fix missing read-only access checks, fixes CVE-2008-5086

daniel

.cvsignore

@@ -1,25 +1,6 @@
-libvirt-0.0.3.tar.gz
-libvirt-0.0.4.tar.gz
-libvirt-0.0.5.tar.gz
-libvirt-0.0.6.tar.gz
-libvirt-0.1.0.tar.gz
-libvirt-0.1.2.tar.gz
-libvirt-0.1.1.tar.gz
-libvirt-0.1.3.tar.gz
-libvirt-0.1.4.tar.gz
-libvirt-0.1.5.tar.gz
-libvirt-0.1.6.tar.gz
-libvirt-0.1.7.tar.gz
-libvirt-0.1.8.tar.gz
-libvirt-0.1.9.tar.gz
-libvirt-0.1.10.tar.gz
-libvirt-0.1.11.tar.gz
-libvirt-0.2.0.tar.gz
-libvirt-0.2.1.tar.gz
-libvirt-0.2.2.tar.gz
-libvirt-0.2.3.tar.gz
-libvirt-0.3.0.tar.gz
-libvirt-0.3.1.tar.gz
-libvirt-0.3.2.tar.gz
-libvirt-0.3.3.tar.gz
-libvirt-0.4.0.tar.gz
+.build*.log
+*.rpm
+i686
+x86_64
+libvirt-*.tar.gz
+libvirt-0.4.2.tar.gz

branch

@@ -0,0 +1 @@
+F-9

libvirt-0.4.0-auth-null-cb-2.patch

@@ -1,83 +0,0 @@
-diff -rupN libvirt-0.4.0.orig/src/remote_internal.c libvirt-0.4.0.new/src/remote_internal.c
---- libvirt-0.4.0.orig/src/remote_internal.c	2008-01-11 10:39:34.000000000 -0500
-+++ libvirt-0.4.0.new/src/remote_internal.c	2008-01-11 10:43:12.000000000 -0500
-@@ -3054,8 +3054,12 @@ remoteAuthSASL (virConnectPtr conn, stru
-     if ((remoteAddr = addrToString(&sa, salen)) == NULL)
-         goto cleanup;
- 
--    if ((saslcb = remoteAuthMakeCallbacks(auth->credtype, auth->ncredtype)) == NULL)
--        goto cleanup;
-+    if (auth) {
-+        if ((saslcb = remoteAuthMakeCallbacks(auth->credtype, auth->ncredtype)) == NULL)
-+            goto cleanup;
-+    } else {
-+        saslcb = NULL;
-+    }
- 
-     /* Setup a handle for being a client */
-     err = sasl_client_new("libvirt",
-@@ -3168,15 +3172,21 @@ remoteAuthSASL (virConnectPtr conn, stru
-             goto cleanup;
-         }
-         /* Run the authentication callback */
--        if ((*(auth->cb))(cred, ncred, auth->cbdata) < 0) {
-+        if (auth && auth->cb) {
-+            if ((*(auth->cb))(cred, ncred, auth->cbdata) < 0) {
-+                __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE,
-+                                 VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0,
-+                                 "Failed to collect auth credentials");
-+                goto cleanup;
-+            }
-+            remoteAuthFillInteract(cred, interact);
-+            goto restart;
-+        } else {
-             __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE,
-                              VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0,
--                             "Failed to collect auth credentials");
-+                             "No authentication callback available");
-             goto cleanup;
--            return -1;
-         }
--        remoteAuthFillInteract(cred, interact);
--        goto restart;
-     }
-     free(iret.mechlist);
- 
-@@ -3240,15 +3250,22 @@ remoteAuthSASL (virConnectPtr conn, stru
-                 return -1;
-             }
-             /* Run the authentication callback */
--            if ((*(auth->cb))(cred, ncred, auth->cbdata) < 0) {
-+            if (auth && auth->cb) {
-+                if ((*(auth->cb))(cred, ncred, auth->cbdata) < 0) {
-+                    __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE,
-+                                     VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0,
-+                                     "Failed to collect auth credentials");
-+                    goto cleanup;
-+                    return -1;
-+                }
-+                remoteAuthFillInteract(cred, interact);
-+                goto restep;
-+            } else {
-                 __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE,
-                                  VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0,
--                                 "Failed to collect auth credentials");
-+                                 "No authentication callback available");
-                 goto cleanup;
--                return -1;
-             }
--            remoteAuthFillInteract(cred, interact);
--            goto restep;
-         }
- 
-         if (serverin) {
-@@ -3319,7 +3336,8 @@ remoteAuthSASL (virConnectPtr conn, stru
-     if (remoteAddr) free(remoteAddr);
-     if (serverin) free(serverin);
- 
--    free(saslcb);
-+    if (saslcb)
-+        free(saslcb);
-     remoteAuthFreeCredentials(cred, ncred);
-     if (ret != 0 && saslconn)
-         sasl_dispose(&saslconn);

