* Fri Jul 3 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.4-3.fc12

- Handle shared/readonly image labelling (bug #493692)
- Don't unnecessarily try to change a file context (bug #507555)
- Don't try to label a disk with no path (e.g. empty cdrom) (bug #499569)

.cvsignore

@@ -6,3 +6,5 @@ libvirt-*.tar.gz
 libvirt-0.6.0.tar.gz
 libvirt-0.6.1.tar.gz
 libvirt-0.6.2.tar.gz
+libvirt-0.6.3.tar.gz
+libvirt-0.6.4.tar.gz

libvirt-0.6.4-do-not-unnecessarily-try-to-change-a-file-context.patch

@@ -0,0 +1,47 @@
+From ae4523336ac06e3ff7cc7b416fad9e57998c6b54 Mon Sep 17 00:00:00 2001
+From: Tim Waugh <twaugh@redhat.com>
+Date: Fri, 3 Jul 2009 10:29:01 +0100
+Subject: [PATCH 2/3] Don't unnecessarily try to change a file context
+
+As pointed out by Tim Waugh here:
+
+  https://bugzilla.redhat.com/507555
+
+We shouldn't bother trying to set the context of a file if it already
+matches what we want.
+
+(Fixed to use STREQ() and not use tabs, as pointed out by danpb)
+
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+---
+ src/security_selinux.c |   11 ++++++++++-
+ 1 files changed, 10 insertions(+), 1 deletions(-)
+
+diff --git a/src/security_selinux.c b/src/security_selinux.c
+index db1c27d..c2015a1 100644
+--- a/src/security_selinux.c
++++ b/src/security_selinux.c
+@@ -280,10 +280,19 @@ static int
+ SELinuxSetFilecon(virConnectPtr conn, const char *path, char *tcon)
+ {
+     char ebuf[1024];
++    security_context_t econ;
+ 
+     VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon);
+ 
+-    if(setfilecon(path, tcon) < 0) {
++    if (setfilecon(path, tcon) < 0) {
++        if (getfilecon(path, &econ) >= 0) {
++            if (STREQ(tcon, econ)) {
++                freecon(econ);
++                /* It's alright, there's nothing to change anyway. */
++                return 0;
++            }
++            freecon(econ);
++        }
+         virSecurityReportError(conn, VIR_ERR_ERROR,
+                                _("%s: unable to set security context "
+                                  "'\%s\' on %s: %s."), __func__,
+-- 
+1.6.2.5
+

libvirt-0.6.4-fix-nosource-label.patch

@@ -0,0 +1,35 @@
+From 06f607a9c5cfd50433ae27cc7729c31f81d87f19 Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Fri, 3 Jul 2009 10:40:55 +0100
+Subject: [PATCH 3/3] Skip labelling if no src path present
+
+Fixes startup of guest's with sourceless cdrom devices.
+
+Patch originall posted here:
+
+  https://bugzilla.redhat.com/499569
+
+but never sent upstream.
+
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+---
+ src/security_selinux.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/src/security_selinux.c b/src/security_selinux.c
+index c2015a1..eb8d308 100644
+--- a/src/security_selinux.c
++++ b/src/security_selinux.c
+@@ -342,6 +342,9 @@ SELinuxSetSecurityImageLabel(virConnectPtr conn,
+ {
+     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
+ 
++    if (!disk->src)
++        return 0;
++
+     if (disk->shared) {
+         return SELinuxSetFilecon(conn, disk->src, default_image_context);
+     } else if (disk->readonly) {
+-- 
+1.6.2.5
+

