- 06 2月, 2014 1 次提交
-
-
由 Eric Blake 提交于
Noticed a misuse of 'to' while testing my event regression under polkit ACLs, and decided to review the entire conf files for other legibility bugs. * daemon/libvirtd.conf: Use correct grammar. * src/qemu/qemu.conf: Likewise. Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 05 2月, 2014 1 次提交
-
-
由 Eric Blake 提交于
https://bugzilla.redhat.com/show_bug.cgi?id=1058839 Commit f9f56340 for CVE-2014-0028 almost had the right idea - we need to check the ACL rules to filter which events to send. But it overlooked one thing: the event dispatch queue is running in the main loop thread, and therefore does not normally have a current virIdentityPtr. But filter checks can be based on current identity, so when libvirtd.conf contains access_drivers=["polkit"], we ended up rejecting access for EVERY event due to failure to look up the current identity, even if it should have been allowed. Furthermore, even for events that are triggered by API calls, it is important to remember that the point of events is that they can be copied across multiple connections, which may have separate identities and permissions. So even if events were dispatched from a context where we have an identity, we must change to the correct identity of the connection that will be receiving the event, rather than basing a decision on the context that triggered the event, when deciding whether to filter an event to a particular connection. If there were an easy way to get from virConnectPtr to the appropriate virIdentityPtr, then object_event.c could adjust the identity prior to checking whether to dispatch an event. But setting up that back-reference is a bit invasive. Instead, it is easier to delay the filtering check until lower down the stack, at the point where we have direct access to the RPC client object that owns an identity. As such, this patch ends up reverting a large portion of the framework of commit f9f56340. We also have to teach 'make check' to special-case the fact that the event registration filtering is done at the point of dispatch, rather than the point of registration. Note that even though we don't actually use virConnectDomainEventRegisterCheckACL (because the RegisterAny variant is sufficient), we still generate the function for the purposes of documenting that the filtering takes place. Also note that I did not entirely delete the notion of a filter from object_event.c; I still plan on using that for my upcoming patch series for qemu monitor events in libvirt-qemu.so. In other words, while this patch changes ACL filtering to live in remote.c and therefore we have no current client of the filtering in object_event.c, the notion of filtering in object_event.c is still useful down the road. * src/check-aclrules.pl: Exempt event registration from having to pass checkACL filter down call stack. * daemon/remote.c (remoteRelayDomainEventCheckACL) (remoteRelayNetworkEventCheckACL): New functions. (remoteRelay*Event*): Use new functions. * src/conf/domain_event.h (virDomainEventStateRegister) (virDomainEventStateRegisterID): Drop unused parameter. * src/conf/network_event.h (virNetworkEventStateRegisterID): Likewise. * src/conf/domain_event.c (virDomainEventFilter): Delete unused function. * src/conf/network_event.c (virNetworkEventFilter): Likewise. * src/libxl/libxl_driver.c: Adjust caller. * src/lxc/lxc_driver.c: Likewise. * src/network/bridge_driver.c: Likewise. * src/qemu/qemu_driver.c: Likewise. * src/remote/remote_driver.c: Likewise. * src/test/test_driver.c: Likewise. * src/uml/uml_driver.c: Likewise. * src/vbox/vbox_tmpl.c: Likewise. * src/xen/xen_driver.c: Likewise. Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 21 1月, 2014 1 次提交
-
-
由 Laine Stump 提交于
I noticed this problem when adding systemd support to netcf, because I setup the configure.ac to automatically prefer using systemd over initscripts when possible - although I had copied the install-data-local target from the example of libvirt's "libvirt-guests" service more or less verbatim, "make distcheck" would fail because it was trying to install the service file directly into /lib/systemd/system rather than into /home/user/some/unimportant/name/lib/systemd/system. This is caused by the install/uninstall rules for the systemd unit files relying on $(DESTDIR) pointing the installed files to the right place, but in reality $(DESTDIR) is empty during this part of make distcheck - it instead sets $(prefix) with the toplevel directory used for its test build/install/uninstall cycle. (This problem hasn't been seen when running "make distcheck" in libvirt because libvirt will never build/install systemd support unless explicitly told to do so on the configure commandline, and "make distcheck" doesn't put the "--with-initscript=..." option on the configure commandline.) I verified that the same problem does exist in libvirt by modifying libvirt's configure.ac to set: init_systemd=yes with_init_script=systemd+redhat This forces a build/install of the systemd unit files during distcheck, which yields an error like this: /usr/bin/install -c -m 644 virtlockd.service \ /lib/systemd/system/ libtool: install: warning: relinking `libvirt-qemu.la' /usr/bin/install: cannot remove '/lib/systemd/system/virtlockd.service': Permission denied make[4]: *** [install-systemd] Error 1 After adding $(prefix) to all the definitions of SYSTEMD_UNIT_DIR, make distcheck now completes successfully with the modified configure.ac, and the above lines change to something like this: /usr/bin/install -c -m 644 virtlockd.service \ /home/laine/devel/libvirt/libvirt-1.2.1/_inst/lib/systemd/system/