libvirt-0.4.0-auth-null-cb.patch

@@ -1,44 +0,0 @@
-diff -rup libvirt-0.4.0.orig/src/remote_internal.c libvirt-0.4.0.new/src/remote_internal.c
---- libvirt-0.4.0.orig/src/remote_internal.c	2007-12-17 16:51:09.000000000 -0500
-+++ libvirt-0.4.0.new/src/remote_internal.c	2008-01-02 16:28:44.000000000 -0500
-@@ -3347,24 +3347,26 @@ remoteAuthPolkit (virConnectPtr conn, st
-     };
-     remoteDebug(priv, "Client initialize PolicyKit authentication");
- 
--    for (i = 0 ; i < auth->ncredtype ; i++) {
--        if (auth->credtype[i] == VIR_CRED_EXTERNAL)
--            allowcb = 1;
--    }
-+    if (auth && auth->cb) {
-+        /* Check if the neccessary credential type for PolicyKit is supported */
-+        for (i = 0 ; i < auth->ncredtype ; i++) {
-+            if (auth->credtype[i] == VIR_CRED_EXTERNAL)
-+                allowcb = 1;
-+        }
- 
--    /* Run the authentication callback */
--    if (allowcb) {
--        if (auth && auth->cb &&
--            (*(auth->cb))(&cred, 1, auth->cbdata) < 0) {
--            __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE,
--                             VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0,
--                             "Failed to collect auth credentials");
--            return -1;
-+        if (allowcb) {
-+            /* Run the authentication callback */
-+            if ((*(auth->cb))(&cred, 1, auth->cbdata) < 0) {
-+                __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE,
-+                                 VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0,
-+                                 "Failed to collect auth credentials");
-+                return -1;
-+            }
-         } else {
--            remoteDebug(priv, "No auth callback provided for PolicyKit");
-+            remoteDebug(priv, "Client auth callback does not support PolicyKit");
-         }
-     } else {
--        remoteDebug(priv, "Client auth callback does not support PolicyKit");
-+        remoteDebug(priv, "No auth callback provided");
-     }
- 
-     memset (&ret, 0, sizeof ret);

libvirt-0.4.0-conffile-size.patch

@@ -1,12 +0,0 @@
-diff -rup libvirt-0.4.0.orig/src/conf.c libvirt-0.4.0.new/src/conf.c
---- libvirt-0.4.0.orig/src/conf.c	2007-12-12 08:30:49.000000000 -0500
-+++ libvirt-0.4.0.new/src/conf.c	2008-01-02 16:30:12.000000000 -0500
-@@ -705,7 +705,7 @@ error:
- virConfPtr
- __virConfReadFile(const char *filename)
- {
--    char content[4096];
-+    char content[8192];
-     int fd;
-     int len;
- 

libvirt-0.4.0-nodeinfo-compat.patch

@@ -1,22 +0,0 @@
-diff -rup libvirt-0.4.0.orig/src/xend_internal.c libvirt-0.4.0.new/src/xend_internal.c
---- libvirt-0.4.0.orig/src/xend_internal.c	2007-12-17 18:05:27.000000000 -0500
-+++ libvirt-0.4.0.new/src/xend_internal.c	2008-01-18 21:13:30.000000000 -0500
-@@ -1907,6 +1907,9 @@ sexpr_to_xend_node_info(struct sexpr *ro
-     info->mhz = sexpr_int(root, "node/cpu_mhz");
-     info->nodes = sexpr_int(root, "node/nr_nodes");
-     info->sockets = sexpr_int(root, "node/sockets_per_node");
-+    info->cores = sexpr_int(root, "node/cores_per_socket");
-+    info->threads = sexpr_int(root, "node/threads_per_core");
-+
-     /* Xen 3.2.0 replaces sockets_per_node with 'nr_cpus'.
-      * Old Xen calculated sockets_per_node using its internal
-      * nr_cpus / (nodes*cores*threads), so fake it ourselves
-@@ -1921,8 +1924,6 @@ sexpr_to_xend_node_info(struct sexpr *ro
-         if (info->sockets == 0)
-             info->sockets = 1;
-     }
--    info->cores = sexpr_int(root, "node/cores_per_socket");
--    info->threads = sexpr_int(root, "node/threads_per_core");
-     return (0);
- }
- 

libvirt-0.4.0-remote-ssh.patch

@@ -1,17 +0,0 @@
-diff -rup libvirt-0.4.0.orig/src/remote_internal.c libvirt-0.4.0.new/src/remote_internal.c
---- libvirt-0.4.0.orig/src/remote_internal.c	2008-01-14 19:32:25.000000000 -0500
-+++ libvirt-0.4.0.new/src/remote_internal.c	2008-01-14 19:32:42.000000000 -0500
-@@ -677,11 +677,12 @@ doRemoteOpen (virConnectPtr conn,
-         cmd_argv[j++] = strdup (sockname ? sockname : LIBVIRTD_PRIV_UNIX_SOCKET);
-         cmd_argv[j++] = 0;
-         assert (j == nr_args);
--        for (j = 0; j < nr_args; j++)
-+        for (j = 0; j < (nr_args-1); j++) {
-             if (cmd_argv[j] == NULL) {
-                 error (conn, VIR_ERR_SYSTEM_ERROR, strerror (ENOMEM));
-                 goto failed;
-             }
-+        }
-     }
- 
-         /*FALLTHROUGH*/

libvirt-0.5.1-read-only-checks.patch

@@ -0,0 +1,152 @@
+diff --git a/src/libvirt.c b/src/libvirt.c
+--- a/src/libvirt.c
++++ b/src/libvirt.c
+@@ -2296,6 +2296,16 @@ virDomainMigrate (virDomainPtr domain,
+     conn = domain->conn;        /* Source connection. */
+     if (!VIR_IS_CONNECT (dconn)) {
+         virLibConnError (conn, VIR_ERR_INVALID_CONN, __FUNCTION__);
++        return NULL;
++    }
++
++    if (domain->conn->flags & VIR_CONNECT_RO) {
++        virLibDomainError(domain, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return NULL;
++    }
++    if (dconn->flags & VIR_CONNECT_RO) {
++        /* NB, delibrately report error against source object, not dest here */
++        virLibDomainError(domain, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
+         return NULL;
+     }
+ 
+@@ -2426,6 +2436,11 @@ virDomainMigratePrepare (virConnectPtr d
+         return -1;
+     }
+ 
++    if (dconn->flags & VIR_CONNECT_RO) {
++        virLibConnError(dconn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return -1;
++    }
++
+     if (dconn->driver->domainMigratePrepare)
+         return dconn->driver->domainMigratePrepare (dconn, cookie, cookielen,
+                                                     uri_in, uri_out,
+@@ -2457,6 +2472,11 @@ virDomainMigratePerform (virDomainPtr do
+     }
+     conn = domain->conn;
+ 
++    if (domain->conn->flags & VIR_CONNECT_RO) {
++        virLibDomainError(domain, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return -1;
++    }
++
+     if (conn->driver->domainMigratePerform)
+         return conn->driver->domainMigratePerform (domain, cookie, cookielen,
+                                                    uri,
+@@ -2482,6 +2502,11 @@ virDomainMigrateFinish (virConnectPtr dc
+ 
+     if (!VIR_IS_CONNECT (dconn)) {
+         virLibConnError (NULL, VIR_ERR_INVALID_CONN, __FUNCTION__);
++        return NULL;
++    }
++
++    if (dconn->flags & VIR_CONNECT_RO) {
++        virLibConnError(dconn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
+         return NULL;
+     }
+ 
+@@ -2517,6 +2542,11 @@ virDomainMigratePrepare2 (virConnectPtr 
+         return -1;
+     }
+ 
++    if (dconn->flags & VIR_CONNECT_RO) {
++        virLibConnError(dconn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return -1;
++    }
++
+     if (dconn->driver->domainMigratePrepare2)
+         return dconn->driver->domainMigratePrepare2 (dconn, cookie, cookielen,
+                                                      uri_in, uri_out,
+@@ -2547,6 +2577,11 @@ virDomainMigrateFinish2 (virConnectPtr d
+         return NULL;
+     }
+ 
++    if (dconn->flags & VIR_CONNECT_RO) {
++        virLibConnError(dconn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return NULL;
++    }
++
+     if (dconn->driver->domainMigrateFinish2)
+         return dconn->driver->domainMigrateFinish2 (dconn, dname,
+                                                     cookie, cookielen,
+@@ -2905,6 +2940,11 @@ virDomainBlockPeek (virDomainPtr dom,
+     }
+     conn = dom->conn;
+ 
++    if (dom->conn->flags & VIR_CONNECT_RO) {
++        virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return (-1);
++    }
++
+     if (!path) {
+         virLibDomainError (dom, VIR_ERR_INVALID_ARG,
+                            _("path is NULL"));
+@@ -2980,6 +3020,11 @@ virDomainMemoryPeek (virDomainPtr dom,
+     }
+     conn = dom->conn;
+ 
++    if (dom->conn->flags & VIR_CONNECT_RO) {
++        virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return (-1);
++    }
++
+     /* Flags must be VIR_MEMORY_VIRTUAL at the moment.
+      *
+      * Note on access to physical memory: A VIR_MEMORY_PHYSICAL flag is
+@@ -3246,6 +3291,11 @@ virDomainSetAutostart(virDomainPtr domai
+     }
+ 
+     conn = domain->conn;
++
++    if (domain->conn->flags & VIR_CONNECT_RO) {
++        virLibDomainError(domain, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return (-1);
++    }
+ 
+     if (conn->driver->domainSetAutostart)
+         return conn->driver->domainSetAutostart (domain, autostart);
+@@ -4197,6 +4247,11 @@ virNetworkSetAutostart(virNetworkPtr net
+         return (-1);
+     }
+ 
++    if (network->conn->flags & VIR_CONNECT_RO) {
++        virLibNetworkError(network, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return (-1);
++    }
++
+     conn = network->conn;
+ 
+     if (conn->networkDriver && conn->networkDriver->networkSetAutostart)
+@@ -4395,6 +4450,11 @@ virConnectFindStoragePoolSources(virConn
+         return NULL;
+     }
+ 
++    if (conn->flags & VIR_CONNECT_RO) {
++        virLibConnError(conn, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return NULL;
++    }
++
+     if (conn->storageDriver && conn->storageDriver->findPoolSources)
+         return conn->storageDriver->findPoolSources(conn, type, srcSpec, flags);
+ 
+@@ -5068,6 +5128,11 @@ virStoragePoolSetAutostart(virStoragePoo
+         return (-1);
+     }
+ 
++    if (pool->conn->flags & VIR_CONNECT_RO) {
++        virLibStoragePoolError(pool, VIR_ERR_OPERATION_DENIED, __FUNCTION__);
++        return (-1);
++    }
++
+     conn = pool->conn;
+ 
+     if (conn->storageDriver && conn->storageDriver->poolSetAutostart)

libvirt.spec

@@ -1,26 +1,46 @@
 # -*- rpm-spec -*-
 
-%if "%{fedora}" >= "8"
-%define with_polkit 1
-%define with_proxy no
-%else
-%define with_polkit 0
-%define with_proxy yes
+%define with_xen       0%{!?_without_xen:1}
+%define with_xen_proxy 0%{!?_without_xen_proxy:1}
+%define with_qemu      0%{!?_without_qemu:1}
+%define with_openvz    0%{!?_without_openvz:1}
+%define with_lxc       0%{!?_without_lxc:1}
+%define with_sasl      0%{!?_without_sasl:1}
+%define with_avahi     0%{!?_without_avahi:1}
+%define with_polkit    0%{!?_without_polkit:0}
+%define with_python    0%{!?_without_python:1}
+%define with_libvirtd  0%{!?_without_libvirtd:1}
+%define with_uml       0%{!?_without_uml:1}
+
+# Xen is available only on i386 x86_64 ia64
+%ifnarch i386 i686 x86_64 ia64
+%define with_xen 0
+%endif
+
+%if ! %{with_xen}
+%define with_xen_proxy 0
+%endif
+
+%if 0%{?fedora}
+%ifarch ppc64
+%define with_qemu 0
+%endif
+%endif
+
+%if 0%{?fedora} >= 8
+%define with_polkit    0%{!?_without_polkit:1}
+%define with_xen_proxy 0
 %endif
 
