External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 13:45:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu: Store state of FIPS in virQEMUDriver

Browse Source 
Rather than re-query all the time we can cache the state of FIPS of the
host as it will not change during the runtime of the guest.

Introduce a 'hostFips' flag to 'virQEMUDriver' and move the code
checking the state from 'qemuCheckFips' to 'qemuStateInitialize' and
also populate 'hostFips' in qemuxml2argvtest.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
This commit is contained in:
Peter Krempa 2022-05-16 12:47:19 +02:00
parent 552790edf2
commit b5fd6f2b68
4 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/qemu/qemu_command.c
View File

@ -1787,21 +1787,11 @@ bool
qemuCheckFips(virDomainObj *vm)
{
qemuDomainObjPrivate *priv = vm->privateData;
virQEMUCaps *qemuCaps = priv->qemuCaps;
if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_ENABLE_FIPS))
if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ENABLE_FIPS))
return false;
if (virFileExists("/proc/sys/crypto/fips_enabled")) {
g_autofree char *buf = NULL;
if (virFileReadAll("/proc/sys/crypto/fips_enabled", 10, &buf) < 0)
return false;
if (STREQ(buf, "1\n"))
return true;
}
return false;
return priv->driver->hostFips;
}

1
src/qemu/qemu_conf.h
View File

@ -251,6 +251,7 @@ struct _virQEMUDriver {
/* Immutable values */
bool privileged;
char *embeddedRoot;
bool hostFips; /* FIPS mode is enabled on the host */
/* Immutable pointers. Caller must provide locking */
virStateInhibitCallback inhibitCallback;

9
src/qemu/qemu_driver.c
View File

@ -735,6 +735,15 @@ qemuStateInitialize(bool privileged,
if (qemuMigrationDstErrorInit(qemu_driver) < 0)
goto error;
/* qemu-5.1 and older requires use of '-enable-fips' flag when the host
* is in FIPS mode. We store whether FIPS is enabled */
if (virFileExists("/proc/sys/crypto/fips_enabled")) {
g_autofree char *buf = NULL;
if (virFileReadAll("/proc/sys/crypto/fips_enabled", 10, &buf) > 0)
qemu_driver->hostFips = STREQ(buf, "1\n");
}
if (privileged) {
g_autofree char *channeldir = NULL;

5
tests/qemuxml2argvtest.c
View File

@ -386,9 +386,12 @@ testCompareXMLToArgvCreateArgs(virQEMUDriver *drv,
unsigned int flags)
{
qemuDomainObjPrivate *priv = vm->privateData;
bool enableFips = !!(flags & FLAG_FIPS_HOST);
bool enableFips;
size_t i;
drv->hostFips = flags & FLAG_FIPS_HOST;
enableFips = drv->hostFips;
if (qemuProcessCreatePretendCmdPrepare(drv, vm, migrateURI,
VIR_QEMU_PROCESS_START_COLD) < 0)
return NULL;