| PR/issue: Add templates for Issues and PR Add issue and PR templates to help developers. Signed-off-by: Zhang Hailiang <zhang.zhanghailiang@huawei.com> | 6 年前 |
| Rebase libvirt to version 6.2.0 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| Substitute security_context_t with char * Replace deprecated security_context_t with char Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 5 年前 |
| cherry-pick bugfixes from version 5.5.0 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| Substitute security_context_t with char * Replace deprecated security_context_t with char Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 5 年前 |
| cpu-model: enable 'host-model' cpu mode for AArch64 architecture Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu_map: introduce Kunpeng-920 cpu features Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cherry-pick bugfixes from version 5.5.0 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cherry-pick bugfixes from version 5.5.0 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cherry-pick bugfixes from version 5.5.0 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cherry-pick bugfixes from version 5.5.0 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cherry-pick bugfixes from version 5.5.0 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| cpu: add cpu model support for kunpeng-920 Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| bugfix: fix virsh dump/migrate and virDaemon return code error Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| bugfix: fix virsh dump/migrate and virDaemon return code error Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| bugfix: fix virsh dump/migrate and virDaemon return code error Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 6 年前 |
| Substitute security_context_t with char * Replace deprecated security_context_t with char Signed-off-by: Xu Yandong <xuyandong2@huawei.com> | 5 年前 |
| spec: Update release version with !49 increase release verison by one Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> | 4 年前 |
| qemu: agent: set ifname to NULL after freeing CVE-2020-25637 Signed-off-by: Jan Tomko <jtomko@redhat.com> Rported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Jiri Denemark <jdenemar@redhat.com> cherry-pick from commit a63b48c5ecef077bf0f909a85f453a605600cf05 Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 |
| rpc: add support for filtering @acls by uint params CVE-2020-25637 Add a new field to @acl annotations for filtering by unsigned int parameters. Signed-off-by: Jan Tomko <jtomko@redhat.com> Reviewed-by: Jiri Denemark <jdenemar@redhat.com> cherry-pick from commit 50864dcda191eb35732dbd80fb6ca251a6bba923 Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 |
| rpc: gendispatch: handle empty flags CVE-2020-25637 Prepare for omission of the <flagname> in remote_protocol.x @acl annotations: @acl: <object>:<permission>:<flagname> so that we can add more field after, e.g.: @acl: <object>:<permission>::<field> Signed-off-by: Jan Tomko <jtomko@redhat.com> Reviewed-by: Jiri Denemark <jdenemar@redhat.com> cherry-pick from commit 955029bd0ad7ef96000f529ac38204a8f4a96401 Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 |
| rpc: require write acl for guest agent in virDomainInterfaceAddresses CVE-2020-25637 Add a requirement for domain:write if source is set to VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT. Signed-off-by: Jan Tomko <jtomko@redhat.com> Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed-by: Jiri Denemark <jdenemar@redhat.com> cherry-pick from commit e4116eaa44cb366b59f7fe98f4b88d04c04970ad Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 |
| security: fix SELinux label generation logic A process can access a file if the set of MCS categories for the file is equal-to *or* a subset-of, the set of MCS categories for the process. If there are two VMs: a) svirt_t:s0:c117 b) svirt_t:s0:c117,c720 Then VM (b) is able to access files labelled for VM (a). IOW, we must discard case where the categories are equal because that is a subset of many other valid category pairs. Fixes: https://gitlab.com/libvirt/libvirt/-/issues/153 CVE-2021-3631 Reviewed-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> | 4 年前 |
| storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath 'virStoragePoolObjListSearch' returns a locked and refed object, thus we must release it on ACL permission failure. Fixes: 7aa0e8c0cb8 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1984318 Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com> | 4 年前 |
| util: Move virIsDevMapperDevice() to virdevmapper.c CVE-2020-14339 When introducing virdevmapper.c (in v4.3.0-rc1~427) I didn't realize there is a function that calls in devmapper. The function is called virIsDevMapperDevice() and lives in virutil.c. Now that we have a special file for handling devmapper move it there. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Jiri Denemark <jdenemar@redhat.com> cherry-pick from commit dfa0e118f745fe3f4fe95975c6100f0fc6d788be Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 |
| virdevmapper: Don't use libdevmapper to obtain dependencies CVE-2020-14339 When building domain's private /dev in a namespace, libdevmapper is consulted for getting full dependency tree of domain's disks. The reason is that for a multipath devices all dependent devices must be created in the namespace and allowed in CGroups. However, this approach is very fragile as building of namespace happens in the forked off child process, after mass close of FDs and just before dropping privileges and execing QEMU. And it so happens that when calling libdevmapper APIs, one of them opens /dev/mapper/control and saves the FD into a global variable. The FD is kept open until the lib is unlinked or dm_lib_release() is called explicitly. We are doing neither. However, the virDevMapperGetTargets() function is called also from libvirtd (when setting up CGroups) and thus has to be thread safe. Unfortunately, libdevmapper APIs are not thread safe (nor async signal safe) and thus we can't use them. Reimplement what libdevmapper would do using plain C (ioctl()-s, /proc/devices parsing, /dev/mapper dirwalking, and so on). Fixes: a30078cb832646177defd256e77c632905f1e6d0 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1858260 Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> cherry-pick from commit 22494556542c676d1b9e7f1c1f2ea13ac17e1e3e Signed-off-by: Jiajie Li <lijiajie11@huawei.com> | 5 年前 |
| virsh: Display vhostuser socket path in domblklist The domblklist command is designed to show a brief information about the blocks of a domain. One piece of information that is shows is "Target"and "Source". Before the modification, the Vhost disk of SPDK is displayed as "-". After the modification, the socket associated with it can be displayed. Signed-off-by: dinglimin <dinglimin@cmss.chinamobile.com> | 4 年前 |