 Summary: Library providing a simple API virtualization
 Name: libvirt
-Version: 0.4.0
-Release: 4%{?dist}%{?extra_release}
-License: LGPL
+Version: 0.5.1
+Release: 2%{?dist}%{?extra_release}
+License: LGPLv2+
 Group: Development/Libraries
 Source: libvirt-%{version}.tar.gz
-Patch1: libvirt-%{version}-auth-null-cb.patch
-Patch2: libvirt-%{version}-conffile-size.patch
-Patch3: libvirt-%{version}-auth-null-cb-2.patch
-Patch4: libvirt-%{version}-remote-ssh.patch
-Patch5: libvirt-%{version}-nodeinfo-compat.patch
-BuildRoot: %{_tmppath}/%{name}-%{version}-root
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
+Patch0: libvirt-0.5.1-read-only-checks.patch
 URL: http://libvirt.org/
 BuildRequires: python python-devel
 Requires: libxml2
@@ -29,39 +49,89 @@ Requires: ncurses
 Requires: dnsmasq
 Requires: bridge-utils
 Requires: iptables
+# needed for device enumeration
+Requires: hal
 # So remote clients can access libvirt over SSH tunnel
 # (client invokes 'nc' against the UNIX socket on the server)
 Requires: nc
+%if %{with_sasl}
 Requires: cyrus-sasl
 # Not technically required, but makes 'out-of-box' config
-# work correctly & doesn't have onerous dependancies
+# work correctly & doesn't have onerous dependencies
 Requires: cyrus-sasl-md5
+%endif
 %if %{with_polkit}
 Requires: PolicyKit >= 0.6
 %endif
-
-%ifarch i386 x86_64 ia64
+# For mount/umount in FS driver
+BuildRequires: util-linux
+# For showmount in FS driver (netfs discovery)
+BuildRequires: nfs-utils
+Requires: nfs-utils
+%if %{with_qemu}
+# From QEMU RPMs
+Requires: /usr/bin/qemu-img
+%else
+%if %{with_xen}
+# From Xen RPMs
+Requires: /usr/sbin/qcow-create
+%endif
+%endif
+# For LVM drivers
+Requires: lvm2
+# For ISCSI driver
+Requires: iscsi-initiator-utils
+# For disk driver
+Requires: parted
+%if %{with_xen}
 BuildRequires: xen-devel
 %endif
 BuildRequires: libxml2-devel
+BuildRequires: xhtml1-dtds
 BuildRequires: readline-devel
 BuildRequires: ncurses-devel
 BuildRequires: gettext
 BuildRequires: gnutls-devel
+BuildRequires: hal-devel
+%if %{with_avahi}
 BuildRequires: avahi-devel
+%endif
+BuildRequires: libselinux-devel
 BuildRequires: dnsmasq
 BuildRequires: bridge-utils
+%if %{with_qemu}
+BuildRequires: qemu
+%endif
+%if %{with_sasl}
 BuildRequires: cyrus-sasl-devel
+%endif
 %if %{with_polkit}
 BuildRequires: PolicyKit-devel >= 0.6
 %endif
+# For mount/umount in FS driver
+BuildRequires: util-linux
+%if %{with_qemu}
+# From QEMU RPMs
+BuildRequires: /usr/bin/qemu-img
+%else
+%if %{with_xen}
+# From Xen RPMs
+BuildRequires: /usr/sbin/qcow-create
+%endif
+%endif
+# For LVM drivers
+BuildRequires: lvm2
+# For ISCSI driver
+BuildRequires: iscsi-initiator-utils
+# For disk driver
+BuildRequires: parted-devel
 Obsoletes: libvir
 
 # Fedora build root suckage
 BuildRequires: gawk
 
 %description
-Libvirt is a C toolkit to interract with the virtualization capabilities
+Libvirt is a C toolkit to interact with the virtualization capabilities
 of recent versions of Linux (and other OSes).
 
