From d98c472ceea2197166fbe0864964109fc32cc21e Mon Sep 17 00:00:00 2001 From: Jiri Denemark Date: Thu, 3 Aug 2023 00:15:00 +0200 Subject: [PATCH] libvirt-9.5.0-5.el9 - Revert "qemu_passt: Actually use @logfd" (rhbz#2209191) - Revert "qemu_passt: Precreate passt logfile" (rhbz#2209191) Resolves: rhbz#2209191 --- ...Revert-qemu_passt-Actually-use-logfd.patch | 38 +++++ ...t-qemu_passt-Precreate-passt-logfile.patch | 148 ++++++++++++++++++ libvirt.spec | 8 +- 3 files changed, 193 insertions(+), 1 deletion(-) create mode 100644 libvirt-Revert-qemu_passt-Actually-use-logfd.patch create mode 100644 libvirt-Revert-qemu_passt-Precreate-passt-logfile.patch diff --git a/libvirt-Revert-qemu_passt-Actually-use-logfd.patch b/libvirt-Revert-qemu_passt-Actually-use-logfd.patch new file mode 100644 index 0000000..9644786 --- /dev/null +++ b/libvirt-Revert-qemu_passt-Actually-use-logfd.patch @@ -0,0 +1,38 @@ +From f3e5bf77bc6f591e5799ae9de36498df5c2a1811 Mon Sep 17 00:00:00 2001 +Message-ID: +From: Michal Privoznik +Date: Tue, 1 Aug 2023 16:18:47 +0200 +Subject: [PATCH] Revert "qemu_passt: Actually use @logfd" + +This reverts commit 83686f1eea1a001a37a92f2c054ffb2689c43a40. + +This is needed only so that the next revert is clean. + +Signed-off-by: Michal Privoznik +Reviewed-by: Martin Kletzander +(cherry picked from commit bc9a254dc72b6904e8368c3fea3ab49b7238ff34) +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2209191 +Signed-off-by: Michal Privoznik +--- + src/qemu/qemu_passt.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/qemu/qemu_passt.c b/src/qemu/qemu_passt.c +index 3679bf75fc..25b22d8ad9 100644 +--- a/src/qemu/qemu_passt.c ++++ b/src/qemu/qemu_passt.c +@@ -204,9 +204,9 @@ qemuPasstStart(virDomainObj *vm, + /* The logFile location is not restricted to a per-domain directory. It + * can be anywhere. Pre-create it as passt may not have enough perms to + * do so. */ +- if ((logfd = qemuDomainOpenFile(cfg, vm->def, net->backend.logFile, +- O_CREAT | O_TRUNC | O_APPEND | O_RDWR, +- &needUnlink)) < 0) { ++ if (qemuDomainOpenFile(cfg, vm->def, net->backend.logFile, ++ O_CREAT | O_TRUNC | O_APPEND | O_RDWR, ++ &needUnlink) < 0) { + return -1; + } + +-- +2.41.0 diff --git a/libvirt-Revert-qemu_passt-Precreate-passt-logfile.patch b/libvirt-Revert-qemu_passt-Precreate-passt-logfile.patch new file mode 100644 index 0000000..32c2d6b --- /dev/null +++ b/libvirt-Revert-qemu_passt-Precreate-passt-logfile.patch @@ -0,0 +1,148 @@ +From 8897c7d63f763bf9b59f7e79ec6b2f9caf84823b Mon Sep 17 00:00:00 2001 +Message-ID: <8897c7d63f763bf9b59f7e79ec6b2f9caf84823b.1691014499.git.jdenemar@redhat.com> +From: Michal Privoznik +Date: Tue, 1 Aug 2023 16:20:58 +0200 +Subject: [PATCH] Revert "qemu_passt: Precreate passt logfile" + +This reverts commit 8511b96a319836700b4829816cdae27c3630060d. + +Turns out, we need to do a bit more than just plain +qemuSecurityDomainSetPathLabel() which sets svirt_image_t. Passt +has its own SELinux policy and as a part of that they invent +passt_log_t for log files. Right now, I don't know how libvirt +could query that and even if I did, passt SELinux policy would +need to permit relabelling from svirt_t to passt_log_t, which it +doesn't [1]. + +Until these problems are addressed we shouldn't be pre-creating +the file as it puts users into way worse position - even +scenarios that used to work don't work. But then again - using +log file for passt is usually valuable for developers only and +not regular users. + +1: https://bugzilla.redhat.com/show_bug.cgi?id=2209191#c10 +Signed-off-by: Michal Privoznik +Reviewed-by: Martin Kletzander +(cherry picked from commit 99349ba18e726465215a71f28d2146a0a2adb65d) +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2209191 +Signed-off-by: Michal Privoznik +--- + src/qemu/qemu_passt.c | 40 +++++----------------------------------- + 1 file changed, 5 insertions(+), 35 deletions(-) + +diff --git a/src/qemu/qemu_passt.c b/src/qemu/qemu_passt.c +index 25b22d8ad9..99636a3a49 100644 +--- a/src/qemu/qemu_passt.c ++++ b/src/qemu/qemu_passt.c +@@ -20,8 +20,6 @@ + + #include + +-#include +- + #include "qemu_dbus.h" + #include "qemu_extdevice.h" + #include "qemu_security.h" +@@ -138,13 +136,9 @@ void + qemuPasstStop(virDomainObj *vm, + virDomainNetDef *net) + { +- qemuDomainObjPrivate *priv = vm->privateData; +- virQEMUDriver *driver = priv->driver; + g_autofree char *pidfile = qemuPasstCreatePidFilename(vm, net); + g_autofree char *passtSocketName = qemuPasstCreateSocketPath(vm, net); + +- qemuSecurityDomainRestorePathLabel(driver, vm, net->backend.logFile); +- + qemuPasstKill(pidfile, passtSocketName); + } + +@@ -172,12 +166,10 @@ qemuPasstStart(virDomainObj *vm, + { + qemuDomainObjPrivate *priv = vm->privateData; + virQEMUDriver *driver = priv->driver; +- g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); + g_autofree char *passtSocketName = qemuPasstCreateSocketPath(vm, net); + g_autoptr(virCommand) cmd = NULL; + g_autofree char *pidfile = qemuPasstCreatePidFilename(vm, net); + char macaddr[VIR_MAC_STRING_BUFLEN]; +- bool needUnlink = false; + size_t i; + + cmd = virCommandNew(PASST); +@@ -199,25 +191,8 @@ qemuPasstStart(virDomainObj *vm, + if (net->sourceDev) + virCommandAddArgList(cmd, "--interface", net->sourceDev, NULL); + +- if (net->backend.logFile) { +- VIR_AUTOCLOSE logfd = -1; +- /* The logFile location is not restricted to a per-domain directory. It +- * can be anywhere. Pre-create it as passt may not have enough perms to +- * do so. */ +- if (qemuDomainOpenFile(cfg, vm->def, net->backend.logFile, +- O_CREAT | O_TRUNC | O_APPEND | O_RDWR, +- &needUnlink) < 0) { +- return -1; +- } +- +- if (qemuSecurityDomainSetPathLabel(driver, vm, +- net->backend.logFile, false) < 0) { +- goto error; +- } +- +- /* Worse, passt deliberately doesn't support FD passing. */ ++ if (net->backend.logFile) + virCommandAddArgList(cmd, "--log-file", net->backend.logFile, NULL); +- } + + /* Add IP address info */ + for (i = 0; i < net->guestIP.nips; i++) { +@@ -228,7 +203,7 @@ qemuPasstStart(virDomainObj *vm, + * a single IPv4 and single IPv6 address + */ + if (!(addr = virSocketAddrFormat(&ip->address))) +- goto error; ++ return -1; + + virCommandAddArgList(cmd, "--address", addr, NULL); + +@@ -256,14 +231,14 @@ qemuPasstStart(virDomainObj *vm, + /* validation guarantees this will never happen */ + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Invalid portForward proto value %1$u"), pf->proto); +- goto error; ++ return -1; + } + + if (VIR_SOCKET_ADDR_VALID(&pf->address)) { + g_autofree char *addr = NULL; + + if (!(addr = virSocketAddrFormat(&pf->address))) +- goto error; ++ return -1; + + virBufferAddStr(&buf, addr); + emitsep = true; +@@ -309,7 +284,7 @@ qemuPasstStart(virDomainObj *vm, + + + if (qemuExtDeviceLogCommand(driver, vm, cmd, "passt") < 0) +- goto error; ++ return -1; + + if (qemuSecurityCommandRun(driver, vm, cmd, -1, -1, true, NULL) < 0) + goto error; +@@ -317,11 +292,6 @@ qemuPasstStart(virDomainObj *vm, + return 0; + + error: +- if (needUnlink && unlink(net->backend.logFile) < 0) { +- VIR_WARN("Unable to unlink '%s': %s", +- net->backend.logFile, g_strerror(errno)); +- } +- + qemuPasstKill(pidfile, passtSocketName); + return -1; + } +-- +2.41.0 diff --git a/libvirt.spec b/libvirt.spec index 89ff127..9e4f39d 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -229,7 +229,7 @@ Summary: Library providing a simple virtualization API Name: libvirt Version: 9.5.0 -Release: 4%{?dist}%{?extra_release} +Release: 5%{?dist}%{?extra_release} License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1 URL: https://libvirt.org/ @@ -250,6 +250,8 @@ Patch9: libvirt-qemu-S390-does-not-provide-physical-address-size.patch Patch10: libvirt-nodedev-report-mdev-persistence-properly.patch Patch11: libvirt-node_device-Don-t-leak-error-message-buffer-from-virMdevctlListDefined-Active.patch Patch12: libvirt-storage-Fix-returning-of-locked-objects-from-virStoragePoolObjListSearch.patch +Patch13: libvirt-Revert-qemu_passt-Actually-use-logfd.patch +Patch14: libvirt-Revert-qemu_passt-Precreate-passt-logfile.patch Requires: libvirt-daemon = %{version}-%{release} @@ -2486,6 +2488,10 @@ exit 0 %endif %changelog +* Wed Aug 2 2023 Jiri Denemark - 9.5.0-5 +- Revert "qemu_passt: Actually use @logfd" (rhbz#2209191) +- Revert "qemu_passt: Precreate passt logfile" (rhbz#2209191) + * Mon Jul 31 2023 Jiri Denemark - 9.5.0-4 - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' (CVE-2023-3750, rhbz#2221851)