2010-02-23 00:01:34 +00:00
|
|
|
*#*#
|
|
|
|
|
*.#*#
|
2017-03-03 12:43:51 +00:00
|
|
|
*.[187]
|
|
|
|
|
*.[187].in
|
2008-10-28 17:47:12 +00:00
|
|
|
*.a
|
2012-02-03 21:30:06 +00:00
|
|
|
*.cov
|
2010-04-29 03:36:03 +00:00
|
|
|
*.exe
|
2014-02-26 19:56:06 +00:00
|
|
|
*.exe.manifest
|
2010-06-09 18:35:49 +00:00
|
|
|
*.gcda
|
|
|
|
|
*.gcno
|
|
|
|
|
*.gcov
|
2012-02-03 21:30:06 +00:00
|
|
|
*.html
|
|
|
|
|
*.i
|
Prevent crash from dlclose() of libvirt.so
When libvirt calls virInitialize it creates a thread local
for the virErrorPtr storage, and registers a callback to
cleanup memory when a thread exits. When libvirt is dlclose()d
or otherwise made non-resident, the callback function is
removed from memory, but the thread local may still exist
and if a thread later exists, it will invoke the callback
and SEGV. There may also be other thread locals with callbacks
pointing to libvirt code, so it is in general never safe to
unload libvirt.so from memory once initialized.
To allow dlclose() to succeed, but keep libvirt.so resident
in memory, link with '-z nodelete'. This issue was first
found with the libvirt CIM provider, but can potentially
hit many of the dynamic language bindings which all ultimately
involve dlopen() in some way, either on libvirt.so itself,
or on the glue code for the binding which in turns links
to libvirt
* configure.ac, src/Makefile.am: Ensure libvirt.so is linked
with -z nodelete
* cfg.mk, .gitignore, tests/Makefile.am, tests/shunloadhelper.c,
tests/shunloadtest.c: A test case to unload libvirt while
a thread is still running.
2011-09-01 16:57:06 +00:00
|
|
|
*.la
|
|
|
|
|
*.lo
|
2012-02-03 21:30:06 +00:00
|
|
|
*.loT
|
2008-10-28 17:47:12 +00:00
|
|
|
*.o
|
2010-02-23 00:01:34 +00:00
|
|
|
*.orig
|
2014-01-14 21:28:57 +00:00
|
|
|
*.pem
|
2012-02-03 21:30:06 +00:00
|
|
|
*.pyc
|
2010-02-23 00:01:34 +00:00
|
|
|
*.rej
|
2012-02-03 21:30:06 +00:00
|
|
|
*.s
|
2016-05-03 13:36:01 +00:00
|
|
|
*.service
|
|
|
|
|
*.socket
|
2015-05-05 11:34:06 +00:00
|
|
|
*.swp
|
2008-10-28 17:47:12 +00:00
|
|
|
*~
|
2012-10-26 12:39:55 +00:00
|
|
|
.#*
|
2017-04-21 14:05:19 +00:00
|
|
|
.color_coded
|
2012-02-03 21:30:06 +00:00
|
|
|
.deps
|
build: use automake subdir-objects
Automake 2.0 will enable subdir-objects by default; in preparation
for that change, automake 1.14 outputs LOADS of warnings:
daemon/Makefile.am:38: warning: source file '../src/remote/remote_protocol.c' is in a subdirectory,
daemon/Makefile.am:38: but option 'subdir-objects' is disabled
automake-1.14: warning: possible forward-incompatibility.
automake-1.14: At least a source file is in a subdirectory, but the 'subdir-objects'
automake-1.14: automake option hasn't been enabled. For now, the corresponding output
automake-1.14: object file(s) will be placed in the top-level directory. However,
automake-1.14: this behaviour will change in future Automake versions: they will
automake-1.14: unconditionally cause object files to be placed in the same subdirectory
automake-1.14: of the corresponding sources.
automake-1.14: You are advised to start using 'subdir-objects' option throughout your
automake-1.14: project, to avoid future incompatibilities.
daemon/Makefile.am:38: warning: source file '../src/remote/lxc_protocol.c' is in a subdirectory,
daemon/Makefile.am:38: but option 'subdir-objects' is disabled
...
As automake 1.9 also supported this option, and the previous patches
fixed up the code base to work with it, it is safe to now turn it on
unconditionally.
* configure.ac (AM_INIT_AUTOMAKE): Enable subdir-objects.
* .gitignore: Ignore .dirstamp directories.
* src/Makefile.am (PDWTAGS, *-protocol-struct): Adjust to
new subdir-object location of .lo files.
