Compare commits
56 Commits
libvirt-0_
...
libvirt-0_
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e29f71d1c9 | ||
|
|
427ed20801 | ||
|
|
d23e6c285b | ||
|
|
2c139b45d8 | ||
|
|
762435e3b7 | ||
|
|
6383d6b056 | ||
|
|
3712441ea6 | ||
|
|
9d0bc882fa | ||
|
|
90dddf3d3d | ||
|
|
86abd54d02 | ||
|
|
4ab5ad5425 | ||
|
|
f9c1b758c3 | ||
|
|
38cf1bd5ba | ||
|
|
aeda455930 | ||
|
|
288291b795 | ||
|
|
7c2073faca | ||
|
|
5b528ba717 | ||
|
|
4f731a7250 | ||
|
|
f1ac0031f5 | ||
|
|
e45b9c9030 | ||
|
|
3cf75c269d | ||
|
|
585033f372 | ||
|
|
897506e66a | ||
|
|
e4bf8ffa42 | ||
|
|
20367a58a6 | ||
|
|
aa037364ed | ||
|
|
c034c1a3b2 | ||
|
|
da05e02884 | ||
|
|
e1b7b518ac | ||
|
|
581b5f5022 | ||
|
|
c476c8b683 | ||
|
|
b93eafc59f | ||
|
|
2105d62ca8 | ||
|
|
743adffffe | ||
|
|
11e3b51c0d | ||
|
|
66df925739 | ||
|
|
b20a5c6d3b | ||
|
|
7f58f3aa54 | ||
|
|
6577b14441 | ||
|
|
2e7812764f | ||
|
|
854b878580 | ||
|
|
89c28e4013 | ||
|
|
db269c2d21 | ||
|
|
98e4f7ee9f | ||
|
|
0c4afc5ee9 | ||
|
|
593255292e | ||
|
|
ccafc8ecb4 | ||
|
|
a38fb9cbc1 | ||
|
|
6359121866 | ||
|
|
b20d669e88 | ||
|
|
a3e1cc37ed | ||
|
|
a6eca3382d | ||
|
|
c6c5072e90 | ||
|
|
705fd20a0e | ||
|
|
e0e9927d93 | ||
|
|
bae7a0fb84 |
@@ -8,3 +8,7 @@ libvirt-0.6.1.tar.gz
|
||||
libvirt-0.6.2.tar.gz
|
||||
libvirt-0.6.3.tar.gz
|
||||
libvirt-0.6.4.tar.gz
|
||||
libvirt-0.6.5.tar.gz
|
||||
libvirt-0.7.0.tar.gz
|
||||
libvirt-0.7.1.tar.gz
|
||||
libvirt-0.7.2.tar.gz
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
From ae4523336ac06e3ff7cc7b416fad9e57998c6b54 Mon Sep 17 00:00:00 2001
|
||||
From: Tim Waugh <twaugh@redhat.com>
|
||||
Date: Fri, 3 Jul 2009 10:29:01 +0100
|
||||
Subject: [PATCH 2/3] Don't unnecessarily try to change a file context
|
||||
|
||||
As pointed out by Tim Waugh here:
|
||||
|
||||
https://bugzilla.redhat.com/507555
|
||||
|
||||
We shouldn't bother trying to set the context of a file if it already
|
||||
matches what we want.
