Commit Graph

38311 Commits

Author SHA1 Message Date
Michal Privoznik
228a27f59b security: Reintroduce virSecurityManager{Set,Restore}SavedStateLabel
These APIs were removed/renamed in v6.5.0-rc1~142 and v6.5.0-rc1~141
because they deemed unused. And if it wasn't for the RFE [1] things
would stay that way.

The RFE asks for us to not change DAC ownership on the file a domain is
restoring from. We have been doing that for ages (if not forever),
nevertheless it's annoying because if the restore file is on an NFS
remembering owner won't help - NFS doesn't support XATTRs yet. But more
importantly, there is no need for us to chown() the file because when
restoring the domain the file is opened and the FD is then passed to
QEMU. Therefore, we really need only to set SELinux and AppArmor.

This reverts bd22eec903.
This partially reverts 4ccbd207f2.

The difference to the original code is that secdrivers are now
not required to provide dummy implementation to avoid
virReportUnsupportedError(). The callback is run if it exists, if
it doesn't zero is returned without any error.

1: https://bugzilla.redhat.com/show_bug.cgi?id=1851016

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-07-10 14:14:09 +02:00
Michal Privoznik
c531f42755 virSecurityManagerMetadataLock: Ignore RO filesystem
When locking files for metadata change, we open() them for R/W
access. The write access is needed because we want to acquire
exclusive (write) lock (to mutually exclude with other daemons
trying to modify XATTRs on the same file). Anyway, the open()
might fail if the file lives on a RO filesystem. Well, if that's
the case, ignore the error and continue with the next file on the
list. We won't change any seclabel on the file anyway - there is
nothing to remember then.

Reported-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-10 14:09:22 +02:00
Michal Privoznik
0a145de970 virSecurityManagerMetadataLock: Clarify directory locking comment
In the light of recent commit of 9d83281382 fix the comment that
says directories can't be locked. Well, in general they can, but
not in our case.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-10 14:06:51 +02:00
Pavel Hrdina
78e76a8a42 tests: use WITH_NSS instead of NSS
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:58 +02:00
Pavel Hrdina
966a0a75cc tests: commandhelper: change how we detect if running as daemon
The old code works correctly with make and running directly from shell
but it failed with Meson test suite where session ID and process group
are the same in both cases.

What changes in both cases is parent process ID so use that instead of
session ID.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:55 +02:00
Pavel Hrdina
e7fc35ec11 src: remote: Makefile: properly format sysconfdir in virtproxyd.conf
Commit <5b816e16968ba02def56f067774ecd9a8c8d44d7> removed hard-coded
sysconfdir path from *.conf files but missed virtproxyd.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:52 +02:00
Pavel Hrdina
6d4e0b5c00 src: util: Makefile: drop undefined OPENPTY_LIBS
Commit <f650e86703847af544762d02f79c70131ff7fbab> added check for
openpty function from util library using AC_CHECK_LIB(). However, that
macro doesn't define OPENPTY_LIBS, it only defines WITH_LIBUTIL and
prepends -lutil into LIBS for the whole project.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:50 +02:00
Pavel Hrdina
eacdda1e7c src: util: Makefile: drop undefined LDEXP_LIBM
It was introduced by commit <c606671aaad10a9bc87f226bc473a091e00a9629>
as a gnulib ldexp module and later removed by commit
<09fe607b4de8eb883c966e90aaf5563299a22738>.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:48 +02:00
Pavel Hrdina
72e64d018b src: util: rename some program macros
Fixes inconsistency with macro names for external programs.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:45 +02:00
Pavel Hrdina
28ebb257e0 src: logging: Makefile: drop undefined LOG_DRIVER
Commit <0985a9597bb0348d46c0d18dc548a676bf0ad8e2> added unused variable
so remove it.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:43 +02:00
Pavel Hrdina
d0335ff259 src: remote: Makefile: drop CFLAGS and LDFLAGS duplication
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:40 +02:00
Pavel Hrdina
a073f83400 src: remove unnecessary -I$(srcdir)/secret include
Commit <894556ca813ad3c4ebb01083b7971d73b4f53c8b> moved function
virSecretGetSecretString out of secret directory but forgot to update
CFLAGS in places where the include is no longer needed.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:38 +02:00
Pavel Hrdina
67e79d7462 src: Makefile: remove LOCK_CHECKING_CFLAGS leftover
Commit <fd3b8fe7ad491c77c0b3f57110adaf64f743855e> removed objectlocking
test but forgot to remove all of the usages of LOCK_CHECKING_CFLAGS.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:35 +02:00
Pavel Hrdina
18c0588298 scripts: check-remote-protocol: remove unused OBJEXT argument
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:32 +02:00
Pavel Hrdina
c6a0d3ff8b po: change the format of POTFILES.in
There is no need to provide relative paths to the current directory if
we provide search paths using --directory option for xgettext.

