External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-09 23:10:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
3fff8c91b0
libvirt/po/POTFILES
Daniel P. Berrangé 3fff8c91b0 network: introduce a "none" firewall backend type 
There are two scenarios identified after the recent firewall backend
selection was introduced, which result in libvirtd failing to startup
due to an inability to find either iptables/nftables

 - On Linux if running unprivileged with $PATH lacking the dir
   containing iptables/nftables
 - On non-Linux where iptables/nftables never existed

In the former case, it is preferrable to restore the behaviour whereby
the driver starts successfully. Users will get an error reported when
attempting to start any virtual network, due to the lack of permissions
needed to create bridge devices. This makes the missing firewall backend
irrelevant.

In the latter case, the network driver calls the 'nop' platform
implementation which does not attempt to implement any firewall logic,
just allowing the network to start without firewall rules.

To solve this are number of changes are required

 * Introduce VIR_FIREWALL_BACKEND_NONE, which does nothing except
   report a fatal error from virFirewallApply(). This code path
   is unreachable, since we'll never create a virFirewall
   object with with VIR_FIREWALL_BACKEND_NONE, so the error reporting
   is just a sanity check.

 * Ignore the compile time backend defaults and assume use of
   the 'none' backend if running unprivileged.

   This fixes the first regression, avoiding the failure to start
   libvirtd on Linux in unprivileged context, instead allowing use
   of the driver and expecting a permission denied when creating a
   bridge.

 * Reject the use of compile time backend defaults no non-Linux
   and hardcode the 'none' backend. The non-Linux platforms have
   no firewall implementation at all currently, so there's no
   reason to permit the use of 'firewall_backend_priority'
   meson option.

   This fixes the second regression, avoiding the failure to start
   libvirtd on non-Linux hosts due to non-existant Linux binaries.

 * Change the Linux platform backend to raise an error if the
   firewall backend is 'none'. Again this code path is unreachable
   by default since we'll fail to create the bridge before getting
   here, but if someone modified network.conf to request the 'none'
   backend, this will stop further progress.

 * Change the nop platform backend to raise an error if the
   firewall backend is 'iptables' or 'nftables'. Again this code
   path is unreachable, since we should already have failed to
   find the iptables/nftables binaries on non-Linux hosts, so
   this is just a sanity check.

 * 'none' is not permited as a value in 'firewall_backend_priority'
   meson option, since it is conceptually meaningless to ask for
   that on Linux.

NB, 'firewall_backend_priority' allows repeated options temporarily,
which we don't want. Meson intends to turn this into a hard error

  DEPRECATION: Duplicated values in array option is deprecated. This will become a hard error in the future.

and we can live with the reduced error checking until that happens.