-
- 16 1月, 2014 2 次提交
-
-
由 Eric Blake 提交于
We haven't had a release with network events yet, so we are free to fix the RPC so that it actually does what we want. Doing client-side filtering of per-network events is inefficient if a connection is only interested in events on a single network out of hundreds available on the server. But to do server-side per-network filtering, the server needs to know which network to filter on - so we need to pass an optional network over on registration. Furthermore, it is possible to have a client with both a global and per-network filter; in the existing code, the server sends only one event and the client replicates to both callbacks. But with server-side filtering, the server will send the event twice, so we need a way for the client to know which callbackID is sending an event, to ensure that the client can filter out events from a registration that does not match the callbackID from the server. Likewise, the existing style of deregistering by eventID alone is fine; but in the new style, we have to remember which callbackID to delete. This patch fixes the RPC wire definition to contain all the needed pieces of information, and hooks into the server and client side improvements of the previous patches, in order to switch over to full server-side filtering of network events. Also, since we fixed this in time, all released versions of libvirtd that support network events also support per-network filtering, so we can hard-code that assumption into network_event.c. Converting domain events to server-side filtering will require the introduction of new RPC numbers, as well as a server feature bit that the client can use to tell whether to use old-style (server only supports global events) or new-style (server supports filtered events), so that is deferred to a later set of patches. * src/conf/network_event.c (virNetworkEventStateRegisterClient): Assume server-side filtering. * src/remote/remote_protocol.x (remote_connect_network_event_register_any_args): Add network argument. (remote_connect_network_event_register_any_ret): Return callbackID instead of count. (remote_connect_network_event_deregister_any_args): Pass callbackID instead of eventID. (remote_connect_network_event_deregister_any_ret): Drop unused type. (remote_network_event_lifecycle_msg): Add callbackID. * daemon/remote.c (remoteDispatchConnectNetworkEventDeregisterAny): Drop unused arg, and deal with callbackID from client. (remoteRelayNetworkEventLifecycle): Pass callbackID. (remoteDispatchConnectNetworkEventRegisterAny): Likewise, and recognize non-NULL network. * src/remote/remote_driver.c (remoteConnectNetworkEventRegisterAny): Pass network, and track server side id. (remoteConnectNetworkEventDeregisterAny): Deregister by callback id. (remoteNetworkBuildEventLifecycle): Pass remote id to event queue. * src/remote_protocol-structs: Regenerate. Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Eric Blake 提交于
Right now, the daemon side of RPC events is hard-coded to at most one callback per eventID. But when there are hundreds of domains or networks coupled and multiple conections, then sending every event to every connection that wants an event, even for the connections that only care about events for a particular object, is inefficient. In order to track more than one callback in the server, we need to store callbacks by more than just their eventID. This patch rearranges the daemon side to store network callbacks in a dynamic array, which can eventually be used for multiple callbacks of the same eventID, although actual behavior is unchanged without further patches to the RPC protocol. For ease of review, domain events are saved for a later patch, as they touch more code. While at it, fix a bug where a malicious client could send a negative eventID to cause network event registration to access outside of array bounds (thankfully not a CVE, since domain events were already doing the bounds check, and since network events have not been released). * daemon/libvirtd.h (daemonClientPrivate): Alter the tracking of network events. * daemon/remote.c (daemonClientEventCallback): New struct. (remoteEventCallbackFree): New function. (remoteClientInitHook, remoteRelayNetworkEventLifecycle) (remoteClientFreeFunc) (remoteDispatchConnectNetworkEventRegisterAny): Track network callbacks differently. (remoteDispatchConnectNetworkEventDeregisterAny): Enforce bounds. Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 09 1月, 2014 1 次提交
-
-
由 Guido Günther 提交于
We point to the manpages where available and redirect to libvirt's homepage as a last resort.
