External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-10-05 22:05:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

conf: Audit TPM emulator device at domain startup

Browse Source 
Extend the existing auditing with auditing for the TPM emulator.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
Stefan Berger 2018-05-24 10:51:26 -04:00
parent ff907a46dd
commit 6f06a6c145
2 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/auditlog.html.in
View File

@ -264,7 +264,7 @@
<dt><code>reason</code></dt> <dt><code>reason</code></dt>
<dd>The reason which caused the resource to be assigned to happen</dd> <dd>The reason which caused the resource to be assigned to happen</dd>
<dt><code>resrc</code></dt> <dt><code>resrc</code></dt>
<dd>The type of resource assigned. Set to <code>tpm</code></dd> <dd>The type of resource assigned. Set to <code>tpm</code> or <code>tpm-emulator</code></dd>
<dt><code>device</code></dt> <dt><code>device</code></dt>
<dd>The path of the host TPM device assigned to the guest</dd> <dd>The path of the host TPM device assigned to the guest</dd>
</dl> </dl>

16
src/conf/domain_audit.c
View File

@ -555,12 +555,13 @@ virDomainAuditRedirdev(virDomainObjPtr vm, virDomainRedirdevDefPtr redirdev,
/** /**
* virDomainAuditTPM: * virDomainAuditTPM:
* @vm: domain making a change in pass-through host device * @vm: domain making a change in pass-through host device or emulator
* @tpm: TPM device being attached or removed * @tpm: TPM device being attached or removed
* @reason: one of "start", "attach", or "detach" * @reason: one of "start", "attach", or "detach"
* @success: true if the device passthrough operation succeeded * @success: true if the device operation succeeded
* *
* Log an audit message about an attempted device passthrough change. * Log an audit message about an attempted device passthrough or emulator
* change.
*/ */
static void static void
virDomainAuditTPM(virDomainObjPtr vm, virDomainTPMDefPtr tpm, virDomainAuditTPM(virDomainObjPtr vm, virDomainTPMDefPtr tpm,
@ -596,6 +597,15 @@ virDomainAuditTPM(virDomainObjPtr vm, virDomainTPMDefPtr tpm,
virt, reason, vmname, uuidstr, device); virt, reason, vmname, uuidstr, device);
break; break;
case VIR_DOMAIN_TPM_TYPE_EMULATOR: case VIR_DOMAIN_TPM_TYPE_EMULATOR:
path = tpm->data.emulator.source.data.nix.path;
if (!(device = virAuditEncode("device", VIR_AUDIT_STR(path)))) {
VIR_WARN("OOM while encoding audit message");
goto cleanup;
}
VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success,
"virt=%s resrc=tpm-emulator reason=%s %s uuid=%s %s",
virt, reason, vmname, uuidstr, device);
break; break;
case VIR_DOMAIN_TPM_TYPE_LAST: case VIR_DOMAIN_TPM_TYPE_LAST:
default: default: