER_SELINUX_SOURCES = \ + access/viraccessdriverselinux.h access/viraccessdriverselinux.c + ACCESS_DRIVER_POLKIT_POLICY = \ access/org.libvirt.api.policy @@ -1400,6 +1403,12 @@ libvirt_driver_access_la_LIBADD = EXTRA_DIST += access/genpolkit.pl +if WITH_SELINUX +libvirt_driver_access_la_SOURCES += $(ACCESS_DRIVER_SELINUX_SOURCES) +else +EXTRA_DIST += $(ACCESS_DRIVER_SELINUX_SOURCES) +endif + if WITH_POLKIT1 libvirt_driver_access_la_SOURCES += $(ACCESS_DRIVER_POLKIT_SOURCES) diff --git a/src/access/viraccessdriverselinux.c b/src/access/viraccessdriverselinux.c new file mode 100644 index 0000000..235760d --- /dev/null +++ b/src/access/viraccessdriverselinux.c @@ -0,0 +1,565 @@ +/* + * viraccessdriverselinux.c: selinuxed access control driver + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>;. + */ + +#include <config.h> + +#include "viraccessdriverselinux.h" +#include "viralloc.h" +#include "vircommand.h" +#include "virlog.h" +#include "virthread.h" +#include "virerror.h" +#include "virutil.h" + +#include <selinux/selinux.h> +#include <selinux/avc.h> +#include <selinux/av_permissions.h> +#include <selinux/flask.h> + + +#define VIR_FROM_THIS VIR_FROM_ACCESS +#define virAccessError(code, ...) \ + virReportErrorHelper(VIR_FROM_THIS, code, __FILE__, \ + __FUNCTION__, __LINE__, __VA_ARGS__) + +typedef enum { + VIR_ACCESS_DRIVER_SELINUX_CLASS_CONNECT, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + + VIR_ACCESS_DRIVER_SELINUX_CLASS_LAST +} virAccessDriverSELinuxClass; + +VIR_ENUM_DECL(virAccessDriverSELinuxClass) +VIR_ENUM_IMPL(virAccessDriverSELinuxClass, + VIR_ACCESS_DRIVER_SELINUX_CLASS_LAST, + "vir_connect", + "vir_domain") + +static void virAccessDriverSELinuxAVCLog(const char *fmt, ...) ATTRIBUTE_FMT_PRINTF(1, 2); +static void virAccessDriverSELinuxAVCLogAudit(void *data, security_class_t class, char *buf, size_t bufleft); +static void *virAccessDriverSELinuxAVCCreateThread(void (*run)(void)); +static void virAccessDriverSELinuxAVCStopThread(void *thread); +static void *virAccessDriverSELinuxAVCAllocLock(void); +static void virAccessDriverSELinuxAVCGetLock(void *lock); +static void virAccessDriverSELinuxAVCReleaseLock(void *lock); +static void virAccessDriverSELinuxAVCFreeLock(void *lock); + + +/* AVC callback structures for use in avc_init. */ +static const struct avc_memory_callback virAccessDriverSELinuxAVCMemCallbacks = +{ + .func_malloc = malloc, + .func_free = free, +}; + +VIR_WARNINGS_NO_MISSING_FORMAT +static const struct avc_log_callback virAccessDriverSELinuxAVCLogCallbacks = +{ + .func_log = virAccessDriverSELinuxAVCLog, + .func_audit = virAccessDriverSELinuxAVCLogAudit, +}; +VIR_WARNINGS_RESET + +static const struct avc_thread_callback virAccessDriverSELinuxAVCThreadCallbacks = +{ + .func_create_thread = virAccessDriverSELinuxAVCCreateThread, + .func_stop_thread = virAccessDriverSELinuxAVCStopThread, +}; +static const struct avc_lock_callback virAccessDriverSELinuxAVCLockCallbacks = +{ + .func_alloc_lock = virAccessDriverSELinuxAVCAllocLock, + .func_get_lock = virAccessDriverSELinuxAVCGetLock, + .func_release_lock = virAccessDriverSELinuxAVCReleaseLock, + .func_free_lock = virAccessDriverSELinuxAVCFreeLock, +}; + + +typedef struct _virAccessDriverSELinuxPrivate virAccessDriverSELinuxPrivate; +typedef virAccessDriverSELinuxPrivate *virAccessDriverSELinuxPrivatePtr; + +struct _virAccessDriverSELinuxPrivate { + bool enabled; + + /* Cache for AVCs */ + struct avc_entry_ref aeref; + + /* SID of the daemon */ + security_id_t selfSid; +}; + + +static int virAccessDriverSELinuxSetup(virAccessManagerPtr manager) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + int r; + security_context_t localCon; + int ret = -1; + + if ((r = is_selinux_enabled()) < 0) { + virReportSystemError(errno, "%s", + _("Unable to determine if SELinux is enabled")); + return -1; + } + priv->enabled = r != 0; + priv->selfSid = SECSID_WILD; + + avc_entry_ref_init(&priv->aeref); + + if (avc_init("avc", + &virAccessDriverSELinuxAVCMemCallbacks, + &virAccessDriverSELinuxAVCLogCallbacks, + &virAccessDriverSELinuxAVCThreadCallbacks, + &virAccessDriverSELinuxAVCLockCallbacks) < 0) { + virReportSystemError(errno, "%s", + _("Unable to initialize AVC system")); + goto cleanup; + } + + if (getcon(&localCon) < 0) { + virReportSystemError(errno, "%s", + _("Unable to get context of daemon")); + goto cleanup; + } + + if (avc_context_to_sid(localCon, &priv->selfSid) < 0) { + virReportSystemError(errno, + _("Unable to convert context %s to SID"), + (char*)localCon); + goto cleanup; + } + VIR_FREE(localCon); + + ret = 0; +cleanup: + if (ret < 0) + priv->selfSid = SECSID_WILD; + freecon(localCon); + return ret; +} + + +static void virAccessDriverSELinuxCleanup(virAccessManagerPtr manager) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + priv->selfSid = SECSID_WILD; +} + + +static security_id_t +virAccessDriverSELinuxGetClientSID(void) +{ + virIdentityPtr identity = virIdentityGetCurrent(); + const char *seccon = NULL; + security_id_t sid = SECSID_WILD; + + if (!identity) { + virAccessError(VIR_ERR_ACCESS_DENIED, "%s", + _("SELinux denying due to lack of identity")); + return NULL; + } + if (virIdentityGetAttr(identity, VIR_IDENTITY_ATTR_SELINUX_CONTEXT, &seccon) < 0) + goto cleanup; + + if (!seccon) { + virAccessError(VIR_ERR_INTERNAL_ERROR, "%s", + _("No security context available")); + goto cleanup; + } + + if (avc_context_to_sid((security_context_t)seccon, &sid) < 0) { + virReportSystemError(errno, + _("Unable to convert context %s to SID"), + seccon); + sid = SECSID_WILD; + goto cleanup; + } + +cleanup: + virObjectUnref(identity); + return sid; +} + + +static security_class_t +virAccessDriverSELinuxGetObjectClass(const char *klassname) +{ + security_class_t ret; + + if ((ret = string_to_security_class(klassname)) == 0) { + virReportSystemError(errno, + _("Unable to find security class '%s'"), klassname); + return 0; + } + + return ret; +} + + +static access_vector_t +virAccessDriverSELinuxGetObjectPerm(const char *permname, + const char *klassname, + security_class_t objectClass) +{ + access_vector_t ret; + + if (objectClass == 0) + return 0; + + if ((ret = string_to_av_perm(objectClass, permname)) == 0) { + virReportSystemError(errno, + _("Unable to lookup permission '%s' for class '%s'"), + permname, klassname); + return 0; + } + + return ret; +} + +static int +virAccessDriverSELinuxCheck(virAccessManagerPtr manager, + security_id_t objectSid, + virAccessDriverSELinuxClass klass, + const char *permname) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + const char *klassname = virAccessDriverSELinuxClassTypeToString(klass); + security_id_t clientSid = virAccessDriverSELinuxGetClientSID(); + security_class_t klassId = virAccessDriverSELinuxGetObjectClass(klassname); + access_vector_t perm = virAccessDriverSELinuxGetObjectPerm(permname, klassname, klassId); + int ret; + + if (clientSid == SECSID_WILD || + klassId == 0 || + perm == 0) { +#ifdef HAVE_SECURITY_DENY_UNKNOWN + if (security_deny_unknown() == 0) { + VIR_WARN("Allow access, because policy does not deny unknown objects"); + ret = 1; /* Allow */ + } else { + ret = 0; /* Deny */ + } +#else + ret = 0; /* Deny */ +#endif + goto cleanup; + } + + if (avc_has_perm(clientSid, objectSid, + klassId, perm, + &priv->aeref, NULL) < 0) { + int save_errno = errno; + if (security_getenforce() == 0) { + char ebuf[1024]; + VIR_WARN("Ignoring denial in non-enforcing mode: %s", + virStrerror(save_errno, ebuf, sizeof(ebuf))); + ret = 1; /* Allow */ + goto cleanup; + } + switch (save_errno) { + case EACCES: + ret = 0; /* Deny */ + break; + case EINVAL: + ret = -1; /* Error */ + virAccessError(VIR_ERR_ACCESS_DENIED, "%s", + _("SELinux denying due to invalid security context")); + break; + default: + ret = -1; /* Error */ + virReportSystemError(errno, "%s", + _("SELinux denying")); + break; + } + goto cleanup; + } + + ret = 1; + +cleanup: + return ret; +} + + +static int +virAccessDriverSELinuxCheckConnect(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virAccessPermConnect perm) +{ + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + /* There's no object to use for targetSid here, so we + * instead use the daemon's context as the targetSid */ + return virAccessDriverSELinuxCheck(manager, + priv->selfSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_CONNECT, + virAccessPermConnectTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckDomain(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virDomainDefPtr domain ATTRIBUTE_UNUSED, + virAccessPermDomain perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermDomainTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckInterface(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virInterfaceDefPtr iface ATTRIBUTE_UNUSED, + virAccessPermInterface perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermInterfaceTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckNetwork(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virNetworkDefPtr network ATTRIBUTE_UNUSED, + virAccessPermNetwork perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermNetworkTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckNodeDevice(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virNodeDeviceDefPtr nodedev ATTRIBUTE_UNUSED, + virAccessPermNodeDevice perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermNodeDeviceTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckNWFilter(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virNWFilterDefPtr nwfilter ATTRIBUTE_UNUSED, + virAccessPermNWFilter perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermNWFilterTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckSecret(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virSecretDefPtr secret ATTRIBUTE_UNUSED, + virAccessPermSecret perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermSecretTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckStoragePool(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virStoragePoolDefPtr pool ATTRIBUTE_UNUSED, + virAccessPermStoragePool perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermStoragePoolTypeToString(perm)); +} + + +static int +virAccessDriverSELinuxCheckStorageVol(virAccessManagerPtr manager, + const char *driverName ATTRIBUTE_UNUSED, + virStoragePoolDefPtr pool ATTRIBUTE_UNUSED, + virStorageVolDefPtr vol ATTRIBUTE_UNUSED, + virAccessPermStorageVol perm) +{ + security_id_t objectSid; + + virAccessDriverSELinuxPrivatePtr priv = virAccessManagerGetPrivateData(manager); + + objectSid = priv->selfSid; /* XXX take from def ? */ + + return virAccessDriverSELinuxCheck(manager, + objectSid, + VIR_ACCESS_DRIVER_SELINUX_CLASS_DOMAIN, + virAccessPermStorageVolTypeToString(perm)); +} + + +static void virAccessDriverSELinuxAVCLog(const char *fmt, ...) +{ + va_list ap; + va_start(ap, fmt); + virLogVMessage(VIR_LOG_FROM_ACCESS, VIR_LOG_WARN, + __FILE__, __LINE__ ,__func__, + NULL, fmt, ap); + va_end(ap); +} + + +static void virAccessDriverSELinuxAVCLogAudit(void *data ATTRIBUTE_UNUSED, + security_class_t class ATTRIBUTE_UNUSED, + char *buf ATTRIBUTE_UNUSED, + size_t bufleft ATTRIBUTE_UNUSED) +{ +} + + +static void *virAccessDriverSELinuxAVCCreateThread(void (*run)(void)) +{ + virThreadPtr thread; + + if (VIR_ALLOC(thread) < 0) { + virReportOOMError(); + return NULL; + } + + if (virThreadCreate(thread, false, (virThreadFunc)run, NULL) < 0) { + virReportSystemError(errno, "%s", + _("Unable to create thread")); + VIR_FREE(thread); + } + + return thread; +} + + +static void virAccessDriverSELinuxAVCStopThread(void *thread) +{ + virThreadCancel(thread); + VIR_FREE(thread); +} + + +static void *virAccessDriverSELinuxAVCAllocLock(void) +{ + virMutexPtr lock; + if (VIR_ALLOC(lock) < 0) { + virReportOOMError(); + return NULL; + } + if (virMutexInit(lock) < 0) { + virReportSystemError(errno, "%s", + _("Unable to initialize mutex")); + VIR_FREE(lock); + return NULL; + } + return lock; +} + + +static void virAccessDriverSELinuxAVCGetLock(void *lock) +{ + virMutexLock(lock); +} + + +static void virAccessDriverSELinuxAVCReleaseLock(void *lock) +{ + virMutexUnlock(lock); +} + + +static void virAccessDriverSELinuxAVCFreeLock(void *lock) +{ + virMutexDestroy(lock); + VIR_FREE(lock); +} + + +virAccessDriver accessDriverSELinux = { + .privateDataLen = sizeof(virAccessDriverSELinuxPrivate), + .name = "selinux", + .setup = virAccessDriverSELinuxSetup, + .cleanup = virAccessDriverSELinuxCleanup, + .checkConnect = virAccessDriverSELinuxCheckConnect, + .checkDomain = virAccessDriverSELinuxCheckDomain, + .checkInterface = virAccessDriverSELinuxCheckInterface, + .checkNetwork = virAccessDriverSELinuxCheckNetwork, + .checkNodeDevice = virAccessDriverSELinuxCheckNodeDevice, + .checkNWFilter = virAccessDriverSELinuxCheckNWFilter, + .checkSecret = virAccessDriverSELinuxCheckSecret, + .checkStoragePool = virAccessDriverSELinuxCheckStoragePool, + .checkStorageVol = virAccessDriverSELinuxCheckStorageVol, +}; diff --git a/src/access/viraccessdriverselinux.h b/src/access/viraccessdriverselinux.h new file mode 100644 index 0000000..e2b26e2 --- /dev/null +++ b/src/access/viraccessdriverselinux.h @@ -0,0 +1,28 @@ +/* + * viraccessdriverselinux.h: selinuxed access control driver + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>;. + */ + +#ifndef __VIR_ACCESS_DRIVER_SELINUX_H__ +# define __VIR_ACCESS_DRIVER_SELINUX_H__ + +# include "viraccessdriver.h" + +extern virAccessDriver accessDriverSELinux; + +#endif /* __VIR_ACCESS_DRIVER_SELINUX_H__ */ diff --git a/src/access/viraccessmanager.c b/src/access/viraccessmanager.c index 559a844..b84e244 100644 --- a/src/access/viraccessmanager.c +++ b/src/access/viraccessmanager.c @@ -26,6 +26,9 @@ #if WITH_POLKIT1 # include "viraccessdriverpolkit.h" #endif +#if WITH_SELINUX +# include "viraccessdriverselinux.h" +#endif #include "viralloc.h" #include "virerror.h" #include "virobject.h" @@ -114,6 +117,9 @@ static virAccessDriverPtr accessDrivers[] = { #if WITH_POLKIT1 &accessDriverPolkit, #endif +#if WITH_SELINUX + &accessDriverSELinux, +#endif }; diff --git a/src/internal.h b/src/internal.h index 5e29694..35d470a 100644 --- a/src/internal.h +++ b/src/internal.h @@ -235,11 +235,15 @@ # define VIR_WARNINGS_NO_CAST_ALIGN \ _Pragma ("GCC diagnostic push") \ _Pragma ("GCC diagnostic ignored \"-Wcast-align\"") +# define VIR_WARNINGS_NO_MISSING_FORMAT \ + _Pragma ("GCC diagnostic push") \ + _Pragma ("GCC diagnostic ignored \"-Wmissing-format-attribute\"") # define VIR_WARNINGS_RESET \ _Pragma ("GCC diagnostic pop") # else # define VIR_WARNINGS_NO_CAST_ALIGN +# define VIR_WARNINGS_NO_MISSING_FORMAT # define VIR_WARNINGS_RESET # endif diff --git a/src/util/virlog.c b/src/util/virlog.c index 064f8e8..ab57a5c 100644 --- a/src/util/virlog.c +++ b/src/util/virlog.c @@ -66,7 +66,8 @@ VIR_ENUM_IMPL(virLogSource, VIR_LOG_FROM_LAST, "error", "audit", "trace", - "library"); + "library", + "access"); /* * A logging buffer to keep some history over logs diff --git a/src/util/virlog.h b/src/util/virlog.h index 7db1657..98555c3 100644 --- a/src/util/virlog.h +++ b/src/util/virlog.h @@ -50,6 +50,7 @@ typedef enum { VIR_LOG_FROM_AUDIT, VIR_LOG_FROM_TRACE, VIR_LOG_FROM_LIBRARY, + VIR_LOG_FROM_ACCESS, VIR_LOG_FROM_LAST, } virLogSource; -- 1.8.1.4