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-07 22:18:06 +00:00
|
|
|
.dirstamp
|
2012-09-14 09:09:51 +00:00
|
|
|
.gdb_history
|
2008-10-17 10:03:15 +00:00
|
|
|
.git
|
2009-07-10 08:01:04 +00:00
|
|
|
.git-module-status
|
2012-02-03 21:30:06 +00:00
|
|
|
.libs
|
2011-03-17 02:35:17 +00:00
|
|
|
.lvimrc
|
2012-02-03 21:30:06 +00:00
|
|
|
.memdump
|
2010-04-21 15:55:03 +00:00
|
|
|
.sc-start-sc_*
|
2017-04-21 14:47:02 +00:00
|
|
|
.ycm_extra_conf.py
|
2012-10-12 23:50:19 +00:00
|
|
|
/AUTHORS
|
2010-02-23 00:01:34 +00:00
|
|
|
/GNUmakefile
|
2010-11-16 19:29:09 +00:00
|
|
|
/INSTALL
|
|
|
|
|
/NEWS
|
|
|
|
|
/aclocal.m4
|
|
|
|
|
/autom4te.cache
|
2017-04-07 06:50:21 +00:00
|
|
|
/build-aux/*
|
2010-04-30 14:52:54 +00:00
|
|
|
/build/
|
2019-01-25 16:28:23 +00:00
|
|
|
/ci-tree/
|
2014-11-06 11:17:19 +00:00
|
|
|
/confdefs.h
|
2010-11-16 19:29:09 +00:00
|
|
|
/config.cache
|
|
|
|
|
/config.guess
|
|
|
|
|
/config.h
|
|
|
|
|
/config.h.in
|
|
|
|
|
/config.log
|
|
|
|
|
/config.rpath
|
|
|
|
|
/config.status
|
|
|
|
|
/config.sub
|
|
|
|
|
/configure
|
|
|
|
|
/configure.lineno
|
2014-11-06 15:53:28 +00:00
|
|
|
/conftest.*
|
2013-08-08 10:51:01 +00:00
|
|
|
/docs/aclperms.htmlinc
|
2012-04-27 16:05:12 +00:00
|
|
|
/docs/apibuild.py.stamp
|
2012-02-03 21:30:06 +00:00
|
|
|
/docs/devhelp/libvirt.devhelp
|
2011-05-16 15:33:56 +00:00
|
|
|
/docs/hvsupport.html.in
|
2015-04-15 14:23:25 +00:00
|
|
|
/docs/libvirt-admin-*.xml
|
2012-02-03 21:30:06 +00:00
|
|
|
/docs/libvirt-api.xml
|
Introduce an LXC specific public API & library
This patch introduces support for LXC specific public APIs. In
common with what was done for QEMU, this creates a libvirt_lxc.so
library and libvirt/libvirt-lxc.h header file.
The actual APIs are
int virDomainLxcOpenNamespace(virDomainPtr domain,
int **fdlist,
unsigned int flags);
int virDomainLxcEnterNamespace(virDomainPtr domain,
unsigned int nfdlist,
int *fdlist,
unsigned int *noldfdlist,
int **oldfdlist,
unsigned int flags);
which provide a way to use the setns() system call to move the
calling process into the container's namespace. It is not
practical to write in a generically applicable manner. The
nearest that we could get to such an API would be an API which
allows to pass a command + argv to be executed inside a
container. Even if we had such a generic API, this LXC specific
API is still useful, because it allows the caller to maintain
the current process context, in particular any I/O streams they
have open.
NB the virDomainLxcEnterNamespace() API is special in that it
runs client side, so does not involve the internal driver API.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-21 13:15:19 +00:00
|
|
|
/docs/libvirt-lxc-*.xml
|
2013-01-15 12:30:30 +00:00
|
|
|
/docs/libvirt-qemu-*.xml
|
2012-02-03 21:30:06 +00:00
|
|
|
/docs/libvirt-refs.xml
|
2017-01-03 11:22:54 +00:00
|
|
|
/docs/news.html.in
|
2012-02-03 21:30:06 +00:00
|
|
|
/docs/todo.html.in
|
2019-05-22 16:16:59 +00:00
|
|
|
/examples/c/admin/client_close
|
|
|
|
|
/examples/c/admin/client_info
|
|
|
|
|
/examples/c/admin/client_limits
|
|
|
|
|
/examples/c/admin/list_clients
|
|
|
|
|
/examples/c/admin/list_servers
|
|
|
|
|
/examples/c/admin/logging
|
|
|
|
|
/examples/c/admin/threadpool_params
|
|
|
|
|
/examples/c/domain/dommigrate
|
|
|
|
|
/examples/c/domain/domtop
|
|
|
|
|
/examples/c/domain/info1
|
|
|
|
|
/examples/c/domain/rename
|
|
|
|
|
/examples/c/domain/suspend
|
|
|
|
|
/examples/c/misc/event-test
|
|
|
|
|
/examples/c/misc/hellolibvirt
|
|
|
|
|
/examples/c/misc/openauth
|
2011-07-28 12:55:21 +00:00
|
|
|
/gnulib/lib/*
|
|
|
|
|
/gnulib/m4/*
|
|
|
|
|
/gnulib/tests/*
|
2015-11-26 14:02:49 +00:00
|
|
|
/include/libvirt/libvirt-common.h
|
2010-11-16 19:29:09 +00:00
|
|
|
/libtool
|
2016-06-15 11:19:32 +00:00
|
|
|
/libvirt-*.tar.xz
|
2010-05-19 22:16:47 +00:00
|
|
|
/libvirt-[0-9]*
|
2014-06-20 16:47:15 +00:00
|
|
|
/libvirt*.pc
|
2010-11-16 19:29:09 +00:00
|
|
|
/libvirt.spec
|
|
|
|
|
/ltconfig
|
|
|
|
|
/ltmain.sh
|
2011-04-05 19:06:31 +00:00
|
|
|
/m4/*
|
2010-02-23 00:01:34 +00:00
|
|
|
/maint.mk
|
2012-06-15 16:13:11 +00:00
|
|
|
/mingw-libvirt.spec
|
2010-11-16 19:29:09 +00:00
|
|
|
/mkinstalldirs
|
2018-04-03 15:39:17 +00:00
|
|
|
/po/*gmo
|
po: minimize & canonicalize translations stored in git
Similar to the libvirt.pot, .po files contain line numbers and file
names identifying where in the source a translatable string comes from.