 %package devel
@@ -69,7 +139,7 @@ Summary: Libraries, includes, etc. to compile with the libvirt library
 Group: Development/Libraries
 Requires: libvirt = %{version}
 Requires: pkgconfig
-%ifarch i386 x86_64 ia64
+%if %{with_xen}
 Requires: xen-devel
 %endif
 Obsoletes: libvir-devel
@@ -78,6 +148,7 @@ Obsoletes: libvir-devel
 Includes and documentations for the C library providing an API to use
 the virtualization capabilities of recent versions of Linux (and other OSes).
 
+%if %{with_python}
 %package python
 Summary: Python bindings for the libvirt library
 Group: Development/Libraries
@@ -87,26 +158,69 @@ Obsoletes: libvir-python
 %description python
 The libvirt-python package contains a module that permits applications
 written in the Python programming language to use the interface
-supplied by the libvirt library to use the the virtualization capabilities 
+supplied by the libvirt library to use the virtualization capabilities
 of recent versions of Linux (and other OSes).
+%endif
 
 %prep
 %setup -q
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
+%patch0 -p1
 
 %build
-# Xen is availble only on i386 x86_64 ia64
-%ifarch i386 i686 x86_64 ia64
-%configure --with-init-script=redhat --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid --with-remote-file=%{_localstatedir}/run/libvirtd.pid
-%else
-%configure --without-xen --with-init-script=redhat --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid --with-remote-file=%{_localstatedir}/run/libvirtd.pid
+%if ! %{with_xen}
+%define _without_xen --without-xen
 %endif
 
-make
+%if ! %{with_qemu}
+%define _without_qemu --without-qemu
+%endif
+
+%if ! %{with_openvz}
+%define _without_openvz --without-openvz
+%endif
+
+%if ! %{with_lxc}
+%define _without_lxc --without-lxc
+%endif
+
+%if ! %{with_sasl}
+%define _without_sasl --without-sasl
+%endif
+
+%if ! %{with_avahi}
+%define _without_avahi --without-avahi
+%endif
+
+%if ! %{with_polkit}
+%define _without_polkit --without-polkit
+%endif
+
+%if ! %{with_python}
+%define _without_python --without-python
+%endif
+
+%if ! %{with_libvirtd}
+%define _without_libvirtd --without-libvirtd
+%endif
+
+%if ! %{with_uml}
+%define _without_uml --without-uml
+%endif
+
+%configure %{?_without_xen} \
+           %{?_without_qemu} \
+           %{?_without_openvz} \
+           %{?_without_lxc} \
+           %{?_without_sasl} \
+           %{?_without_avahi} \
+           %{?_without_polkit} \
+           %{?_without_python} \
+           %{?_without_libvirtd} \
+           %{?_without_uml} \
+           --with-init-script=redhat \
+           --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid \
+           --with-remote-file=%{_localstatedir}/run/libvirtd.pid
+make %{?_smp_mflags}
 
 %install
 rm -fr %{buildroot}
@@ -119,7 +233,12 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.a
 rm -f $RPM_BUILD_ROOT%{_libdir}/python*/site-packages/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/python*/site-packages/*.a
 install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/run/libvirt/
+# Default dir for disk images defined in SELinux policy
+install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/lib/libvirt/images/
+# Default dir for kernel+initrd images defnied in SELinux policy
+install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/lib/libvirt/boot/
 
+%if %{with_qemu}
 # We don't want to install /etc/libvirt/qemu/networks in the main %files list
 # because if the admin wants to delete the default network completely, we don't
 # want to end up re-incarnating it on every RPM upgrade.
@@ -130,14 +249,30 @@ rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml
 rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
 # Strip auto-generated UUID - we need it generated per-install
 sed -i -e "/<uuid>/d" $RPM_BUILD_ROOT%{_datadir}/libvirt/networks/default.xml
+%else
+rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml
+rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_qemu.aug
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug
+%endif
 %find_lang %{name}
 
+%if ! %{with_python}
+rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-python-%{version}
+%endif
+
+%if ! %{with_qemu}
+rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu.conf
+%endif
+
 %clean
 rm -fr %{buildroot}
 