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Extend the 'gendispatch.pl' script to be able to generate three new types of file. - 'aclheader' - defines signatures of helper APIs for doing authorization checks. There is one helper API for each API requiring an auth check. Any @acl annotations result in a method being generated with a suffix of 'EnsureACL'. If the ACL check requires examination of flags, an extra 'flags' param will be present. Some examples extern int virConnectBaselineCPUEnsureACL(void); extern int virConnectDomainEventDeregisterEnsureACL(virDomainDefPtr domain); extern int virDomainAttachDeviceFlagsEnsureACL(virDomainDefPtr domain, unsigned int flags); Any @aclfilter annotations resuilt in a method being generated with a suffix of 'CheckACL'. extern int virConnectListAllDomainsCheckACL(virDomainDefPtr domain); These are used for filtering individual objects from APIs which return a list of objects - 'aclbody' - defines the actual implementation of the methods described above. This calls into the access manager APIs. A complex example: /* Returns: -1 on error (denied==error), 0 on allowed */ int virDomainAttachDeviceFlagsEnsureACL(virConnectPtr conn, virDomainDefPtr domain, unsigned int flags) { virAccessManagerPtr mgr; int rv; if (!(mgr = virAccessManagerGetDefault())) return -1; if ((rv = virAccessManagerCheckDomain(mgr, conn->driver->name, domain, VIR_ACCESS_PERM_DOMAIN_WRITE)) <= 0) { if (rv == 0) virReportError(VIR_ERR_ACCESS_DENIED, NULL); return -1; } if (((flags & (VIR_DOMAIN_AFFECT_CONFIG|VIR_DOMAIN_AFFECT_LIVE)) == 0) && (rv = virAccessManagerCheckDomain(mgr, conn->driver->name, domain, VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) { if (rv == 0) virReportError(VIR_ERR_ACCESS_DENIED, NULL); return -1; } if (((flags & (VIR_DOMAIN_AFFECT_CONFIG)) == (VIR_DOMAIN_AFFECT_CONFIG)) && (rv = virAccessManagerCheckDomain(mgr, conn->driver->name, domain, VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) { if (rv == 0) virReportError(VIR_ERR_ACCESS_DENIED, NULL); return -1; } return 0; } - 'aclsyms' - generates a linker script to export the APIs to drivers. Some examples virConnectBaselineCPUEnsureACL; virConnectCompareCPUEnsureACL; Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- .gitignore | 9 +++ src/Makefile.am | 55 ++++++++++++- src/rpc/gendispatch.pl | 209 ++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 268 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f9168fc..7a28941 100644 --- a/.gitignore +++ b/.gitignore @@ -104,10 +104,19 @@ /sc_* /src/.*.stamp /src/access/org.libvirt.api.policy +/src/access/viraccessapicheck.c +/src/access/viraccessapicheck.h +/src/access/viraccessapichecklxc.c +/src/access/viraccessapichecklxc.h +/src/access/viraccessapicheckqemu.c +/src/access/viraccessapicheckqemu.h /src/esx/*.generated.* /src/hyperv/*.generated.* /src/libvirt*.def /src/libvirt.syms +/src/libvirt_access.syms +/src/libvirt_access_lxc.syms +/src/libvirt_access_qemu.syms /src/libvirt_*.stp /src/libvirt_*helper /src/libvirt_*probes.h diff --git a/src/Makefile.am b/src/Makefile.am index a099d7a..945d8e1 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -789,6 +789,15 @@ SECURITY_DRIVER_SELINUX_SOURCES = \ SECURITY_DRIVER_APPARMOR_SOURCES = \ security/security_apparmor.h security/security_apparmor.c +ACCESS_DRIVER_GENERATED = \ + access/viraccessapicheck.h access/viraccessapicheck.c \ + access/viraccessapicheckqemu.h access/viraccessapicheckqemu.c \ + access/viraccessapichecklxc.h access/viraccessapichecklxc.c + +ACCESS_DRIVER_SYMFILES = \ + libvirt_access.syms \ + libvirt_access_qemu.syms \ + libvirt_access_lxc.syms ACCESS_DRIVER_SOURCES = \ access/viraccessperm.h access/viraccessperm.c \ @@ -1393,7 +1402,7 @@ libvirt_security_manager_la_SOURCES += $(SECURITY_DRIVER_APPARMOR_SOURCES) libvirt_security_manager_la_CFLAGS += $(APPARMOR_CFLAGS) endif -libvirt_driver_access_la_SOURCES = $(ACCESS_DRIVER_SOURCES) +libvirt_driver_access_la_SOURCES = $(ACCESS_DRIVER_SOURCES) $(ACCESS_DRIVER_GENERATED) noinst_LTLIBRARIES += libvirt_driver_access.la libvirt_la_BUILT_LIBADD += libvirt_driver_access.la libvirt_driver_access_la_CFLAGS = \ @@ -1426,6 +1435,50 @@ EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) endif +USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) +BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) +CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) + +libvirt_access.syms: $(srcdir)/rpc/gendispatch.pl \ + $(REMOTE_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ + remote REMOTE $(REMOTE_PROTOCOL) > $@ +libvirt_access_qemu.syms: $(srcdir)/rpc/gendispatch.pl \ + $(QEMU_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ + qemu QEMU $(QEMU_PROTOCOL) > $@ +libvirt_access_lxc.syms: $(srcdir)/rpc/gendispatch.pl \ + $(LXC_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ + lxc LXC $(LXC_PROTOCOL) > $@ + +access/viraccessapicheck.h: $(srcdir)/rpc/gendispatch.pl \ + $(REMOTE_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ + remote REMOTE $(REMOTE_PROTOCOL) > $@ +access/viraccessapicheck.c: $(srcdir)/rpc/gendispatch.pl \ + $(REMOTE_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ + remote REMOTE $(REMOTE_PROTOCOL) access/viraccessapicheck.h > $@ + +access/viraccessapicheckqemu.h: $(srcdir)/rpc/gendispatch.pl \ + $(QEMU_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ + qemu QEMU $(QEMU_PROTOCOL) > $@ +access/viraccessapicheckqemu.c: $(srcdir)/rpc/gendispatch.pl \ + $(QEMU_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ + qemu QEMU $(QEMU_PROTOCOL) access/viraccessapicheckqemu.h > $@ + +access/viraccessapichecklxc.h: $(srcdir)/rpc/gendispatch.pl \ + $(LXC_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ + lxc LXC $(LXC_PROTOCOL) > $@ +access/viraccessapichecklxc.c: $(srcdir)/rpc/gendispatch.pl \ + $(LXC_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ + lxc LXC $(LXC_PROTOCOL) access/viraccessapichecklxc.h > $@ + # Add all conditional sources just in case... EXTRA_DIST += \ $(TEST_DRIVER_SOURCES) \ diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl index 4d5007f..1232455 100755 --- a/src/rpc/gendispatch.pl +++ b/src/rpc/gendispatch.pl @@ -40,8 +40,9 @@ my $res = GetOptions("mode=s" => \$mode); die "cannot parse command line options" unless $res; -die "unknown mode '$mode', expecting 'client', 'server' or 'debug'" - unless $mode =~ /^(client|server|debug)$/; +die "unknown mode '$mode', expecting 'client', 'server', " . + "'aclheader', 'aclbody', 'aclsym' or 'debug'" + unless $mode =~ /^(client|server|aclheader|aclbody|aclsym|debug)$/; my $structprefix = shift or die "missing struct prefix argument"; my $procprefix = shift or die "missing procedure prefix argument"; @@ -124,7 +125,13 @@ while (<PROTOCOL>) { } } elsif ($collect_opts) { if (m,^\s*\*\s*\@(\w+)\s*:\s*((?:\w|:|\!|\|)+)\s*$,) { - $opts{$1} = $2; + if ($1 eq "acl" || + $1 eq "aclfilter") { + $opts{$1} = [] unless exists $opts{$1}; + push @{$opts{$1}}, $2; + } else { + $opts{$1} = $2; + } } elsif (m,^\s*\*/\s*$,) { $collect_opts = 0; } elsif (m,^\s*\*\s*$,) { @@ -251,6 +258,8 @@ while (<PROTOCOL>) { $calls{$name}->{streamflag} = "none"; } + $calls{$name}->{acl} = $opts{acl}; + $calls{$name}->{aclfilter} = $opts{aclfilter}; # for now, we distinguish only two levels of priority: # low (0) and high (1) @@ -337,11 +346,18 @@ sub hyper_to_long #---------------------------------------------------------------------- # Output -print <<__EOF__; +if ($mode eq "aclsym") { + print <<__EOF__; +# Automatically generated by gendispatch.pl. +# Do not edit this file. Any changes you make will be lost. +__EOF__ +} else { + print <<__EOF__; /* Automatically generated by gendispatch.pl. * Do not edit this file. Any changes you make will be lost. */ __EOF__ +} # Debugging. if ($mode eq "debug") { @@ -1626,4 +1642,189 @@ elsif ($mode eq "client") { print " return rv;\n"; print "}\n"; } +} elsif ($mode eq "aclheader" || + $mode eq "aclbody" || + $mode eq "aclsym") { + my %generate = map { $_ => 1 } @autogen; + my @keys = keys %calls; + + if ($mode eq "aclsym") { + @keys = sort { my $c = $a . "ensureacl"; + my $d = $b . "ensureacl"; + $c cmp $d } @keys; + } else { + @keys = sort { $a cmp $b } @keys; + } + + if ($mode eq "aclheader") { + my @headers = ( + "internal.h", + "domain_conf.h", + "network_conf.h", + "secret_conf.h", + "storage_conf.h", + "nwfilter_conf.h", + "node_device_conf.h", + "interface_conf.h" + ); + foreach my $hdr (@headers) { + print "#include \"$hdr\"\n"; + } + } elsif ($mode eq "aclbody") { + my $header = shift; + print "#include <config.h>\n"; + print "#include \"$header\"\n"; + print "#include \"access/viraccessmanager.h\"\n"; + print "#include \"datatypes.h\"\n"; + print "#include \"virerror.h\"\n"; + print "\n"; + print "#define VIR_FROM_THIS VIR_FROM_ACCESS\n"; + } + print "\n"; + + foreach (@keys) { + my $call = $calls{$_}; + + die "missing 'acl' option for $call->{ProcName}" + unless exists $call->{acl} && + $#{$call->{acl}} != -1; + + next if $call->{acl}->[0] eq "none"; + + if ($mode eq "aclsym") { + my $apiname = "vir" . $call->{ProcName}; + if ($structprefix eq "qemu") { + $apiname =~ s/virDomain/virDomainQemu/; + } elsif ($structprefix eq "lxc") { + $apiname =~ s/virDomain/virDomainLxc/; + } + if (defined $call->{aclfilter}) { + print $apiname . "CheckACL;\n"; + } + print $apiname . "EnsureACL;\n"; + } else { + &generate_acl($call, $call->{acl}, "Ensure"); + if (defined $call->{aclfilter}) { + &generate_acl($call, $call->{aclfilter}, "Check"); + } + } + + sub generate_acl { + my $call = shift; + my $acl = shift; + my $action = shift; + + my @acl; + foreach (@{$acl}) { + my @bits = split /:/; + push @acl, { object => $bits[0], perm => $bits[1], flags => $bits[2] } + } + + my $checkflags = 0; + for (my $i = 1 ; $i <= $#acl ; $i++) { + if ($acl[$i]->{object} ne $acl[0]->{object}) { + die "acl for '$call->{ProcName}' cannot check different objects"; + } + if (defined $acl[$i]->{flags}) { + $checkflags = 1; + } + } + + my $apiname = "vir" . $call->{ProcName}; + if ($structprefix eq "qemu") { + $apiname =~ s/virDomain/virDomainQemu/; + } elsif ($structprefix eq "lxc") { + $apiname =~ s/virDomain/virDomainLxc/; + } + + my $object = $acl[0]->{object}; + my $arg = $acl[0]->{object}; + $arg =~ s/^.*_(\w+)$/$1/; + $object =~ s/^(\w)/uc $1/e; + $object =~ s/_(\w)/uc $1/e; + $object =~ s/Nwfilter/NWFilter/; + my $objecttype = "vir" . $object . "DefPtr"; + $apiname .= $action . "ACL"; + + if ($arg eq "interface") { + $arg = "iface"; + } + + my @argdecls; + push @argdecls, "virConnectPtr conn"; + if ($object ne "Connect") { + if ($object eq "StorageVol") { + push @argdecls, "virStoragePoolDefPtr pool"; + } + push @argdecls, "$objecttype $arg"; + } + if ($checkflags) { + push @argdecls, "unsigned int flags"; + } + + if ($mode eq "aclheader") { + print "extern int $apiname(" . join(", ", @argdecls) . ");\n"; + } else { + my @argvars; + push @argvars, "mgr"; + push @argvars, "conn->driver->name"; + if ($object ne "Connect") { + if ($object eq "StorageVol") { + push @argvars, "pool"; + } + push @argvars, $arg; + } + + if ($action eq "Check") { + print "/* Returns: -1 on error, 0 on denied, 1 on allowed */\n"; + } else { + print "/* Returns: -1 on error (denied==error), 0 on allowed */\n"; + } + print "int $apiname(" . join(", ", @argdecls) . ")\n"; + print "{\n"; + print " virAccessManagerPtr mgr;\n"; + print " int rv;\n"; + print "\n"; + print " if (!(mgr = virAccessManagerGetDefault()))\n"; + print " return -1;\n"; + print "\n"; + + foreach my $acl (@acl) { + my $perm = "vir_access_perm_" . $acl->{object} . "_" . $acl->{perm}; + $perm =~ tr/a-z/A-Z/; + + my $method = "virAccessManagerCheck" . $object; + my $space = ' ' x length($method); + print " if ("; + if (defined $acl->{flags}) { + my $flags = $acl->{flags}; + if ($flags =~ /^\!/) { + $flags = substr $flags, 1; + print "((flags & ($flags)) == 0) &&\n"; + } else { + print "((flags & ($flags)) == ($flags)) &&\n"; + } + print " "; + } + print "(rv = $method(" . join(", ", @argvars, $perm) . ")) <= 0) {\n"; + if ($action eq "Ensure") { + print " if (rv == 0)\n"; + print " virReportError(VIR_ERR_ACCESS_DENIED, NULL);\n"; + print " return -1;\n"; + } else { + print " return rv;\n"; + } + print " }"; + print "\n"; + } + + if ($action eq "Check") { + print " return 1;\n"; + } else { + print " return 0;\n"; + } + print "}\n\n"; + } + } + } } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Insert calls to the ACL checking APIs in all QEMU driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/Makefile.am | 9 +- src/qemu/qemu_driver.c | 716 +++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 645 insertions(+), 80 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 945d8e1..658d551 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1067,9 +1067,12 @@ noinst_LTLIBRARIES += libvirt_driver_qemu.la #libvirt_la_BUILT_LIBADD += libvirt_driver_qemu.la endif -libvirt_driver_qemu_impl_la_CFLAGS = $(GNUTLS_CFLAGS) \ - $(LIBNL_CFLAGS) \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) +libvirt_driver_qemu_impl_la_CFLAGS = \ + $(GNUTLS_CFLAGS) \ + $(LIBNL_CFLAGS) \ + -I$(top_srcdir)/src/access \ + -I$(top_srcdir)/src/conf \ + $(AM_CFLAGS) libvirt_driver_qemu_impl_la_LDFLAGS = $(AM_LDFLAGS) libvirt_driver_qemu_impl_la_LIBADD = $(CAPNG_LIBS) \ $(GNUTLS_LIBS) \ diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9b738e0..a99706b 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -92,6 +92,8 @@ #include "virtypedparam.h" #include "virbitmap.h" #include "virstring.h" +#include "viraccessapicheck.h" +#include "viraccessapicheckqemu.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -1053,6 +1055,10 @@ static virDrvOpenStatus qemuConnectOpen(virConnectPtr conn, } } } + + if (virConnectOpenEnsureACL(conn) < 0) + goto cleanup; + conn->privateData = qemu_driver; ret = VIR_DRV_OPEN_SUCCESS; @@ -1075,8 +1081,11 @@ static int qemuConnectClose(virConnectPtr conn) /* Which features are supported by this driver? */ static int -qemuConnectSupportsFeature(virConnectPtr conn ATTRIBUTE_UNUSED, int feature) +qemuConnectSupportsFeature(virConnectPtr conn, int feature) { + if (virConnectSupportsFeatureEnsureACL(conn) < 0) + return -1; + switch (feature) { case VIR_DRV_FEATURE_MIGRATION_V2: case VIR_DRV_FEATURE_MIGRATION_V3: @@ -1093,6 +1102,9 @@ qemuConnectSupportsFeature(virConnectPtr conn ATTRIBUTE_UNUSED, int feature) } static const char *qemuConnectGetType(virConnectPtr conn ATTRIBUTE_UNUSED) { + if (virConnectGetTypeEnsureACL(conn) < 0) + return NULL; + return "QEMU"; } @@ -1154,6 +1166,9 @@ qemuConnectGetSysinfo(virConnectPtr conn, unsigned int flags) virCheckFlags(0, NULL); + if (virConnectGetSysinfoEnsureACL(conn) < 0) + return NULL; + if (!driver->hostsysinfo) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("Host SMBIOS information is not available")); @@ -1170,6 +1185,9 @@ qemuConnectGetSysinfo(virConnectPtr conn, unsigned int flags) } static int qemuConnectGetMaxVcpus(virConnectPtr conn ATTRIBUTE_UNUSED, const char *type) { + if (virConnectGetMaxVcpusEnsureACL(conn) < 0) + return -1; + if (!type) return 16; @@ -1193,6 +1211,9 @@ static char *qemuConnectGetCapabilities(virConnectPtr conn) { virCapsPtr caps = NULL; char *xml = NULL; + if (virConnectGetCapabilitiesEnsureACL(conn) < 0) + return NULL; + if (!