The source locations in the .po files are thrown away and replaced with
content from the libvirt.pot whenever msgmerge is run, so this is not
precious information that needs to be stored in git.
When msgmerge processes a .po file, it will add in any msgids from the
libvirt.pot that were not already present. Thus, if a particular msgid
currently has no translation, it can be considered redundant and again
does not need storing in git.
When msgmerge processes a .po file and can't find an exact existing
translation match, it will try todo fuzzy matching instead, marking such
entries with a "# fuzzy" comment to alert the translator to take a
look and either discard, edit or accept the match. Looking at the
existing fuzzy matches in .po files shows that the quality is awful,
with many having a completely different set of printf format specifiers
between the msgid and fuzzy msgstr entry. Fortunately when msgfmt
generates the .gmo, the fuzzy entries are all ignored anyway. The fuzzy
entries could be useful to translators if they were working on the .po
files directly from git, but Libvirt outsourced translation to the
Fedora Zanata system, so keeping fuzzy matches in git is not much help.
Finally, by default msgids are sorted based on source location. Thus, if
a bit of code with translatable text is moved from one file to another,
it may shift around in the .po file, despite the msgid not itself changing.
If the msgids were sorted alphabetically, the .po files would have
stable ordering when code is refactored.
This patch takes advantage of the above observations to canonicalize
and minimize the content stored for .po files in git. Instead of storing
the real .po files, we now store .mini.po files.
The .mini.po files are the same file format as .po files, but have no
source location comments, are sorted alphabetically, and all fuzzy
msgstrs and msgids with no translation are discarded. This cuts the size
of content in the po directory from 109MB to 19MB.
Users working from a libvirt git checkout who need the full .po files
can run "make update-po", which merges the libvirt.pot and .mini.po
file to create a .po file containing all the content previously stored
in git.
Conversely if a full .po file has been modified, for example, by
downloading new content from Zanata, the .mini.po files can be updated
by running "make update-mini-po". The resulting diffs of the .mini.po
file will clearly show the changed translations without any of the noise
that previously obscured content. Being able to see content changes
clearly actually identified a bug in the zanata python client where it
was adding bogus "fuzzy" annotations to many messages:
https://bugzilla.redhat.com/show_bug.cgi?id=1564497
Users working from libvirt releases should not see any difference in
behaviour, since the tarballs only contain the full .po files, not the
.mini.po files.
As an added benefit, generating tarballs with "make dist", will no
longer cause creation of dirty files in git, since it won't touch the
.mini.po files, only the .po files which are no longer kept in git.
To avoid creating a single commit 100+MB in size, each language is
minimized separately in a following commit.
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-04-04 18:45:40 +00:00
|
|
|
/po/*po
|
|
|
|
|
!/po/*.mini.po
|
|
|
|
|
/po/*pot
|
2010-11-09 10:45:14 +00:00
|
|
|
/proxy/
|
2013-11-22 16:42:22 +00:00
|
|
|
/python/
|
2012-09-14 09:08:54 +00:00
|
|
|
/run
|
2011-08-18 23:03:26 +00:00
|
|
|
/sc_*
|
2012-07-23 14:45:20 +00:00
|
|
|
/src/.*.stamp
|
2014-06-20 16:48:12 +00:00
|
|
|
/src/*.pc
|
2012-01-23 15:12:57 +00:00
|
|
|
/src/access/org.libvirt.api.policy
|
Auto-generate helpers for checking access control rules
Extend the 'gendispatch.pl' script to be able to generate
three new types of file.
- 'aclheader' - defines signatures of helper APIs for
doing authorization checks. There is one helper API
for each API requiring an auth check. Any @acl
annotations result in a method being generated with
a suffix of 'EnsureACL'. If the ACL check requires
examination of flags, an extra 'flags' param will be
present. Some examples
extern int virConnectBaselineCPUEnsureACL(void);
extern int virConnectDomainEventDeregisterEnsureACL(virDomainDefPtr domain);
extern int virDomainAttachDeviceFlagsEnsureACL(virDomainDefPtr domain, unsigned int flags);
Any @aclfilter annotations resuilt in a method being
generated with a suffix of 'CheckACL'.