-
- 11 12月, 2013 1 次提交
-
-
由 Cédric Bosdonnat 提交于
-
- 10 12月, 2013 2 次提交
-
-
由 Cédric Bosdonnat 提交于
into remoteDispatchObjectEventSend as it will later be used for both the domain and network events.
-
由 Michael Chapman 提交于
- Use SIGUSR1, not SIGHUP, on reload. At present, virtlockd only responds to the former. - Fix PID file for virtlockd. - Do not start virtlockd in any runlevels by default. It needs to be explicitly selected in libvirt's qemu.conf anyway, so there is no need to have it running on all systems regardless. - Fix chkconfig priorities to ensure virtlockd is started before libvirtd is started, and stopped after libvirtd is stopped. - Add "Should-Start: virtlockd" to the libvirtd initscript's LSB header, for the same reason. - Add "Default-Stop" to both libvirtd and virtlockd initscripts. LSB does not guarantee that this defaults to the inverse of "Default-Start". Signed-off-by: NMichael Chapman <mike@very.puzzling.org> Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
-
- 03 12月, 2013 1 次提交
-
-
由 Michal Privoznik 提交于
https://bugzilla.redhat.com/show_bug.cgi?id=1033061 Currently, initialization of drivers is done in a separate thread. This is done for several reasons: a driver that is initialized may require running event loop, it may take ages to initialize driver (e.g. due to autostarting domains). While the thread is spawn and run, the main() continues its execution. However, if something goes bad, or the event loop is just exited (e.g. due to a --timeout or SIGINT) we try to cleanup all the drivers. So we have two threads running Initialize() and Cleanup() concurrently. This may result in accessing stale pointers - e.g. netcf driver will free() itself in stateCleanup callback, while the init thread may come, open a dummy connection in order to autostart some domains and voilà: do_open() iterates over interface drivers and accesses stale netcf driver. The fix consists in not running stateCleanup if the init thread is still running. Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
-
- 21 10月, 2013 2 次提交
-
-
由 Daniel P. Berrange 提交于
Unconditional use of getenv is not secure in setuid env. While not all libvirt code runs in a setuid env (since much of it only exists inside libvirtd) this is not always clear to developers. So make all the code paranoid, even if it only ever runs inside libvirtd. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The libvirt.so library has far too many library deps to allow linking against it from setuid programs. Those libraries can do stuff in __attribute__((constructor) functions which is not setuid safe. The virt-login-shell needs to link directly against individual files that it uses, with all library deps turned off except for libxml2 and libselinux. Create a libvirt-setuid-rpc-client.la library which is linked to by virt-login-shell. A config-post.h file allows this library to disable all external deps except libselinux and libxml2. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 18 10月, 2013 1 次提交
-
-
由 Chen Hanxiao 提交于
If we fail to get domain, we had to judge whether it's null or not when doing 'cleanup'. Signed-off-by: NChen Hanxiao <chenhanxiao@cn.fujitsu.com>
-
- 01 10月, 2013 1 次提交
-
-
由 Daniel P. Berrange 提交于
The libvirtd server pushes data out to clients. It does not know what protocol version the client might have, so must be conservative and use the old payload limits. ie send no more than 256kb of data per packet. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 27 9月, 2013 2 次提交
-
-
由 Daniel P. Berrange 提交于
When a client disconnects from libvirtd, all event callbacks must be removed. This involves running the public API virConnectDomainEventDeregisterAny This code does not run in normal API dispatch context, so no identity was set. The result was that the access control drivers denied the attempt to deregister callbacks. The callbacks thus continued to trigger after the client was free'd causing fairly predictable use of free memory & a crash. This can be triggered by any client with readonly access when the ACL drivers are active. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Eric Blake 提交于
Caused by commit 012c25e8 splitting out a convenience library. CC libvirtd_conf_la-libvirtd-config.lo In file included from ../src/rpc/virnetmessage.h:24:0, from ../src/rpc/virnetserverprogram.h:27, from ../src/rpc/virnetserver.h:32, from libvirtd-config.c:31: ../src/rpc/virnetprotocol.h:9:21: fatal error: rpc/rpc.h: No such file or directory * daemon/Makefile.am (libvirtd_conf_la_CFLAGS): Add XDR_CFLAGS. Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 24 9月, 2013 1 次提交
-
-
由 Giuseppe Scrivano 提交于
Signed-off-by: NGiuseppe Scrivano <gscrivan@redhat.com> Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 20 9月, 2013 1 次提交
-
-
由 Jiri Denemark 提交于
-
- 19 9月, 2013 2 次提交
-
-
由 Christophe Fergeau 提交于
A previous patch used existing #define for the various files in /etc/pki instead of hardcoding them in the help output. However I missed that remote_driver.h contains #define for more paths that are present in the daemon help output. This commit uses the existing constants for the path to the configuration file and to the libvirt sockets.