|
||||
|
||||
(Fixed to use STREQ() and not use tabs, as pointed out by danpb)
|
||||
|
||||
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
|
||||
---
|
||||
src/security_selinux.c | 11 ++++++++++-
|
||||
1 files changed, 10 insertions(+), 1 deletions(-)
|
||||
|
||||
diff --git a/src/security_selinux.c b/src/security_selinux.c
|
||||
index db1c27d..c2015a1 100644
|
||||
--- a/src/security_selinux.c
|
||||
+++ b/src/security_selinux.c
|
||||
@@ -280,10 +280,19 @@ static int
|
||||
SELinuxSetFilecon(virConnectPtr conn, const char *path, char *tcon)
|
||||
{
|
||||
char ebuf[1024];
|
||||
+ security_context_t econ;
|
||||
|
||||
VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon);
|
||||
|
||||
- if(setfilecon(path, tcon) < 0) {
|
||||
+ if (setfilecon(path, tcon) < 0) {
|
||||
+ if (getfilecon(path, &econ) >= 0) {
|
||||
+ if (STREQ(tcon, econ)) {
|
||||
+ freecon(econ);
|
||||
+ /* It's alright, there's nothing to change anyway. */
|
||||
+ return 0;
|
||||
+ }
|
||||
+ freecon(econ);
|
||||
+ }
|
||||
virSecurityReportError(conn, VIR_ERR_ERROR,
|
||||
_("%s: unable to set security context "
|
||||
"'\%s\' on %s: %s."), __func__,
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
@@ -1,130 +0,0 @@
|
||||
From 80965bff6d46dea1808c8bbf02f50f0e289a0e65 Mon Sep 17 00:00:00 2001
|
||||
From: Daniel P. Berrange <berrange@redhat.com>
|
||||
Date: Mon, 29 Jun 2009 10:41:56 +0000
|
||||
Subject: [PATCH] Fix crash in QEMU driver with bad capabilities data
|
||||
|
||||
---
|
||||
src/qemu_driver.c | 80 +++++++++++++++++++++++++++++++++++-----------------
|
||||
1 files changed, 54 insertions(+), 26 deletions(-)
|
||||
|
||||
diff -up libvirt-0.6.2/src/qemu_driver.c.bad-caps libvirt-0.6.2/src/qemu_driver.c
|
||||
--- libvirt-0.6.2/src/qemu_driver.c.bad-caps 2009-07-03 10:07:03.275252815 +0100
|
||||
+++ libvirt-0.6.2/src/qemu_driver.c 2009-07-03 10:08:52.143502961 +0100
|
||||
@@ -360,12 +360,43 @@ next:
|
||||
return 0;
|
||||
}
|
||||
|
||||
+
|
||||
+static int
|
||||
+qemudSecurityCapsInit(virSecurityDriverPtr secdrv,
|
||||
+ virCapsPtr caps)
|
||||
+{
|
||||
+ const char *doi, *model;
|
||||
+
|
||||
+ doi = virSecurityDriverGetDOI(secdrv);
|
||||
+ model = virSecurityDriverGetModel(secdrv);
|
||||
+
|
||||
+ caps->host.secModel.model = strdup(model);
|
||||
+ if (!caps->host.secModel.model) {
|
||||
+ char ebuf[1024];
|
||||
+ VIR_ERROR(_("Failed to copy secModel model: %s"),
|
||||
+ virStrerror(errno, ebuf, sizeof ebuf));
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ caps->host.secModel.doi = strdup(doi);
|
||||
+ if (!caps->host.secModel.doi) {
|
||||
+ char ebuf[1024];
|
||||
+ VIR_ERROR(_("Failed to copy secModel DOI: %s"),
|
||||
+ virStrerror(errno, ebuf, sizeof ebuf));
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ VIR_DEBUG("Initialized caps for security driver \"%s\" with "
|
||||
+ "DOI \"%s\"", model, doi);
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+
|
||||
static int
|
||||
qemudSecurityInit(struct qemud_driver *qemud_drv)
|
||||
{
|
||||
int ret;
|
||||
- const char *doi, *model;
|
||||
- virCapsPtr caps;
|
||||
virSecurityDriverPtr security_drv;
|
||||
|
||||
ret = virSecurityDriverStartup(&security_drv,
|
||||
@@ -381,36 +412,17 @@ qemudSecurityInit(struct qemud_driver *q
|
||||
}
|
||||
|
||||
qemud_drv->securityDriver = security_drv;
|
||||
- doi = virSecurityDriverGetDOI(security_drv);
|
||||
- model = virSecurityDriverGetModel(security_drv);
|
||||
|
||||
- VIR_DEBUG("Initialized security driver \"%s\" with "
|
||||
- "DOI \"%s\"", model, doi);
|
||||
+ VIR_INFO("Initialized security driver %s", security_drv->name);
|
||||
|
||||
/*
|
||||
* Add security policy host caps now that the security driver is
|
||||
* initialized.