extern int virConnectListAllDomainsCheckACL(virDomainDefPtr domain);
These are used for filtering individual objects from APIs
which return a list of objects
- 'aclbody' - defines the actual implementation of the
methods described above. This calls into the access
manager APIs. A complex example:
/* Returns: -1 on error (denied==error), 0 on allowed */
int virDomainAttachDeviceFlagsEnsureACL(virConnectPtr conn,
virDomainDefPtr domain,
unsigned int flags)
{
virAccessManagerPtr mgr;
int rv;
if (!(mgr = virAccessManagerGetDefault()))
return -1;
if ((rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_WRITE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG|VIR_DOMAIN_AFFECT_LIVE)) == 0) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG)) == (VIR_DOMAIN_AFFECT_CONFIG)) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
virObjectUnref(mgr);
return 0;
}
- 'aclsyms' - generates a linker script to export the
APIs to drivers. Some examples
virConnectBaselineCPUEnsureACL;
virConnectCompareCPUEnsureACL;
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-18 16:49:41 +00:00
|
|
|
/src/access/viraccessapicheck.c
|
|
|
|
|
/src/access/viraccessapicheck.h
|
|
|
|
|
/src/access/viraccessapichecklxc.c
|
|
|
|
|
/src/access/viraccessapichecklxc.h
|
|
|
|
|
/src/access/viraccessapicheckqemu.c
|
|
|
|
|
/src/access/viraccessapicheckqemu.h
|
2015-04-16 12:23:16 +00:00
|
|
|
/src/admin/admin_client.h
|
2015-04-15 14:13:22 +00:00
|
|
|
/src/admin/admin_protocol.[ch]
|
2018-01-19 11:30:31 +00:00
|
|
|
/src/admin/admin_server_dispatch_stubs.h
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/bhyve/test_virtbhyved.aug
|
|
|
|
|
/src/bhyve/virtbhyved.aug
|
|
|
|
|
/src/bhyve/virtbhyved.conf
|
2012-02-03 21:30:06 +00:00
|
|
|
/src/esx/*.generated.*
|
2011-07-13 15:05:19 +00:00
|
|
|
/src/hyperv/*.generated.*
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/interface/test_virtinterfaced.aug
|
|
|
|
|
/src/interface/virtinterfaced.aug
|
|
|
|
|
/src/interface/virtinterfaced.conf
|
2012-02-03 21:30:06 +00:00
|
|
|
/src/libvirt*.def
|
|
|
|
|
/src/libvirt.syms
|
Auto-generate helpers for checking access control rules
Extend the 'gendispatch.pl' script to be able to generate
three new types of file.
- 'aclheader' - defines signatures of helper APIs for
doing authorization checks. There is one helper API
for each API requiring an auth check. Any @acl
annotations result in a method being generated with
a suffix of 'EnsureACL'. If the ACL check requires
examination of flags, an extra 'flags' param will be
present. Some examples
extern int virConnectBaselineCPUEnsureACL(void);
extern int virConnectDomainEventDeregisterEnsureACL(virDomainDefPtr domain);
extern int virDomainAttachDeviceFlagsEnsureACL(virDomainDefPtr domain, unsigned int flags);
Any @aclfilter annotations resuilt in a method being
generated with a suffix of 'CheckACL'.
extern int virConnectListAllDomainsCheckACL(virDomainDefPtr domain);
These are used for filtering individual objects from APIs
which return a list of objects
- 'aclbody' - defines the actual implementation of the
methods described above. This calls into the access
manager APIs. A complex example:
/* Returns: -1 on error (denied==error), 0 on allowed */
int virDomainAttachDeviceFlagsEnsureACL(virConnectPtr conn,
virDomainDefPtr domain,
unsigned int flags)
{
virAccessManagerPtr mgr;
int rv;
if (!(mgr = virAccessManagerGetDefault()))
return -1;
if ((rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_WRITE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG|VIR_DOMAIN_AFFECT_LIVE)) == 0) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG)) == (VIR_DOMAIN_AFFECT_CONFIG)) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
virObjectUnref(mgr);
return 0;
}
- 'aclsyms' - generates a linker script to export the
APIs to drivers. Some examples
virConnectBaselineCPUEnsureACL;
virConnectCompareCPUEnsureACL;
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-18 16:49:41 +00:00
|
|
|
/src/libvirt_access.syms
|
2013-08-07 12:03:50 +00:00
|
|
|
/src/libvirt_access.xml
|
Auto-generate helpers for checking access control rules
Extend the 'gendispatch.pl' script to be able to generate
three new types of file.
- 'aclheader' - defines signatures of helper APIs for
doing authorization checks. There is one helper API
for each API requiring an auth check. Any @acl
annotations result in a method being generated with
a suffix of 'EnsureACL'. If the ACL check requires
examination of flags, an extra 'flags' param will be
present. Some examples
extern int virConnectBaselineCPUEnsureACL(void);
extern int virConnectDomainEventDeregisterEnsureACL(virDomainDefPtr domain);
extern int virDomainAttachDeviceFlagsEnsureACL(virDomainDefPtr domain, unsigned int flags);
Any @aclfilter annotations resuilt in a method being
generated with a suffix of 'CheckACL'.
extern int virConnectListAllDomainsCheckACL(virDomainDefPtr domain);
These are used for filtering individual objects from APIs
which return a list of objects
- 'aclbody' - defines the actual implementation of the
methods described above. This calls into the access
manager APIs. A complex example:
/* Returns: -1 on error (denied==error), 0 on allowed */
int virDomainAttachDeviceFlagsEnsureACL(virConnectPtr conn,
virDomainDefPtr domain,
unsigned int flags)
{
virAccessManagerPtr mgr;
int rv;
if (!(mgr = virAccessManagerGetDefault()))
return -1;
if ((rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_WRITE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG|VIR_DOMAIN_AFFECT_LIVE)) == 0) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG)) == (VIR_DOMAIN_AFFECT_CONFIG)) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
virObjectUnref(mgr);
return 0;
}
- 'aclsyms' - generates a linker script to export the
APIs to drivers. Some examples
virConnectBaselineCPUEnsureACL;
virConnectCompareCPUEnsureACL;
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-18 16:49:41 +00:00
|
|
|
/src/libvirt_access_lxc.syms
|
2013-08-07 12:03:50 +00:00
|
|
|
/src/libvirt_access_lxc.xml
|
Auto-generate helpers for checking access control rules
Extend the 'gendispatch.pl' script to be able to generate
three new types of file.
