- 27 3月, 2017 1 次提交
-
-
由 Erik Skultety 提交于
A mediated device will be identified by a UUID (with 'model' now being a mandatory <hostdev> attribute to represent the mediated device API) of the user pre-created mediated device. We also need to make sure that if user explicitly provides a guest address for a mdev device, the address type will be matching the device API supported on that specific mediated device and error out with an incorrect XML message. The resulting device XML: <devices> <hostdev mode='subsystem' type='mdev' model='vfio-pci'> <source> <address uuid='c2177883-f1bb-47f0-914d-32a22e3a8804'> </source> </hostdev> </devices> Signed-off-by: NErik Skultety <eskultet@redhat.com>
-
- 15 2月, 2017 2 次提交
-
-
由 Jim Fehlig 提交于
If the apparmor security driver is loaded/enabled and domain config contains a <seclabel> element whose type attribute is not 'apparmor', starting the domain fails when attempting to label resources such as tap FDs. Many of the apparmor driver entry points attempt to retrieve the apparmor security label from the domain def, returning failure if not found. Functions such as AppArmorSetFDLabel fail even though domain config contains an explicit 'none' secuirty driver, e.g. <seclabel type='none' model='none'/> Change the entry points to succeed if the domain config <seclabel> is not apparmor. This matches the behavior of the selinux driver.
-
由 Jim Fehlig 提交于
Like other callers of reload_profile, don't overwrite errors in AppArmorSetSecurityHostdevLabelHelper.
-
- 25 11月, 2016 2 次提交
-
-
由 Eric Farman 提交于
Ensure that the vhost-scsi wwpn information is passed to the different security policies. Signed-off-by: NEric Farman <farman@linux.vnet.ibm.com>
-
由 Eric Farman 提交于
We already have a "scsi" hostdev subsys type, which refers to a single LUN that is passed through to a guest. But what of things where multiple LUNs are passed through via a single SCSI HBA, such as with the vhost-scsi target? Create a new hostdev subsys type that will carry this. Signed-off-by: NEric Farman <farman@linux.vnet.ibm.com>
-
- 12 11月, 2016 1 次提交
-
-
由 Eric Farman 提交于
As was suggested in an earlier review comment[1], we can catch some additional code points by cleaning up how we use the hostdev subsystem type in some switch statements. [1] End of https://www.redhat.com/archives/libvir-list/2016-September/msg00399.htmlSigned-off-by: NEric Farman <farman@linux.vnet.ibm.com> Signed-off-by: NJohn Ferlan <jferlan@redhat.com>
-
- 04 2月, 2016 1 次提交
-
-
由 Peter Krempa 提交于
Few build breaking mistakes in less-popular parts of our code.
-
- 06 10月, 2015 1 次提交
-
-
由 Cédric Bosdonnat 提交于
profile_status function was not making any difference between error cases and unconfined profiles. The problem with this approach is that dominfo was throwing an error on unconfined domains.
-
- 10 7月, 2015 1 次提交
-
-
由 Cédric Bosdonnat 提交于
Initializing libvirt log in virt-aa-helper and getting it to output libvirt log to stderr. This will help debugging problems happening in libvirt functions called from within virt-aa-helper
-
- 14 1月, 2015 1 次提交
-
-
由 Daniel P. Berrange 提交于
The virDomainDefParse* and virDomainDefFormat* methods both accept the VIR_DOMAIN_XML_* flags defined in the public API, along with a set of other VIR_DOMAIN_XML_INTERNAL_* flags defined in domain_conf.c. This is seriously confusing & error prone for a number of reasons: - VIR_DOMAIN_XML_SECURE, VIR_DOMAIN_XML_MIGRATABLE and VIR_DOMAIN_XML_UPDATE_CPU are only relevant for the formatting operation - Some of the VIR_DOMAIN_XML_INTERNAL_* flags only apply to parse or to format, but not both. This patch cleanly separates out the flags. There are two distint VIR_DOMAIN_DEF_PARSE_* and VIR_DOMAIN_DEF_FORMAT_* flags that are used by the corresponding methods. The VIR_DOMAIN_XML_* flags received via public API calls must be converted to the VIR_DOMAIN_DEF_FORMAT_* flags where needed. The various calls to virDomainDefParse which hardcoded the use of the VIR_DOMAIN_XML_INACTIVE flag change to use the VIR_DOMAIN_DEF_PARSE_INACTIVE flag.
