Commit Graph

3 Commits

Author SHA1 Message Date
Peter Krempa
1dcba456fa qemu: caps: Always assume presence of 'ide-hd' and 'ide-cd' devices
The split of ide-disk into the two separate devices was introduced by
qemu commit 1f56e32a7f4b3 released in qemu v0.15.

Note that when compared to the previous commit which made sure that no
disk related tests were touched, in this case it's not as careful.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2019-02-08 08:34:17 +01:00
Peter Krempa
caccbba64a qemu: capabilities: Always assume QEMU_CAPS_BOOTINDEX
The field was added in qemu v0.13.0-rc0-731-g1ca4d09ae0 so all supported
qemu versions now use it.

There's a LOT of test fallout as we did not use capabilities close
enough to upstream for many of our tests.

Several tests had a 'bootindex' variant. Since they'd become redundant
they are also removed here.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2018-08-09 17:00:54 +02:00
Ján Tomko
3527f9dde6 qemu: deny privilege elevation and spawn in seccomp
If QEMU uses a seccomp blacklist (since 2.11), -sandbox on
no longer tries to whitelist all the calls, but uses sets
of blacklists:
default (always blacklisted with -sandbox on)
obsolete (defaults to deny)
elevateprivileges (setuid & co, default: allow)
spawn (fork & execve, default: allow)
resourcecontrol (setaffinity, setscheduler, default: allow)

If these are supported, default to sandbox with all four
categories blacklisted.

https://bugzilla.redhat.com/show_bug.cgi?id=1492597

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-04-17 16:29:38 +02:00