- 'aclheader' - defines signatures of helper APIs for
doing authorization checks. There is one helper API
for each API requiring an auth check. Any @acl
annotations result in a method being generated with
a suffix of 'EnsureACL'. If the ACL check requires
examination of flags, an extra 'flags' param will be
present. Some examples
extern int virConnectBaselineCPUEnsureACL(void);
extern int virConnectDomainEventDeregisterEnsureACL(virDomainDefPtr domain);
extern int virDomainAttachDeviceFlagsEnsureACL(virDomainDefPtr domain, unsigned int flags);
Any @aclfilter annotations resuilt in a method being
generated with a suffix of 'CheckACL'.
extern int virConnectListAllDomainsCheckACL(virDomainDefPtr domain);
These are used for filtering individual objects from APIs
which return a list of objects
- 'aclbody' - defines the actual implementation of the
methods described above. This calls into the access
manager APIs. A complex example:
/* Returns: -1 on error (denied==error), 0 on allowed */
int virDomainAttachDeviceFlagsEnsureACL(virConnectPtr conn,
virDomainDefPtr domain,
unsigned int flags)
{
virAccessManagerPtr mgr;
int rv;
if (!(mgr = virAccessManagerGetDefault()))
return -1;
if ((rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_WRITE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG|VIR_DOMAIN_AFFECT_LIVE)) == 0) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
if (((flags & (VIR_DOMAIN_AFFECT_CONFIG)) == (VIR_DOMAIN_AFFECT_CONFIG)) &&
(rv = virAccessManagerCheckDomain(mgr,
conn->driver->name,
domain,
VIR_ACCESS_PERM_DOMAIN_SAVE)) <= 0) {
virObjectUnref(mgr);
if (rv == 0)
virReportError(VIR_ERR_ACCESS_DENIED, NULL);
return -1;
}
virObjectUnref(mgr);
return 0;
}
- 'aclsyms' - generates a linker script to export the
APIs to drivers. Some examples
virConnectBaselineCPUEnsureACL;
virConnectCompareCPUEnsureACL;
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-04-18 16:49:41 +00:00
|
|
|
/src/libvirt_access_qemu.syms
|
2013-08-07 12:03:50 +00:00
|
|
|
/src/libvirt_access_qemu.xml
|
2015-08-20 18:03:12 +00:00
|
|
|
/src/libvirt_admin.syms
|
2012-02-03 21:30:06 +00:00
|
|
|
/src/libvirt_*.stp
|
|
|
|
|
/src/libvirt_*helper
|
2012-05-25 02:43:43 +00:00
|
|
|
/src/libvirt_*probes.h
|
2012-02-03 21:30:06 +00:00
|
|
|
/src/libvirt_lxc
|
2018-02-20 13:16:28 +00:00
|
|
|
/src/libvirtd
|
2018-02-21 12:48:23 +00:00
|
|
|
/src/libvirtd*.logrotate
|
2019-07-19 15:48:10 +00:00
|
|
|
/src/libxl/test_libvirtd_libxl.aug
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/libxl/test_virtxend.aug
|
|
|
|
|
/src/libxl/virtxend.aug
|
|
|
|
|
/src/libxl/virtxend.conf
|
2015-04-30 16:32:58 +00:00
|
|
|
/src/locking/libxl-lockd.conf
|
|
|
|
|
/src/locking/libxl-sanlock.conf
|
2012-08-03 09:27:07 +00:00
|
|
|
/src/locking/lock_daemon_dispatch_stubs.h
|
2011-07-06 16:20:04 +00:00
|
|
|
/src/locking/lock_protocol.[ch]
|
2011-07-06 16:30:08 +00:00
|
|
|
/src/locking/qemu-lockd.conf
|
2011-08-15 20:42:43 +00:00
|
|
|
/src/locking/qemu-sanlock.conf
|
Autogenerate augeas test case from default config files
When adding new config file parameters, the corresponding
additions to the augeas lens' are constantly forgotten.
Also there are augeas test cases, these don't catch the
error, since they too are never updated.
To address this, the augeas test cases need to be auto-generated
from the example config files.
* build-aux/augeas-gentest.pl: Helper to generate an
augeas test file, substituting in elements from the
example config files
* src/Makefile.am, daemon/Makefile.am: Switch to
auto-generated augeas test cases
* daemon/test_libvirtd.aug, daemon/test_libvirtd.aug.in,
src/locking/test_libvirt_sanlock.aug,
src/locking/test_libvirt_sanlock.aug.in,
src/lxc/test_libvirtd_lxc.aug,
src/lxc/test_libvirtd_lxc.aug.in,
src/qemu/test_libvirtd_qemu.aug,
src/qemu/test_libvirtd_qemu.aug.in: Remove example
config file data, replacing with a ::CONFIG:: placeholder
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-05-25 10:14:15 +00:00
|
|
|
/src/locking/test_libvirt_sanlock.aug
|
2019-07-19 15:48:10 +00:00
|
|
|
/src/locking/test_libvirt_lockd.aug
|
|
|
|
|
/src/locking/test_virtlockd.aug
|
2015-02-09 16:35:05 +00:00
|
|
|
/src/logging/log_daemon_dispatch_stubs.h
|
|
|
|
|
/src/logging/log_protocol.[ch]
|
2019-07-19 15:48:10 +00:00
|
|
|
/src/logging/test_virtlogd.aug
|
2012-07-17 14:54:08 +00:00
|
|
|
/src/lxc/lxc_controller_dispatch.h
|
|
|
|
|
/src/lxc/lxc_monitor_dispatch.h
|
2012-12-21 13:19:54 +00:00
|
|
|
/src/lxc/lxc_monitor_protocol.c
|
|
|
|
|
/src/lxc/lxc_monitor_protocol.h
|
2013-02-18 05:04:17 +00:00
|
|
|
/src/lxc/lxc_protocol.[ch]
|
2012-08-01 11:40:56 +00:00
|
|
|
/src/lxc/test_libvirtd_lxc.aug
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/lxc/test_virtlxcd.aug
|
|
|
|
|
/src/lxc/virtlxcd.aug
|
|
|
|
|
/src/lxc/virtlxcd.conf
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/network/test_virtnetworkd.aug
|
|
|
|
|
/src/network/virtnetworkd.aug
|
|
|
|
|
/src/network/virtnetworkd.conf
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/node_device/test_virtnodedevd.aug
|
|
|
|
|
/src/node_device/virtnodedevd.aug
|
|
|
|
|
/src/node_device/virtnodedevd.conf
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/nwfilter/test_virtnwfilterd.aug
|
|
|
|
|
/src/nwfilter/virtnwfilterd.aug
|
|
|
|
|
/src/nwfilter/virtnwfilterd.conf
|
Autogenerate augeas test case from default config files
When adding new config file parameters, the corresponding
additions to the augeas lens' are constantly forgotten.