libvirt-0.6.4-shared-readonly-label.patch

@@ -0,0 +1,97 @@
+From e700e17c3989d32e04ef98c63ac9b9414fefb366 Mon Sep 17 00:00:00 2001
+From: Daniel P. Berrange <berrange@redhat.com>
+Date: Fri, 3 Jul 2009 10:24:50 +0100
+Subject: [PATCH 1/3] Re-label shared and readonly images
+
+This patch was posted ages ago here:
+
+  https://bugzilla.redhat.com/493692
+
+But was never posted upstream AFAICT.
+
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+---
+ src/security_selinux.c |   27 +++++++++++++++++----------
+ 1 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/src/security_selinux.c b/src/security_selinux.c
+index ac317d7..db1c27d 100644
+--- a/src/security_selinux.c
++++ b/src/security_selinux.c
+@@ -24,11 +24,12 @@
+ #include "virterror_internal.h"
+ #include "util.h"
+ #include "memory.h"
+-
++#include "logging.h"
+ 
+ #define VIR_FROM_THIS VIR_FROM_SECURITY
+ 
+ static char default_domain_context[1024];
++static char default_content_context[1024];
+ static char default_image_context[1024];
+ #define SECURITY_SELINUX_VOID_DOI       "0"
+ #define SECURITY_SELINUX_NAME "selinux"
+@@ -148,8 +149,13 @@ SELinuxInitialize(virConnectPtr conn)
+     close(fd);
+ 
+     ptr = strchrnul(default_image_context, '\n');
+-    *ptr = '\0';
+-
++    if (*ptr == '\n') {
++        *ptr = '\0';
++        strcpy(default_content_context, ptr+1);
++        ptr = strchrnul(default_content_context, '\n');
++        if (*ptr == '\n')
++            *ptr = '\0';
++    }
+     return 0;
+ }
+ 
+@@ -275,6 +281,8 @@ SELinuxSetFilecon(virConnectPtr conn, const char *path, char *tcon)
+ {
+     char ebuf[1024];
+ 
++    VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon);
++
+     if(setfilecon(path, tcon) < 0) {
+         virSecurityReportError(conn, VIR_ERR_ERROR,
+                                _("%s: unable to set security context "
+@@ -299,9 +307,6 @@ SELinuxRestoreSecurityImageLabel(virConnectPtr conn,
+     char *newpath = NULL;
+     const char *path = disk->src;
+ 
+-    if (disk->readonly || disk->shared)
+-        return 0;
+-
+     if ((err = virFileResolveLink(path, &newpath)) < 0) {
+         virReportSystemError(conn, err,
+                              _("cannot resolve symlink %s"), path);
+@@ -328,8 +333,13 @@ SELinuxSetSecurityImageLabel(virConnectPtr conn,
+ {
+     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
+ 
+-    if (secdef->imagelabel)
++    if (disk->shared) {
++        return SELinuxSetFilecon(conn, disk->src, default_image_context);
++    } else if (disk->readonly) {
++        return SELinuxSetFilecon(conn, disk->src, default_content_context);
++    } else if (secdef->imagelabel) {
+         return SELinuxSetFilecon(conn, disk->src, secdef->imagelabel);
++    }
+ 
+     return 0;
+ }
+@@ -403,9 +413,6 @@ SELinuxSetSecurityLabel(virConnectPtr conn,
+ 
+     if (secdef->imagelabel) {
+         for (i = 0 ; i < vm->def->ndisks ; i++) {
+-            if (vm->def->disks[i]->readonly ||
+-                vm->def->disks[i]->shared) continue;
+-
+             if (SELinuxSetSecurityImageLabel(conn, vm, vm->def->disks[i]) < 0)
+                 return -1;
+         }
+-- 
+1.6.2.5
+

libvirt-0.6.4-svirt-sound.patch

@@ -1,8 +1,8 @@
---- src/qemu_conf.c.orig	2009-04-02 11:50:10.000000000 +0200
-+++ src/qemu_conf.c	2009-04-03 17:46:59.000000000 +0200
-@@ -779,6 +779,20 @@ int qemudBuildCommandLine(virConnectPtr 
+--- src/qemu_conf.c.orig	2009-05-29 19:24:59.000000000 +0200
++++ src/qemu_conf.c	2009-05-29 19:19:39.000000000 +0200
+@@ -792,6 +792,20 @@ int qemudBuildCommandLine(virConnectPtr 
+     char uuid[VIR_UUID_STRING_BUFLEN];
      char domid[50];
-     char *pidfile;
      const char *cpu = NULL;
 +    int skipSound = 0;
 +
@@ -12,7 +12,7 @@
 +        getuid() == 0) {
 +        static int soundWarned = 0; 
 +        skipSound = 1;
-+        if (vm->def->nsounds &&
++        if (def->nsounds &&
 +            !soundWarned) {
 +            soundWarned = 1;
 +            VIR_WARN0("Sound cards for VMs are disabled while SELinux security model is active");
@@ -21,12 +21,12 @@
  
      uname_normalize(&ut);
  
-@@ -1425,7 +1439,8 @@ int qemudBuildCommandLine(virConnectPtr 
+@@ -1429,7 +1443,8 @@ int qemudBuildCommandLine(virConnectPtr 
      }
  
