Commit Graph

37911 Commits

Author SHA1 Message Date
Roman Bogorodskiy
9f78225886 docs: bhyve: document ignoring unknown MSRs
Ignoring unknown MSRs using <features> element
<msrs unknown='ignore'/> was supported for quite some already,
so add documentation for it for completeness of flags coverage,
as some guests can be extra picky about flags passed to bhyve,
and it's useful to know how to control those.

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-07-14 19:54:01 +04:00
Prathamesh Chavan
459c30d062 qemu_domainjob: Move PrivateXML parse-job and format-job
Functions `qemuDomainObjPrivateXMLParseJob` and
`qemuDomainObjPrivateXMLFormatJob` are moved from
`qemu_domain` to `qemu_domainjob`.

Signed-off-by: Prathamesh Chavan <pc44800@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-14 16:48:27 +02:00
Prathamesh Chavan
594e61ed82 qemu_domain: remove passing qemuDomainObjPrivatePtr as param
`qemuDomainObjPrivatePtr` parameter was avoided being passed
as a paramter in functions `qemuDomainObjPrivateXMLParseJob`
and `qemuDomainObjPrivateXMLFormatJob`, as we already pass
`virDomainObjPtr`, which can be used to get `privateData`
pointer.

Signed-off-by: Prathamesh Chavan <pc44800@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-14 16:48:20 +02:00
Andrea Bolognani
31939c80cd ci: Refresh Dockerfiles
All targets get cpanm, which is now part of the base system, and
xz is now installed explicitly instead of relying on it being either
present by default or dragged in indirectly.

The corresponding libvirt-ci commit is 8920e8f408ba.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2020-07-14 12:02:59 +02:00
Andrea Bolognani
4541d3a918 ci: Exclude macOS when generating Dockerfiles
Just like FreeBSD, macOS is not supported by the Dockerfile
generator.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2020-07-14 12:00:12 +02:00
Côme Borsoi
45ed335450 Translated using Weblate (French)
Currently translated at 11.8% (1222 of 10318 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/fr/

Signed-off-by: Côme Borsoi <fedora@borsoi.fr>
2020-07-13 22:04:40 +02:00
Jin Yan
2f470a4fb1 qemu: fix memleak in qemuDomainAttachDeviceLive()
During disk hot plugging, qemuDomainAttachDeviceLive() adds the new
disk to the device list of the VM object. However, hot plugging
cdroms and floppies only updates the src variable of the original
disk device, so the newly generated disk object needs to be freed.

Signed-off-by: Jin Yan <jinyan12@huawei.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 22:00:49 +02:00
Bastien Orivel
7187b8e2b6 news: Document the type attribute for mac addresses
Signed-off-by: Bastien Orivel <bastien.orivel@diateam.net>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 18:47:57 +02:00
Bastien Orivel
454e5961ab Add a type attribute on the mac address element
This is only used in the ESX driver where, when set to "static", it will
ignore all the checks libvirt does about the origin of the MAC address
(whether or not it's in a VMWare OUI) and forward the original one to
the ESX server telling it not to check it either.

This allows keeping a deterministic MAC address which can be useful for
licensed software which might dislike changes.

Signed-off-by: Bastien Orivel <bastien.orivel@diateam.net>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 18:47:44 +02:00
Daniel Henrique Barboza
c051e56d27 docs/kbase: introduce migrationinternals.rst
This document describes briefly how Libvirt migration internals
works, complementing the info available in migration.html.in.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:38 +02:00
Daniel Henrique Barboza
3734dba02e qemu_migration.c: modernize qemuMigrationSrcConfirmPhase()
Use g_autoptr() and remove both 'error' and 'cleanup' labels.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:34 +02:00
Daniel Henrique Barboza
e056fdaed5 libvirt-domain.c: g_autofree in virDomainMigrate() and virDomainMigrate2()
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:31 +02:00
Daniel Henrique Barboza
47fe0737b3 qemu_migration.c: use g_auto* in qemuMigrationDstFinish()
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:28 +02:00
Daniel Henrique Barboza
494a2acd09 qemu_migration.c: modernize qemuMigrationDstPersist()
Use g_autoptr() and remove the 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:25 +02:00
Daniel Henrique Barboza
ab6e89a81d qemu_migration.c: use g_auto* in qemuMigrationSrcPerformJob and Peer2Peer
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:23 +02:00
Daniel Henrique Barboza
866ce83c3e qemu_migration.c: use auto* in qemuMigrationSrcRun()
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:19 +02:00
Daniel Henrique Barboza
6f59ffb4c9 qemu_migration.c: modernize qemuMigrationSrcPerformNative()
Use g_autoptr() and remove the unneeded 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:16 +02:00
Daniel Henrique Barboza
b7d5277deb qemu_driver.c: use g_auto* in qemuDomainMigratePerform3* functions
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:10 +02:00
Daniel Henrique Barboza
c54dba525d qemu_migration_cookie.c: modernize qemuMigrationEatCookie()
Use g_autoptr() and remove the obsolete 'error' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:07 +02:00
Daniel Henrique Barboza
ce15bd09d1 qemu_migration.c: modernize qemuMigrationSrcBeginPhase()
Use g_autoptr() and remove the 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:04 +02:00
Daniel Henrique Barboza
78db83dc1a qemu_migration_cookie.h: register AUTOPTR_CLEANUP_FUNC for qemuMigrationCookiePtr
Next patch will use g_autoptr() in a qemuMigrationCookiePtr pointer to
modernize qemuMigrationSrcBeginPhase().

