2020-07-20 16:18:57 +02:00
|
|
|
/*
|
|
|
|
* qemu_namespace.h: QEMU domain namespace helpers
|
|
|
|
*
|
|
|
|
* Copyright (C) 2006-2020 Red Hat, Inc.
|
|
|
|
* Copyright (C) 2006 Daniel P. Berrange
|
|
|
|
*
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
|
|
* License along with this library. If not, see
|
|
|
|
* <http://www.gnu.org/licenses/>.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#pragma once
|
|
|
|
|
|
|
|
#include "virenum.h"
|
|
|
|
#include "qemu_conf.h"
|
|
|
|
#include "virconf.h"
|
|
|
|
|
|
|
|
typedef enum {
|
|
|
|
QEMU_DOMAIN_NS_MOUNT = 0,
|
|
|
|
QEMU_DOMAIN_NS_LAST
|
|
|
|
} qemuDomainNamespace;
|
|
|
|
VIR_ENUM_DECL(qemuDomainNamespace);
|
|
|
|
|
|
|
|
int qemuDomainEnableNamespace(virDomainObjPtr vm,
|
|
|
|
qemuDomainNamespace ns);
|
|
|
|
|
|
|
|
bool qemuDomainNamespaceEnabled(virDomainObjPtr vm,
|
|
|
|
qemuDomainNamespace ns);
|
|
|
|
|
qemu_domain_namespace: Repurpose qemuDomainBuildNamespace()
Okay, here is the deal. Currently, the way we build namespace is
very fragile. It is done from pre-exec hook when starting a
domain, after we mass closed all FDs and before we drop
privileges and exec() QEMU. This fact poses some limitations onto
the namespace build code, e.g. it has to make sure not to keep
any FD opened (not even through a library call), because it would
be leaked to QEMU. Also, it has to call only async signal safe
functions. These requirements are hard to meet - in fact as of my
commit v6.2.0-rc1~235 we are leaking a FD into QEMU by calling
libdevmapper functions.
To solve this issue and avoid similar problems in the future, we
should change our paradigm. We already have functions which can
populate domain's namespace with nodes from the daemon context.
If we use them to populate the namespace and keep only the bare
minimum in the pre-exec hook, we've mitigated the risk.
Therefore, the old qemuDomainBuildNamespace() is renamed to
qemuDomainUnshareNamespace() and new qemuDomainBuildNamespace()
function is introduced. So far, the new function is basically a
NOP and domain's namespace is still populated from the pre-exec
hook - next patches will fix it.
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-21 18:12:26 +02:00
|
|
|
int qemuDomainUnshareNamespace(virQEMUDriverConfigPtr cfg,
|
|
|
|
virSecurityManagerPtr mgr,
|
|
|
|
virDomainObjPtr vm);
|
|
|
|
|
2020-07-21 17:13:11 +02:00
|
|
|
int qemuDomainBuildNamespace(virQEMUDriverConfigPtr cfg,
|
|
|
|
virDomainObjPtr vm);
|
2020-07-20 16:18:57 +02:00
|
|
|
|
|
|
|
void qemuDomainDestroyNamespace(virQEMUDriverPtr driver,
|
|
|
|
virDomainObjPtr vm);
|
|
|
|
|
|
|
|
bool qemuDomainNamespaceAvailable(qemuDomainNamespace ns);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceSetupDisk(virDomainObjPtr vm,
|
|
|
|
virStorageSourcePtr src);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceTeardownDisk(virDomainObjPtr vm,
|
|
|
|
virStorageSourcePtr src);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceSetupHostdev(virDomainObjPtr vm,
|
|
|
|
virDomainHostdevDefPtr hostdev);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceTeardownHostdev(virDomainObjPtr vm,
|
|
|
|
virDomainHostdevDefPtr hostdev);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceSetupMemory(virDomainObjPtr vm,
|
|
|
|
virDomainMemoryDefPtr memory);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceTeardownMemory(virDomainObjPtr vm,
|
|
|
|
virDomainMemoryDefPtr memory);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceSetupChardev(virDomainObjPtr vm,
|
|
|
|
virDomainChrDefPtr chr);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceTeardownChardev(virDomainObjPtr vm,
|
|
|
|
virDomainChrDefPtr chr);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceSetupRNG(virDomainObjPtr vm,
|
|
|
|
virDomainRNGDefPtr rng);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceTeardownRNG(virDomainObjPtr vm,
|
|
|
|
virDomainRNGDefPtr rng);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceSetupInput(virDomainObjPtr vm,
|
|
|
|
virDomainInputDefPtr input);
|
|
|
|
|
|
|
|
int qemuDomainNamespaceTeardownInput(virDomainObjPtr vm,
|
|
|
|
virDomainInputDefPtr input);
|