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-06-17 15:55:14 +01:00

400 lines
10 KiB
Plaintext
Raw Blame History

src/access/viraccessapicheck.c
src/access/viraccessapichecklxc.c
src/access/viraccessapicheckqemu.c
src/admin/admin_client.h
src/admin/admin_server_dispatch_stubs.h
src/remote/remote_client_bodies.h
src/remote/remote_daemon_dispatch_stubs.h
src/access/viraccessdriverpolkit.c
src/access/viraccessmanager.c
src/admin/admin_server.c
src/admin/admin_server_dispatch.c
src/admin/libvirt-admin.c
src/bhyve/bhyve_capabilities.c
src/bhyve/bhyve_command.c
src/bhyve/bhyve_domain.c
src/bhyve/bhyve_driver.c
src/bhyve/bhyve_firmware.c
src/bhyve/bhyve_monitor.c
src/bhyve/bhyve_parse_command.c
src/bhyve/bhyve_process.c
src/ch/ch_conf.c
src/ch/ch_domain.c
src/ch/ch_driver.c
src/ch/ch_interface.c
src/ch/ch_monitor.c
src/ch/ch_process.c
src/conf/backup_conf.c
src/conf/capabilities.c
src/conf/checkpoint_conf.c
src/conf/cpu_conf.c
src/conf/device_conf.c
src/conf/domain_addr.c
src/conf/domain_capabilities.c
src/conf/domain_conf.c
src/conf/domain_event.c
src/conf/domain_postparse.c
src/conf/domain_validate.c
src/conf/interface_conf.c
src/conf/netdev_bandwidth_conf.c
src/conf/netdev_vlan_conf.c
src/conf/netdev_vport_profile_conf.c
src/conf/network_conf.c
src/conf/networkcommon_conf.c
src/conf/node_device_conf.c
src/conf/node_device_util.c
src/conf/numa_conf.c
src/conf/nwfilter_conf.c
src/conf/nwfilter_params.c
src/conf/object_event.c
src/conf/secret_conf.c
src/conf/snapshot_conf.c
src/conf/storage_adapter_conf.c
src/conf/storage_conf.c
src/conf/storage_encryption_conf.c
src/conf/storage_source_conf.c
src/conf/virchrdev.c
src/conf/virdomainjob.c
src/conf/virdomainmomentobjlist.c
src/conf/virdomainobjlist.c
src/conf/virnetworkobj.c
src/conf/virnetworkportdef.c
src/conf/virnodedeviceobj.c
src/conf/virnwfilterbindingdef.c
src/conf/virnwfilterbindingobj.c
src/conf/virnwfilterbindingobjlist.c
src/conf/virnwfilterobj.c
src/conf/virsavecookie.c
src/conf/virsecretobj.c
src/conf/virstorageobj.c
src/cpu/cpu.c
src/cpu/cpu_arm.c
src/cpu/cpu_map.c
src/cpu/cpu_ppc64.c
src/cpu/cpu_riscv64.c
src/cpu/cpu_s390.c
src/cpu/cpu_x86.c
src/datatypes.c
src/driver.c
src/esx/esx_driver.c
src/esx/esx_network_driver.c
src/esx/esx_storage_backend_iscsi.c
src/esx/esx_storage_backend_vmfs.c
src/esx/esx_storage_driver.c
src/esx/esx_stream.c
src/esx/esx_util.c
src/esx/esx_util.h
src/esx/esx_vi.c
src/esx/esx_vi_methods.c
src/esx/esx_vi_types.c
src/hyperv/hyperv_driver.c
src/hyperv/hyperv_network_driver.c
src/hyperv/hyperv_util.c
src/hyperv/hyperv_wmi.c
src/hypervisor/domain_cgroup.c
src/hypervisor/domain_driver.c
src/hypervisor/domain_interface.c
src/hypervisor/virhostdev.c
src/interface/interface_backend_netcf.c
src/interface/interface_backend_udev.c
src/internal.h
src/libvirt-domain-checkpoint.c
src/libvirt-domain-snapshot.c
src/libvirt-domain.c
src/libvirt-host.c
src/libvirt-lxc.c
src/libvirt-network.c
src/libvirt-nodedev.c
src/libvirt-nwfilter.c
src/libvirt-qemu.c
src/libvirt-secret.c
src/libvirt-storage.c
src/libvirt-stream.c
src/libvirt.c
src/libxl/libxl_capabilities.c
src/libxl/libxl_conf.c
src/libxl/libxl_domain.c
src/libxl/libxl_driver.c
src/libxl/libxl_migration.c
src/libxl/xen_common.c
src/libxl/xen_xl.c
src/libxl/xen_xm.c
src/locking/lock_daemon.c
src/locking/lock_daemon_dispatch.c
src/locking/lock_driver_lockd.c
src/locking/lock_driver_sanlock.c
src/locking/lock_manager.c
src/locking/sanlock_helper.c
src/logging/log_cleaner.c