|
||||
*/
|
||||
- caps = qemud_drv->caps;
|
||||
-
|
||||
- caps->host.secModel.model = strdup(model);
|
||||
- if (!caps->host.secModel.model) {
|
||||
- char ebuf[1024];
|
||||
- VIR_ERROR(_("Failed to copy secModel model: %s"),
|
||||
- virStrerror(errno, ebuf, sizeof ebuf));
|
||||
- return -1;
|
||||
- }
|
||||
+ return qemudSecurityCapsInit(security_drv, qemud_drv->caps);
|
||||
+}
|
||||
|
||||
- caps->host.secModel.doi = strdup(doi);
|
||||
- if (!caps->host.secModel.doi) {
|
||||
- char ebuf[1024];
|
||||
- VIR_ERROR(_("Failed to copy secModel DOI: %s"),
|
||||
- virStrerror(errno, ebuf, sizeof ebuf));
|
||||
- return -1;
|
||||
- }
|
||||
|
||||
- return 0;
|
||||
-}
|
||||
|
||||
/**
|
||||
* qemudStartup:
|
||||
@@ -1852,13 +1864,29 @@ static int qemudGetNodeInfo(virConnectPt
|
||||
|
||||
static char *qemudGetCapabilities(virConnectPtr conn) {
|
||||
struct qemud_driver *driver = conn->privateData;
|
||||
+ virCapsPtr caps;
|
||||
char *xml = NULL;
|
||||
|
||||
qemuDriverLock(driver);
|
||||
+ if ((caps = qemudCapsInit()) == NULL) {
|
||||
+ virReportOOMError(conn);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ if (qemu_driver->securityDriver &&
|
||||
+ qemudSecurityCapsInit(qemu_driver->securityDriver, caps) < 0) {
|
||||
+ virCapabilitiesFree(caps);
|
||||
+ virReportOOMError(conn);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
virCapabilitiesFree(qemu_driver->caps);
|
||||
- if ((qemu_driver->caps = qemudCapsInit()) == NULL ||
|
||||
- (xml = virCapabilitiesFormatXML(driver->caps)) == NULL)
|
||||
+ qemu_driver->caps = caps;
|
||||
+
|
||||
+ if ((xml = virCapabilitiesFormatXML(driver->caps)) == NULL)
|
||||
virReportOOMError(conn);
|
||||
+
|
||||
+cleanup:
|
||||
qemuDriverUnlock(driver);
|
||||
|
||||
return xml;
|
||||
@@ -1,35 +0,0 @@
|
||||
From 06f607a9c5cfd50433ae27cc7729c31f81d87f19 Mon Sep 17 00:00:00 2001
|
||||
From: Cole Robinson <crobinso@redhat.com>
|
||||
Date: Fri, 3 Jul 2009 10:40:55 +0100
|
||||
Subject: [PATCH 3/3] Skip labelling if no src path present
|
||||
|
||||
Fixes startup of guest's with sourceless cdrom devices.
|
||||
|
||||
Patch originall posted here:
|
||||
|
||||
https://bugzilla.redhat.com/499569
|
||||
|
||||
but never sent upstream.
|
||||
|
||||
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
|
||||
---
|
||||
src/security_selinux.c | 3 +++
|
||||
1 files changed, 3 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/src/security_selinux.c b/src/security_selinux.c
|
||||
index c2015a1..eb8d308 100644
|
||||
--- a/src/security_selinux.c
|
||||
+++ b/src/security_selinux.c
|
||||
@@ -342,6 +342,9 @@ SELinuxSetSecurityImageLabel(virConnectPtr conn,
|
||||
{
|
||||
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
|
||||
|
||||
+ if (!disk->src)
|
||||
+ return 0;
|
||||
+
|
||||
if (disk->shared) {
|
||||
return SELinuxSetFilecon(conn, disk->src, default_image_context);
|
||||
} else if (disk->readonly) {
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
@@ -1,97 +0,0 @@
|
||||
From e700e17c3989d32e04ef98c63ac9b9414fefb366 Mon Sep 17 00:00:00 2001
|
||||
From: Daniel P. Berrange <berrange@redhat.com>
|
||||
Date: Fri, 3 Jul 2009 10:24:50 +0100
|
||||
Subject: [PATCH 1/3] Re-label shared and readonly images
|
||||
|
||||
This patch was posted ages ago here:
|
||||
|
||||
https://bugzilla.redhat.com/493692
|
||||
|
||||
But was never posted upstream AFAICT.