(caps = virQEMUDriverGetCapabilities(driver, true))) goto cleanup; @@ -1296,6 +1317,9 @@ static virDomainPtr qemuDomainLookupByID(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1321,6 +1345,9 @@ static virDomainPtr qemuDomainLookupByUUID(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByUUIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1344,6 +1371,9 @@ static virDomainPtr qemuDomainLookupByName(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByNameEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1362,6 +1392,9 @@ static int qemuDomainIsActive(virDomainPtr dom) if (!(obj = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainIsActiveEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = virDomainObjIsActive(obj); cleanup: @@ -1378,6 +1411,9 @@ static int qemuDomainIsPersistent(virDomainPtr dom) if (!(obj = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainIsPersistentEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = obj->persistent; cleanup: @@ -1394,6 +1430,9 @@ static int qemuDomainIsUpdated(virDomainPtr dom) if (!(obj = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainIsUpdatedEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = obj->updated; cleanup: @@ -1408,6 +1447,9 @@ static int qemuConnectGetVersion(virConnectPtr conn, unsigned long *version) { unsigned int qemuVersion = 0; virCapsPtr caps = NULL; + if (virConnectGetVersionEnsureACL(conn) < 0) + return -1; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -1425,8 +1467,11 @@ cleanup: } -static char *qemuConnectGetHostname(virConnectPtr conn ATTRIBUTE_UNUSED) +static char *qemuConnectGetHostname(virConnectPtr conn) { + if (virConnectGetHostnameEnsureACL(conn) < 0) + return NULL; + return virGetHostname(); } @@ -1435,6 +1480,9 @@ static int qemuConnectListDomains(virConnectPtr conn, int *ids, int nids) { virQEMUDriverPtr driver = conn->privateData; int n; + if (virConnectListDomainsEnsureACL(conn) < 0) + return -1; + n = virDomainObjListGetActiveIDs(driver->domains, ids, nids); return n; @@ -1444,6 +1492,9 @@ static int qemuConnectNumOfDomains(virConnectPtr conn) { virQEMUDriverPtr driver = conn->privateData; int n; + if (virConnectNumOfDomainsEnsureACL(conn) < 0) + return -1; + n = virDomainObjListNumOfDomains(driver->domains, 1); return n; @@ -1499,6 +1550,9 @@ static virDomainPtr qemuDomainCreateXML(virConnectPtr conn, VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; @@ -1583,6 +1637,9 @@ static int qemuDomainSuspend(virDomainPtr dom) { if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainSuspendEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -1661,6 +1718,9 @@ static int qemuDomainResume(virDomainPtr dom) { cfg = virQEMUDriverGetConfig(driver); + if (virDomainResumeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -1738,6 +1798,9 @@ static int qemuDomainShutdownFlags(virDomainPtr dom, unsigned int flags) { if (agentRequested || (!flags && priv->agent)) useAgent = true; + if (virDomainShutdownFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (priv->agentError) { if (agentRequested && !acpiRequested) { virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s", @@ -1836,6 +1899,9 @@ qemuDomainReboot(virDomainPtr dom, unsigned int flags) priv = vm->privateData; + if (virDomainRebootEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if ((flags & VIR_DOMAIN_REBOOT_GUEST_AGENT) || (!(flags & VIR_DOMAIN_REBOOT_ACPI_POWER_BTN) && priv->agent)) @@ -1917,6 +1983,9 @@ qemuDomainReset(virDomainPtr dom, unsigned int flags) if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainResetEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -1974,6 +2043,9 @@ qemuDomainDestroyFlags(virDomainPtr dom, priv = vm->privateData; + if (virDomainDestroyFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + qemuDomainSetFakeReboot(driver, vm, false); @@ -2049,6 +2121,9 @@ static char *qemuDomainGetOSType(virDomainPtr dom) { if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetOSTypeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ignore_value(VIR_STRDUP(type, vm->def->os.type)); cleanup: @@ -2067,6 +2142,9 @@ qemuDomainGetMaxMemory(virDomainPtr dom) if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetMaxMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = vm->def->mem.max_balloon; cleanup: @@ -2094,6 +2172,9 @@ static int qemuDomainSetMemoryFlags(virDomainPtr dom, unsigned long newmem, cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetMemoryFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -2194,6 +2275,9 @@ static int qemuDomainInjectNMI(virDomainPtr domain, unsigned int flags) if (!(vm = qemuDomObjFromDomain(domain))) return -1; + if (virDomainInjectNMIEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -2265,6 +2349,9 @@ static int qemuDomainSendKey(virDomainPtr domain, priv = vm->privateData; + if (virDomainSendKeyEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -2300,6 +2387,9 @@ static int qemuDomainGetInfo(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + info->state = virDomainObjGetState(vm, NULL); if (!virDomainObjIsActive(vm)) { @@ -2379,6 +2469,9 @@ qemuDomainGetState(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetStateEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *state = virDomainObjGetState(vm, reason); ret = 0; @@ -2402,6 +2495,9 @@ qemuDomainGetControlInfo(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetControlInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -2972,6 +3068,9 @@ qemuDomainSaveFlags(virDomainPtr dom, const char *path, const char *dxml, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainSaveFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -3027,6 +3126,9 @@ qemuDomainManagedSave(virDomainPtr dom, unsigned int flags) if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainManagedSaveEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -3085,14 +3187,19 @@ static int qemuDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags) { virDomainObjPtr vm = NULL; - int ret; + int ret = -1; virCheckFlags(0, -1); if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainHasManagedSaveImageEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = vm->hasManagedSave; + +cleanup: virObjectUnlock(vm); return ret; } @@ -3110,6 +3217,9 @@ qemuDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags) if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainManagedSaveRemoveEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(name = qemuDomainManagedSavePath(driver, vm))) goto cleanup; @@ -3272,6 +3382,9 @@ static int qemuDomainCoreDump(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainCoreDumpEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginAsyncJob(driver, vm, QEMU_ASYNC_JOB_DUMP) < 0) goto cleanup; @@ -3378,6 +3491,9 @@ qemuDomainScreenshot(virDomainPtr dom, priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); + if (virDomainScreenshotEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0) goto cleanup; @@ -3800,11 +3916,15 @@ qemuDomainSetVcpusFlags(virDomainPtr dom, unsigned int nvcpus, return -1; } + if (!(vm = qemuDomObjFromDomain(dom))) + goto cleanup; + cfg = virQEMUDriverGetConfig(driver); - if (!(caps = virQEMUDriverGetCapabilities(driver, false))) + + if (virDomainSetVcpusFlagsEnsureACL(dom->conn, vm->def, flags) < 0) goto cleanup; - if (!(vm = qemuDomObjFromDomain(dom))) + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; priv = vm->privateData; @@ -3936,6 +4056,9 @@ qemuDomainPinVcpuFlags(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainPinVcpuFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -4119,6 +4242,9 @@ qemuDomainGetVcpuPinInfo(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetVcpuPinInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -4207,6 +4333,9 @@ qemuDomainPinEmulator(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainPinEmulatorEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -4361,6 +4490,9 @@ qemuDomainGetEmulatorPinInfo(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetEmulatorPinInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -4426,6 +4558,9 @@ qemuDomainGetVcpus(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetVcpusEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", @@ -4525,6 +4660,9 @@ qemuDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags) priv = vm->privateData; + if (virDomainGetVcpusFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -4608,6 +4746,9 @@ static int qemuDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr secl if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainGetSecurityLabelEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainVirtTypeToString(vm->def->virtType)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("unknown virt type in domain definition '%d'"), @@ -4656,6 +4797,9 @@ static int qemuDomainGetSecurityLabelList(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainGetSecurityLabelListEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainVirtTypeToString(vm->def->virtType)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("unknown virt type in domain definition '%d'"), @@ -4723,6 +4867,9 @@ static int qemuNodeGetSecurityModel(virConnectPtr conn, if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; + if (virNodeGetSecurityModelEnsureACL(conn) < 0) + goto cleanup; + /* We treat no driver as success, but simply return no data in *secmodel */ if (caps->host.nsecModels == 0 || caps->host.secModels[0].model == NULL) @@ -5058,6 +5205,9 @@ qemuDomainRestoreFlags(virConnectPtr conn, if (fd < 0) goto cleanup; + if (virDomainRestoreFlagsEnsureACL(conn, def) < 0) + goto cleanup; + if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_LIVE | @@ -5116,6 +5266,9 @@ qemuDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *path, if (fd < 0) goto cleanup; + if (virDomainSaveImageGetXMLDescEnsureACL(conn, def) < 0) + goto cleanup; + ret = qemuDomainDefFormatXML(driver, def, flags); cleanup: @@ -5155,6 +5308,9 @@ qemuDomainSaveImageDefineXML(virConnectPtr conn, const char *path, goto cleanup; } + if (virDomainSaveImageDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + xml = qemuDomainDefFormatXML(driver, def, VIR_DOMAIN_XML_INACTIVE | VIR_DOMAIN_XML_SECURE | @@ -5265,6 +5421,9 @@ static char *qemuDomainGetXMLDesc(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetXMLDescEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + /* Refresh current memory based on balloon info if supported */ if ((vm->def->memballoon != NULL) && (vm->def->memballoon->model != VIR_DOMAIN_MEMBALLOON_MODEL_NONE) && @@ -5323,6 +5482,9 @@ static char *qemuConnectDomainXMLFromNative(virConnectPtr conn, virCheckFlags(0, NULL); + if (virConnectDomainXMLFromNativeEnsureACL(conn) < 0) + goto cleanup; + if (STRNEQ(format, QEMU_CONFIG_FORMAT_ARGV)) { virReportError(VIR_ERR_INVALID_ARG, _("unsupported config type %s"), format); @@ -5368,6 +5530,9 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn, cfg = virQEMUDriverGetConfig(driver); + if (virConnectDomainXMLToNativeEnsureACL(conn) < 0) + goto cleanup; + if (STRNEQ(format, QEMU_CONFIG_FORMAT_ARGV)) { virReportError(VIR_ERR_INVALID_ARG, _("unsupported config type %s"), format); @@ -5540,19 +5705,28 @@ cleanup: static int qemuConnectListDefinedDomains(virConnectPtr conn, char **const names, int nnames) { virQEMUDriverPtr driver = conn->privateData; - int n; + int ret = -1; - n = virDomainObjListGetInactiveNames(driver->domains, names, nnames); - return n; + if (virConnectListDefinedDomainsEnsureACL(conn) < 0) + goto cleanup; + + ret = virDomainObjListGetInactiveNames(driver->domains, names, nnames); + +cleanup: + return ret; } static int qemuConnectNumOfDefinedDomains(virConnectPtr conn) { virQEMUDriverPtr driver = conn->privateData; - int n; + int ret = -1; + + if (virConnectNumOfDefinedDomainsEnsureACL(conn) < 0) + goto cleanup; - n = virDomainObjListNumOfDomains(driver->domains, 0); + ret = virDomainObjListNumOfDomains(driver->domains, 0); - return n; +cleanup: + return ret; } @@ -5649,6 +5823,9 @@ qemuDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainCreateWithFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -5700,6 +5877,9 @@ static virDomainPtr qemuDomainDefineXML(virConnectPtr conn, const char *xml) { VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; @@ -5789,6 +5969,9 @@ qemuDomainUndefineFlags(virDomainPtr dom, cfg = virQEMUDriverGetConfig(driver); + if (virDomainUndefineFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot undefine transient domain")); @@ -6555,6 +6738,9 @@ static int qemuDomainAttachDeviceFlags(virDomainPtr dom, const char *xml, priv = vm->privateData; + if (virDomainAttachDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -6695,6 +6881,9 @@ static int qemuDomainUpdateDeviceFlags(virDomainPtr dom, priv = vm->privateData; + if (virDomainUpdateDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -6827,6 +7016,9 @@ static int qemuDomainDetachDeviceFlags(virDomainPtr dom, const char *xml, priv = vm->privateData; + if (virDomainDetachDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -6942,6 +7134,9 @@ static int qemuDomainGetAutostart(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *autostart = vm->autostart; ret = 0; @@ -6964,6 +7159,9 @@ static int qemuDomainSetAutostart(virDomainPtr dom, cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot set autostart for transient domain")); @@ -7065,6 +7263,9 @@ static char *qemuDomainGetSchedulerType(virDomainPtr dom, } priv = vm->privateData; + if (virDomainGetSchedulerTypeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_CPU)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cgroup CPU controller is not mounted")); @@ -7244,6 +7445,10 @@ qemuDomainSetBlkioParameters(virDomainPtr dom, priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); + + if (virDomainSetBlkioParametersEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -7391,6 +7596,9 @@ qemuDomainGetBlkioParameters(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetBlkioParametersEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -7575,6 +7783,9 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetMemoryParametersEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -7695,6 +7906,10 @@ qemuDomainGetMemoryParameters(virDomainPtr dom, return -1; priv = vm->privateData; + + if (virDomainGetMemoryParametersEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -7850,6 +8065,9 @@ qemuDomainSetNumaParameters(virDomainPtr dom, priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetNumaParametersEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -7992,6 +8210,9 @@ qemuDomainGetNumaParameters(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetNumaParametersEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -8190,6 +8411,9 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetSchedulerParametersFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -8461,6 +8685,9 @@ qemuDomainGetSchedulerParametersFlags(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetSchedulerParametersFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (*nparams > 1) { rc = qemuGetCpuBWStatus(priv->cgroup); if (rc < 0) @@ -8617,6 +8844,9 @@ qemuDomainBlockResize(virDomainPtr dom, priv = vm->privateData; + if (virDomainBlockResizeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -8677,6 +8907,9 @@ qemuDomainBlockStats(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainBlockStatsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -8754,6 +8987,9 @@ qemuDomainBlockStatsFlags(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainBlockStatsFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0) goto cleanup; @@ -8907,6 +9143,9 @@ qemuDomainInterfaceStats(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainInterfaceStatsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -8985,6 +9224,9 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom, cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetInterfaceParametersEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -9144,6 +9386,9 @@ qemuDomainGetInterfaceParameters(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainGetInterfaceParametersEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -9250,6 +9495,9 @@ qemuDomainMemoryStats(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainMemoryStatsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0) goto cleanup; @@ -9301,6 +9549,9 @@ qemuDomainBlockPeek(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainBlockPeekEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!path || path[0] == '\0') { virReportError(VIR_ERR_INVALID_ARG, "%s", _("NULL or empty path")); @@ -9363,6 +9614,9 @@ qemuDomainMemoryPeek(virDomainPtr dom, cfg = virQEMUDriverGetConfig(driver); + if (virDomainMemoryPeekEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (flags != VIR_MEMORY_VIRTUAL && flags != VIR_MEMORY_PHYSICAL) { virReportError(VIR_ERR_INVALID_ARG, "%s", _("flags parameter must be VIR_MEMORY_VIRTUAL or VIR_MEMORY_PHYSICAL")); @@ -9456,6 +9710,9 @@ static int qemuDomainGetBlockInfo(virDomainPtr dom, cfg = virQEMUDriverGetConfig(driver); + if (virDomainGetBlockInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!path || path[0] == '\0') { virReportError(VIR_ERR_INVALID_ARG, "%s", _("NULL or empty path")); @@ -9590,12 +9847,19 @@ qemuConnectDomainEventRegister(virConnectPtr conn, virFreeCallback freecb) { virQEMUDriverPtr driver = conn->privateData; - int ret; + int ret = -1; - ret = virDomainEventStateRegister(conn, - driver->domainEventState, - callback, opaque, freecb); + if (virConnectDomainEventRegisterEnsureACL(conn) < 0) + goto cleanup; + + if (virDomainEventStateRegister(conn, + driver->domainEventState, + callback, opaque, freecb) < 0) + goto cleanup; + ret = 0; + +cleanup: return ret; } @@ -9605,12 +9869,19 @@ qemuConnectDomainEventDeregister(virConnectPtr conn, virConnectDomainEventCallback callback) { virQEMUDriverPtr driver = conn->privateData; - int ret; + int ret = -1; - ret = virDomainEventStateDeregister(conn, - driver->domainEventState, - callback); + if (virConnectDomainEventDeregisterEnsureACL(conn) < 0) + goto cleanup; + + if (virDomainEventStateDeregister(conn, + driver->domainEventState, + callback) < 0) + goto cleanup; + + ret = 0; +cleanup: return ret; } @@ -9624,14 +9895,20 @@ qemuConnectDomainEventRegisterAny(virConnectPtr conn, virFreeCallback freecb) { virQEMUDriverPtr driver = conn->privateData; - int ret; + int ret = -1; + + if (virConnectDomainEventRegisterAnyEnsureACL(conn) < 0) + goto cleanup; if (virDomainEventStateRegisterID(conn, driver->domainEventState, dom, eventID, callback, opaque, freecb, &ret) < 0) - ret = -1; + goto cleanup; + ret = 0; + +cleanup: return ret; } @@ -9641,12 +9918,19 @@ qemuConnectDomainEventDeregisterAny(virConnectPtr conn, int callbackID) { virQEMUDriverPtr driver = conn->privateData; - int ret; + int ret = -1; - ret = virDomainEventStateDeregisterID(conn, - driver->domainEventState, - callbackID); + if (virConnectDomainEventDeregisterAnyEnsureACL(conn) < 0) + goto cleanup; + if (virDomainEventStateDeregisterID(conn, + driver->domainEventState, + callbackID) < 0) + goto cleanup; + + ret = 0; + +cleanup: return ret; } @@ -9712,6 +9996,9 @@ qemuDomainMigratePrepareTunnel(virConnectPtr dconn, goto cleanup; } + if (virDomainMigratePrepareTunnelEnsureACL(dconn, def) < 0) + goto cleanup; + ret = qemuMigrationPrepareTunnel(driver, dconn, NULL, 0, NULL, NULL, /* No cookies in v2 */ st, &def, flags); @@ -9782,6 +10069,9 @@ qemuDomainMigratePrepare2(virConnectPtr dconn, goto cleanup; } + if (virDomainMigratePrepare2EnsureACL(dconn, def) < 0) + goto cleanup; + /* Do not use cookies in v2 protocol, since the cookie * length was not sufficiently large, causing failures * migrating between old & new libvirtd @@ -9825,6 +10115,9 @@ qemuDomainMigratePerform(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainMigratePerformEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (flags & VIR_MIGRATE_PEER2PEER) { dconnuri = uri; uri = NULL; @@ -9869,6 +10162,9 @@ qemuDomainMigrateFinish2(virConnectPtr dconn, goto cleanup; } + if (virDomainMigrateFinish2EnsureACL(dconn, vm->def) < 0) + goto cleanup; + /* Do not use cookies in v2 protocol, since the cookie * length was not sufficiently large, causing failures * migrating between old & new libvirtd @@ -9905,6 +10201,9 @@ qemuDomainMigrateBegin3(virDomainPtr domain, if (!(vm = qemuDomObjFromDomain(domain))) return NULL; + if (virDomainMigrateBegin3EnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if ((flags & VIR_MIGRATE_CHANGE_PROTECTION)) { if (qemuMigrationJobStart(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT) < 0) goto cleanup; @@ -10020,6 +10319,9 @@ qemuDomainMigratePrepare3(virConnectPtr dconn, goto cleanup; } + if (virDomainMigratePrepare3EnsureACL(dconn, def) < 0) + goto cleanup; + ret = qemuMigrationPrepareDirect(driver, dconn, cookiein, cookieinlen, cookieout, cookieoutlen, @@ -10082,6 +10384,9 @@ qemuDomainMigratePrepareTunnel3(virConnectPtr dconn, goto cleanup; } + if (virDomainMigratePrepareTunnel3EnsureACL(dconn, def) < 0) + goto cleanup; + ret = qemuMigrationPrepareTunnel(driver, dconn, cookiein, cookieinlen, cookieout, cookieoutlen, @@ -10115,6 +10420,11 @@ qemuDomainMigratePerform3(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainMigratePerform3EnsureACL(dom->conn, vm->def) < 0) { + virObjectUnlock(vm); + return -1; + } + return qemuMigrationPerform(driver, dom->conn, vm, xmlin, dconnuri, uri, cookiein, cookieinlen, cookieout, cookieoutlen, @@ -10147,6 +10457,9 @@ qemuDomainMigrateFinish3(virConnectPtr dconn, goto cleanup; } + if (virDomainMigrateFinish3EnsureACL(dconn, vm->def) < 0) + goto cleanup; + dom = qemuMigrationFinish(driver, dconn, vm, cookiein, cookieinlen, cookieout, cookieoutlen, @@ -10176,6 +10489,9 @@ qemuDomainMigrateConfirm3(virDomainPtr domain, cfg = virQEMUDriverGetConfig(driver); + if (virDomainMigrateConfirm3EnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (!qemuMigrationJobIsActive(vm, QEMU_ASYNC_JOB_MIGRATION_OUT)) goto cleanup; @@ -10211,25 +10527,15 @@ cleanup: static int -qemuNodeDeviceGetPciInfo(virNodeDevicePtr dev, +qemuNodeDeviceGetPciInfo(virNodeDeviceDefPtr def, unsigned *domain, unsigned *bus, unsigned *slot, unsigned *function) { - virNodeDeviceDefPtr def = NULL; virNodeDevCapsDefPtr cap; - char *xml = NULL; int ret = -1; - xml = virNodeDeviceGetXMLDesc(dev, 0); - if (!xml) - goto out; - - def = virNodeDeviceDefParseString(xml, EXISTING_DEVICE, NULL); - if (!def) - goto out; - cap = def->caps; while (cap) { if (cap->type == VIR_NODE_DEV_CAP_PCI_DEV) { @@ -10245,14 +10551,12 @@ qemuNodeDeviceGetPciInfo(virNodeDevicePtr dev, if (!cap) { virReportError(VIR_ERR_INVALID_ARG, - _("device %s is not a PCI device"), dev->name); + _("device %s is not a PCI device"), def->name); goto out; } ret = 0; out: - virNodeDeviceDefFree(def); - VIR_FREE(xml); return ret; } @@ -10266,15 +10570,28 @@ qemuNodeDeviceDetachFlags(virNodeDevicePtr dev, unsigned domain, bus, slot, function; int ret = -1; bool in_inactive_list = false; + virNodeDeviceDefPtr def = NULL; + char *xml = NULL; virCheckFlags(0, -1); - if (qemuNodeDeviceGetPciInfo(dev, &domain, &bus, &slot, &function) < 0) - return -1; + xml = virNodeDeviceGetXMLDesc(dev, 0); + if (!xml) + goto cleanup; + + def = virNodeDeviceDefParseString(xml, EXISTING_DEVICE, NULL); + if (!def) + goto cleanup; + + if (virNodeDeviceDetachFlagsEnsureACL(dev->conn, def) < 0) + goto cleanup; + + if (qemuNodeDeviceGetPciInfo(def, &domain, &bus, &slot, &function) < 0) + goto cleanup; pci = virPCIDeviceNew(domain, bus, slot, function); if (!pci) - return -1; + goto cleanup; if (!driverName || STREQ(driverName, "kvm")) { virPCIDeviceSetStubDriver(pci, "pci-stub"); @@ -10300,6 +10617,9 @@ out: virObjectUnlock(driver->activePciHostdevs); if (in_inactive_list) virPCIDeviceFree(pci); +cleanup: + virNodeDeviceDefFree(def); + VIR_FREE(xml); return ret; } @@ -10313,17 +10633,30 @@ static int qemuNodeDeviceReAttach(virNodeDevicePtr dev) { virQEMUDriverPtr driver = dev->conn->privateData; - virPCIDevicePtr pci; + virPCIDevicePtr pci = NULL; virPCIDevicePtr other; unsigned domain, bus, slot, function; int ret = -1; + virNodeDeviceDefPtr def = NULL; + char *xml = NULL; - if (qemuNodeDeviceGetPciInfo(dev, &domain, &bus, &slot, &function) < 0) - return -1; + xml = virNodeDeviceGetXMLDesc(dev, 0); + if (!xml) + goto cleanup; + + def = virNodeDeviceDefParseString(xml, EXISTING_DEVICE, NULL); + if (!def) + goto cleanup; + + if (virNodeDeviceReAttachEnsureACL(dev->conn, def) < 0) + goto cleanup; + + if (qemuNodeDeviceGetPciInfo(def, &domain, &bus, &slot, &function) < 0) + goto cleanup; pci = virPCIDeviceNew(domain, bus, slot, function); if (!pci) - return -1; + goto cleanup; virObjectLock(driver->activePciHostdevs); virObjectLock(driver->inactivePciHostdevs); @@ -10353,6 +10686,9 @@ out: virObjectUnlock(driver->inactivePciHostdevs); virObjectUnlock(driver->activePciHostdevs); virPCIDeviceFree(pci); +cleanup: + virNodeDeviceDefFree(def); + VIR_FREE(xml); return ret; } @@ -10363,13 +10699,26 @@ qemuNodeDeviceReset(virNodeDevicePtr dev) virPCIDevicePtr pci; unsigned domain, bus, slot, function; int ret = -1; + virNodeDeviceDefPtr def = NULL; + char *xml = NULL; - if (qemuNodeDeviceGetPciInfo(dev, &domain, &bus, &slot, &function) < 0) - return -1; + xml = virNodeDeviceGetXMLDesc(dev, 0); + if (!xml) + goto cleanup; + + def = virNodeDeviceDefParseString(xml, EXISTING_DEVICE, NULL); + if (!def) + goto cleanup; + + if (virNodeDeviceResetEnsureACL(dev->conn, def) < 0) + goto cleanup; + + if (qemuNodeDeviceGetPciInfo(def, &domain, &bus, &slot, &function) < 0) + goto cleanup; pci = virPCIDeviceNew(domain, bus, slot, function); if (!pci) - return -1; + goto cleanup; virObjectLock(driver->activePciHostdevs); virObjectLock(driver->inactivePciHostdevs); @@ -10383,6 +10732,9 @@ out: virObjectUnlock(driver->inactivePciHostdevs); virObjectUnlock(driver->activePciHostdevs); virPCIDeviceFree(pci); +cleanup: + virNodeDeviceDefFree(def); + VIR_FREE(xml); return ret; } @@ -10397,6 +10749,9 @@ qemuConnectCompareCPU(virConnectPtr conn, virCheckFlags(0, VIR_CPU_COMPARE_ERROR); + if (virConnectCompareCPUEnsureACL(conn) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -10420,12 +10775,16 @@ qemuConnectBaselineCPU(virConnectPtr conn ATTRIBUTE_UNUSED, unsigned int ncpus, unsigned int flags) { - char *cpu; + char *cpu = NULL; virCheckFlags(0, NULL); + if (virConnectBaselineCPUEnsureACL(conn) < 0) + goto cleanup; + cpu = cpuBaselineXML(xmlCPUs, ncpus, NULL, 0); +cleanup: return cpu; } @@ -10441,6 +10800,9 @@ static int qemuDomainGetJobInfo(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetJobInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (priv->job.asyncJob && !priv->job.dump_memory_only) { memcpy(info, &priv->job.info, sizeof(*info)); @@ -10493,6 +10855,9 @@ qemuDomainGetJobStats(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetJobStatsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -10621,6 +10986,9 @@ static int qemuDomainAbortJob(virDomainPtr dom) { if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainAbortJobEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_ABORT) < 0) goto cleanup; @@ -10675,6 +11043,9 @@ qemuDomainMigrateSetMaxDowntime(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainMigrateSetMaxDowntimeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MIGRATION_OP) < 0) goto cleanup; @@ -10722,6 +11093,9 @@ qemuDomainMigrateGetCompressionCache(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainMigrateGetCompressionCacheEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0) goto cleanup; @@ -10774,6 +11148,9 @@ qemuDomainMigrateSetCompressionCache(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainMigrateSetCompressionCacheEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MIGRATION_OP) < 0) goto cleanup; @@ -10828,6 +11205,10 @@ qemuDomainMigrateSetMaxSpeed(virDomainPtr dom, goto cleanup; priv = vm->privateData; + + if (virDomainMigrateSetMaxSpeedEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MIGRATION_OP) < 0) goto cleanup; @@ -10875,6 +11256,10 @@ qemuDomainMigrateGetMaxSpeed(virDomainPtr dom, goto cleanup; priv = vm->privateData; + + if (virDomainMigrateGetMaxSpeedEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *bandwidth = priv->migMaxBandwidth; ret = 0; @@ -11830,6 +12215,9 @@ qemuDomainSnapshotCreateXML(virDomainPtr domain, cfg = virQEMUDriverGetConfig(driver); + if (virDomainSnapshotCreateXMLEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -12160,6 +12548,9 @@ static int qemuDomainSnapshotListNames(virDomainPtr domain, char **names, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; + if (virDomainSnapshotListNamesEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + n = virDomainSnapshotObjListGetNames(vm->snapshots, NULL, names, nameslen, flags); @@ -12181,6 +12572,9 @@ static int qemuDomainSnapshotNum(virDomainPtr domain, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; + if (virDomainSnapshotNumEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + n = virDomainSnapshotObjListNum(vm->snapshots, NULL, flags); cleanup: @@ -12202,6 +12596,9 @@ qemuDomainListAllSnapshots(virDomainPtr domain, virDomainSnapshotPtr **snaps, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; + if (virDomainListAllSnapshotsEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + n = virDomainListSnapshots(vm->snapshots, NULL, domain, snaps, flags); cleanup: @@ -12226,6 +12623,9 @@ qemuDomainSnapshotListChildrenNames(virDomainSnapshotPtr snapshot, if (!