In addition it will make libvirt.pot file look cleaner as it will not
contain relative paths to current directory. It improves the situation
for developers which are using different build path as that would
change the relative path in libvirt.pot as well. After this patch
it will not happen anymore.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:29 +02:00
Pavel Hrdina
f3b0261e1c m4: virt-selinux: drop check for selabel_open signature change
All supported OSes have at least libselinux version 2.5 so it's safe
to drop this check.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:27 +02:00
Pavel Hrdina
121d980bbb m4: virt-sanlock: drop check for sanlock_write_lockspace()
Function sanlock_write_lockspace() was introduced in 2.7 version which
is available in all supported OSes.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:24 +02:00
Pavel Hrdina
ab7204d908 m4: virt-sanlock: drop check for sanlock_killpath()
Function sanlock_killpath() was introduced in 2.4 version and had
modified one of the arguments from `char *` into `const char *` in
version 2.7. All of this is available in all supported OSes.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:22 +02:00
Pavel Hrdina
c495169478 m4: virt-sanlock: drop check for SANLK_INQ_WAIT
SANLK_INQ_WAIT was introduced in sanlock 2.4 which is available in all
supported OSes.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:20 +02:00
Pavel Hrdina
95037c48ef m4: virt-sanlock: use pkg-config to find libsanlock_client
The last distribution supported by libvirt and lacking pkg-config file
for libsanlock_client was Ubuntu 16.04. It is no longer supported so
switch to pkg-config.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:17 +02:00
Pavel Hrdina
4e27aa6e60 m4: virt-sanlock: drop check for sanlock_inq_lockspace
This check was introduced by commit
<96a02703daad4dc6663165adbc0feade9900cebd> to guard calling
sanlock_inq_lockspace() function but it used SANLK_INQ_WAIT as a
parameter which was introduced later.  This was eventually fixed by
commit <238dba0f9c925359cb3b8beddd8c8ae739cb4e06>.

We can safely replace check for sanlock_inq_lockspace as that function
was introduced in sanlock-1.9.  The oldest used version, sanlock-2.2,
is by Ubuntu 16.04.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:13 +02:00
Pavel Hrdina
9411bbcd5c docs: remove unused wrapstring.xsl file
Commit <d672551816e106f2ce8a6a04658691db96435fb5> removed last usage of
this file so drop it as well.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:11 +02:00
Pavel Hrdina
caa2545457 docs: remove incorrect generated files by apibuild.py
These files are generated by xsltproc as part of html/index.html and
html/index-%.html rules.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:09 +02:00
Pavel Hrdina
66e39b6e20 Makefile: drop undefined LIB_CLOCK_GETTIME
This was introduced together with clock-time gnulib module by commit
<d74e5a4dfc434d3a1d01856d013a7f50d910fa95> and removed from libvirt
by commit <86d223a762990c9d529065a2d3b30b6a00ea63dd>.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:06 +02:00
Pavel Hrdina
cb3b37bb39 configure: remove usage of AC_HEADER_MAJOR
Commit <03c532cf9711dd6ad35380455a77141ef7d492ab> removed usage of
MAJOR_IN_MKDEV and MAJOR_IN_SYSMACROS from libvirt which makes the
AC_HEADER_MAJOR useless.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:04 +02:00
Pavel Hrdina
9bc09df873 configure: introduce FLAT_NAMESPACE_FLAGS
Set FLAT_NAMESPACE_FLAGS to -Wl,-flat_namespace in configure only for
macOS and use it unconditionally in Makefiles.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:02 +02:00
Pavel Hrdina
83131d9714 configure: drop check for unsupported FreeBSD
FreeBSD 10 is no longer supported by libvirt and the struct member
ifi_oqdrops is usable without any define on later FreeBSD versions.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:40:00 +02:00
Pavel Hrdina
6c1ee710b1 build: use DLOPEN_LIBS directly
There is no need to have DRIVER_MODULES_LIBS as it's used only for
libvirt.so. The other places are using DLOPEN_LIBS directly and dlopen
is required if building with libvirtd.