src/logging/log_daemon.c
src/logging/log_daemon_dispatch.c
src/logging/log_handler.c
src/logging/log_manager.c
src/lxc/lxc_cgroup.c
src/lxc/lxc_conf.c
src/lxc/lxc_container.c
src/lxc/lxc_controller.c
src/lxc/lxc_domain.c
src/lxc/lxc_driver.c
src/lxc/lxc_fuse.c
src/lxc/lxc_hostdev.c
src/lxc/lxc_native.c
src/lxc/lxc_process.c
src/network/bridge_driver.c
src/network/bridge_driver_conf.c
src/network/bridge_driver_linux.c
src/network/bridge_driver_nop.c
src/network/leaseshelper.c
src/network/network_iptables.c
src/network/network_nftables.c
src/node_device/node_device_driver.c
src/node_device/node_device_udev.c
src/nwfilter/nwfilter_dhcpsnoop.c
src/nwfilter/nwfilter_driver.c
src/nwfilter/nwfilter_ebiptables_driver.c
src/nwfilter/nwfilter_gentech_driver.c
src/nwfilter/nwfilter_learnipaddr.c
src/openvz/openvz_conf.c
src/openvz/openvz_driver.c
src/openvz/openvz_util.c
src/qemu/qemu_agent.c
src/qemu/qemu_alias.c
src/qemu/qemu_backup.c
src/qemu/qemu_block.c
src/qemu/qemu_blockjob.c
src/qemu/qemu_capabilities.c
src/qemu/qemu_cgroup.c
src/qemu/qemu_checkpoint.c
src/qemu/qemu_command.c
src/qemu/qemu_conf.c
src/qemu/qemu_dbus.c
src/qemu/qemu_domain.c
src/qemu/qemu_domain_address.c
src/qemu/qemu_domainjob.c
src/qemu/qemu_driver.c
src/qemu/qemu_extdevice.c
src/qemu/qemu_fd.c
src/qemu/qemu_firmware.c
src/qemu/qemu_hostdev.c
src/qemu/qemu_hotplug.c
src/qemu/qemu_interface.c
src/qemu/qemu_interop_config.c
src/qemu/qemu_logcontext.c
src/qemu/qemu_migration.c
src/qemu/qemu_migration_cookie.c
src/qemu/qemu_migration_params.c
src/qemu/qemu_monitor.c
src/qemu/qemu_monitor_json.c
src/qemu/qemu_monitor_text.c
src/qemu/qemu_namespace.c
src/qemu/qemu_nbdkit.c
src/qemu/qemu_passt.c
src/qemu/qemu_process.c
src/qemu/qemu_qapi.c
src/qemu/qemu_saveimage.c
src/qemu/qemu_slirp.c
src/qemu/qemu_snapshot.c
src/qemu/qemu_tpm.c
src/qemu/qemu_validate.c
src/qemu/qemu_vhost_user.c
src/qemu/qemu_vhost_user_gpu.c
src/qemu/qemu_virtiofs.c
src/remote/remote_daemon.c
src/remote/remote_daemon_config.c
src/remote/remote_daemon_dispatch.c
src/remote/remote_daemon_stream.c
src/remote/remote_driver.c
src/remote/remote_sockets.c
src/remote/remote_ssh_helper.c
src/rpc/virkeepalive.c
src/rpc/virnetclient.c
src/rpc/virnetclientprogram.c
src/rpc/virnetclientstream.c
src/rpc/virnetdaemon.c
src/rpc/virnetlibsshsession.c
src/rpc/virnetmessage.c
src/rpc/virnetsaslcontext.c
src/rpc/virnetserver.c
src/rpc/virnetserverclient.c
src/rpc/virnetserverprogram.c
src/rpc/virnetserverservice.c
src/rpc/virnetsocket.c
src/rpc/virnetsshsession.c
src/rpc/virnettlscert.c
src/rpc/virnettlscontext.c
src/secret/secret_driver.c
src/security/security_apparmor.c
src/security/security_dac.c
src/security/security_driver.c
src/security/security_manager.c
src/security/security_selinux.c
src/security/security_util.c
src/security/virt-aa-helper.c
src/storage/parthelper.c
src/storage/storage_backend.c
src/storage/storage_backend_disk.c
src/storage/storage_backend_fs.c
src/storage/storage_backend_gluster.c
src/storage/storage_backend_iscsi.c
src/storage/storage_backend_iscsi_direct.c
src/storage/storage_backend_logical.c
src/storage/storage_backend_mpath.c
src/storage/storage_backend_rbd.c
src/storage/storage_backend_scsi.c
src/storage/storage_backend_vstorage.c
src/storage/storage_backend_zfs.c
src/storage/storage_driver.c
src/storage/storage_util.c
src/storage_file/storage_file_backend.c
src/storage_file/storage_file_backend_fs.c
src/storage_file/storage_file_backend_gluster.c