 %post
 /sbin/ldconfig
 
+%if %{with_libvirtd}
+%if %{with_qemu}
 # We want to install the default network for initial RPM installs
 # or on the first upgrade from a non-network aware libvirt only.
 # We check this by looking to see if the daemon is already installed
@@ -150,14 +285,18 @@ then
          > %{_sysconfdir}/libvirt/qemu/networks/default.xml
     ln -s ../default.xml %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
 fi
+%endif
 
 /sbin/chkconfig --add libvirtd
+%endif
 
 %preun
+%if %{with_libvirtd}
 if [ $1 = 0 ]; then
     /sbin/service libvirtd stop 1>/dev/null 2>&1
     /sbin/chkconfig --del libvirtd
 fi
+%endif
 
 %postun
 /sbin/ldconfig
@@ -170,27 +309,69 @@ fi
 %{_bindir}/virsh
 %{_libdir}/lib*.so.*
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/
+
+%if %{with_qemu}
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/qemu/
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/qemu/networks/
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/qemu/networks/autostart
+%endif
+
+%if %{with_libvirtd}
 %{_sysconfdir}/rc.d/init.d/libvirtd
 %config(noreplace) %{_sysconfdir}/sysconfig/libvirtd
 %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf
+%endif
+
+%if %{with_qemu}
 %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf
+%endif
+
+%if %{with_sasl}
 %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf
+%endif
+
+%if %{with_qemu}
 %dir %{_datadir}/libvirt/
 %dir %{_datadir}/libvirt/networks/
 %{_datadir}/libvirt/networks/default.xml
+%endif
+
 %dir %{_localstatedir}/run/libvirt/
 %dir %{_localstatedir}/lib/libvirt/
-%if %{with_polkit}
-%{_datadir}/PolicyKit/policy/libvirtd.policy
+%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/images/
+%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/boot/
+
+%if %{with_qemu}
+%{_datadir}/augeas/lenses/libvirtd_qemu.aug
+%{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug
 %endif
+
+%if %{with_libvirtd}
+%{_datadir}/augeas/lenses/libvirtd.aug
+%{_datadir}/augeas/lenses/tests/test_libvirtd.aug
+%endif
+
+%if %{with_polkit}
+%{_datadir}/PolicyKit/policy/org.libvirt.unix.policy
+%endif
+
+%if %{with_qemu}
 %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/qemu/
-%if %{with_proxy} == "yes"
+%endif
+
+%if %{with_xen_proxy}
 %attr(4755, root, root) %{_libexecdir}/libvirt_proxy
 %endif
+
+%if %{with_lxc}
+%attr(0755, root, root) %{_libexecdir}/libvirt_lxc
+%endif
+
+%if %{with_libvirtd}
+%attr(0755, root, root) %{_libexecdir}/libvirt_parthelper
 %attr(0755, root, root) %{_sbindir}/libvirtd
+%endif
+
 %doc docs/*.rng
 %doc docs/*.xml
 
@@ -210,6 +391,7 @@ fi
 %doc docs/examples
 %doc docs/libvirt-api.xml
 
+%if %{with_python}
 %files python
 %defattr(-, root, root)
 
@@ -220,8 +402,104 @@ fi
 %doc python/TODO
 %doc python/libvirtclass.txt
 %doc docs/examples/python
+%endif
 