-
- 25 9月, 2014 1 次提交
-
-
由 Cole Robinson 提交于
The check for ISCSI devices was missing a check of subsys type, which meant we could skip labelling of other host devices as well. This fixes USB hotplug on F21 https://bugzilla.redhat.com/show_bug.cgi?id=1145968
-
- 24 7月, 2014 5 次提交
-
-
由 John Ferlan 提交于
Create the structures and API's to hold and manage the iSCSI host device. This extends the 'scsi_host' definitions added in commit id '5c811dce'. A future patch will add the XML parsing, but that code requires some infrastructure to be in place first in order to handle the differences between a 'scsi_host' and an 'iSCSI host' device.
-
由 John Ferlan 提交于
Split virDomainHostdevSubsysSCSI further. In preparation for having either SCSI or iSCSI data, create a union in virDomainHostdevSubsysSCSI to contain just a virDomainHostdevSubsysSCSIHost to describe the 'scsi_host' host device
-
由 John Ferlan 提交于
Create a separate typedef for the hostdev union data describing SCSI Then adjust the code to use the new pointer
-
由 John Ferlan 提交于
Create a separate typedef for the hostdev union data describing PCI. Then adjust the code to use the new pointer
-
由 John Ferlan 提交于
Create a separate typedef for the hostdev union data describing USB. Then adjust the code to use the new pointer
-
- 16 7月, 2014 1 次提交
-
-
由 Cédric Bosdonnat 提交于
Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default. This profile allows quite a lot, but strives to restrict access to dangerous resources. Removing the explicit authorizations to bash, systemd and cron files, forces them to keep the lxc profile for all applications inside the container. PUx permissions where leading to running systemd (and others tasks) unconfined. Put the generic files, network and capabilities restrictions directly in the TEMPLATE.lxc: this way, users can restrict them on a per container basis.
-
- 11 7月, 2014 1 次提交
-
-
由 Michal Privoznik 提交于
This negation in names of boolean variables is driving me insane. The code is much more readable if we drop the 'no-' prefix. Well, at least for me. Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
-
- 09 7月, 2014 2 次提交
-
-
由 Peter Krempa 提交于
Refactor the code and reuse it to implement the functionality.
-
由 Peter Krempa 提交于
Refactor the existing code to allow re-using it for the per-image label restore too.
-
- 26 6月, 2014 1 次提交
-
-
由 Peter Krempa 提交于
I'm going to add functions that will deal with individual image files rather than whole disks. Rename the security function to make room for the new one.
-
- 20 6月, 2014 2 次提交
-
-
由 Peter Krempa 提交于
I'm going to add functions that will deal with individual image files rather than whole disks. Rename the security function to make room for the new one.
-
由 Peter Krempa 提交于
Also remove one spurious ATTRIBUTE_UNUSED guarding the @migrated argument.
