提交 · 76d31244c5ca52d05f2fefaf7be55caf2169c470 · openeuler / libvirt

01 10月, 2019 5 次提交

rpc: fix escaping of shell path for netcat binary · 76d31244

由 Daniel P. Berrangé 提交于 9月 19, 2019

Consider having a nc binary in the path with a space in its name,
for example '/tmp/fo o/nc'

This results in libvirt running SSH with the following arg value

"'if ''/tmp/fo o/nc'' -q 2>&1 | grep \"requires
an argument\" >/dev/null 2>&1; then ARG=-q0;
else ARG=;fi;''/tmp/fo o/nc'' $ARG -U
/var/run/libvirt/libvirt-sock'"

The use of the single quote escaping was introduced by

commit 6ac6238d
Author: Guido Günther <agx@sigxcpu.org>
Date: Thu Oct 13 21:49:01 2011 +0200

Use virBufferEscapeShell in virNetSocketNewConnectSSH

to escape the netcat command since it's passed to the shell. Adjust
expected test case output accordingly.

While the intention of this change was good, the result is broken as it
is still underquoted.

On the SSH server side, SSH itself runs the command via the shell.
Our command is then invoking the shell again. Thus we see

$ virsh -c qemu+ssh://root@domokun/system?netcat=%2Ftmp%2Ffo%20o%2Fnc list
error: failed to connect to the hypervisor
error: End of file while reading data: sh: /tmp/fo: No such file or directory: Input/output error

With the second level of escaping added we can now successfully use a nc
binary with a space in the path.

The original test case added was misleading as it illustrated using a
binary path of 'nc -4' which is not a path, it is a command with a
separate argument, which is getting interpreted as a path.
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

76d31244

admin: fix memory leak of typed parameters getting client info · c76dc0ea

由 Daniel P. Berrangé 提交于 9月 30, 2019

In the error code path, the temporary parameters are not freed.
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

c76dc0ea

qemu_capabilities: Put only unique FW images into domcaps · 2f163204

由 Michal Privoznik 提交于 9月 12, 2019

In the domain capabilities XML there are FW image paths printed.
There are two sources for the image paths (in order of
preference):

  1) firmware descriptor files - as returned by
  qemuFirmwareGetSupported()

  2) a compile time list of FW:NRAM pairs which can be overridden
  in qemu.conf

If either of those contains a duplicate FW image path (which is
a valid use case) it is printed twice in the capabilities XML.
While it's technically not a bug, it doesn't look good.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Tested-by: NKashyap Chamarthy <kchamart@redhat.com>
Reviewed-by: NAndrea Bolognani <abologna@redhat.com>

2f163204

qemu: checkpoint: Don't update current checkpoint until we are done · 808fa349

由 Peter Krempa 提交于 9月 30, 2019

Similarly to the snapshot code there's no reason to modify current
checkpoint until we are done creating the new one.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>

808fa349

qemu: snapshot: Don't update current snapshot until we're done · 391728be

由 Peter Krempa 提交于 9月 30, 2019

Since commit f1056279 we store whether a snapshot is current globally
rather than locally in the snapshot object.

This means that we don't have to unset the current snapshot prior to
taking/reverting the snapshot and we can do it only when everything is
done successfully.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>

391728be

30 9月, 2019 28 次提交

clarify the xml example for NVDIMM more clealy · cd62dbc0

由 Luyao Zhong 提交于 9月 23, 2019

The NVDIMM backend file can be a normal file or a real device file,
Current xml example and explainations may mislead users. So add more
info about the NVDIMM related elements and update the xml examples.
Signed-off-by: NLuyao Zhong <luyao.zhong@intel.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>

cd62dbc0

security: AppArmor profile fixes for swtpm · d660dd95

由 Chris Coulson 提交于 9月 24, 2019

The AppArmor profile generated by virt-aa-helper is too strict for swtpm.
This change contains 2 small fixes:
- Relax append access to swtpm's log file to permit write access instead.
Append access is insufficient because the log is opened with O_CREAT.
- Permit swtpm to acquire a lock on its lock file.
Signed-off-by: NChris Coulson <chris.coulson@canonical.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>

d660dd95

qemu: sanity check vhost user FD before passing to QEMU · 6ffb8fff

由 Daniel P. Berrangé 提交于 9月 30, 2019

Ensure that the FD we're passing to QEMU is actually open, so we get a
sane error message upfront instead of telling QEMU to use a closed FD.
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

6ffb8fff

qemu: ensure vhostuser FD is initialized to -1 · 227925a2

由 Daniel P. Berrangé 提交于 9月 27, 2019

The video private data was not initializing the vhostuser FD
causing us to attempt to close FD 0 many times over.

Fixes

  commit ca60ecfa
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   Mon Sep 23 14:44:36 2019 +0400

      qemu: add qemuDomainVideoPrivate

Since the test suite does not invoke qemuExtDevicesStart(), no
vhost_user_fd will be present when generating test XML. To deal
with this we can must a fake FD number. While the current XML
is using FD == 0, we pick a very interesting number that's unlikely
to be a real FD, so that we're more likely to see any mistakes
closing the invalid FD.
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

227925a2

qemu: monitor: unexport qemuMonitorJSONTransactionAdd · 7a46bd52