-
由 Daniel P. Berrange 提交于
The 'stats' variable was not initialized to NULL, so if some early validation of the RPC call fails, it is possible to jump to the 'cleanup' label and VIR_FREE an uninitialized pointer. This is a security flaw, since the API can be called from a readonly connection which can trigger the validation checks. This was introduced in release v0.9.1 onwards by commit 158ba873 Author: Daniel P. Berrange <berrange@redhat.com> Date: Wed Apr 13 16:21:35 2011 +0100 Merge all returns paths from dispatcher into single path Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 18 9月, 2013 3 次提交
-
-
由 Daniel P. Berrange 提交于
With the existing pkcheck (pid, start time) tuple for identifying the process, there is a race condition, where a process can make a libvirt RPC call and in another thread exec a setuid application, causing it to change to effective UID 0. This in turn causes polkit to do its permission check based on the wrong UID. To address this, libvirt must get the UID the caller had at time of connect() (from SO_PEERCRED) and pass a (pid, start time, uid) triple to the pkcheck program. This fix requires that libvirt is re-built against a version of polkit that has the fix for its CVE-2013-4288, so that libvirt can see 'pkg-config --variable pkcheck_supports_uid polkit-gobject-1' Signed-off-by: NColin Walters <walters@redhat.com> Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Christophe Fergeau 提交于
There are constants for these paths in remote_driver.h so we can use these rather than duplicating them in the help output. Signed-off-by: NChristophe Fergeau <cfergeau@redhat.com> Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Christophe Fergeau 提交于
The help message indicates that the CA certificate is $sysconfdir/pki/CA/caert.pem while the actual path is $sysconfdir/pki/CA/cacert.pem Signed-off-by: NChristophe Fergeau <cfergeau@redhat.com> Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 10 9月, 2013 2 次提交
-
-
由 Eric Blake 提交于
If we use subdir-objects with automake, any reference to a cross-directory .c file will result in automake creating rules that track dependency in the cross directory. But this presents a problem during 'make distclean' - if the cross directory is cleaned up first, then the daemon directory will be left with dangling references to .Po dependency files that no longer exist. Meanwhile, referring to the cross-directory .c file means that we are compiling the file twice - once in src, and once in daemon. Better is to compile just once in src into a convenience library, and then use that library from daemon. The tests directory had a similar situation of a cross-directory .c file; to solve that, we actually need a convenience library. * daemon/Makefile.am (DAEMON_SOURCES): Drop .c files... (libvirtd_LDADD): ...and instead use library. (libvirtd_conf_la_SOURCES): Declare a new convenience library. (libvirtd_LDFLAGS): Drop duplicate flag. * tests/Makefile.am (libvirtdconftest_SOURCES): Drop .c file... (libvirtdconftest_LDADD): ..and instead use library. Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Eric Blake 提交于
Trying to enable automake's subdir-objects option resulted in the creation of literal directories such as src/$(srcdir)/remote/. I traced this to the fact that we had used a literal $(srcdir) in a location that later fed an automake *_SOURCES variable. This has also been reported as an automake bug: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=13928 but it's better to fix our code than to wait for an automake fix. Some things to remember that affect VPATH builds, and where an in-tree build is blissfully unaware of the issues: if a VPATH build fails to find a file that was used as a prereq of any other target, then the rule for that file will expand $@ to prefer the current build dir (bad because a VPATH build on a fresh checkout will then stick $@ in the current directory instead of the desired srcdir); conversely, if a VPATH build finds the file in srcdir but decides it needs to be rebuilt, then the rule for that file will expand $@ to include the directory where it was found out-of-date (bad for an explicit listing of $(srcdir)/$@ because an incremental VPATH build will then expand srcdir twice). As we want these files to go into srcdir unconditionally, we have to massage or avoid $@ for any recipe that involves one of these files. Therefore, this patch removes all uses of $(srcdir) from any generated file name that later feeds a *_SOURCES variable, and then rewrites all the recipes to generate those files to hard-code their creation into srcdir without the use of $@. * src/Makefile.am (REMOTE_DRIVER_GENERATED): Drop $(srcdir); VPATH builds know how to find the files, and automake subdir-objects fails with it in place. (LXC_MONITOR_PROTOCOL_GENERATED, (LXC_MONITOR_GENERATED) (ACCESS_DRIVER_GENERATED, LOCK_PROTOCOL_GENERATED): Likewise. (*_client_bodies.h): Hard-code rules to write into srcdir, as VPATH tries to build $@ locally if missing. (util/virkeymaps.h): Likewise. (lxc/lxc_monitor_dispatch.h): Likewise. (access/viraccessapi*): Likewise. (locking/lock_daemon_dispatch_stubs.h): Likewise. * daemon/Makeflie.am (DAEMON_GENERATED, remote_dispatch.h): Likewise. Signed-off-by: NEric Blake <eblake@redhat.com> fixup DAEMON_GENERATED
-
- 04 9月, 2013 2 次提交
-
-
由 Eric Blake 提交于
Automake has builtin support to prevent botched conditional nesting, but only if you use: if FOO else !FOO endif !FOO An example error message when using the wrong name: daemon/Makefile.am:378: error: else reminder (LIBVIRT_INIT_SCRIPT_SYSTEMD_TRUE) incompatible with current conditional: LIBVIRT_INIT_SCRIPT_SYSTEMD_FALSE daemon/Makefile.am:381: error: endif reminder (LIBVIRT_INIT_SCRIPT_SYSTEMD_TRUE) incompatible with current conditional: LIBVIRT_INIT_SCRIPT_SYSTEMD_FALSE As our makefiles tend to have quite a bit of nested conditionals, it's better to take advantage of the benefits of the build system double-checking that our conditionals are well-nested, but that requires a syntax check to enforce our usage style. Alas, unlike C preprocessor and spec files, we can't use indentation to make it easier to see how deeply nesting goes. * cfg.mk (sc_makefile_conditionals): New rule. * daemon/Makefile.am: Enforce the style. * gnulib/tests/Makefile.am: Likewise. * python/Makefile.am: Likewise. * src/Makefile.am: Likewise. * tests/Makefile.am: Likewise. * tools/Makefile.am: Likewise. Signed-off-by: NEric Blake <eblake@redhat.com>
-
由 Nehal J Wani 提交于
Fixes for argument layouts of various functions in daemon/remote.c
-
- 29 8月, 2013 11 次提交
-
-
由 Daniel P. Berrange 提交于
The return values for the virConnectListAllSecrets call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virConnectListAllNWFilters call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virConnectListAllNodeDevices call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virConnectListAllInterfaces call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virConnectListAllNetworks call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virStoragePoolListAllVolumes call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virConnectListAllStoragePools call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virConnectListAllDomains call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virDomain{SnapshotListAllChildren,ListAllSnapshots} calls were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The return values for the virDomainGetJobStats call were not bounds checked. This is a robustness issue for clients if something where to cause corruption of the RPC stream data. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
由 Daniel P. Berrange 提交于
The parameters for the virDomainMigrate*Params RPC calls were not bounds checks, meaning a malicious client can cause libvirtd to consume arbitrary memory This issue was introduced in the 1.1.0 release of libvirt Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 22 8月, 2013 2 次提交
-
-
由 Guido Günther 提交于
and use it when available
-
由 Guido Günther 提交于
by adding it to AM_LDFLAGS instead of every linking rule and by avoiding a forked grep.
-