|
||||
|
||||
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
|
||||
---
|
||||
src/security_selinux.c | 27 +++++++++++++++++----------
|
||||
1 files changed, 17 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/src/security_selinux.c b/src/security_selinux.c
|
||||
index ac317d7..db1c27d 100644
|
||||
--- a/src/security_selinux.c
|
||||
+++ b/src/security_selinux.c
|
||||
@@ -24,11 +24,12 @@
|
||||
#include "virterror_internal.h"
|
||||
#include "util.h"
|
||||
#include "memory.h"
|
||||
-
|
||||
+#include "logging.h"
|
||||
|
||||
#define VIR_FROM_THIS VIR_FROM_SECURITY
|
||||
|
||||
static char default_domain_context[1024];
|
||||
+static char default_content_context[1024];
|
||||
static char default_image_context[1024];
|
||||
#define SECURITY_SELINUX_VOID_DOI "0"
|
||||
#define SECURITY_SELINUX_NAME "selinux"
|
||||
@@ -148,8 +149,13 @@ SELinuxInitialize(virConnectPtr conn)
|
||||
close(fd);
|
||||
|
||||
ptr = strchrnul(default_image_context, '\n');
|
||||
- *ptr = '\0';
|
||||
-
|
||||
+ if (*ptr == '\n') {
|
||||
+ *ptr = '\0';
|
||||
+ strcpy(default_content_context, ptr+1);
|
||||
+ ptr = strchrnul(default_content_context, '\n');
|
||||
+ if (*ptr == '\n')
|
||||
+ *ptr = '\0';
|
||||
+ }
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -275,6 +281,8 @@ SELinuxSetFilecon(virConnectPtr conn, const char *path, char *tcon)
|
||||
{
|
||||
char ebuf[1024];
|
||||
|
||||
+ VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon);
|
||||
+
|
||||
if(setfilecon(path, tcon) < 0) {
|
||||
virSecurityReportError(conn, VIR_ERR_ERROR,
|
||||
_("%s: unable to set security context "
|
||||
@@ -299,9 +307,6 @@ SELinuxRestoreSecurityImageLabel(virConnectPtr conn,
|
||||
char *newpath = NULL;
|
||||
const char *path = disk->src;
|
||||
|
||||
- if (disk->readonly || disk->shared)
|
||||
- return 0;
|
||||
-
|
||||
if ((err = virFileResolveLink(path, &newpath)) < 0) {
|
||||
virReportSystemError(conn, err,
|
||||
_("cannot resolve symlink %s"), path);
|
||||
@@ -328,8 +333,13 @@ SELinuxSetSecurityImageLabel(virConnectPtr conn,
|
||||
{
|
||||
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
|
||||
|
||||
- if (secdef->imagelabel)
|
||||
+ if (disk->shared) {
|
||||
+ return SELinuxSetFilecon(conn, disk->src, default_image_context);
|
||||
+ } else if (disk->readonly) {
|
||||
+ return SELinuxSetFilecon(conn, disk->src, default_content_context);
|
||||
+ } else if (secdef->imagelabel) {
|
||||
return SELinuxSetFilecon(conn, disk->src, secdef->imagelabel);
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -403,9 +413,6 @@ SELinuxSetSecurityLabel(virConnectPtr conn,
|
||||
|
||||
if (secdef->imagelabel) {
|
||||
for (i = 0 ; i < vm->def->ndisks ; i++) {
|
||||
- if (vm->def->disks[i]->readonly ||
|
||||
- vm->def->disks[i]->shared) continue;
|
||||
-
|
||||
if (SELinuxSetSecurityImageLabel(conn, vm, vm->def->disks[i]) < 0)
|
||||
return -1;
|
||||
}
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
--- src/qemu_conf.c.orig 2009-05-29 19:24:59.000000000 +0200
|
||||
+++ src/qemu_conf.c 2009-05-29 19:19:39.000000000 +0200
|
||||
@@ -792,6 +792,20 @@ int qemudBuildCommandLine(virConnectPtr
|
||||
char uuid[VIR_UUID_STRING_BUFLEN];
|
||||
char domid[50];
|
||||
const char *cpu = NULL;
|
||||
+ int skipSound = 0;
|
||||
+
|
||||
+ if (driver->securityDriver &&
|
||||
+ driver->securityDriver->name &&
|
||||
+ STREQ(driver->securityDriver->name, "selinux") &&
|
||||
+ getuid() == 0) {
|
||||
+ static int soundWarned = 0;
|
||||
+ skipSound = 1;
|
||||
+ if (def->nsounds &&
|
||||
+ !soundWarned) {
|
||||
+ soundWarned = 1;
|
||||
+ VIR_WARN0("Sound cards for VMs are disabled while SELinux security model is active");
|
||||
+ }
|
||||
+ }
|
||||
|
||||
uname_normalize(&ut);
|
||||
|
||||
@@ -1429,7 +1443,8 @@ int qemudBuildCommandLine(virConnectPtr
|
||||
}
|
||||
|
||||
/* Add sound hardware */
|
||||
- if (def->nsounds) {
|
||||
+ if (def->nsounds &&
|
||||
+ !skipSound) {
|
||||
int size = 100;
|
||||
char *modstr;
|
||||
if (VIR_ALLOC_N(modstr, size+1) < 0)
|
||||
31
libvirt-logrotate-avoid-compressing-small-logs.patch
Normal file
31
libvirt-logrotate-avoid-compressing-small-logs.patch
Normal file
@@ -0,0 +1,31 @@
|
||||
From d7cca87f6c5ad2316934af8ecb95829b95b662c6 Mon Sep 17 00:00:00 2001
|
||||
From: Dan Kenigsberg <danken@redhat.com>
|
||||
Date: Wed, 21 Oct 2009 13:56:04 +0200
|
||||
Subject: [PATCH] Do not log rotate very small logs
|
||||
|
||||
Without this, after few weeks without use, each defined domain grows a
|
||||
tail of empty gzipped logs, instead of keeping just the last log of
|
||||
interest.