(vm = qemuDomObjFromSnapshot(snapshot))) goto cleanup; + if (virDomainSnapshotListChildrenNamesEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12252,6 +12652,9 @@ qemuDomainSnapshotNumChildren(virDomainSnapshotPtr snapshot, if (!(vm = qemuDomObjFromSnapshot(snapshot))) goto cleanup; + if (virDomainSnapshotNumChildrenEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12278,6 +12681,9 @@ qemuDomainSnapshotListAllChildren(virDomainSnapshotPtr snapshot, if (!(vm = qemuDomObjFromSnapshot(snapshot))) goto cleanup; + if (virDomainSnapshotListAllChildrenEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12303,6 +12709,9 @@ static virDomainSnapshotPtr qemuDomainSnapshotLookupByName(virDomainPtr domain, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; + if (virDomainSnapshotLookupByNameEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromName(vm, name))) goto cleanup; @@ -12325,6 +12734,9 @@ static int qemuDomainHasCurrentSnapshot(virDomainPtr domain, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; + if (virDomainHasCurrentSnapshotEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + ret = (vm->current_snapshot != NULL); cleanup: @@ -12346,6 +12758,9 @@ qemuDomainSnapshotGetParent(virDomainSnapshotPtr snapshot, if (!(vm = qemuDomObjFromSnapshot(snapshot))) goto cleanup; + if (virDomainSnapshotGetParentEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12375,6 +12790,9 @@ static virDomainSnapshotPtr qemuDomainSnapshotCurrent(virDomainPtr domain, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; + if (virDomainSnapshotCurrentEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (!vm->current_snapshot) { virReportError(VIR_ERR_NO_DOMAIN_SNAPSHOT, "%s", _("the domain does not have a current snapshot")); @@ -12402,6 +12820,9 @@ static char *qemuDomainSnapshotGetXMLDesc(virDomainSnapshotPtr snapshot, if (!(vm = qemuDomObjFromSnapshot(snapshot))) goto cleanup; + if (virDomainSnapshotGetXMLDescEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12428,6 +12849,9 @@ qemuDomainSnapshotIsCurrent(virDomainSnapshotPtr snapshot, if (!(vm = qemuDomObjFromSnapshot(snapshot))) goto cleanup; + if (virDomainSnapshotIsCurrentEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12454,6 +12878,9 @@ qemuDomainSnapshotHasMetadata(virDomainSnapshotPtr snapshot, if (!(vm = qemuDomObjFromSnapshot(snapshot))) goto cleanup; + if (virDomainSnapshotHasMetadataEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12518,6 +12945,9 @@ static int qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, cfg = virQEMUDriverGetConfig(driver); + if (virDomainRevertToSnapshotEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -12876,6 +13306,10 @@ static int qemuDomainSnapshotDelete(virDomainSnapshotPtr snapshot, return -1; cfg = virQEMUDriverGetConfig(driver); + + if (virDomainSnapshotDeleteEnsureACL(snapshot->domain->conn, vm->def) < 0) + goto cleanup; + if (!(snap = qemuSnapObjFromSnapshot(vm, snapshot))) goto cleanup; @@ -12975,6 +13409,9 @@ static int qemuDomainQemuMonitorCommand(virDomainPtr domain, const char *cmd, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; + if (virDomainQemuMonitorCommandEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -13036,6 +13473,9 @@ static virDomainPtr qemuDomainQemuAttach(virConnectPtr conn, &pidfile, &monConfig, &monJSON))) goto cleanup; + if (virDomainQemuAttachEnsureACL(conn, def) < 0) + goto cleanup; + if (!monConfig) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("No monitor connection for pid %u"), pid_value); @@ -13124,6 +13564,9 @@ qemuDomainOpenConsole(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainOpenConsoleEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -13202,6 +13645,9 @@ qemuDomainOpenChannel(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainOpenChannelEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -13438,12 +13884,13 @@ cleanup: } static int -qemuDomainBlockJobImpl(virDomainPtr dom, const char *path, const char *base, +qemuDomainBlockJobImpl(virDomainObjPtr vm, + virConnectPtr conn, + const char *path, const char *base, unsigned long bandwidth, virDomainBlockJobInfoPtr info, int mode, unsigned int flags) { - virQEMUDriverPtr driver = dom->conn->privateData; - virDomainObjPtr vm = NULL; + virQEMUDriverPtr driver = conn->privateData; qemuDomainObjPrivatePtr priv; char *device = NULL; int ret = -1; @@ -13452,9 +13899,6 @@ qemuDomainBlockJobImpl(virDomainPtr dom, const char *path, const char *base, int idx; virDomainDiskDefPtr disk; - if (!(vm = qemuDomObjFromDomain(dom))) - return -1; - if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -13511,7 +13955,7 @@ qemuDomainBlockJobImpl(virDomainPtr dom, const char *path, const char *base, if (disk->mirror && mode == BLOCK_JOB_ABORT && (flags & VIR_DOMAIN_BLOCK_JOB_ABORT_PIVOT)) { - ret = qemuDomainBlockPivot(dom->conn, driver, vm, device, disk); + ret = qemuDomainBlockPivot(conn, driver, vm, device, disk); goto endjob; } @@ -13601,9 +14045,20 @@ cleanup: static int qemuDomainBlockJobAbort(virDomainPtr dom, const char *path, unsigned int flags) { + virDomainObjPtr vm; + virCheckFlags(VIR_DOMAIN_BLOCK_JOB_ABORT_ASYNC | VIR_DOMAIN_BLOCK_JOB_ABORT_PIVOT, -1); - return qemuDomainBlockJobImpl(dom, path, NULL, 0, NULL, BLOCK_JOB_ABORT, + + if (!(vm = qemuDomObjFromDomain(dom))) + return -1; + + if (virDomainBlockJobAbortEnsureACL(dom->conn, vm->def) < 0) { + virObjectUnlock(vm); + return -1; + } + + return qemuDomainBlockJobImpl(vm, dom->conn, path, NULL, 0, NULL, BLOCK_JOB_ABORT, flags); } @@ -13611,8 +14066,18 @@ static int qemuDomainGetBlockJobInfo(virDomainPtr dom, const char *path, virDomainBlockJobInfoPtr info, unsigned int flags) { + virDomainObjPtr vm; virCheckFlags(0, -1); - return qemuDomainBlockJobImpl(dom, path, NULL, 0, info, BLOCK_JOB_INFO, + + if (!(vm = qemuDomObjFromDomain(dom))) + return -1; + + if (virDomainGetBlockJobInfoEnsureACL(dom->conn, vm->def) < 0) { + virObjectUnlock(vm); + return -1; + } + + return qemuDomainBlockJobImpl(vm, dom->conn, path, NULL, 0, info, BLOCK_JOB_INFO, flags); } @@ -13620,18 +14085,29 @@ static int qemuDomainBlockJobSetSpeed(virDomainPtr dom, const char *path, unsigned long bandwidth, unsigned int flags) { + virDomainObjPtr vm; virCheckFlags(0, -1); - return qemuDomainBlockJobImpl(dom, path, NULL, bandwidth, NULL, + + if (!(vm = qemuDomObjFromDomain(dom))) + return -1; + + if (virDomainBlockJobSetSpeedEnsureACL(dom->conn, vm->def) < 0) { + virObjectUnlock(vm); + return -1; + } + + return qemuDomainBlockJobImpl(vm, dom->conn, path, NULL, bandwidth, NULL, BLOCK_JOB_SPEED, flags); } static int -qemuDomainBlockCopy(virDomainPtr dom, const char *path, +qemuDomainBlockCopy(virDomainObjPtr vm, + virConnectPtr conn, + const char *path, const char *dest, const char *format, unsigned long bandwidth, unsigned int flags) { - virQEMUDriverPtr driver = dom->conn->privateData; - virDomainObjPtr vm; + virQEMUDriverPtr driver = conn->privateData; qemuDomainObjPrivatePtr priv; char *device = NULL; virDomainDiskDefPtr disk; @@ -13646,10 +14122,9 @@ qemuDomainBlockCopy(virDomainPtr dom, const char *path, virCheckFlags(VIR_DOMAIN_BLOCK_REBASE_SHALLOW | VIR_DOMAIN_BLOCK_REBASE_REUSE_EXT, -1); - if (!(vm = qemuDomObjFromDomain(dom))) - goto cleanup; priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -13801,21 +14276,31 @@ static int qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, unsigned long bandwidth, unsigned int flags) { + virDomainObjPtr vm; + virCheckFlags(VIR_DOMAIN_BLOCK_REBASE_SHALLOW | VIR_DOMAIN_BLOCK_REBASE_REUSE_EXT | VIR_DOMAIN_BLOCK_REBASE_COPY | VIR_DOMAIN_BLOCK_REBASE_COPY_RAW, -1); + if (!(vm = qemuDomObjFromDomain(dom))) + return -1; + + if (virDomainBlockRebaseEnsureACL(dom->conn, vm->def) < 0) { + virObjectUnlock(vm); + return -1; + } + if (flags & VIR_DOMAIN_BLOCK_REBASE_COPY) { const char *format = NULL; if (flags & VIR_DOMAIN_BLOCK_REBASE_COPY_RAW) format = "raw"; flags &= ~(VIR_DOMAIN_BLOCK_REBASE_COPY | VIR_DOMAIN_BLOCK_REBASE_COPY_RAW); - return qemuDomainBlockCopy(dom, path, base, format, bandwidth, flags); + return qemuDomainBlockCopy(vm, dom->conn, path, base, format, bandwidth, flags); } - return qemuDomainBlockJobImpl(dom, path, base, bandwidth, NULL, + return qemuDomainBlockJobImpl(vm, dom->conn, path, base, bandwidth, NULL, BLOCK_JOB_PULL, flags); } @@ -13823,8 +14308,18 @@ static int qemuDomainBlockPull(virDomainPtr dom, const char *path, unsigned long bandwidth, unsigned int flags) { + virDomainObjPtr vm; virCheckFlags(0, -1); - return qemuDomainBlockJobImpl(dom, path, NULL, bandwidth, NULL, + + if (!(vm = qemuDomObjFromDomain(dom))) + return -1; + + if (virDomainBlockPullEnsureACL(dom->conn, vm->def) < 0) { + virObjectUnlock(vm); + return -1; + } + + return qemuDomainBlockJobImpl(vm, dom->conn, path, NULL, bandwidth, NULL, BLOCK_JOB_PULL, flags); } @@ -13853,6 +14348,9 @@ qemuDomainBlockCommit(virDomainPtr dom, const char *path, const char *base, goto cleanup; priv = vm->privateData; + if (virDomainBlockCommitEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -13982,6 +14480,9 @@ qemuDomainOpenGraphics(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainOpenGraphicsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -14077,6 +14578,9 @@ qemuDomainSetBlockIoTune(virDomainPtr dom, priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetBlockIoTuneEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto endjob; @@ -14222,6 +14726,9 @@ qemuDomainGetBlockIoTune(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) return -1; + if (virDomainGetBlockIoTuneEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -14349,6 +14856,9 @@ qemuDomainGetDiskErrors(virDomainPtr dom, priv = vm->privateData; + if (virDomainGetDiskErrorsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0) goto cleanup; @@ -14425,6 +14935,9 @@ qemuDomainSetMetadata(virDomainPtr dom, cfg = virQEMUDriverGetConfig(driver); + if (virDomainSetMetadataEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -14515,6 +15028,9 @@ qemuDomainGetMetadata(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainGetMetadataEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto cleanup; @@ -14795,6 +15311,9 @@ qemuDomainGetCPUStats(virDomainPtr domain, priv = vm->privateData; + if (virDomainGetCPUStatsEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + isActive = virDomainObjIsActive(vm); if (!isActive) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", @@ -14852,6 +15371,9 @@ qemuDomainPMSuspendForDuration(virDomainPtr dom, priv = vm->privateData; + if (virDomainPMSuspendForDurationEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -14934,6 +15456,9 @@ qemuDomainPMWakeup(virDomainPtr dom, if (!(vm = qemuDomObjFromDomain(dom))) goto cleanup; + if (virDomainPMWakeupEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -14976,8 +15501,12 @@ qemuConnectListAllDomains(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_DOMAINS_FILTERS_ALL, -1); + if (virConnectListAllDomainsEnsureACL(conn) < 0) + goto cleanup; + ret = virDomainObjListExport(driver->domains, conn, domains, flags); +cleanup: return ret; } @@ -15000,6 +15529,9 @@ qemuDomainQemuAgentCommand(virDomainPtr domain, priv = vm->privateData; + if (virDomainQemuAgentCommandEnsureACL(domain->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -15069,6 +15601,9 @@ qemuDomainFSTrim(virDomainPtr dom, priv = vm->privateData; + if (virDomainFSTrimEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -15113,88 +15648,115 @@ cleanup: static int -qemuNodeGetInfo(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeGetInfo(virConnectPtr conn, virNodeInfoPtr nodeinfo) { + if (virNodeGetInfoEnsureACL(conn) < 0) + return -1; + return nodeGetInfo(nodeinfo); } static int -qemuNodeGetCPUStats(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeGetCPUStats(virConnectPtr conn, int cpuNum, virNodeCPUStatsPtr params, int *nparams, unsigned int flags) { + if (virNodeGetCPUStatsEnsureACL(conn) < 0) + return -1; + return nodeGetCPUStats(cpuNum, params, nparams, flags); } static int -qemuNodeGetMemoryStats(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeGetMemoryStats(virConnectPtr conn, int cellNum, virNodeMemoryStatsPtr params, int *nparams, unsigned int flags) { + if (virNodeGetMemoryStatsEnsureACL(conn) < 0) + return -1; + return nodeGetMemoryStats(cellNum, params, nparams, flags); } static int -qemuNodeGetCellsFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeGetCellsFreeMemory(virConnectPtr conn, unsigned long long *freeMems, int startCell, int maxCells) { + if (virNodeGetCellsFreeMemoryEnsureACL(conn) < 0) + return -1; + return nodeGetCellsFreeMemory(freeMems, startCell, maxCells); } static unsigned long long -qemuNodeGetFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED) +qemuNodeGetFreeMemory(virConnectPtr conn) { + if (virNodeGetFreeMemoryEnsureACL(conn) < 0) + return 0; + return nodeGetFreeMemory(); } static int -qemuNodeGetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeGetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int *nparams, unsigned int flags) { + if (virNodeGetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeGetMemoryParameters(params, nparams, flags); } static int -qemuNodeSetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeSetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int nparams, unsigned int flags) { + if (virNodeSetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeSetMemoryParameters(params, nparams, flags); } static int -qemuNodeGetCPUMap(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeGetCPUMap(virConnectPtr conn, unsigned char **cpumap, unsigned int *online, unsigned int flags) { + if (virNodeGetCPUMapEnsureACL(conn) < 0) + return -1; + return nodeGetCPUMap(cpumap, online, flags); } static int -qemuNodeSuspendForDuration(virConnectPtr conn ATTRIBUTE_UNUSED, +qemuNodeSuspendForDuration(virConnectPtr conn, unsigned int target, unsigned long long duration, unsigned int flags) { + if (virNodeSuspendForDurationEnsureACL(conn) < 0) + return -1; + return nodeSuspendForDuration(target, duration, flags); } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Insert calls to the ACL checking APIs in all UML driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/Makefile.am | 4 +- src/uml/uml_driver.c | 174 +++++++++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 165 insertions(+), 13 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index a915fe3..75db540 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1142,7 +1142,9 @@ noinst_LTLIBRARIES += libvirt_driver_uml.la endif libvirt_driver_uml_impl_la_CFLAGS = \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) + -I$(top_srcdir)/src/access \ + -I$(top_srcdir)/src/conf \ + $(AM_CFLAGS) libvirt_driver_uml_impl_la_LDFLAGS = $(AM_LDFLAGS) # libvirt_driver_uml_impl_la_LIBADD = libvirt_driver_uml_impl_la_SOURCES = $(UML_DRIVER_SOURCES) diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index b238b0f..25b9748 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -65,6 +65,7 @@ #include "virprocess.h" #include "viruri.h" #include "virstring.