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:18:01 +02:00
Daniel Henrique Barboza
51f1e7f2da qemu_migration.c: use g_auto* in qemuMigrationDstPrepareDirect()
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:59 +02:00
Daniel Henrique Barboza
d9ea60c0a0 qemu_monitor_json.c: modernize qemuMonitorJSONMigrateIncoming()
Use g_autoptr() and remove the now obsolete 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:56 +02:00
Daniel Henrique Barboza
b75ff9a194 qemu_migration_params.c: use g_autofree in qemuMigrationParamsApply()
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:54 +02:00
Daniel Henrique Barboza
769de4695b qemu_migration_params.c: modernize qemuMigrationParamsEnableTLS()
Use g_autoptr() and remove both 'cleanup' and 'error' labels.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:52 +02:00
Daniel Henrique Barboza
5b4ae09e71 qemu_migration_params.c: modernize qemuMigrationParamsFetch()
Use g_autoptr() and remove the 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:49 +02:00
Daniel Henrique Barboza
db64224bca qemu_migration.c: use g_auto* in qemuMigrationDstPrepareAny()
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:47 +02:00
Daniel Henrique Barboza
1a86aee92a qemu_migration.c: modernize qemuMigrationDstPrepare()
Use g_autofree and remove the 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:44 +02:00
Daniel Henrique Barboza
e200803f45 qemu_driver.c: modernize qemuDomainMigratePrepare3Params()
Use variable autocleanup and remove the now obsolete 'cleanup'
label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:42 +02:00
Daniel Henrique Barboza
b2aefee3ef qemu_driver.c: modernize qemuDomainMigratePrepare3()
Use g_autoptr() on pointers and remove the unneeded 'cleanup'
label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:40 +02:00
Daniel Henrique Barboza
6c4a3e43e7 qemu_driver.c: modernize qemuDomainMigrateBegin3Params()
Use g_autofree and remove the unneeded 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:35 +02:00
Daniel Henrique Barboza
7916104971 libvirt-domain.c: use g_autofree in virDomainMigrateVersion* functions
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:32 +02:00
Daniel Henrique Barboza
37fce4c2ef libvirt-domain.c: modernize virDomainMigrateVersion1
Use g_autofree on strings and remove the 'done' label since it's
now unneeded.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:30 +02:00
Daniel Henrique Barboza
fe14a62121 libvirt-domain.c: modernize virDomainMigrateCheckNotLocal()
Use g_autoptr() and remove the 'cleanup' label.

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-13 17:17:27 +02:00
Nikolay Shirokovskiy
606e7e0318 storage: fix vstorage backend build
Add headers with declarations of  geteuid/getegid
and virGetUserName/virGetGroupName.

Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy@virtuozzo.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2020-07-13 09:27:42 +03:00
Laine Stump
866bb99644 docs: point out that locals should be defined at the top of a block of code
Although we have nothing in make syntax-check to enforce this, and
apparently there are places where it isn't the case (according to
Dan), we should discourage the practice of defining new variables in
the middle of a block of code.

https://www.redhat.com/archives/libvir-list/2020-July/msg00433.html

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2020-07-10 13:42:42 -04:00
Pavel Hrdina
b94856c919 docs: rename fig to svg in Makefile.am
Commit <9ad637c9651ff29955dd6aa8fe31f639b42b7315> converted all fig
files into svg files but did not change the Makefile.am.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2020-07-10 17:39:29 +02:00
Prathamesh Chavan
53a55eff59 qemu_domain: moved qemuDomainNamespace to qemu_domain
While moving the code, qemuDomainNamespace also was moved
to `qemu_domainjob`. Hence it is moved back to `qemu_domain`
where it will be more appropriate.