      /* Add sound hardware */
--    if (vm->def->nsounds) {
-+    if (vm->def->nsounds &&
+-    if (def->nsounds) {
++    if (def->nsounds &&
 +        !skipSound) {
          int size = 100;
          char *modstr;

libvirt.spec

@@ -1,26 +1,14 @@
 # -*- rpm-spec -*-
 
-%define with_xen       0%{!?_without_xen:1}
-%define with_xen_proxy 0%{!?_without_xen_proxy:1}
-%define with_qemu      0%{!?_without_qemu:1}
-%define with_openvz    0%{!?_without_openvz:1}
-%define with_lxc       0%{!?_without_lxc:1}
-%define with_sasl      0%{!?_without_sasl:1}
-%define with_avahi     0%{!?_without_avahi:1}
-%define with_polkit    0%{!?_without_polkit:0}
-%define with_python    0%{!?_without_python:1}
-%define with_libvirtd  0%{!?_without_libvirtd:1}
-%define with_uml       0%{!?_without_uml:1}
-%define with_network   0%{!?_without_network:1}
-
 %define with_xen           0%{!?_without_xen:1}
 %define with_xen_proxy     0%{!?_without_xen_proxy:1}
 %define with_qemu          0%{!?_without_qemu:1}
 %define with_openvz        0%{!?_without_openvz:1}
 %define with_lxc           0%{!?_without_lxc:1}
+%define with_vbox          0%{!?_without_vbox:1}
 %define with_sasl          0%{!?_without_sasl:1}
 %define with_avahi         0%{!?_without_avahi:1}
-%define with_polkit        0%{!?_without_polkit:0}
+%define with_polkit        0%{!?_without_polkit:1}
 %define with_python        0%{!?_without_python:1}
 %define with_libvirtd      0%{!?_without_libvirtd:1}
 %define with_uml           0%{!?_without_uml:1}
@@ -60,20 +48,28 @@
 %define with_rhel5 0
 %else
 %define with_rhel5 1
+%define with_polkit 0
 %endif
 
 
 Summary: Library providing a simple API virtualization
 Name: libvirt
-Version: 0.6.2
-Release: 1%{?dist}%{?extra_release}
+Version: 0.6.4
+Release: 3%{?dist}%{?extra_release}
 License: LGPLv2+
 Group: Development/Libraries
 Source: libvirt-%{version}.tar.gz
 
-# Not for upstream. Temporary hack till PulseAudio autostart
-# problems are sorted out when SELinux enforcing
-Patch200: libvirt-0.6.2-svirt-sound.patch
+# Handle shared/readonly image labelling (bug #493692)
+Patch1: libvirt-0.6.4-shared-readonly-label.patch
+# Don't unnecessarily try to change a file context (bug #507555)
+Patch2: libvirt-0.6.4-do-not-unnecessarily-try-to-change-a-file-context.patch
+# Don't try to label a disk with no path (e.g. empty cdrom) (bug #499569)
+Patch3: libvirt-0.6.4-fix-nosource-label.patch
+
+# Temporary hack till PulseAudio autostart problems are sorted
+# out when SELinux enforcing (bz 486112)
+Patch200: libvirt-0.6.4-svirt-sound.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 URL: http://libvirt.org/
@@ -143,9 +139,6 @@ BuildRequires: avahi-devel
 BuildRequires: libselinux-devel
 BuildRequires: dnsmasq
 BuildRequires: bridge-utils
-%if %{with_qemu}
-BuildRequires: qemu
-%endif
 %if %{with_sasl}
 BuildRequires: cyrus-sasl-devel
 %endif
@@ -224,6 +217,10 @@ of recent versions of Linux (and other OSes).
 %prep
 %setup -q
 
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+
 %patch200 -p0
 
 mv NEWS NEWS.old
@@ -246,6 +243,10 @@ iconv -f ISO-8859-1 -t UTF-8 < NEWS.old > NEWS
 %define _without_lxc --without-lxc
 %endif
 
+%if ! %{with_vbox}
+%define _without_vbox --without-vbox
+%endif
+
 %if ! %{with_sasl}
 %define _without_sasl --without-sasl
 %endif
@@ -302,6 +303,7 @@ iconv -f ISO-8859-1 -t UTF-8 < NEWS.old > NEWS
            %{?_without_qemu} \
            %{?_without_openvz} \
            %{?_without_lxc} \
+           %{?_without_vbox} \
            %{?_without_sasl} \
            %{?_without_avahi} \
            %{?_without_polkit} \
@@ -336,8 +338,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/python*/site-packages/*.a
 install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/run/libvirt/
 # Default dir for disk images defined in SELinux policy
 install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/lib/libvirt/images/
-# Default dir for kernel+initrd images defnied in SELinux policy
+# Default dir for kernel+initrd images defined in SELinux policy
 install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/lib/libvirt/boot/
+# used for virDomainMemoryPeek
+install -d -m 0700 $RPM_BUILD_ROOT%{_localstatedir}/cache/libvirt/
 