Also there are augeas test cases, these don't catch the
error, since they too are never updated.
To address this, the augeas test cases need to be auto-generated
from the example config files.
* build-aux/augeas-gentest.pl: Helper to generate an
augeas test file, substituting in elements from the
example config files
* src/Makefile.am, daemon/Makefile.am: Switch to
auto-generated augeas test cases
* daemon/test_libvirtd.aug, daemon/test_libvirtd.aug.in,
src/locking/test_libvirt_sanlock.aug,
src/locking/test_libvirt_sanlock.aug.in,
src/lxc/test_libvirtd_lxc.aug,
src/lxc/test_libvirtd_lxc.aug.in,
src/qemu/test_libvirtd_qemu.aug,
src/qemu/test_libvirtd_qemu.aug.in: Remove example
config file data, replacing with a ::CONFIG:: placeholder
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-05-25 10:14:15 +00:00
|
|
|
/src/qemu/test_libvirtd_qemu.aug
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/qemu/test_virtqemud.aug
|
|
|
|
|
/src/qemu/virtqemud.aug
|
|
|
|
|
/src/qemu/virtqemud.conf
|
2011-05-06 13:11:32 +00:00
|
|
|
/src/remote/*_client_bodies.h
|
|
|
|
|
/src/remote/*_protocol.[ch]
|
2018-02-20 13:16:28 +00:00
|
|
|
/src/remote/*_stubs.h
|
2019-06-21 16:19:11 +00:00
|
|
|
/src/remote/libvirtd.aug
|
2019-06-21 16:19:11 +00:00
|
|
|
/src/remote/libvirtd.conf
|
2019-07-19 15:48:10 +00:00
|
|
|
/src/remote/test_libvirtd.aug
|
remote: introduce virtproxyd daemon to handle IP connectivity
The libvirtd daemon provides the traditional libvirt experience where
all the drivers are in a single daemon, and is accessible over both
local UNIX sockets and remote IP sockets.
In the new world we're having a set of per-driver daemons which will
primarily be accessed locally via their own UNIX sockets.
We still, however, need to allow for case of applications which will
connect to libvirt remotely. These remote connections can be done as
TCP/TLS sockets, or by SSH tunnelling to the UNIX socket.
In the later case, the old libvirt.so clients will only know about
the path to the old libvirtd socket /var/run/libvirt/libvirt-sock,
and not the new driver sockets /var/run/libvirt/virtqemud-sock.
It is also not desirable to expose the main driver specific daemons
over IP directly to minimize their attack service.
Thus the virtproxyd daemon steps into place, to provide TCP/TLS sockets,
and back compat for the old libvirtd UNIX socket path(s). It will then
forward all RPC calls made to the appropriate driver specific daemon.
Essentially it is equivalent to the old libvirtd with absolutely no
drivers registered except for the remote driver (and other stateless
drivers in libvirt.so).
We could have modified libvirtd so none of the drivers are registed
to get the same end result. We could even add a libvirtd.conf parameter
to control whether the drivers are loaded to enable users to switch back
to the old world if we discover bugs in the split-daemon model. Using a
new daemon though has some advantages
- We can make virtproxyd and the virtXXXd per-driver daemons all
have "Conflicts: libvirtd.service" in their systemd unit files.
This will guarantee that libvirtd is never started at the same
time, as this would result in two daemons running the same driver.
Fortunately drivers use locking to protect themselves, but it is
better to avoid starting a daemon we know will conflict.
- It allows us to break CLI compat to remove the --listen parameter.
Both listen_tcp and listen_tls parameters in /etc/libvirtd/virtd.conf
will default to zero. Either TLS or TCP can be enabled exclusively
though virtd.conf without requiring the extra step of adding --listen.
- It allows us to set a strict SELinux policy over virtproxyd. For
back compat the libvirtd policy must continue to allow all drivers
to run. We can't easily give a second policy to libvirtd which
locks it down. By introducing a new virtproxyd we can set a strict
policy for that daemon only.
- It gets rid of the weird naming of having a daemon with "lib" in
its name. Now all normal daemons libvirt ships will have "virt"
as their prefix not "libvirt".
- Distros can more easily choose their upgrade path. They can
ship both sets of daemons in their packages, and choose to
either enable libvirtd, or enable the per-driver daemons and
virtproxyd out of the box. Users can easily override this if
desired by just tweaking which systemd units are active.
