2020-07-20 14:18:57 +00:00
|
|
|
/*
|
|
|
|
|
* qemu_namespace.h: QEMU domain namespace helpers
|
|
|
|
|
*
|
|
|
|
|
* Copyright (C) 2006-2020 Red Hat, Inc.
|
|
|
|
|
* Copyright (C) 2006 Daniel P. Berrange
|
|
|
|
|
*
|
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
|
|
|
*
|
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
|
|
|
* License along with this library. If not, see
|
|
|
|
|
* <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#pragma once
|
|
|
|
|
|
|
|
|
|
#include "virenum.h"
|
|
|
|
|
#include "qemu_conf.h"
|
|
|
|
|
|
|
|
|
|
typedef enum {
|
|
|
|
|
QEMU_DOMAIN_NS_MOUNT = 0,
|
|
|
|
|
QEMU_DOMAIN_NS_LAST
|
|
|
|
|
} qemuDomainNamespace;
|
|
|
|
|
VIR_ENUM_DECL(qemuDomainNamespace);
|
|
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainEnableNamespace(virDomainObj *vm,
|
2020-07-20 14:18:57 +00:00
|
|
|
qemuDomainNamespace ns);
|
|
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
bool qemuDomainNamespaceEnabled(virDomainObj *vm,
|
2020-07-20 14:18:57 +00:00
|
|
|
qemuDomainNamespace ns);
|
|
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainUnshareNamespace(virQEMUDriverConfig *cfg,
|
|
|
|
|
virSecurityManager *mgr,
|
|
|
|
|
virDomainObj *vm);
|
qemu_domain_namespace: Repurpose qemuDomainBuildNamespace()
Okay, here is the deal. Currently, the way we build namespace is
very fragile. It is done from pre-exec hook when starting a
domain, after we mass closed all FDs and before we drop
privileges and exec() QEMU. This fact poses some limitations onto
the namespace build code, e.g. it has to make sure not to keep
any FD opened (not even through a library call), because it would
be leaked to QEMU. Also, it has to call only async signal safe
functions. These requirements are hard to meet - in fact as of my
commit v6.2.0-rc1~235 we are leaking a FD into QEMU by calling
libdevmapper functions.
To solve this issue and avoid similar problems in the future, we
should change our paradigm. We already have functions which can
populate domain's namespace with nodes from the daemon context.
If we use them to populate the namespace and keep only the bare
minimum in the pre-exec hook, we've mitigated the risk.
Therefore, the old qemuDomainBuildNamespace() is renamed to
qemuDomainUnshareNamespace() and new qemuDomainBuildNamespace()
function is introduced. So far, the new function is basically a
NOP and domain's namespace is still populated from the pre-exec
hook - next patches will fix it.
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-21 16:12:26 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainBuildNamespace(virQEMUDriverConfig *cfg,
|
|
|
|
|
virDomainObj *vm);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
void qemuDomainDestroyNamespace(virQEMUDriver *driver,
|
|
|
|
|
virDomainObj *vm);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
|
|
|
|
bool qemuDomainNamespaceAvailable(qemuDomainNamespace ns);
|
|
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceSetupDisk(virDomainObj *vm,
|
2021-07-14 14:46:54 +00:00
|
|
|
virStorageSource *src,
|
|
|
|
|
bool *created);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceTeardownDisk(virDomainObj *vm,
|
|
|
|
|
virStorageSource *src);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceSetupHostdev(virDomainObj *vm,
|
2021-07-14 14:46:54 +00:00
|
|
|
virDomainHostdevDef *hostdev,
|
|
|
|
|
bool *created);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceTeardownHostdev(virDomainObj *vm,
|
|
|
|
|
virDomainHostdevDef *hostdev);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceSetupMemory(virDomainObj *vm,
|
2021-07-14 14:46:54 +00:00
|
|
|
virDomainMemoryDef *memory,
|
|
|
|
|
bool *created);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceTeardownMemory(virDomainObj *vm,
|
|
|
|
|
virDomainMemoryDef *memory);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceSetupChardev(virDomainObj *vm,
|
2021-07-14 14:46:54 +00:00
|
|
|
virDomainChrDef *chr,
|
|
|
|
|
bool *created);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceTeardownChardev(virDomainObj *vm,
|
|
|
|
|
virDomainChrDef *chr);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceSetupRNG(virDomainObj *vm,
|
2021-07-14 14:46:54 +00:00
|
|
|
virDomainRNGDef *rng,
|
|
|
|
|
bool *created);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceTeardownRNG(virDomainObj *vm,
|
|
|
|
|
virDomainRNGDef *rng);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceSetupInput(virDomainObj *vm,
|
2021-07-14 14:46:54 +00:00
|
|
|
virDomainInputDef *input,
|
|
|
|
|
bool *created);
|
2020-07-20 14:18:57 +00:00
|
|
|
|
2021-03-11 07:16:13 +00:00
|
|
|
int qemuDomainNamespaceTeardownInput(virDomainObj *vm,
|
|
|
|
|
virDomainInputDef *input);
|