|
||||
|
||||
* daemon/libvirtd.logrotate.in: only rotate when the log is over 100 KBytes
|
||||
|
||||
(cherry picked from commit b03fe2d0aefb57a096a102bf23375f0a167ca189)
|
||||
|
||||
Fedora-patch: libvirt-logrotate-avoid-compressing-small-logs.patch
|
||||
---
|
||||
daemon/libvirtd.logrotate.in | 1 +
|
||||
1 files changed, 1 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/daemon/libvirtd.logrotate.in b/daemon/libvirtd.logrotate.in
|
||||
index 093651c..0c51fd3 100644
|
||||
--- a/daemon/libvirtd.logrotate.in
|
||||
+++ b/daemon/libvirtd.logrotate.in
|
||||
@@ -5,4 +5,5 @@
|
||||
compress
|
||||
delaycompress
|
||||
copytruncate
|
||||
+ minsize 100k
|
||||
}
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
42
libvirt-qemu-machine-type-fixes2.patch
Normal file
42
libvirt-qemu-machine-type-fixes2.patch
Normal file
@@ -0,0 +1,42 @@
|
||||
From b7b6a28eb9eae641762de9408a90971d849ce92e Mon Sep 17 00:00:00 2001
|
||||
From: Mark McLoughlin <markmc@redhat.com>
|
||||
Date: Thu, 15 Oct 2009 12:09:17 +0100
|
||||
Subject: [PATCH] Don't copy old machines from a domain which has none
|
||||
|
||||
If the the qemu and kvm binaries are the same, we don't include machine
|
||||
types in the kvm domain info.
|
||||
|
||||
However, the code which refreshes the machine types info from the
|
||||
previous capabilities structure first looks at the kvm domain's info,
|
||||
finds it matches and then copies the empty machine types list over
|
||||
for the top-level qemu domain.
|
||||
|
||||
That doesn't make sense, we shouldn't copy an empty machin types list.
|
||||
|
||||
* src/qemu/qemu_conf.c: qemudGetOldMachinesFromInfo(): don't copy an
|
||||
empty machine types list.
|
||||
|
||||
(cherry picked from commit 2210f8a3a8e2774ca4fb8b42e21899e5b85ca913)
|
||||
|
||||
Fedora-patch: libvirt-qemu-machine-type-fixes2.patch
|
||||
---
|
||||
src/qemu/qemu_conf.c | 3 +++
|
||||
1 files changed, 3 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
|
||||
index ac63570..b881f1e 100644
|
||||
--- a/src/qemu/qemu_conf.c
|
||||
+++ b/src/qemu/qemu_conf.c
|
||||
@@ -505,6 +505,9 @@ qemudGetOldMachinesFromInfo(virCapsGuestDomainInfoPtr info,
|
||||
virCapsGuestMachinePtr *list;
|
||||
int i;
|
||||
|
||||
+ if (!info->nmachines)
|
||||
+ return 0;
|
||||
+
|
||||
if (!info->emulator || !STREQ(emulator, info->emulator))
|
||||
return 0;
|
||||
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
168
libvirt-qemu-save-restore.patch
Normal file
168
libvirt-qemu-save-restore.patch
Normal file
@@ -0,0 +1,168 @@
|
||||
From 076fffe1514b72ffc9a041f7f68348f5487ee8ba Mon Sep 17 00:00:00 2001
|
||||
From: Daniel P. Berrange <berrange@redhat.com>
|
||||
Date: Wed, 11 Nov 2009 12:07:00 +0000
|
||||
Subject: [PATCH] Fix save and restore with non-privileged guests and SELinux
|
||||
|
||||
When running qemu:///system instance, libvirtd runs as root,
|
||||
but QEMU may optionally be configured to run non-root. When
|
||||
then saving a guest to a state file, the file is initially
|
||||
created as root, and thus QEMU cannot write to it. It is also
|
||||
missing labelling required to allow access via SELinux.