It's mandatory since <5aec02dc37623bf739d1edd8f2be3e4ad9f94ff5>.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-10 09:39:47 +02:00
Ján Tomko
2c846fa6bc util: fix accessibility check for hook directory
virFileIsAccessible does not return true on accessible
directories. Check whether it set EISDIR and only
then assume the directory is inaccessible.

Return 0 (not found) instead of 1 (found),
since the bridge driver taints the network based on
this return value, not whether the hook actually ran.

Remove the bogus check from virHookCall, since it already
checks the virHooksFound bitmap that was filled before
by virHookCheck.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Fixes: 7fa7f7eeb6
Closes: https://gitlab.com/libvirt/libvirt/-/issues/47
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-07-09 17:49:27 +02:00
Roman Bogorodskiy
d38559f0b6 cpu_arm: fix build on non-Linux
- Add a check for asm/hwcap.h header presence,
 - Add a check for getauxval() function that is used
   on Linux, and for elf_aux_info() which is a FreeBSD
   equivalent.

This is based on a patch submitted by Mikael Urankar in
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=247722.

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-07-09 18:55:27 +04:00
Martin Kletzander
9d83281382 resctrl: Do not open directory for writing
When preparing for the removal of GNULIB commit 18dca21a32 removed the
unneeded O_DIRECTORY, but unfortunately started opening the directory for
writing which fails every time for a directory.  There is also no need for that
as flock() works on O_RDONLY file descriptor as well, even for LOCK_EX.

https://bugzilla.redhat.com/1852741

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2020-07-09 13:45:01 +02:00
Bastien Orivel
518a4db628 Add a changelog entry for the esx NIC limit changes
This was forgotten in 4bd375b6ce

Signed-off-by: Bastien Orivel <bastien.orivel@diateam.net>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2020-07-09 13:10:33 +02:00
Fangge Jin
500810f3c5 src: fix word spell typos
Signed-off-by: Fangge Jin <fjin@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2020-07-09 10:01:41 +02:00
Ryan Schmidt
807095fdee Replace "OS-X" with "macOS" in index.html.in
Apple changed the operating system's name from "OS X" to "macOS" a few years ago.

Signed-off-by: Ryan Schmidt <git@ryandesign.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2020-07-09 09:14:51 +02:00
Nicolas Brignone
a4d97f0c19 conf: use g_autofree for all pointers to virXMLPropString() in device_conf.c
All modified functions are similar, in all cases "cleanup" label is removed,
along with all the "goto" calls.

Signed-off-by: Nicolas Brignone <nmbrignone@gmail.com>
Reviewed-by: Laine Stump <laine@redhat.com>
2020-07-08 23:11:21 -04:00
Laine Stump
310ce7cf7e eliminate unnecessary labels and ret variables
after making all virFirewall objects use g_autoptr().

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:36:22 -04:00
Laine Stump
cf1ec5daac use g_autoptr() for all usages of virFirewallNew/Free
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:36:19 -04:00
Laine Stump
322727a4cb storage: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:36:16 -04:00
Laine Stump
e205c3ebfa nwfilter: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:36:12 -04:00
Laine Stump
e54bb482a1 esx: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:36:09 -04:00
Laine Stump
c02a08ec5a lxc: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:36:05 -04:00
Laine Stump
8d591eb167 network: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:36:02 -04:00
Laine Stump
5cd1b25bd2 tools: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:58 -04:00
Laine Stump
7f141a1c62 tests: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:54 -04:00
Laine Stump
f3c87f098e util: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:48 -04:00
Laine Stump
6351c85762 libxl: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:44 -04:00
Laine Stump
cf01360489 conf: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:36 -04:00
Laine Stump
ac59ecc9f8 bhyve: eliminate unnecessary labels
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:25 -04:00
Laine Stump
84fddfed45 libxl: eliminate extra copy of string
libxlMakeNic was calling g_strdup(virBufferCurrentContent(&buf)) to
make a copy of the buffer contents, and then later freeing the buffer
without ever using it again. Instead of this extra strdup, just
transfer ownership of the virBuffer's string with
virBufferContentAndReset(), and be done with it.

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:18 -04:00
Laine Stump
065f7d5ba9 remove redundant calls to virBufferFreeAndReset()
There are several calls to virBufferFreeAndReset() when functions
encounter an error, but the caller never uses the virBuffer once an
error has been encountered (all callers detect error by looking at the
function return value, not the contents of the virBuffer being
operated on), and now that all virBuffers are auto-freed there is no
reason for the lower level functions like these to spend time freeing
a buffer that is guaranteed to be freed momentarily anyway.

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-07-08 16:35:05 -04:00