Signed-off-by: Prathamesh Chavan <pc44800@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 16:36:43 +02:00
Pavel Hrdina
e5c00317de wireshark: fix compilation errors
With meson introduction which is using the same CFLAGS for the whole
project some compilation errors were discovered. The wireshark plugin
library is the only one in tools directory that is not using AM_CFLAGS.

With the AM_CFLAGS we get these errors:

../../tools/wireshark/src/packet-libvirt.c: In function 'dissect_libvirt_fds':
../../tools/wireshark/src/packet-libvirt.c:348:31: error: unused parameter 'tvb' [-Werror=unused-parameter]
  348 | dissect_libvirt_fds(tvbuff_t *tvb, gint start, gint32 nfds)
      |                     ~~~~~~~~~~^~~
../../tools/wireshark/src/packet-libvirt.c:348:41: error: unused parameter 'start' [-Werror=unused-parameter]
  348 | dissect_libvirt_fds(tvbuff_t *tvb, gint start, gint32 nfds)
      |                                    ~~~~~^~~~~
../../tools/wireshark/src/packet-libvirt.c:348:55: error: unused parameter 'nfds' [-Werror=unused-parameter]
  348 | dissect_libvirt_fds(tvbuff_t *tvb, gint start, gint32 nfds)
      |                                                ~~~~~~~^~~~
At top level:
../../tools/wireshark/src/packet-libvirt.c:64:5: error: 'dissect_xdr_bool' defined but not used [-Werror=unused-function]
   64 |     dissect_xdr_##xtype(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf) \
      |     ^~~~~~~~~~~~
../../tools/wireshark/src/packet-libvirt.c:88:1: note: in expansion of macro 'XDR_PRIMITIVE_DISSECTOR'
   88 | XDR_PRIMITIVE_DISSECTOR(bool,    bool_t,  boolean)
      | ^~~~~~~~~~~~~~~~~~~~~~~
../../tools/wireshark/src/packet-libvirt.c:64:5: error: 'dissect_xdr_float' defined but not used [-Werror=unused-function]
   64 |     dissect_xdr_##xtype(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf) \
      |     ^~~~~~~~~~~~
../../tools/wireshark/src/packet-libvirt.c:86:1: note: in expansion of macro 'XDR_PRIMITIVE_DISSECTOR'
   86 | XDR_PRIMITIVE_DISSECTOR(float,   gfloat,  float)
      | ^~~~~~~~~~~~~~~~~~~~~~~
../../tools/wireshark/src/packet-libvirt.c:64:5: error: 'dissect_xdr_short' defined but not used [-Werror=unused-function]
   64 |     dissect_xdr_##xtype(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf) \
      |     ^~~~~~~~~~~~
../../tools/wireshark/src/packet-libvirt.c:80:1: note: in expansion of macro 'XDR_PRIMITIVE_DISSECTOR'
   80 | XDR_PRIMITIVE_DISSECTOR(short,   gint16,  int)
      | ^~~~~~~~~~~~~~~~~~~~~~~
../../tools/wireshark/src/packet-libvirt.c: In function 'dissect_libvirt_message':
../../tools/wireshark/src/packet-libvirt.c:423:34: error: null pointer dereference [-Werror=null-dereference]
  423 |         vir_xdr_dissector_t xd = find_payload_dissector(proc, type, get_program_data(prog, VIR_PROGRAM_DISSECTORS),
      |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  424 |                                                         *(gsize *)get_program_data(prog, VIR_PROGRAM_DISSECTORS_LEN));
      |                                                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-10 16:07:02 +02:00
Pavel Hrdina
d7147b3797 m4: virt-xdr: rewrite XDR check
The current code to check XDR support was obsolete and way to
complicated.

On linux we can use pkg-config to check for libtirpc and have
the CFLAGS and LIBS configured by it as well.

On MinGW there is portablexdr library which installs header files
directly into system include directory.

On FreeBSD and macOS XDR functions are part of libc so there is
no library needed, we just need to call AM_CONDITIONAL to silence
configure which otherwise complains about missing WITH_XDR.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-10 16:07:02 +02:00
Pavel Hrdina
d3a1a3d708 m4: virt-secdriver-selinux: drop obsolete function checks
All of the listed functions are available in libselinux version 2.2.
Our supported OSes start with version 2.5 so there is no need to check
it.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-07-10 16:07:02 +02:00
Pavel Hrdina
9ad637c965 docs: convert FIG files into SVG format
Converted by using:

    fig2dev -L svg <infile> <outfile>

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-07-10 16:07:02 +02:00
Pavel Hrdina
062f233b17 docs: drop %.png: %.fig rule
convert bin is part of ImageMagick package and uses uniconvertor to
create png file from fig files.