src/storage_file/storage_file_probe.c
src/storage_file/storage_source.c
src/storage_file/storage_source_backingstore.c
src/test/test_driver.c
src/util/iohelper.c
src/util/viracpi.c
src/util/viralloc.c
src/util/virarptable.c
src/util/viraudit.c
src/util/virauth.c
src/util/virauthconfig.c
src/util/virbitmap.c
src/util/vircgroup.c
src/util/virccw.c
src/util/vircgroupbackend.c
src/util/vircgroupbackend.h
src/util/vircgroupv1.c
src/util/vircgroupv2.c
src/util/vircgroupv2devices.c
src/util/vircommand.c
src/util/virconf.c
src/util/vircrypto.c
src/util/virdaemon.c
src/util/virdevmapper.c
src/util/virdnsmasq.c
src/util/virerror.c
src/util/virerror.h
src/util/virevent.c
src/util/vireventthread.c
src/util/virfcp.c
src/util/virfdstream.c
src/util/virfile.c
src/util/virfilecache.c
src/util/virfirewall.c
src/util/virfirewalld.c
src/util/virfirmware.c
src/util/virgdbus.c
src/util/virhash.c
src/util/virhook.c
src/util/virhostcpu.c
src/util/virhostmem.c
src/util/virhostuptime.c
src/util/viridentity.c
src/util/virinitctl.c
src/util/viriscsi.c
src/util/virjson.c
src/util/virlease.c
src/util/virlockspace.c
src/util/virlog.c
src/util/virmacmap.c
src/util/virmdev.c
src/util/virmodule.c
src/util/virnetdev.c
src/util/virnetdevbandwidth.c
src/util/virnetdevbridge.c
src/util/virnetdevip.c
src/util/virnetdevmacvlan.c
src/util/virnetdevmidonet.c
src/util/virnetdevopenvswitch.c
src/util/virnetdevtap.c
src/util/virnetdevveth.c
src/util/virnetdevvportprofile.c
src/util/virnetlink.c
src/util/virnodesuspend.c
src/util/virnuma.c
src/util/virnvme.c
src/util/virobject.c
src/util/virpci.c
src/util/virperf.c
src/util/virpidfile.c
src/util/virpolkit.c
src/util/virportallocator.c
src/util/virprocess.c
src/util/virqemu.c
src/util/virrandom.c
src/util/virresctrl.c
src/util/virrotatingfile.c
src/util/virscsi.c
src/util/virscsihost.c
src/util/virscsivhost.c
src/util/virsecret.c
src/util/virsocketaddr.c
src/util/virstoragefile.c
src/util/virstring.c
src/util/virsysinfo.c
src/util/virsystemd.c
src/util/virthreadjob.c
src/util/virthreadpool.c
src/util/virtime.c
src/util/virtpm.c
src/util/virtypedparam-public.c
src/util/virtypedparam.c
src/util/viruri.c
src/util/virusb.c
src/util/virutil.c
src/util/virvhba.c
src/util/virvsock.c
src/util/virxml.c
src/vbox/vbox_XPCOMCGlue.c
src/vbox/vbox_common.c
src/vbox/vbox_driver.c
src/vbox/vbox_network.c
src/vbox/vbox_snapshot_conf.c
src/vbox/vbox_storage.c
src/vbox/vbox_tmpl.c
src/vmware/vmware_conf.c
src/vmware/vmware_driver.c
src/vmx/vmx.c
src/vz/vz_driver.c
src/vz/vz_sdk.c
src/vz/vz_utils.c
src/vz/vz_utils.h
tests/virpolkittest.c
tools/libvirt-guests.sh.in
tools/ssh-proxy/ssh-proxy.c
tools/virsh-backup.c
tools/virsh-checkpoint.c
tools/virsh-completer-host.c
tools/virsh-console.c
tools/virsh-domain-event.c
tools/virsh-domain-monitor.c
tools/virsh-domain.c
tools/virsh-edit.c
tools/virsh-host.c
tools/virsh-interface.c
tools/virsh-network.c
tools/virsh-nodedev.c
tools/virsh-nwfilter.c
tools/virsh-pool.c
tools/virsh-secret.c
tools/virsh-snapshot.c
tools/virsh-util.c
tools/virsh-volume.c
tools/virsh.c
tools/virsh.h
tools/virt-admin.c
tools/virt-host-validate-bhyve.c
tools/virt-host-validate-ch.c
tools/virt-host-validate-common.c
tools/virt-host-validate-lxc.c
tools/virt-host-validate-qemu.c
tools/virt-host-validate.c
tools/virt-login-shell-helper.c
tools/virt-pki-query-dn.c
tools/virt-pki-validate.c
tools/virt-validate-common.c
tools/vsh-table.c
tools/vsh.c
tools/vsh.h
Reference in New Issue View Git Blame Copy Permalink