-
- 02 4月, 2014 1 次提交
-
-
由 Eric Blake 提交于
A continuation of the migration of disk details to virstoragefile. This patch moves a single enum, but converting the name has quite a bit of fallout. * src/conf/domain_conf.h (virDomainDiskType): Move... * src/util/virstoragefile.h (virStorageType): ...and rename. * src/bhyve/bhyve_command.c (bhyveBuildDiskArgStr) (virBhyveProcessBuildLoadCmd): Update clients. * src/conf/domain_conf.c (virDomainDiskSourceDefParse) (virDomainDiskDefParseXML, virDomainDiskSourceDefFormatInternal) (virDomainDiskDefFormat, virDomainDiskGetActualType) (virDomainDiskDefForeachPath, virDomainDiskSourceIsBlockType): Likewise. * src/conf/snapshot_conf.h (_virDomainSnapshotDiskDef): Likewise. * src/conf/snapshot_conf.c (virDomainSnapshotDiskDefParseXML) (virDomainSnapshotAlignDisks, virDomainSnapshotDiskDefFormat): Likewise. * src/esx/esx_driver.c (esxAutodetectSCSIControllerModel) (esxDomainDefineXML): Likewise. * src/locking/domain_lock.c (virDomainLockManagerAddDisk): Likewise. * src/lxc/lxc_controller.c (virLXCControllerSetupLoopDeviceDisk) (virLXCControllerSetupNBDDeviceDisk) (virLXCControllerSetupLoopDevices, virLXCControllerSetupDisk): Likewise. * src/parallels/parallels_driver.c (parallelsGetHddInfo): Likewise. * src/phyp/phyp_driver.c (phypDiskType): Likewise. * src/qemu/qemu_command.c (qemuGetDriveSourceString) (qemuDomainDiskGetSourceString, qemuBuildDriveStr) (qemuBuildCommandLine, qemuParseCommandLineDisk) (qemuParseCommandLine): Likewise. * src/qemu/qemu_conf.c (qemuCheckSharedDevice) (qemuTranslateDiskSourcePool) (qemuTranslateSnapshotDiskSourcePool): Likewise. * src/qemu/qemu_domain.c (qemuDomainDeviceDefPostParse) (qemuDomainDetermineDiskChain): Likewise. * src/qemu/qemu_driver.c (qemuDomainGetBlockInfo) (qemuDomainSnapshotPrepareDiskExternalBackingInactive) (qemuDomainSnapshotPrepareDiskExternalBackingActive) (qemuDomainSnapshotPrepareDiskExternalOverlayActive) (qemuDomainSnapshotPrepareDiskExternalOverlayInactive) (qemuDomainSnapshotPrepareDiskInternal) (qemuDomainSnapshotPrepare) (qemuDomainSnapshotCreateSingleDiskActive): Likewise. * src/qemu/qemu_hotplug.c (qemuDomainChangeEjectableMedia): Likewise. * src/qemu/qemu_migration.c (qemuMigrationIsSafe): Likewise. * src/security/security_apparmor.c (AppArmorRestoreSecurityImageLabel) (AppArmorSetSecurityImageLabel): Likewise. * src/security/security_dac.c (virSecurityDACSetSecurityImageLabel) (virSecurityDACRestoreSecurityImageLabelInt) (virSecurityDACSetSecurityAllLabel): Likewise. * src/security/security_selinux.c (virSecuritySELinuxRestoreSecurityImageLabelInt) (virSecuritySELinuxSetSecurityImageLabel) (virSecuritySELinuxSetSecurityAllLabel): Likewise. * src/storage/storage_backend.c (virStorageFileBackendForType): Likewise. * src/storage/storage_backend_fs.c (virStorageFileBackendFile) (virStorageFileBackendBlock): Likewise. * src/storage/storage_backend_gluster.c (virStorageFileBackendGluster): Likewise. * src/vbox/vbox_tmpl.c (vboxDomainGetXMLDesc, vboxAttachDrives) (vboxDomainAttachDeviceImpl, vboxDomainDetachDevice): Likewise. * src/vmware/vmware_conf.c (vmwareVmxPath): Likewise. * src/vmx/vmx.c (virVMXParseDisk, virVMXFormatDisk) (virVMXFormatFloppy): Likewise. * src/xenxs/xen_sxpr.c (xenParseSxprDisks, xenParseSxpr) (xenFormatSxprDisk): Likewise. * src/xenxs/xen_xm.c (xenParseXM, xenFormatXMDisk): Likewise. * tests/securityselinuxlabeltest.c (testSELinuxLoadDef): Likewise. * src/libvirt_private.syms (domain_conf.h): Move symbols... (virstoragefile.h): ...as appropriate. Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 25 3月, 2014 2 次提交
-
-
由 Ján Tomko 提交于
-
由 Peter Krempa 提交于
Commit 4f202266 breaks build with AppArmor enabled as it missed the refactor to the new accessors.