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_UML @@ -1235,6 +1236,9 @@ static virDrvOpenStatus umlConnectOpen(virConnectPtr conn, } } + if (virConnectOpenEnsureACL(conn) < 0) + return VIR_DRV_OPEN_ERROR; + conn->privateData = uml_driver; return VIR_DRV_OPEN_SUCCESS; @@ -1252,7 +1256,10 @@ static int umlConnectClose(virConnectPtr conn) { return 0; } -static const char *umlConnectGetType(virConnectPtr conn ATTRIBUTE_UNUSED) { +static const char *umlConnectGetType(virConnectPtr conn) { + if (virConnectGetTypeEnsureACL(conn) < 0) + return NULL; + return "UML"; } @@ -1281,6 +1288,9 @@ static char *umlConnectGetCapabilities(virConnectPtr conn) { struct uml_driver *driver = (struct uml_driver *)conn->privateData; char *xml; + if (virConnectGetCapabilitiesEnsureACL(conn) < 0) + return NULL; + umlDriverLock(driver); if ((xml = virCapabilitiesFormatXML(driver->caps)) == NULL) virReportOOMError(); @@ -1346,6 +1356,9 @@ static virDomainPtr umlDomainLookupByID(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1370,6 +1383,9 @@ static virDomainPtr umlDomainLookupByUUID(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByUUIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1394,6 +1410,9 @@ static virDomainPtr umlDomainLookupByName(virConnectPtr conn, goto cleanup; } + if (virDomainLookupByNameEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1417,6 +1436,10 @@ static int umlDomainIsActive(virDomainPtr dom) virReportError(VIR_ERR_NO_DOMAIN, NULL); goto cleanup; } + + if (virDomainIsActiveEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = virDomainObjIsActive(obj); cleanup: @@ -1439,6 +1462,10 @@ static int umlDomainIsPersistent(virDomainPtr dom) virReportError(VIR_ERR_NO_DOMAIN, NULL); goto cleanup; } + + if (virDomainIsPersistentEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = obj->persistent; cleanup: @@ -1460,6 +1487,10 @@ static int umlDomainIsUpdated(virDomainPtr dom) virReportError(VIR_ERR_NO_DOMAIN, NULL); goto cleanup; } + + if (virDomainIsUpdatedEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = obj->updated; cleanup: @@ -1473,6 +1504,9 @@ static int umlConnectGetVersion(virConnectPtr conn, unsigned long *version) { struct utsname ut; int ret = -1; + if (virConnectGetVersionEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); if (driver->umlVersion == 0) { @@ -1494,8 +1528,11 @@ cleanup: } -static char *umlConnectGetHostname(virConnectPtr conn ATTRIBUTE_UNUSED) +static char *umlConnectGetHostname(virConnectPtr conn) { + if (virConnectGetHostnameEnsureACL(conn) < 0) + return NULL; + return virGetHostname(); } @@ -1504,6 +1541,9 @@ static int umlConnectListDomains(virConnectPtr conn, int *ids, int nids) { struct uml_driver *driver = conn->privateData; int n; + if (virConnectListDomainsEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); n = virDomainObjListGetActiveIDs(driver->domains, ids, nids); umlDriverUnlock(driver); @@ -1514,6 +1554,9 @@ static int umlConnectNumOfDomains(virConnectPtr conn) { struct uml_driver *driver = conn->privateData; int n; + if (virConnectNumOfDomainsEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); n = virDomainObjListNumOfDomains(driver->domains, 1); umlDriverUnlock(driver); @@ -1536,6 +1579,9 @@ static virDomainPtr umlDomainCreateXML(virConnectPtr conn, const char *xml, VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_CHECK_LIVE, @@ -1588,6 +1634,9 @@ static int umlDomainShutdownFlags(virDomainPtr dom, goto cleanup; } + if (virDomainShutdownFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + #if 0 if (umlMonitorCommand(driver, vm, "system_powerdown", &info) < 0) { virReportError(VIR_ERR_OPERATION_FAILED, "%s", @@ -1629,6 +1678,9 @@ umlDomainDestroyFlags(virDomainPtr dom, goto cleanup; } + if (virDomainDestroyFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + umlShutdownVMDaemon(driver, vm, VIR_DOMAIN_SHUTOFF_DESTROYED); virDomainAuditStop(vm, "destroyed"); event = virDomainEventNewFromObj(vm, @@ -1671,7 +1723,11 @@ static char *umlDomainGetOSType(virDomainPtr dom) { goto cleanup; } - ignore_value(VIR_STRDUP(type, vm->def->os.type)); + if (virDomainGetOSTypeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + + if (VIR_STRDUP(type, vm->def->os.type) < 0) + goto cleanup; cleanup: if (vm) @@ -1699,6 +1755,10 @@ umlDomainGetMaxMemory(virDomainPtr dom) _("no domain with matching uuid '%s'"), uuidstr); goto cleanup; } + + if (virDomainGetMaxMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = vm->def->mem.max_balloon; cleanup: @@ -1725,6 +1785,9 @@ static int umlDomainSetMaxMemory(virDomainPtr dom, unsigned long newmax) { goto cleanup; } + if (virDomainSetMaxMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (newmax < vm->def->mem.cur_balloon) { virReportError(VIR_ERR_INVALID_ARG, "%s", _("cannot set max memory lower than current memory")); @@ -1758,6 +1821,9 @@ static int umlDomainSetMemory(virDomainPtr dom, unsigned long newmem) { goto cleanup; } + if (virDomainSetMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot set memory of an active domain")); @@ -1795,6 +1861,9 @@ static int umlDomainGetInfo(virDomainPtr dom, goto cleanup; } + if (virDomainGetInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + info->state = virDomainObjGetState(vm, NULL); if (!virDomainObjIsActive(vm)) { @@ -1841,6 +1910,9 @@ umlDomainGetState(virDomainPtr dom, goto cleanup; } + if (virDomainGetStateEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *state = virDomainObjGetState(vm, reason); ret = 0; @@ -1870,6 +1942,9 @@ static char *umlDomainGetXMLDesc(virDomainPtr dom, goto cleanup; } + if (virDomainGetXMLDescEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + ret = virDomainDefFormat((flags & VIR_DOMAIN_XML_INACTIVE) && vm->newDef ? vm->newDef : vm->def, flags); @@ -1886,6 +1961,9 @@ static int umlConnectListDefinedDomains(virConnectPtr conn, struct uml_driver *driver = conn->privateData; int n; + if (virConnectListDefinedDomainsEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); n = virDomainObjListGetInactiveNames(driver->domains, names, nnames); umlDriverUnlock(driver); @@ -1897,6 +1975,9 @@ static int umlConnectNumOfDefinedDomains(virConnectPtr conn) { struct uml_driver *driver = conn->privateData; int n; + if (virConnectNumOfDefinedDomainsEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); n = virDomainObjListNumOfDomains(driver->domains, 0); umlDriverUnlock(driver); @@ -1922,6 +2003,9 @@ static int umlDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) { goto cleanup; } + if (virDomainCreateWithFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = umlStartVMDaemon(dom->conn, driver, vm, (flags & VIR_DOMAIN_START_AUTODESTROY)); virDomainAuditStart(vm, "booted", ret >= 0); @@ -1955,6 +2039,9 @@ static virDomainPtr umlDomainDefineXML(virConnectPtr conn, const char *xml) { VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, 0, NULL))) @@ -1998,6 +2085,9 @@ static int umlDomainUndefineFlags(virDomainPtr dom, goto cleanup; } + if (virDomainUndefineFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot undefine transient domain")); @@ -2098,6 +2188,9 @@ static int umlDomainAttachDevice(virDomainPtr dom, const char *xml) goto cleanup; } + if (virDomainAttachDeviceEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot attach device on inactive domain")); @@ -2216,6 +2309,9 @@ static int umlDomainDetachDevice(virDomainPtr dom, const char *xml) { goto cleanup; } + if (virDomainDetachDeviceEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot detach device on inactive domain")); @@ -2281,6 +2377,9 @@ static int umlDomainGetAutostart(virDomainPtr dom, goto cleanup; } + if (virDomainGetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *autostart = vm->autostart; ret = 0; @@ -2307,6 +2406,9 @@ static int umlDomainSetAutostart(virDomainPtr dom, goto cleanup; } + if (virDomainSetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot set autostart for transient domain")); @@ -2382,6 +2484,9 @@ umlDomainBlockPeek(virDomainPtr dom, goto cleanup; } + if (virDomainBlockPeekEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!path || path[0] == '\0') { virReportError(VIR_ERR_INVALID_ARG, "%s", _("NULL or empty path")); @@ -2449,6 +2554,9 @@ umlDomainOpenConsole(virDomainPtr dom, goto cleanup; } + if (virDomainOpenConsoleEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("domain is not running")); @@ -2505,6 +2613,9 @@ umlConnectDomainEventRegister(virConnectPtr conn, struct uml_driver *driver = conn->privateData; int ret; + if (virConnectDomainEventRegisterEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); ret = virDomainEventStateRegister(conn, driver->domainEventState, @@ -2521,6 +2632,9 @@ umlConnectDomainEventDeregister(virConnectPtr conn, struct uml_driver *driver = conn->privateData; int ret; + if (virConnectDomainEventDeregisterEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); ret = virDomainEventStateDeregister(conn, driver->domainEventState, @@ -2541,6 +2655,9 @@ umlConnectDomainEventRegisterAny(virConnectPtr conn, struct uml_driver *driver = conn->privateData; int ret; + if (virConnectDomainEventRegisterAnyEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); if (virDomainEventStateRegisterID(conn, driver->domainEventState, @@ -2560,6 +2677,9 @@ umlConnectDomainEventDeregisterAny(virConnectPtr conn, struct uml_driver *driver = conn->privateData; int ret; + if (virConnectDomainEventDeregisterAnyEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); ret = virDomainEventStateDeregisterID(conn, driver->domainEventState, @@ -2586,6 +2706,9 @@ static int umlConnectListAllDomains(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_DOMAINS_FILTERS_ALL, -1); + if (virConnectListAllDomainsEnsureACL(conn) < 0) + return -1; + umlDriverLock(driver); ret = virDomainObjListExport(driver->domains, conn, domains, flags); umlDriverUnlock(driver); @@ -2595,88 +2718,115 @@ static int umlConnectListAllDomains(virConnectPtr conn, static int -umlNodeGetInfo(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeGetInfo(virConnectPtr conn, virNodeInfoPtr nodeinfo) { + if (virNodeGetInfoEnsureACL(conn) < 0) + return -1; + return nodeGetInfo(nodeinfo); } static int -umlNodeGetCPUStats(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeGetCPUStats(virConnectPtr conn, int cpuNum, virNodeCPUStatsPtr params, int *nparams, unsigned int flags) { + if (virNodeGetCPUStatsEnsureACL(conn) < 0) + return -1; + return nodeGetCPUStats(cpuNum, params, nparams, flags); } static int -umlNodeGetMemoryStats(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeGetMemoryStats(virConnectPtr conn, int cellNum, virNodeMemoryStatsPtr params, int *nparams, unsigned int flags) { + if (virNodeGetMemoryStatsEnsureACL(conn) < 0) + return -1; + return nodeGetMemoryStats(cellNum, params, nparams, flags); } static int -umlNodeGetCellsFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeGetCellsFreeMemory(virConnectPtr conn, unsigned long long *freeMems, int startCell, int maxCells) { + if (virNodeGetCellsFreeMemoryEnsureACL(conn) < 0) + return -1; + return nodeGetCellsFreeMemory(freeMems, startCell, maxCells); } static unsigned long long -umlNodeGetFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED) +umlNodeGetFreeMemory(virConnectPtr conn) { + if (virNodeGetFreeMemoryEnsureACL(conn) < 0) + return 0; + return nodeGetFreeMemory(); } static int -umlNodeGetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeGetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int *nparams, unsigned int flags) { + if (virNodeGetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeGetMemoryParameters(params, nparams, flags); } static int -umlNodeSetMemoryParameters(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeSetMemoryParameters(virConnectPtr conn, virTypedParameterPtr params, int nparams, unsigned int flags) { + if (virNodeSetMemoryParametersEnsureACL(conn) < 0) + return -1; + return nodeSetMemoryParameters(params, nparams, flags); } static int -umlNodeGetCPUMap(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeGetCPUMap(virConnectPtr conn, unsigned char **cpumap, unsigned int *online, unsigned int flags) { + if (virNodeGetCPUMapEnsureACL(conn) < 0) + return -1; + return nodeGetCPUMap(cpumap, online, flags); } static int -umlNodeSuspendForDuration(virConnectPtr conn ATTRIBUTE_UNUSED, +umlNodeSuspendForDuration(virConnectPtr conn, unsigned int target, unsigned long long duration, unsigned int flags) { + if (virNodeSuspendForDurationEnsureACL(conn) < 0) + return -1; + return nodeSuspendForDuration(target, duration, flags); } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Insert calls to the ACL checking APIs in all libxl driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/Makefile.am | 8 +- src/libxl/libxl_driver.c | 187 ++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 189 insertions(+), 6 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index b3aed10..fd99ee2 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1045,9 +1045,11 @@ noinst_LTLIBRARIES += libvirt_driver_libxl.la #libvirt_la_BUILT_LIBADD += libvirt_driver_libxl.la endif -libvirt_driver_libxl_impl_la_CFLAGS = $(LIBXL_CFLAGS) \ - -I$(top_srcdir)/src/conf \ - -I$(top_srcdir)/src/xenxs \ +libvirt_driver_libxl_impl_la_CFLAGS = \ + $(LIBXL_CFLAGS) \ + -I$(top_srcdir)/src/access \ + -I$(top_srcdir)/src/conf \ + -I$(top_srcdir)/src/xenxs \ $(AM_CFLAGS) libvirt_driver_libxl_impl_la_LDFLAGS = $(AM_LDFLAGS) libvirt_driver_libxl_impl_la_LIBADD = $(LIBXL_LIBS) libvirt_xenxs.la diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 9a7cb20..687d8cd 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -45,6 +45,7 @@ #include "virtypedparam.h" #include "viruri.h" #include "virstring.