Libvirt provides a portable, long term stable C API for managing the virtualization technologies provided by many operating systems. It includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER Hypervisor.
Go to file
Andrea Bolognani 262672dbbf qemu_firmware: Enable loader.secure when requires-smm
Currently, a firmware configuration such as

  <os firmware='efi'>
    <firmware>
      <feature enabled='yes' name='enrolled-keys'/>
    </firmware>
  </os>

will correctly pick a firmware that implements the Secure Boot
feature and initialize the NVRAM file so that it contains the
keys necessary to enforce the signing requirements. However, the
lack of a

  <loader secure='yes'/>

element makes it possible for pflash writes to happen outside
of SMM mode. This means that the authenticated UEFI variables
where the keys are stored could potentially be overwritten by
malicious code running in the guest, thus making it possible to
circumvent Secure Boot.

To prevent that from happening, automatically turn on the
loader.secure feature whenever a firmware that implements Secure
Boot is chosen by the firmware autoselection logic. This is
identical to the way we already automatically enable SMM in such
a scenario.

Note that, while this is technically a guest-visible change, it
will not affect migration of existings VMs and will not prevent
legitimate guest code from running.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-07-01 15:10:39 +02:00
.ctags.d maint: Add support for .ctags.d 2019-05-31 17:54:28 +02:00
.github/workflows Switch to new GitHub repo-lockdown configuration 2021-10-20 14:27:20 +01:00
.gitlab/issue_templates gitlab: issue_template: Remove labelling commands 2022-06-01 12:27:10 +02:00
build-aux syntax-check: Add check prohibiting remote reference to local file 2022-06-01 12:27:10 +02:00
ci ci: Move upstream QEMU integration test to Fedora 36 2022-06-09 14:41:44 +02:00
docs docs: clarify 'readahead' and 'timeout' for disks 2022-06-24 09:03:54 -05:00
examples Introduce VIR_DOMAIN_RUNNING_POSTCOPY_FAILED 2022-06-07 17:40:20 +02:00
include API: Remove internal impl detail from VIR_DOMAIN_IOTHREAD_THREAD_POOL_{MIN,MAX} description 2022-06-30 09:54:40 +02:00
po Translated using Weblate (Korean) 2022-06-30 02:21:26 +02:00
scripts docs: Add HTML reference checker 2022-06-01 12:27:10 +02:00
src qemu_firmware: Enable loader.secure when requires-smm 2022-07-01 15:10:39 +02:00
tests qemu_firmware: Enable loader.secure when requires-smm 2022-07-01 15:10:39 +02:00
tools virsh: Add support for VIR_MIGRATE_ZEROCOPY flag 2022-06-23 16:45:39 +02:00
.ctags ctags: Generate tags for headers, i.e. function prototypes 2018-09-18 14:21:33 +02:00
.dir-locals.el
.editorconfig Add .editorconfig 2019-09-06 12:47:46 +02:00
.gitattributes Add .gitattributes file 2022-03-17 14:33:12 +01:00
.gitignore gitignore: Ignore __pycache__ directory 2021-03-22 12:05:11 +01:00
.gitlab-ci.yml gitlab: mark job dependencies as optional 2022-05-27 08:11:15 -04:00
.gitmodules gnulib: delete all gnulib integration 2020-02-07 15:03:54 +00:00
.gitpublish gitpublish: add a subject prefix 2020-01-16 13:04:11 +00:00
.mailmap mailmap: consolidate my email addresses 2020-10-06 12:05:09 +02:00
AUTHORS.rst.in AUTHORS: change my (Nikolay Shirokovskiy) email 2022-04-06 11:00:53 +03:00
config.h configure: bump min required CLang to 6.0 / XCode 10.0 2022-01-17 10:44:29 +00:00
configmake.h.in meson: generate configmake.h 2020-08-03 09:26:48 +02:00
CONTRIBUTING.rst meson: adjust our documentation to mention meson instead of autoconf 2020-08-03 09:27:09 +02:00
COPYING
COPYING.LESSER maint: Remove control characters from LGPL license file 2015-09-25 09:16:24 +02:00
gitdm.config gitdm: add 'ibm' file 2019-10-18 17:32:52 +02:00
libvirt-admin.pc.in
libvirt-lxc.pc.in
libvirt-qemu.pc.in
libvirt.pc.in
libvirt.spec.in spec: Fix indentation 2022-06-13 09:09:35 -04:00
meson_options.txt meson: Introduce qemu_datadir option 2021-11-18 15:48:59 +01:00
meson.build meson: Require gnutls-3.6.0 or newer 2022-07-01 13:04:58 +02:00
mingw-libvirt.spec.in rpm: fix mingw obsoletes lines 2021-08-02 13:47:20 +01:00
NEWS.rst Post-release version bump to 8.6.0 2022-07-01 11:27:31 +02:00
README.rst README: drop Travis CI badge 2020-08-03 15:08:28 +02:00
run.in run: gracefully handle SIGHUP, SIGQUIT, SIGTERM 2022-03-10 08:06:12 +00:00

GitLab CI Build Status

CII Best Practices

Translation status

Libvirt API for virtualization

Libvirt provides a portable, long term stable C API for managing the virtualization technologies provided by many operating systems. It includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER Hypervisor.

For some of these hypervisors, it provides a stateful management daemon which runs on the virtualization host allowing access to the API both by non-privileged local users and remote users.

Layered packages provide bindings of the libvirt C API into other languages including Python, Perl, PHP, Go, Java, OCaml, as well as mappings into object systems such as GObject, CIM and SNMP.

Further information about the libvirt project can be found on the website:

https://libvirt.org

License

The libvirt C API is distributed under the terms of GNU Lesser General Public License, version 2.1 (or later). Some parts of the code that are not part of the C library may have the more restrictive GNU General Public License, version 2.0 (or later). See the files COPYING.LESSER and COPYING for full license terms & conditions.

Installation

Instructions on building and installing libvirt can be found on the website:

https://libvirt.org/compiling.html

Contributing

The libvirt project welcomes contributions in many ways. For most components the best way to contribute is to send patches to the primary development mailing list. Further guidance on this can be found on the website:

https://libvirt.org/contribute.html

Contact

The libvirt project has two primary mailing lists:

Further details on contacting the project are available on the website:

https://libvirt.org/contact.html