After some time we can deprecate use of libvirtd and after some more
time delete it entirely, leaving us in a pretty world filled with
prancing unicorns.
The main downside with introducing a new daemon, and with the
per-driver daemons in general, is figuring out the correct upgrade
path.
The conservative option is to leave libvirtd running if it was
an existing installation. Only use the new daemons & virtproxyd
on completely new installs.
The aggressive option is to disable libvirtd if already running
and activate all the new daemons.
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Christophe de Dinechin <dinechin@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-07-04 11:33:23 +00:00
|
|
|
/src/remote/test_virtproxyd.aug
|
|
|
|
|
/src/remote/virtproxyd.aug
|
|
|
|
|
/src/remote/virtproxyd.conf
|
2011-09-22 10:51:55 +00:00
|
|
|
/src/rpc/virkeepaliveprotocol.[ch]
|
2010-12-06 17:03:10 +00:00
|
|
|
/src/rpc/virnetprotocol.[ch]
|
2019-07-23 11:22:41 +00:00
|
|
|
/src/secret/test_virtsecretd.aug
|
|
|
|
|
/src/secret/virtsecretd.aug
|
|
|
|
|
/src/secret/virtsecretd.conf
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/storage/test_virtstoraged.aug
|
|
|
|
|
/src/storage/virtstoraged.aug
|
|
|
|
|
/src/storage/virtstoraged.conf
|
2019-07-19 15:48:10 +00:00
|
|
|
/src/test*.aug
|
2017-03-02 10:46:53 +00:00
|
|
|
/src/util/virkeycodetable*.h
|
|
|
|
|
/src/util/virkeynametable*.h
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/vbox/test_virtvboxd.aug
|
|
|
|
|
/src/vbox/virtvboxd.aug
|
|
|
|
|
/src/vbox/virtvboxd.conf
|
2012-02-03 21:30:06 +00:00
|
|
|
/src/virt-aa-helper
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtbhyved
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtinterfaced
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtxend
|
2012-08-02 19:06:50 +00:00
|
|
|
/src/virtlockd
|
2015-02-09 16:35:05 +00:00
|
|
|
/src/virtlogd
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtlxcd
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtnetworkd
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtnodedevd
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtnwfilterd
|
remote: introduce virtproxyd daemon to handle IP connectivity
The libvirtd daemon provides the traditional libvirt experience where
all the drivers are in a single daemon, and is accessible over both
local UNIX sockets and remote IP sockets.
In the new world we're having a set of per-driver daemons which will
primarily be accessed locally via their own UNIX sockets.
We still, however, need to allow for case of applications which will
connect to libvirt remotely. These remote connections can be done as
TCP/TLS sockets, or by SSH tunnelling to the UNIX socket.
In the later case, the old libvirt.so clients will only know about
the path to the old libvirtd socket /var/run/libvirt/libvirt-sock,
and not the new driver sockets /var/run/libvirt/virtqemud-sock.
It is also not desirable to expose the main driver specific daemons
over IP directly to minimize their attack service.
Thus the virtproxyd daemon steps into place, to provide TCP/TLS sockets,
and back compat for the old libvirtd UNIX socket path(s). It will then
forward all RPC calls made to the appropriate driver specific daemon.
Essentially it is equivalent to the old libvirtd with absolutely no
drivers registered except for the remote driver (and other stateless
drivers in libvirt.so).
We could have modified libvirtd so none of the drivers are registed
to get the same end result. We could even add a libvirtd.conf parameter
to control whether the drivers are loaded to enable users to switch back
to the old world if we discover bugs in the split-daemon model. Using a
new daemon though has some advantages
- We can make virtproxyd and the virtXXXd per-driver daemons all
have "Conflicts: libvirtd.service" in their systemd unit files.
This will guarantee that libvirtd is never started at the same
time, as this would result in two daemons running the same driver.
Fortunately drivers use locking to protect themselves, but it is
better to avoid starting a daemon we know will conflict.
- It allows us to break CLI compat to remove the --listen parameter.
Both listen_tcp and listen_tls parameters in /etc/libvirtd/virtd.conf
will default to zero. Either TLS or TCP can be enabled exclusively
though virtd.conf without requiring the extra step of adding --listen.
- It allows us to set a strict SELinux policy over virtproxyd. For
back compat the libvirtd policy must continue to allow all drivers
to run. We can't easily give a second policy to libvirtd which
locks it down. By introducing a new virtproxyd we can set a strict
policy for that daemon only.
- It gets rid of the weird naming of having a daemon with "lib" in
its name. Now all normal daemons libvirt ships will have "virt"
as their prefix not "libvirt".
- Distros can more easily choose their upgrade path. They can
ship both sets of daemons in their packages, and choose to
either enable libvirtd, or enable the per-driver daemons and
virtproxyd out of the box. Users can easily override this if
desired by just tweaking which systemd units are active.
After some time we can deprecate use of libvirtd and after some more
time delete it entirely, leaving us in a pretty world filled with
prancing unicorns.
The main downside with introducing a new daemon, and with the
per-driver daemons in general, is figuring out the correct upgrade
path.
The conservative option is to leave libvirtd running if it was
an existing installation. Only use the new daemons & virtproxyd
on completely new installs.
The aggressive option is to disable libvirtd if already running
and activate all the new daemons.