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_LIBXL @@ -1405,6 +1406,9 @@ libxlConnectOpen(virConnectPtr conn, } } + if (virConnectOpenEnsureACL(conn) < 0) + return VIR_DRV_OPEN_ERROR; + conn->privateData = libxl_driver; return VIR_DRV_OPEN_SUCCESS; @@ -1418,8 +1422,11 @@ libxlConnectClose(virConnectPtr conn ATTRIBUTE_UNUSED) } static const char * -libxlConnectGetType(virConnectPtr conn ATTRIBUTE_UNUSED) +libxlConnectGetType(virConnectPtr conn) { + if (virConnectGetTypeEnsureACL(conn) < 0) + return NULL; + return "Xen"; } @@ -1428,6 +1435,9 @@ libxlConnectGetVersion(virConnectPtr conn, unsigned long *version) { libxlDriverPrivatePtr driver = conn->privateData; + if (virConnectGetVersionEnsureACL(conn) < 0) + return 0; + libxlDriverLock(driver); *version = driver->version; libxlDriverUnlock(driver); @@ -1435,8 +1445,11 @@ libxlConnectGetVersion(virConnectPtr conn, unsigned long *version) } -static char *libxlConnectGetHostname(virConnectPtr conn ATTRIBUTE_UNUSED) +static char *libxlConnectGetHostname(virConnectPtr conn) { + if (virConnectGetHostnameEnsureACL(conn) < 0) + return NULL; + return virGetHostname(); } @@ -1447,6 +1460,9 @@ libxlConnectGetMaxVcpus(virConnectPtr conn, const char *type ATTRIBUTE_UNUSED) int ret; libxlDriverPrivatePtr driver = conn->privateData; + if (virConnectGetMaxVcpusEnsureACL(conn) < 0) + return -1; + ret = libxl_get_max_cpus(driver->ctx); /* libxl_get_max_cpus() will return 0 if there were any failures, e.g. xc_physinfo() failing */ @@ -1459,6 +1475,9 @@ libxlConnectGetMaxVcpus(virConnectPtr conn, const char *type ATTRIBUTE_UNUSED) static int libxlNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info) { + if (virNodeGetInfoEnsureACL(conn) < 0) + return -1; + return libxlDoNodeGetInfo(conn->privateData, info); } @@ -1468,6 +1487,9 @@ libxlConnectGetCapabilities(virConnectPtr conn) libxlDriverPrivatePtr driver = conn->privateData; char *xml; + if (virConnectGetCapabilitiesEnsureACL(conn) < 0) + return NULL; + libxlDriverLock(driver); if ((xml = virCapabilitiesFormatXML(driver->caps)) == NULL) virReportOOMError(); @@ -1482,6 +1504,9 @@ libxlConnectListDomains(virConnectPtr conn, int *ids, int nids) libxlDriverPrivatePtr driver = conn->privateData; int n; + if (virConnectListDomainsEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); n = virDomainObjListGetActiveIDs(driver->domains, ids, nids); libxlDriverUnlock(driver); @@ -1495,6 +1520,9 @@ libxlConnectNumOfDomains(virConnectPtr conn) libxlDriverPrivatePtr driver = conn->privateData; int n; + if (virConnectNumOfDomainsEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); n = virDomainObjListNumOfDomains(driver->domains, 1); libxlDriverUnlock(driver); @@ -1519,6 +1547,9 @@ libxlDomainCreateXML(virConnectPtr conn, const char *xml, VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_CHECK_LIVE, @@ -1561,6 +1592,9 @@ libxlDomainLookupByID(virConnectPtr conn, int id) goto cleanup; } + if (virDomainLookupByIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1587,6 +1621,9 @@ libxlDomainLookupByUUID(virConnectPtr conn, const unsigned char *uuid) goto cleanup; } + if (virDomainLookupByUUIDEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1613,6 +1650,9 @@ libxlDomainLookupByName(virConnectPtr conn, const char *name) goto cleanup; } + if (virDomainLookupByNameEnsureACL(conn, vm->def) < 0) + goto cleanup; + dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; @@ -1643,6 +1683,10 @@ libxlDomainSuspend(virDomainPtr dom) _("No domain with matching uuid '%s'"), uuidstr); goto cleanup; } + + if (virDomainSuspendEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -1702,6 +1746,9 @@ libxlDomainResume(virDomainPtr dom) goto cleanup; } + if (virDomainResumeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -1760,6 +1807,9 @@ libxlDomainShutdownFlags(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainShutdownFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -1813,6 +1863,9 @@ libxlDomainReboot(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainRebootEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -1856,6 +1909,9 @@ libxlDomainDestroyFlags(virDomainPtr dom, goto cleanup; } + if (virDomainDestroyFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -1911,7 +1967,11 @@ libxlDomainGetOSType(virDomainPtr dom) goto cleanup; } - ignore_value(VIR_STRDUP(type, vm->def->os.type)); + if (virDomainGetOSTypeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + + if (VIR_STRDUP(type, vm->def->os.type) < 0) + goto cleanup; cleanup: if (vm) @@ -1934,6 +1994,10 @@ libxlDomainGetMaxMemory(virDomainPtr dom) virReportError(VIR_ERR_NO_DOMAIN, "%s", _("no domain with matching uuid")); goto cleanup; } + + if (virDomainGetMaxMemoryEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = vm->def->mem.max_balloon; cleanup: @@ -1966,6 +2030,9 @@ libxlDomainSetMemoryFlags(virDomainPtr dom, unsigned long newmem, goto cleanup; } + if (virDomainSetMemoryFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + isActive = virDomainObjIsActive(vm); if (flags == VIR_DOMAIN_MEM_CURRENT) { @@ -2088,6 +2155,9 @@ libxlDomainGetInfo(virDomainPtr dom, virDomainInfoPtr info) goto cleanup; } + if (virDomainGetInfoEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { info->cpuTime = 0; info->memory = vm->def->mem.cur_balloon; @@ -2135,6 +2205,9 @@ libxlDomainGetState(virDomainPtr dom, goto cleanup; } + if (virDomainGetStateEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *state = virDomainObjGetState(vm, reason); ret = 0; @@ -2247,6 +2320,9 @@ libxlDomainSaveFlags(virDomainPtr dom, const char *to, const char *dxml, goto cleanup; } + if (virDomainSaveFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -2299,6 +2375,9 @@ libxlDomainRestoreFlags(virConnectPtr conn, const char *from, if (fd < 0) goto cleanup; + if (virDomainRestoreFlagsEnsureACL(conn, def) < 0) + goto cleanup; + if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_LIVE | @@ -2354,6 +2433,9 @@ libxlDomainCoreDump(virDomainPtr dom, const char *to, unsigned int flags) goto cleanup; } + if (virDomainCoreDumpEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -2444,6 +2526,9 @@ libxlDomainManagedSave(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainManagedSaveEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -2519,6 +2604,9 @@ libxlDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainHasManagedSaveImageEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = vm->hasManagedSave; cleanup: @@ -2548,6 +2636,9 @@ libxlDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainManagedSaveRemoveEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + name = libxlDomainManagedSavePath(driver, vm); if (name == NULL) goto cleanup; @@ -2606,6 +2697,9 @@ libxlDomainSetVcpusFlags(virDomainPtr dom, unsigned int nvcpus, goto cleanup; } + if (virDomainSetVcpusFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm) && (flags & VIR_DOMAIN_VCPU_LIVE)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot set vcpus on an inactive domain")); @@ -2725,6 +2819,9 @@ libxlDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainGetVcpusFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + active = virDomainObjIsActive(vm); if ((flags & (VIR_DOMAIN_VCPU_LIVE | VIR_DOMAIN_VCPU_CONFIG)) == 0) { @@ -2782,6 +2879,9 @@ libxlDomainPinVcpu(virDomainPtr dom, unsigned int vcpu, unsigned char *cpumap, goto cleanup; } + if (virDomainPinVcpuEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot pin vcpus on an inactive domain")); @@ -2849,6 +2949,9 @@ libxlDomainGetVcpus(virDomainPtr dom, virVcpuInfoPtr info, int maxinfo, goto cleanup; } + if (virDomainGetVcpusEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -2913,6 +3016,9 @@ libxlDomainGetXMLDesc(virDomainPtr dom, unsigned int flags) goto cleanup; } + if (virDomainGetXMLDescEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + ret = virDomainDefFormat(vm->def, flags); cleanup: @@ -2934,6 +3040,9 @@ libxlConnectDomainXMLFromNative(virConnectPtr conn, const char * nativeFormat, virCheckFlags(0, NULL); + if (virConnectDomainXMLFromNativeEnsureACL(conn) < 0) + goto cleanup; + if (STRNEQ(nativeFormat, LIBXL_CONFIG_FORMAT_XM)) { virReportError(VIR_ERR_INVALID_ARG, _("unsupported config type %s"), nativeFormat); @@ -2977,6 +3086,9 @@ libxlConnectDomainXMLToNative(virConnectPtr conn, const char * nativeFormat, virCheckFlags(0, NULL); + if (virConnectDomainXMLToNativeEnsureACL(conn) < 0) + goto cleanup; + if (STRNEQ(nativeFormat, LIBXL_CONFIG_FORMAT_XM)) { virReportError(VIR_ERR_INVALID_ARG, _("unsupported config type %s"), nativeFormat); @@ -3020,6 +3132,9 @@ libxlConnectListDefinedDomains(virConnectPtr conn, libxlDriverPrivatePtr driver = conn->privateData; int n; + if (virConnectListDefinedDomainsEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); n = virDomainObjListGetInactiveNames(driver->domains, names, nnames); libxlDriverUnlock(driver); @@ -3032,6 +3147,9 @@ libxlConnectNumOfDefinedDomains(virConnectPtr conn) libxlDriverPrivatePtr driver = conn->privateData; int n; + if (virConnectNumOfDefinedDomainsEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); n = virDomainObjListNumOfDomains(driver->domains, 0); libxlDriverUnlock(driver); @@ -3059,6 +3177,9 @@ libxlDomainCreateWithFlags(virDomainPtr dom, goto cleanup; } + if (virDomainCreateWithFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is already running")); @@ -3096,6 +3217,9 @@ libxlDomainDefineXML(virConnectPtr conn, const char *xml) VIR_DOMAIN_XML_INACTIVE))) goto cleanup; + if (virDomainDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, 0, @@ -3155,6 +3279,9 @@ libxlDomainUndefineFlags(virDomainPtr dom, goto cleanup; } + if (virDomainUndefineFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot undefine transient domain")); @@ -3584,6 +3711,9 @@ libxlDomainAttachDeviceFlags(virDomainPtr dom, const char *xml, goto cleanup; } + if (virDomainAttachDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (flags == VIR_DOMAIN_DEVICE_MODIFY_CURRENT) flags |= VIR_DOMAIN_DEVICE_MODIFY_LIVE; @@ -3689,6 +3819,9 @@ libxlDomainDetachDeviceFlags(virDomainPtr dom, const char *xml, goto cleanup; } + if (virDomainDetachDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (flags == VIR_DOMAIN_DEVICE_MODIFY_CURRENT) flags |= VIR_DOMAIN_DEVICE_MODIFY_LIVE; @@ -3794,6 +3927,9 @@ libxlDomainUpdateDeviceFlags(virDomainPtr dom, const char *xml, goto cleanup; } + if (virDomainUpdateDeviceFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (virDomainObjIsActive(vm)) { if (flags == VIR_DOMAIN_DEVICE_MODIFY_CURRENT) flags |= VIR_DOMAIN_DEVICE_MODIFY_LIVE; @@ -3877,6 +4013,9 @@ libxlNodeGetFreeMemory(virConnectPtr conn) const libxl_version_info* ver_info; libxlDriverPrivatePtr driver = conn->privateData; + if (virNodeGetFreeMemoryEnsureACL(conn) < 0) + return 0; + if (libxl_get_physinfo(driver->ctx, &phy_info)) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("libxl_get_physinfo_info failed")); @@ -3900,6 +4039,9 @@ libxlConnectDomainEventRegister(virConnectPtr conn, libxlDriverPrivatePtr driver = conn->privateData; int ret; + if (virConnectDomainEventRegisterEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); ret = virDomainEventStateRegister(conn, driver->domainEventState, @@ -3917,6 +4059,9 @@ libxlConnectDomainEventDeregister(virConnectPtr conn, libxlDriverPrivatePtr driver = conn->privateData; int ret; + if (virConnectDomainEventDeregisterEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); ret = virDomainEventStateDeregister(conn, driver->domainEventState, @@ -3945,6 +4090,9 @@ libxlDomainGetAutostart(virDomainPtr dom, int *autostart) goto cleanup; } + if (virDomainGetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + *autostart = vm->autostart; ret = 0; @@ -3973,6 +4121,9 @@ libxlDomainSetAutostart(virDomainPtr dom, int autostart) goto cleanup; } + if (virDomainSetAutostartEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!vm->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot set autostart for transient domain")); @@ -4042,6 +4193,9 @@ libxlDomainGetSchedulerType(virDomainPtr dom, int *nparams) goto cleanup; } + if (virDomainGetSchedulerTypeEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -4107,6 +4261,9 @@ libxlDomainGetSchedulerParametersFlags(virDomainPtr dom, goto cleanup; } + if (virDomainGetSchedulerParametersFlagsEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); @@ -4189,6 +4346,9 @@ libxlDomainSetSchedulerParametersFlags(virDomainPtr dom, goto cleanup; } + if (virDomainSetSchedulerParametersFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + if (!virDomainObjIsActive(vm)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is not running")); goto cleanup; @@ -4257,6 +4417,10 @@ libxlDomainIsActive(virDomainPtr dom) virReportError(VIR_ERR_NO_DOMAIN, NULL); goto cleanup; } + + if (virDomainIsActiveEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = virDomainObjIsActive(obj); cleanup: @@ -4279,6 +4443,10 @@ libxlDomainIsPersistent(virDomainPtr dom) virReportError(VIR_ERR_NO_DOMAIN, NULL); goto cleanup; } + + if (virDomainIsPersistentEnsureACL(dom->conn, obj->def) < 0) + goto cleanup; + ret = obj->persistent; cleanup: @@ -4301,6 +4469,10 @@ libxlDomainIsUpdated(virDomainPtr dom) virReportError(VIR_ERR_NO_DOMAIN, NULL); goto cleanup; } + + if (virDomainIsUpdatedEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + ret = vm->updated; cleanup: @@ -4317,6 +4489,9 @@ libxlConnectDomainEventRegisterAny(virConnectPtr conn, virDomainPtr dom, int eve libxlDriverPrivatePtr driver = conn->privateData; int ret; + if (virConnectDomainEventRegisterAnyEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); if (virDomainEventStateRegisterID(conn, driver->domainEventState, @@ -4335,6 +4510,9 @@ libxlConnectDomainEventDeregisterAny(virConnectPtr conn, int callbackID) libxlDriverPrivatePtr driver = conn->privateData; int ret; + if (virConnectDomainEventDeregisterAnyEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); ret = virDomainEventStateDeregisterID(conn, driver->domainEventState, @@ -4361,6 +4539,9 @@ libxlConnectListAllDomains(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_DOMAINS_FILTERS_ALL, -1); + if (virConnectListAllDomainsEnsureACL(conn) < 0) + return -1; + libxlDriverLock(driver); ret = virDomainObjListExport(driver->domains, conn, domains, flags); libxlDriverUnlock(driver); -- 1.8.1.4