 %changelog
+* Wed Dec 17 2008 Daniel Veillard <veillard@redhat.com> - 0.5.1-2.fc9
+- fix missing read-only access checks, fixes CVE-2008-5086
+
+* Fri Dec  5 2008 Daniel Veillard <veillard@redhat.com> - 0.5.1-1.fc9
+- upstream release 0.5.1
+- mostly bugfixes e.g #473071
+- some driver improvments
+
+* Wed Nov 26 2008 Daniel Veillard <veillard@redhat.com> - 0.5.0-1.fc9
+- upstream release 0.5.0
+- domain lifecycle event support
+- node device enumeration
+- KVM/QEmu migration support
+- improved LXC support
+- SDL display configuration
+- User Mode Linux driver
+
+* Wed Sep 24 2008 Daniel Veillard <veillard@redhat.com> - 0.4.6-2.fc9
+- a subtle bug in python submakefile broke the 0.4.6-1.fc9 build #463733
+
+* Wed Sep 24 2008 Daniel Veillard <veillard@redhat.com> - 0.4.6-1.fc9
+- upstream release 0.4.6
+- fixes a couple of serious bugs in the previous release
+
+* Tue Sep  9 2008 Daniel Veillard <veillard@redhat.com> - 0.4.5-2.fc9
+- fix a crash if a QEmu/KVM domain is defined without an emulator path
+
+* Mon Sep  8 2008 Daniel Veillard <veillard@redhat.com> - 0.4.5-1.fc9
+- upstream release 0.4.5
+- a lot of bug fixes
+- major updates to QEmu/KVM and Linux containers drivers
+- support for OpenVZ if installed
+
+* Tue Jul  8 2008 Daniel P. Berrange <berrange@redhat.com> - 0.4.4-2.fc9
+- Fix booting of CDROM images with KVM (rhbz #452355)
+
+* Thu Jun 25 2008 Daniel Veillard <veillard@redhat.com> - 0.4.4-1.fc9
+- upstream release of 0.4.4
+- fixes a few bug in previous release
+
+* Thu Jun 12 2008 Daniel Veillard <veillard@redhat.com> - 0.4.3-1.fc9
+- upstream release 0.4.3
+- many bug fixes
+- many small improvements
+- serious xenner fixes
+
+* Wed Jun  4 2008 Mark McLoughlin <markmc@redhat.com> - 0.4.2-4.fc9
+- Disable lokkit support again (#449996, #447633)
+- Ensure PolicyKit is enabled (#446616)
+
+* Fri May  9 2008 Daniel P. Berrange <berrange@redhat.com> - 0.4.2-3.fc9
+- Added directory for initrd/kernel images for SELinux policy
+
+* Mon Apr 28 2008 Mark McLoughlin <markmc@redhat.com> - 0.4.2-2.fc9
+- Enable lokkit support (#443796)
+
+* Tue Apr  8 2008 Daniel Veillard <veillard@redhat.com> - 0.4.2-1.fc9
+- upstream release 0.4.2
+- many bug fixes
+- localization updates
+
+* Thu Apr  4 2008 Daniel P. Berrange <berrange@redhat.com> - 0.4.1-7.fc9
+- Don't run polkit-auth as root
+- Don't request polkit auth if client is root
+
+* Fri Mar 28 2008 Chris Lalancette <clalance@redhat.com> - 0.4.1-6.fc9
+- When dumping XML for a storage pool, make the <source> directory tag
+  match the <dir> tag used for specifying the pool in the first place
+
+* Thu Mar 27 2008 Chris Lalancette <clalance@redhat.com> - 0.4.1-5.fc9
+- Do iscsiadm sendtarget before trying to do login
+- Do sysfs scanning for iSCSI LUNs instead of trying to parse them from
+  iscsiadm session output
+
+* Thu Mar 13 2008 Daniel P. Berrange <berrange@redhat.com> - 0.4.1-4.fc9
+- Fix QEMU tap device setup
+- Fix Xen boot device XML processing
+- Fixed QEMU cdrom media change
+
+* Mon Mar 10 2008 Daniel P. Berrange <berrange@redhat.com> - 0.4.1-3.fc9
+- Fixed daemon startup when run with --daemon flag
+
+* Mon Mar  3 2008 Daniel Veillard <veillard@redhat.com> - 0.4.1-2.fc9
+- 2 patches found just after the release
+
+* Mon Mar  3 2008 Daniel Veillard <veillard@redhat.com> - 0.4.1-1.fc9
+- Release of 0.4.1
+- Storage APIs
+- xenner support
+- lots of assorted improvements, bugfixes and cleanups
+- documentation and localization improvements
+
+* Wed Feb 20 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 0.4.0-5
+- Autorebuild for GCC 4.3
+
 * Fri Jan 18 2008 Daniel P. Berrange <berrange@redhat.com> - 0.4.0-4.fc9
 - Fix SSH tunnelling (rhbz #428743)
 - Fix back-compat for nodeinfo call changes.

sources

@@ -1 +1 @@
-2f6c6adb62145988f0e5021e5cbd71d3  libvirt-0.4.0.tar.gz
+abc697978e9c66cbc8d8db4fa3f1c1b6  libvirt-0.5.1.tar.gz