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Christophe de Dinechin <dinechin@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-07-04 11:33:23 +00:00
|
|
|
/src/virtproxyd
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtqemud
|
2019-07-23 11:22:41 +00:00
|
|
|
/src/virtsecretd
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtstoraged
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtvboxd
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/virtvzd
|
2018-02-20 17:41:45 +00:00
|
|
|
/src/virt-guest-shutdown.target
|
2018-03-16 17:05:24 +00:00
|
|
|
/src/vz/test_virtvzd.aug
|
|
|
|
|
/src/vz/virtvzd.aug
|
|
|
|
|
/src/vz/virtvzd.conf
|
2010-11-16 19:29:09 +00:00
|
|
|
/tests/*.log
|
2012-02-03 21:30:06 +00:00
|
|
|
/tests/*.pid
|
2013-01-28 14:19:14 +00:00
|
|
|
/tests/*.trs
|
2014-03-07 11:50:36 +00:00
|
|
|
/tests/*test
|
2016-05-05 08:09:32 +00:00
|
|
|
/tests/commandhelper
|
|
|
|
|
/tests/qemucapsprobe
|
2016-06-17 17:28:12 +00:00
|
|
|
!/tests/virsh-self-test
|
2014-03-07 11:50:36 +00:00
|
|
|
!/tests/virt-aa-helper-test
|
2016-09-14 08:08:48 +00:00
|
|
|
!/tests/virt-admin-self-test
|
2014-02-13 14:20:04 +00:00
|
|
|
/tests/objectlocking
|
|
|
|
|
/tests/objectlocking-files.txt
|
|
|
|
|
/tests/objectlocking.cm[ix]
|
2012-02-03 21:30:06 +00:00
|
|
|
/tests/reconnect
|
|
|
|
|
/tests/ssh
|
2016-04-18 12:10:33 +00:00
|
|
|
/tests/test_file_access.txt
|
2013-03-19 18:36:28 +00:00
|
|
|
/tests/test_conf
|
2012-10-21 02:29:51 +00:00
|
|
|
/tools/libvirt-guests.sh
|
2013-08-08 15:36:31 +00:00
|
|
|
/tools/virt-login-shell
|
tools: split virt-login-shell into two binaries
The virt-login-shell binary is a setuid program that takes
no arguments. When invoked it looks at the invoking uid,
resolves it to a username, and finds an LXC guest with the
same name. It then starts the guest and runs the shell in
side the namespaces of the container.
Given this set of tasks the virt-login-shell binary needs
to connect to libvirtd, make various other libvirt API calls.
This is a problem for setuid binaries as various libraries
that libvirt.so links to are not safe. For example, they have
constructor functions which execute an unknown amount of code
that can be influenced by env variables.
For this reason virt-login-shell doesn't use libvirt.so,
but instead links to a custom, cut down, set of source files
sufficient to be a local client only.
This introduces a problem for integrating glib2 into libvirt
though, as once integrated, there would be no way to build
virt-login-shell without an external dependancy on glib2 and
this is definitely not setuid safe.
To resolve this problem, we split the virt-login-shell binary
into two parts. The first part is setuid and does almost
nothing. It simply records the original uid+gid, and then
invokes the virt-login-shell-helper binary. Crucially when
it does this it completes scrubs all environment variables.
It is thus safe for virt-login-shell-helper to link to the
normal libvirt.so. Any things that constructor functions
do cannot be influenced by user control env vars or cli
args.
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-08-01 09:58:31 +00:00
|
|
|
/tools/virt-login-shell-helper
|
2012-02-03 21:30:06 +00:00
|
|
|
/tools/virsh
|
|
|
|
|
/tools/virsh-*-edit.c
|
2015-10-12 15:07:21 +00:00
|
|
|
/tools/virt-admin
|
2012-02-03 21:30:06 +00:00
|
|
|
/tools/virt-*-validate
|
|
|
|
|
/tools/virt-sanlock-cleanup
|
2014-01-15 17:06:58 +00:00
|
|
|
/tools/wireshark/src/libvirt
|
2010-11-16 19:29:09 +00:00
|
|
|
/update.log
|
2013-10-23 08:58:55 +00:00
|
|
|
GPATH
|
|
|
|
|
GRTAGS
|
|
|
|
|
GTAGS
|
2008-10-17 10:03:15 +00:00
|
|
|
Makefile
|
2008-10-28 17:47:12 +00:00
|
|
|
Makefile.in
|
2010-12-01 23:48:19 +00:00
|
|
|
TAGS
|
2008-10-28 17:47:12 +00:00
|
|
|
coverage
|
2009-07-03 14:32:17 +00:00
|
|
|
cscope.files
|
2012-11-05 04:59:53 +00:00
|
|
|
cscope.in.out
|
2009-07-03 14:32:17 +00:00
|
|
|
cscope.out
|
2012-11-05 04:59:53 +00:00
|
|
|
cscope.po.out
|
2008-10-28 17:47:12 +00:00
|
|
|
results.log
|
|
|
|
|
stamp-h
|
|
|
|
|
stamp-h.in
|
|
|
|
|
stamp-h1
|
2012-10-31 15:47:34 +00:00
|
|
|
tags
|
2016-06-17 17:31:42 +00:00
|
|
|
!/build-aux/*.pl
|
2011-07-28 12:55:21 +00:00
|
|
|
!/gnulib/lib/Makefile.am
|
|
|
|
|
!/gnulib/tests/Makefile.am
|
2011-04-05 19:06:31 +00:00
|
|
|
!/m4/virt-*.m4
|