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Insert calls to the ACL checking APIs in all network driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/Makefile.am | 7 ++++-- src/network/bridge_driver.c | 61 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+), 2 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 1d43e0d..a76c27e 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1230,8 +1230,11 @@ noinst_LTLIBRARIES += libvirt_driver_network.la endif libvirt_driver_network_impl_la_CFLAGS = \ - $(LIBNL_CFLAGS) $(DBUS_CFLAGS) \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) $(DBUS_CFLAGS) + $(LIBNL_CFLAGS) \ + $(DBUS_CFLAGS) \ + -I$(top_srcdir)/src/access \ + -I$(top_srcdir)/src/conf \ + $(AM_CFLAGS) libvirt_driver_network_impl_la_SOURCES = $(NETWORK_DRIVER_SOURCES) endif EXTRA_DIST += network/default.xml diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d5886fe..d19ae47 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -65,6 +65,7 @@ #include "virdbus.h" #include "virfile.h" #include "virstring.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_NETWORK @@ -2833,6 +2834,9 @@ static virNetworkPtr networkLookupByUUID(virConnectPtr conn, goto cleanup; } + if (virNetworkLookupByUUIDEnsureACL(conn, network->def) < 0) + goto cleanup; + ret = virGetNetwork(conn, network->def->name, network->def->uuid); cleanup: @@ -2856,6 +2860,9 @@ static virNetworkPtr networkLookupByName(virConnectPtr conn, goto cleanup; } + if (virNetworkLookupByNameEnsureACL(conn, network->def) < 0) + goto cleanup; + ret = virGetNetwork(conn, network->def->name, network->def->uuid); cleanup: @@ -2886,6 +2893,9 @@ static int networkConnectNumOfNetworks(virConnectPtr conn) { int nactive = 0, i; struct network_driver *driver = conn->networkPrivateData; + if (virConnectNumOfNetworksEnsureACL(conn) < 0) + return -1; + networkDriverLock(driver); for (i = 0; i < driver->networks.count; i++) { virNetworkObjLock(driver->networks.objs[i]); @@ -2902,6 +2912,9 @@ static int networkConnectListNetworks(virConnectPtr conn, char **const names, in struct network_driver *driver = conn->networkPrivateData; int got = 0, i; + if (virConnectListNetworksEnsureACL(conn) < 0) + return -1; + networkDriverLock(driver); for (i = 0; i < driver->networks.count && got < nnames; i++) { virNetworkObjLock(driver->networks.objs[i]); @@ -2929,6 +2942,9 @@ static int networkConnectNumOfDefinedNetworks(virConnectPtr conn) { int ninactive = 0, i; struct network_driver *driver = conn->networkPrivateData; + if (virConnectNumOfDefinedNetworksEnsureACL(conn) < 0) + return -1; + networkDriverLock(driver); for (i = 0; i < driver->networks.count; i++) { virNetworkObjLock(driver->networks.objs[i]); @@ -2945,6 +2961,9 @@ static int networkConnectListDefinedNetworks(virConnectPtr conn, char **const na struct network_driver *driver = conn->networkPrivateData; int got = 0, i; + if (virConnectListDefinedNetworksEnsureACL(conn) < 0) + return -1; + networkDriverLock(driver); for (i = 0; i < driver->networks.count && got < nnames; i++) { virNetworkObjLock(driver->networks.objs[i]); @@ -2977,10 +2996,14 @@ networkConnectListAllNetworks(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_NETWORKS_FILTERS_ALL, -1); + if (virConnectListAllNetworksEnsureACL(conn) < 0) + goto cleanup; + networkDriverLock(driver); ret = virNetworkList(conn, driver->networks, nets, flags); networkDriverUnlock(driver); +cleanup: return ret; } @@ -2997,6 +3020,10 @@ static int networkIsActive(virNetworkPtr net) virReportError(VIR_ERR_NO_NETWORK, NULL); goto cleanup; } + + if (virNetworkIsActiveEnsureACL(net->conn, obj->def) < 0) + goto cleanup; + ret = virNetworkObjIsActive(obj); cleanup: @@ -3018,6 +3045,10 @@ static int networkIsPersistent(virNetworkPtr net) virReportError(VIR_ERR_NO_NETWORK, NULL); goto cleanup; } + + if (virNetworkIsPersistentEnsureACL(net->conn, obj->def) < 0) + goto cleanup; + ret = obj->persistent; cleanup: @@ -3185,6 +3216,9 @@ static virNetworkPtr networkCreateXML(virConnectPtr conn, const char *xml) { if (!(def = virNetworkDefParseString(xml))) goto cleanup; + if (virNetworkCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (networkValidate(driver, def, true) < 0) goto cleanup; @@ -3225,6 +3259,9 @@ static virNetworkPtr networkDefineXML(virConnectPtr conn, const char *xml) { if (!(def = virNetworkDefParseString(xml))) goto cleanup; + if (virNetworkDefineXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (networkValidate(driver, def, false) < 0) goto cleanup; @@ -3283,6 +3320,9 @@ networkUndefine(virNetworkPtr net) { goto cleanup; } + if (virNetworkUndefineEnsureACL(net->conn, network->def) < 0) + goto cleanup; + if (virNetworkObjIsActive(network)) active = true; @@ -3343,6 +3383,9 @@ networkUpdate(virNetworkPtr net, goto cleanup; } + if (virNetworkUpdateEnsureACL(net->conn, network->def, flags) < 0) + goto cleanup; + /* see if we are listening for dhcp pre-modification */ for (ii = 0; (ipdef = virNetworkDefGetIpByIndex(network->def, AF_INET, ii)); @@ -3478,6 +3521,9 @@ static int networkCreate(virNetworkPtr net) { goto cleanup; } + if (virNetworkCreateEnsureACL(net->conn, network->def) < 0) + goto cleanup; + ret = networkStartNetwork(driver, network); cleanup: @@ -3501,6 +3547,9 @@ static int networkDestroy(virNetworkPtr net) { goto cleanup; } + if (virNetworkDestroyEnsureACL(net->conn, network->def) < 0) + goto cleanup; + if (!virNetworkObjIsActive(network)) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("network is not active")); @@ -3546,6 +3595,9 @@ static char *networkGetXMLDesc(virNetworkPtr net, goto cleanup; } + if (virNetworkGetXMLDescEnsureACL(net->conn, network->def) < 0) + goto cleanup; + if ((flags & VIR_NETWORK_XML_INACTIVE) && network->newDef) def = network->newDef; else @@ -3574,6 +3626,9 @@ static char *networkGetBridgeName(virNetworkPtr net) { goto cleanup; } + if (virNetworkGetBridgeNameEnsureACL(net->conn, network->def) < 0) + goto cleanup; + if (!(network->def->bridge)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("network '%s' does not have a bridge name."), @@ -3604,6 +3659,9 @@ static int networkGetAutostart(virNetworkPtr net, goto cleanup; } + if (virNetworkGetAutostartEnsureACL(net->conn, network->def) < 0) + goto cleanup; + *autostart = network->autostart; ret = 0; @@ -3629,6 +3687,9 @@ static int networkSetAutostart(virNetworkPtr net, goto cleanup; } + if (virNetworkSetAutostartEnsureACL(net->conn, network->def) < 0) + goto cleanup; + if (!network->persistent) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cannot set autostart for transient network")); -- 1.8.1.4

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Insert calls to the ACL checking APIs in all node device driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/Makefile.am | 4 +++- src/node_device/node_device_driver.c | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 8e60612..c899001 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1360,7 +1360,9 @@ endif libvirt_driver_nodedev_la_SOURCES = $(NODE_DEVICE_DRIVER_SOURCES) libvirt_driver_nodedev_la_CFLAGS = \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) + -I$(top_srcdir)/src/access \ + -I$(top_srcdir)/src/conf \ + $(AM_CFLAGS) libvirt_driver_nodedev_la_LDFLAGS = $(AM_LDFLAGS) libvirt_driver_nodedev_la_LIBADD = diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c index 52586b8..67e90a1 100644 --- a/src/node_device/node_device_driver.c +++ b/src/node_device/node_device_driver.c @@ -38,6 +38,8 @@ #include "node_device_conf.h" #include "node_device_hal.h" #include "node_device_driver.h" +#include "virutil.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_NODEDEV @@ -126,6 +128,9 @@ nodeNumOfDevices(virConnectPtr conn, int ndevs = 0; unsigned int i; + if (virNodeNumOfDevicesEnsureACL(conn) < 0) + return -1; + virCheckFlags(0, -1); nodeDeviceLock(driver); @@ -151,6 +156,9 @@ nodeListDevices(virConnectPtr conn, int ndevs = 0; unsigned int i; + if (virNodeListDevicesEnsureACL(conn) < 0) + return -1; + virCheckFlags(0, -1); nodeDeviceLock(driver); @@ -187,6 +195,9 @@ nodeConnectListAllNodeDevices(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_NODE_DEVICES_FILTERS_CAP, -1); + if (virConnectListAllNodeDevicesEnsureACL(conn) < 0) + return -1; + nodeDeviceLock(driver); ret = virNodeDeviceList(conn, driver->devs, devices, flags); nodeDeviceUnlock(driver); @@ -209,6 +220,9 @@ nodeDeviceLookupByName(virConnectPtr conn, const char *name) goto cleanup; } + if (virNodeDeviceLookupByNameEnsureACL(conn, obj->def) < 0) + goto cleanup; + ret = virGetNodeDevice(conn, name); cleanup: @@ -247,6 +261,10 @@ nodeDeviceLookupSCSIHostByWWN(virConnectPtr conn, VIR_NODE_DEV_CAP_FLAG_HBA_FC_HOST) { if (STREQ(cap->data.scsi_host.wwnn, wwnn) && STREQ(cap->data.scsi_host.wwpn, wwpn)) { + + if (virNodeDeviceLookupSCSIHostByWWNEnsureACL(conn, obj->def) < 0) + goto out; + dev = virGetNodeDevice(conn, obj->def->name); virNodeDeviceObjUnlock(obj); goto out; @@ -286,6 +304,9 @@ nodeDeviceGetXMLDesc(virNodeDevicePtr dev, goto cleanup; } + if (virNodeDeviceGetXMLDescEnsureACL(dev->conn, obj->def) < 0) + goto cleanup; + update_driver_name(obj); update_caps(obj); @@ -316,6 +337,9 @@ nodeDeviceGetParent(virNodeDevicePtr dev) goto cleanup; } + if (virNodeDeviceGetParentEnsureACL(dev->conn, obj->def) < 0) + goto cleanup; + if (obj->def->parent) { if (VIR_STRDUP(ret, obj->def->parent) < 0) goto cleanup; @@ -351,6 +375,9 @@ nodeDeviceNumOfCaps(virNodeDevicePtr dev) goto cleanup; } + if (virNodeDeviceNumOfCapsEnsureACL(dev->conn, obj->def) < 0) + goto cleanup; + for (caps = obj->def->caps; caps; caps = caps->next) ++ncaps; ret = ncaps; @@ -382,6 +409,9 @@ nodeDeviceListCaps(virNodeDevicePtr dev, char **const names, int maxnames) goto cleanup; } + if (virNodeDeviceListCapsEnsureACL(dev->conn, obj->def) < 0) + goto cleanup; + for (caps = obj->def->caps; caps && ncaps < maxnames; caps = caps->next) { if (VIR_STRDUP(names[ncaps], virNodeDevCapTypeToString(caps->type)) < 0) goto cleanup; @@ -489,6 +519,9 @@ nodeDeviceCreateXML(virConnectPtr conn, goto cleanup; } + if (virNodeDeviceCreateXMLEnsureACL(conn, def) < 0) + goto cleanup; + if (virNodeDeviceGetWWNs(def, &wwnn, &wwpn) == -1) { goto cleanup; } @@ -542,6 +575,9 @@ nodeDeviceDestroy(virNodeDevicePtr dev) goto out; } + if (virNodeDeviceDestroyEnsureACL(dev->conn, obj->def) < 0) + goto out; + if (virNodeDeviceGetWWNs(obj->def, &wwnn, &wwpn) == -1) { goto out; } -- 1.8.1.4

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Insert calls to the ACL checking APIs in all secrets driver entrypoints. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/Makefile.am | 4 +++- src/secret/secret_driver.c | 31 +++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 89b2bab..647b1f2 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1279,7 +1279,9 @@ noinst_LTLIBRARIES += libvirt_driver_secret.la #libvirt_la_BUILT_LIBADD += libvirt_driver_secret.la endif libvirt_driver_secret_la_CFLAGS = \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) + -I$(top_srcdir)/src/access \ + -I$(top_srcdir)/src/conf \ + $(AM_CFLAGS) if WITH_DRIVER_MODULES libvirt_driver_secret_la_LIBADD = ../gnulib/lib/libgnu.la libvirt_driver_secret_la_LDFLAGS = -module -avoid-version $(AM_LDFLAGS) diff --git a/src/secret/secret_driver.c b/src/secret/secret_driver.c index 5d1739f..fbe49d7 100644 --- a/src/secret/secret_driver.c +++ b/src/secret/secret_driver.c @@ -42,6 +42,7 @@ #include "virfile.h" #include "configmake.h" #include "virstring.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_SECRET @@ -559,6 +560,9 @@ secretConnectNumOfSecrets(virConnectPtr conn) int i; virSecretEntryPtr secret; + if (virConnectNumOfSecretsEnsureACL(conn) < 0) + return -1; + secretDriverLock(driver); i = 0; @@ -578,6 +582,9 @@ secretConnectListSecrets(virConnectPtr conn, char **uuids, int maxuuids) memset(uuids, 0, maxuuids * sizeof(*uuids)); + if (virConnectListSecretsEnsureACL(conn) < 0) + return -1; + secretDriverLock(driver); i = 0; @@ -643,6 +650,9 @@ secretConnectListAllSecrets(virConnectPtr conn, virCheckFlags(VIR_CONNECT_LIST_SECRETS_FILTERS_ALL, -1); + if (virConnectListAllSecretsEnsureACL(conn) < 0) + return -1; + secretDriverLock(driver); for (entry = driver->secrets; entry != NULL; entry = entry->next) @@ -725,6 +735,9 @@ secretLookupByUUID(virConnectPtr conn, const unsigned char *uuid) goto cleanup; } + if (virSecretLookupByUUIDEnsureACL(conn, secret->def) < 0) + goto cleanup; + ret = virGetSecret(conn, secret->def->uuid, secret->def->usage_type, @@ -752,6 +765,9 @@ secretLookupByUsage(virConnectPtr conn, int usageType, const char *usageID) goto cleanup; } + if (virSecretLookupByUsageEnsureACL(conn, secret->def) < 0) + goto cleanup; + ret = virGetSecret(conn, secret->def->uuid, secret->def->usage_type, @@ -781,6 +797,9 @@ secretDefineXML(virConnectPtr conn, const char *xml, secretDriverLock(driver); + if (virSecretDefineXMLEnsureACL(conn, new_attrs) < 0) + goto cleanup; + secret = secretFindByUUID(driver, new_attrs->uuid); if (secret == NULL) { /* No existing secret with same UUID, try look for matching usage instead */ @@ -897,6 +916,9 @@ secretGetXMLDesc(virSecretPtr obj, unsigned int flags) goto cleanup; } + if (virSecretGetXMLDescEnsureACL(obj->conn, secret->def) < 0) + goto cleanup; + ret = virSecretDefFormat(secret->def); cleanup: @@ -933,6 +955,9 @@ secretSetValue(virSecretPtr obj, const unsigned char *value, goto cleanup; } + if (virSecretSetValueEnsureACL(obj->conn, secret->def) < 0) + goto cleanup; + old_value = secret->value; old_value_size = secret->value_size; @@ -988,6 +1013,9 @@ secretGetValue(virSecretPtr obj, size_t *value_size, unsigned int flags, goto cleanup; } + if (virSecretGetValueEnsureACL(obj->conn, secret->def) < 0) + goto cleanup; + if (secret->value == NULL) { char uuidstr[VIR_UUID_STRING_BUFLEN]; virUUIDFormat(obj->uuid, uuidstr); @@ -1034,6 +1062,9 @@ secretUndefine(virSecretPtr obj) goto cleanup; } + if (virSecretUndefineEnsureACL(obj->conn, secret->def) < 0) + goto cleanup; + if (!secret->def->ephemeral && secretDeleteSaved(driver, secret) < 0) goto cleanup; -- 1.8.1.4

On 19.06.2013 19:01, Daniel P. Berrange wrote: You need to update the ACL checks as I'm getting these errors: libxl/libxl_driver.c:3771 Mismatch check 'virDomainLookupByIDEnsureACL' for function 'libxlDomainCreateXML' libxl/libxl_driver.c:3802 Mismatch check 'virDomainLookupByUUIDEnsureACL' for function 'libxlDomainLookupByID' libxl/libxl_driver.c:3831 Mismatch check 'virDomainLookupByNameEnsureACL' for function 'libxlDomainLookupByUUID' libxl/libxl_driver.c:6775 Missing ACL check in function 'libxlDomainLookupByName' for 'domainLookupByName' GEN check-augeas-lockd xen/xen_driver.c:113189 Mismatch check 'virDomainGetSchedulerParametersEnsureACL' for function 'xenUnifiedDomainGetSchedulerParametersFlags' xen/xen_driver.c:113800 Missing ACL check in function 'xenUnifiedDomainRestore' for 'domainRestore' xen/xen_driver.c:113801 Missing ACL check in function 'xenUnifiedDomainRestoreFlags' for 'domainRestoreFlags' xen/xen_driver.c:113831 Missing ACL check in function 'xenUnifiedDomainMigratePrepare' for 'domainMigratePrepare' xen/xen_driver.c:113841 Missing ACL check in function 'xenUnifiedNodeDeviceDettach' for 'nodeDeviceDettach' xen/xen_driver.c:113842 Missing ACL check in function 'xenUnifiedNodeDeviceDetachFlags' for 'nodeDeviceDetachFlags' xen/xen_driver.c:113844 Missing ACL check in function 'xenUnifiedNodeDeviceReset' for 'nodeDeviceReset' xen/xen_driver.c:113847 Missing ACL check in function 'xenUnifiedDomainIsActive' for 'domainIsActive' xen/xen_driver.c:113848 Missing ACL check in function 'xenUnifiedDomainIsPersistent' for 'domainIsPersistent' xen/xen_driver.c:113849 Missing ACL check in function 'xenUnifiedDomainIsUpdated' for 'domainIsUpdated' xen/xen_driver.c:113852 Missing ACL check in function 'xenUnifiedDomainOpenConsole' for 'domainOpenConsole' make[3]: *** [check-aclrules] Error 1 make[3]: Leaving directory `/home/zippy/work/libvirt/libvirt.git/src' make[2]: *** [check-am] Error 2 make[2]: Leaving directory `/home/zippy/work/libvirt/libvirt.git/src' make[1]: *** [check] Error 2 make[1]: Leaving directory `/home/zippy/work/libvirt/libvirt.git/src' make: *** [check-recursive] Error 1 Michal