|
||||
|
||||
* src/qemu/qemu_driver.c: Set ownership on save image before
|
||||
running migrate command in virDomainSave impl. Call out to
|
||||
security driver to set save image labelling
|
||||
* src/security/security_driver.h: Add driver APIs for setting
|
||||
and restoring saved state file labelling
|
||||
* src/security/security_selinux.c: Implement saved state file
|
||||
labelling for SELinux
|
||||
|
||||
(cherry picked from commit bc0010b3d149df00406b82c37eb59874d8525af4)
|
||||
|
||||
Fedora-patch: libvirt-qemu-save-restore.patch
|
||||
---
|
||||
src/qemu/qemu_driver.c | 35 ++++++++++++++++++++++++++++++++---
|
||||
src/security/security_driver.h | 7 +++++++
|
||||
src/security/security_selinux.c | 23 +++++++++++++++++++++++
|
||||
3 files changed, 62 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
||||
index c544c4b..171ac8f 100644
|
||||
--- a/src/qemu/qemu_driver.c
|
||||
+++ b/src/qemu/qemu_driver.c
|
||||
@@ -3146,6 +3146,7 @@ static int qemudDomainSave(virDomainPtr dom,
|
||||
char *xml = NULL;
|
||||
struct qemud_save_header header;
|
||||
int ret = -1;
|
||||
+ int rc;
|
||||
virDomainEventPtr event = NULL;
|
||||
|
||||
memset(&header, 0, sizeof(header));
|
||||
@@ -3226,9 +3227,22 @@ static int qemudDomainSave(virDomainPtr dom,
|
||||
}
|
||||
fd = -1;
|
||||
|
||||
+ if (driver->privileged &&
|
||||
+ chown(path, driver->user, driver->group) < 0) {
|
||||
+ virReportSystemError(NULL, errno,
|
||||
+ _("unable to set ownership of '%s' to user %d:%d"),
|
||||
+ path, driver->user, driver->group);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ if (driver->securityDriver &&
|
||||
+ driver->securityDriver->domainSetSavedStateLabel &&
|
||||
+ driver->securityDriver->domainSetSavedStateLabel(dom->conn, vm, path) == -1)
|
||||
+ goto cleanup;
|
||||
+
|
||||
if (header.compressed == QEMUD_SAVE_FORMAT_RAW) {
|
||||
const char *args[] = { "cat", NULL };
|
||||
- ret = qemuMonitorMigrateToCommand(vm, 0, args, path);
|
||||
+ rc = qemuMonitorMigrateToCommand(vm, 0, args, path);
|
||||
} else {
|
||||
const char *prog = qemudSaveCompressionTypeToString(header.compressed);
|
||||
const char *args[] = {
|
||||
@@ -3236,12 +3250,27 @@ static int qemudDomainSave(virDomainPtr dom,
|
||||
"-c",
|
||||
NULL
|
||||
};
|
||||
- ret = qemuMonitorMigrateToCommand(vm, 0, args, path);
|
||||
+ rc = qemuMonitorMigrateToCommand(vm, 0, args, path);
|
||||
}
|
||||
|
||||
- if (ret < 0)
|
||||
+ if (rc < 0)
|
||||
goto cleanup;
|
||||
|
||||
+ if (driver->privileged &&
|
||||
+ chown(path, 0, 0) < 0) {
|
||||
+ virReportSystemError(NULL, errno,
|
||||
+ _("unable to set ownership of '%s' to user %d:%d"),
|
||||
+ path, 0, 0);
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
+ if (driver->securityDriver &&
|
||||
+ driver->securityDriver->domainRestoreSavedStateLabel &&
|
||||
+ driver->securityDriver->domainRestoreSavedStateLabel(dom->conn, path) == -1)
|
||||
+ goto cleanup;
|
||||
+
|
||||
+ ret = 0;
|
||||
+
|
||||
/* Shut it down */
|
||||
qemudShutdownVMDaemon(dom->conn, driver, vm);
|
||||
event = virDomainEventNewFromObj(vm,