-
- 18 3月, 2014 1 次提交
-
-
由 Daniel P. Berrange 提交于
Any source file which calls the logging APIs now needs to have a VIR_LOG_INIT("source.name") declaration at the start of the file. This provides a static variable of the virLogSource type. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 04 3月, 2014 3 次提交
-
-
由 Cédric Bosdonnat 提交于
-
由 Cédric Bosdonnat 提交于
The reason for these is that aa-status doesn't show the process using the profile as they are in another namespace.
-
由 Cédric Bosdonnat 提交于
use_apparmor() was first designed to be called from withing libvirtd, but libvirt_lxc also uses it. in libvirt_lxc, there is no need to check whether to use apparmor or not: just use it if possible.
-
- 30 1月, 2014 1 次提交
-
-
由 Osier Yang 提交于
To support passing the path of the test data to the utils, one more argument is added to virSCSIDeviceGetSgName, virSCSIDeviceGetDevName, and virSCSIDeviceNew, and the related code is changed accordingly. Later tests for the scsi utils will be based on this patch. Signed-off-by: NOsier Yang <jyang@redhat.com>
-
- 23 1月, 2014 1 次提交
-
-
由 Osier Yang 提交于
Unlike the host devices of other types, SCSI host device XML supports "shareable" tag. This patch introduces it for the virSCSIDevice struct for a later patch use (to detect if the SCSI device is shareable when preparing the SCSI host device in QEMU driver).
-
- 30 10月, 2013 1 次提交
-
-
由 Peter Krempa 提交于
Commit 64a68a4a introduced a typo in the initialization of the apparmor driver structure breaking the build with apparmor enabled.
-
- 29 10月, 2013 1 次提交
-
-
由 Giuseppe Scrivano 提交于
virSecurityManagerGetBaseLabel queries the default settings used by a security model. Signed-off-by: NGiuseppe Scrivano <gscrivan@redhat.com>
-
- 15 10月, 2013 1 次提交
-
-
由 Eric Blake 提交于
'const fooPtr' is the same as 'foo * const' (the pointer won't change, but it's contents can). But in general, if an interface is trying to be const-correct, it should be using 'const foo *' (the pointer is to data that can't be changed). Fix up offenders in src/security. * src/security/security_apparmor.c (reload_profile) (AppArmorSetSecurityHostdevLabelHelper) (AppArmorReleaseSecurityLabel, AppArmorRestoreSecurityAllLabel) (AppArmorSetSecurityProcessLabel) (AppArmorSetSecurityChildProcessLabel) (AppArmorSetSecurityImageLabel, AppArmorSecurityVerify) (AppArmorSetSecurityHostdevLabel) (AppArmorRestoreSecurityHostdevLabel, AppArmorSetFDLabel): Drop needless const. * src/security/security_selinux.c (virSecuritySELinuxSetSecurityFileLabel): Likewise. Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 04 9月, 2013 1 次提交
-
-
由 Michal Privoznik 提交于
The @profile_name variable can be used uninitialized.
-
- 10 7月, 2013 1 次提交
-
-
由 Michal Privoznik 提交于
-
- 26 6月, 2013 1 次提交
-
-
由 Laine Stump 提交于
I realized after the fact that it's probably better in the long run to give this function a name that matches the name of the link used in sysfs to hold the group (iommu_group). I'm changing it now because I'm about to add several more functions that deal with iommu groups.
-
- 23 5月, 2013 1 次提交
-
-
由 Michal Privoznik 提交于
-
- 13 5月, 2013 1 次提交
-
-
由 Michal Privoznik 提交于
After introducing AppArmorSetSecuritySCSILabel() in 2691cd5f we are using virSCSIDevicePtr type without proper include.
-