Unfortunately uniconvertor is python2 only and not available in most
recent distributions which makes the convert command fail with:

sh: uniconvertor: command not found
/usr/bin/mv: cannot stat '/tmp/magick-1397138DRT8Pzx4Qmoc.svg': No such file or directory
convert: delegate failed `'uniconvertor' '%i' '%o.svg'; /usr/bin/mv '%o.svg' '%o'' @ error/delegate.c/InvokeDelegate/1958.
convert: unable to open file `/tmp/magick-1397138S8ARueJXLXkc': No such file or directory @ error/constitute.c/ReadImage/605.
convert: no images defined `docs/migration-managed-direct.png' @ error/convert.c/ConvertImageCommand/3226.

It looks like that there are plans to somehow port uniconvertor into
python3 but as part of different project color-picker but the job is
far from complete.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-10 16:07:02 +02:00
Boris Fiuczynski
630ae5d88c docs: kbase: Fix the libvirt-host--validate typo
In f0d0cd6179 I introduced this typo.

Suggested-by: Erik Skultety <eskultet@redhat.com>
Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 15:04:04 +02:00
Michal Privoznik
77ef118456 qemu_security: Complete renaming of virSecurityManagerSetAllLabel() argument
Just like in the previous commit, the stdin_path argument of
virSecurityManagerSetAllLabel() is renamed to incomingPath.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 14:21:35 +02:00
Michal Privoznik
f68a14d17f secdrivers: Rename @stdin_path argument of virSecurityDomainSetAllLabel()
The argument (if not NULL) points to the file the domain is
restoring from. On QEMU command line this used to be '-incoming
$path', but we've switched to passing FD ages ago and thus this
argument is used only in AppArmor (which loads the profile on
domain start). Anyway, the argument does not refer to stdin,
rename it to 'incomingPath' then.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 14:20:07 +02:00
Michal Privoznik
7e235954e5 Revert "qemuSecurityDomainRestorePathLabel: Introduce @ignoreNS argument"
The only consumer was removed in the previous commit.

This reverts commit f03a38bd1d.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 14:18:50 +02:00
Michal Privoznik
824e349397 qemu: Use qemuSecuritySetSavedStateLabel() to label restore path
Currently, when restoring from a domain the path that the domain
restores from is labelled under qemuSecuritySetAllLabel() (and after
v6.3.0-rc1~108 even outside transactions). While this grants QEMU
the access, it has a flaw, because once the domain is restored, up
and running then qemuSecurityDomainRestorePathLabel() is called,
which is not real counterpart. In case of DAC driver the
SetAllLabel() does nothing with the restore path but
RestorePathLabel() does - it chown()-s the file back and since there
is no original label remembered, the file is chown()-ed to
root:root. While the apparent solution is to have DAC driver set the
label (and thus remember the original one) in SetAllLabel(), we can
do better.

Turns out, we are opening the file ourselves (because it may live on
a root squashed NFS) and then are just passing the FD to QEMU. But
this means, that we don't have to chown() the file at all, we need
to set SELinux labels and/or add the path to AppArmor profile.

And since we want to restore labels right after QEMU is done loading
the migration stream (we don't want to wait until
qemuSecurityRestoreAllLabel()), the best way to approach this is to
have separate APIs for labelling and restoring label on the restore
file.

I will investigate whether AppArmor can use the SavedStateLabel()
API instead of passing the restore path to SetAllLabel().

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1851016

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 14:18:07 +02:00
Michal Privoznik
d665b1ef3b security_selinux: Implement virSecurityManager{Set,Restore}SavedStateLabel
These APIs are are basically
virSecuritySELinuxDomainSetPathLabelRO() and
virSecuritySELinuxDomainRestorePathLabel().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 14:17:01 +02:00
Michal Privoznik
e69df41b6d qemu_security: Implement virSecurityManager{Set,Restore}SavedStateLabel
These APIs don't use namespaces because the
virSecurityManagerSetSavedStateLabel() runs
when the namespace doesn't exist yet and thus
the virSecurityManagerRestoreSavedStateLabel()
has to run without namespace too.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 14:16:27 +02:00