|
||||
diff --git a/src/security/security_driver.h b/src/security/security_driver.h
|
||||
index fde2978..5514962 100644
|
||||
--- a/src/security/security_driver.h
|
||||
+++ b/src/security/security_driver.h
|
||||
@@ -42,6 +42,11 @@ typedef int (*virSecurityDomainRestoreHostdevLabel) (virConnectPtr conn,
|
||||
typedef int (*virSecurityDomainSetHostdevLabel) (virConnectPtr conn,
|
||||
virDomainObjPtr vm,
|
||||
virDomainHostdevDefPtr dev);
|
||||
+typedef int (*virSecurityDomainSetSavedStateLabel) (virConnectPtr conn,
|
||||
+ virDomainObjPtr vm,
|
||||
+ const char *savefile);
|
||||
+typedef int (*virSecurityDomainRestoreSavedStateLabel) (virConnectPtr conn,
|
||||
+ const char *savefile);
|
||||
typedef int (*virSecurityDomainGenLabel) (virConnectPtr conn,
|
||||
virDomainObjPtr sec);
|
||||
typedef int (*virSecurityDomainReserveLabel) (virConnectPtr conn,
|
||||
@@ -71,6 +76,8 @@ struct _virSecurityDriver {
|
||||
virSecurityDomainRestoreLabel domainRestoreSecurityLabel;
|
||||
virSecurityDomainRestoreHostdevLabel domainRestoreSecurityHostdevLabel;
|
||||
virSecurityDomainSetHostdevLabel domainSetSecurityHostdevLabel;
|
||||
+ virSecurityDomainSetSavedStateLabel domainSetSavedStateLabel;
|
||||
+ virSecurityDomainRestoreSavedStateLabel domainRestoreSavedStateLabel;
|
||||
|
||||
/*
|
||||
* This is internally managed driver state and should only be accessed
|
||||
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
|
||||
index 7e0f71a..4f2d1d3 100644
|
||||
--- a/src/security/security_selinux.c
|
||||
+++ b/src/security/security_selinux.c
|
||||
@@ -525,6 +525,7 @@ done:
|
||||
return ret;
|
||||
}
|
||||
|
||||
+
|
||||
static int
|
||||
SELinuxRestoreSecurityPCILabel(virConnectPtr conn,
|
||||
pciDevice *dev ATTRIBUTE_UNUSED,
|
||||
@@ -625,6 +626,26 @@ SELinuxRestoreSecurityLabel(virConnectPtr conn,
|
||||
return rc;
|
||||
}
|
||||
|
||||
+
|
||||
+static int
|
||||
+SELinuxSetSavedStateLabel(virConnectPtr conn,
|
||||
+ virDomainObjPtr vm,
|
||||
+ const char *savefile)
|
||||
+{
|
||||
+ const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
|
||||
+
|
||||
+ return SELinuxSetFilecon(conn, savefile, secdef->imagelabel);
|
||||
+}
|
||||
+
|
||||
+
|
||||
+static int
|
||||
+SELinuxRestoreSavedStateLabel(virConnectPtr conn,
|
||||
+ const char *savefile)
|
||||
+{
|
||||
+ return SELinuxRestoreSecurityFileLabel(conn, savefile);
|
||||
+}
|
||||
+
|
||||
+
|
||||
static int
|
||||
SELinuxSecurityVerify(virConnectPtr conn, virDomainDefPtr def)
|
||||
{
|
||||
@@ -694,4 +715,6 @@ virSecurityDriver virSELinuxSecurityDriver = {
|
||||
.domainSetSecurityLabel = SELinuxSetSecurityLabel,
|
||||
.domainSetSecurityHostdevLabel = SELinuxSetSecurityHostdevLabel,
|
||||
.domainRestoreSecurityHostdevLabel = SELinuxRestoreSecurityHostdevLabel,
|
||||
+ .domainSetSavedStateLabel = SELinuxSetSavedStateLabel,
|
||||
+ .domainRestoreSavedStateLabel = SELinuxRestoreSavedStateLabel,
|
||||
};
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
875
libvirt.spec
875
libvirt.spec
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user