 %if %{with_qemu}
 # We don't want to install /etc/libvirt/qemu/networks in the main %files list
@@ -409,8 +413,10 @@ fi
 %defattr(-, root, root)
 
 %doc AUTHORS ChangeLog NEWS README COPYING.LIB TODO
-%doc %{_mandir}/man1/virsh.1*
+%{_mandir}/man1/virsh.1*
+%{_mandir}/man1/virt-xml-validate.1*
 %{_bindir}/virsh
+%{_bindir}/virt-xml-validate
 %{_libdir}/lib*.so.*
 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/
 
@@ -456,6 +462,7 @@ fi
 %dir %{_localstatedir}/lib/libvirt/
 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/images/
 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/boot/
+%dir %attr(0700, root, root) %{_localstatedir}/cache/libvirt/
 
 %if %{with_qemu}
 %dir %{_localstatedir}/run/libvirt/qemu/
@@ -518,6 +525,7 @@ fi
 %dir %{_includedir}/libvirt
 %{_includedir}/libvirt/*.h
 %{_libdir}/pkgconfig/libvirt.pc
+%dir %{_datadir}/gtk-doc/html/libvirt
 %doc %{_datadir}/gtk-doc/html/libvirt/*.devhelp
 %doc %{_datadir}/gtk-doc/html/libvirt/*.html
 %doc %{_datadir}/gtk-doc/html/libvirt/*.png
@@ -542,6 +550,60 @@ fi
 %endif
 
 %changelog
+* Fri Jul  3 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.4-3.fc12
+- Handle shared/readonly image labelling (bug #493692)
+- Don't unnecessarily try to change a file context (bug #507555)
+- Don't try to label a disk with no path (e.g. empty cdrom) (bug #499569)
+
+* Fri Jun  5 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.4-2.fc12
+- Remove the qemu BuildRequires
+
+* Fri May 29 2009 Daniel Veillard <veillard@redhat.com> - 0.6.4-1.fc12
+- Upstream release of 0.6.4
+- new APIs
+- fixes for latests QEmu/KVM versions
+- various assorted fixes
+
+* Mon May 25 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.3-11.fc12
+- Bring up the bridge, even if it doesn't have an IP address (bug #501912)
+
+* Thu May 21 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.3-10.fc12
+- Fix XML attribute escaping (bug #499791)
+- Fix serious event handling issues causing guests to be destroyed (bug #499698)
+
+* Thu May 21 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.3-9.fc12
+- Fix qemu argv detection with latest qemu (bug #501923)
+
+* Sun May 10 2009 Cole Robinson <crobinso@redhat.com> - 0.6.2-8.fc12
+- Don't try to label a disk with no path (e.g. empty cdrom) (bug #499569)
+
+* Thu May  7 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.3-7.fc12
+- Enable migration for qemu 0.10 (bug #499704)
+
+* Wed May  6 2009 Cole Robinson <crobinso@redhat.com> - 0.6.3-6.fc12
+- Refresh qemu caps when getCapabilities is called (bug #460649)
+
+* Wed May  6 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.3-5.fc12
+- Fix handling of <hostdev managed='yes'> (bug #499386)
+
+* Tue May  5 2009 Daniel Berrange <berrange@redhat.com> - 0.6.3-4.fc12
+- Fix readonly/shared disk image labelling (rhbz #493692)
+
+* Tue Apr 28 2009 Daniel Veillard <veillard@redhat.com> - 0.6.3-3.fc12
+- was also missing /usr/share/gtk-doc/html/libvirt in -devel
+
+* Tue Apr 28 2009 Daniel Veillard <veillard@redhat.com> - 0.6.3-2.fc12
+- fix packaging bug #496945 libvirt should own /var/cache/libvirt
+
+* Fri Apr 24 2009 Daniel Veillard <veillard@redhat.com> - 0.6.3-1.fc12
+- release of 0.6.3
+- VirtualBox driver
+- new virt-xml-validate command
+- assorted bug fixes
+
+* Thu Apr 16 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.2-2.fc12
+- Fix qemu drive format specification (#496092)
+
 * Fri Apr  3 2009 Daniel Veillard <veillard@redhat.com> - 0.6.2-1.fc11
 - release of 0.6.2
 - memory ballooning in QEMU

sources

@@ -1 +1 @@
-3035b484861516a1cd425acef1e760e3  libvirt-0.6.2.tar.gz
+344a6913a94582ea3ab0ad75a9bfef22  libvirt-0.6.4.tar.gz