- conversion of virtfs-proxy-helper from libcap to libcap-ng
- removal of libcap-dev from docker, travis and gitlab CI - removal of deprecate "-virtfs_synth" option -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEtIKLr5QxQM7yo0kQcdTV5YIvc9YFAl3ym0kACgkQcdTV5YIv c9YzNhAAoVGEBUgEGqDhmqU42g34Texs5Of3NPk7IPl471T7pnK4bKSNLzk77ib6 VuknfywHBnljTNBr+3am6A6N8icAkeADkr/gXFt/WPeLdByPuVH6K9Ome4jFuFT3 7mxuH4fKSfLGO4VuuHy1ezGs3upOsQZysKdMFVp6JaoyfGYga/CKGxbBdy1M2iR9 vcRFK9zVbqixuMXDH+K9iGXtJG+voJdFitMhvuraNZK1tGrXiiXRl01FaUxnYgzS mnm+qgWOP05u7gIfpAN9BYPIz2FvyKu+xJNPwXYXzJMyd4mHg6DDxFnpV3e9a7Nq rxSvdt4mO9jacFuuWS4MROAkVlatSc12bjseiIMqLp8fqg7GJ1AIa/5CqBN3Rmmb yxS8ck7EKV5AQDH//aG+uXy2XhgqBh+iK07udJJfoTDKJMwTNfTqDbJmtnUREZFf paIfi92H+qBWxML6eFcqMw1mzKXS5Lqad/8o+Ma2Cmh4GVABlFOZiSoNli8EwHUp BnBTBNehiSLYQe3XP00clboo4x4ySRVeZA8MlGDO0OFqNzHV7pW29Oh+mbDsH/S+ 3CL3j/9sqO0tAFaMlZULh0L7d5Vn1Pc2LV+XYMuZy6sYoMeCrHslcaZUevQ6aap5 z5y1vXCQtXWw3wsFcKgKIsgIh5HIH6bQIc/fdI4578Y4yoIi19M= =ms/Q -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/gkurz/tags/9p-next-2019-12-12' into staging - conversion of virtfs-proxy-helper from libcap to libcap-ng - removal of libcap-dev from docker, travis and gitlab CI - removal of deprecate "-virtfs_synth" option # gpg: Signature made Thu 12 Dec 2019 19:55:53 GMT # gpg: using RSA key B4828BAF943140CEF2A3491071D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" [full] # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" [full] # gpg: aka "[jpeg image of size 3330]" [full] # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/9p-next-2019-12-12: virtfs: Remove the deprecated "-virtfs_synth" option travis.yml: Drop libcap-dev ci: Use libcap-ng docker: remove libcap development packages virtfs-proxy-helper: switch from libcap to libcap-ng Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell
commit
35081f79fa
@ -59,7 +59,7 @@ build-user:
|
||||
|
||||
build-clang:
|
||||
script:
|
||||
- apt-get install -y -qq clang libsdl2-dev libattr1-dev libcap-dev
|
||||
- apt-get install -y -qq clang libsdl2-dev libattr1-dev libcap-ng-dev
|
||||
xfslibs-dev libiscsi-dev libnfs-dev libseccomp-dev gnutls-dev librbd-dev
|
||||
- ./configure --cc=clang --cxx=clang++ --enable-werror
|
||||
--target-list="alpha-softmmu arm-softmmu m68k-softmmu mips64-softmmu
|
||||
|
||||
@ -26,7 +26,6 @@ addons:
|
||||
- libaio-dev
|
||||
- libattr1-dev
|
||||
- libbrlapi-dev
|
||||
- libcap-dev
|
||||
- libcap-ng-dev
|
||||
- libgcc-4.8-dev
|
||||
- libgnutls28-dev
|
||||
|
||||
1
Makefile
1
Makefile
@ -575,7 +575,6 @@ qemu-keymap$(EXESUF): qemu-keymap.o ui/input-keymap.o $(COMMON_LDADDS)
|
||||
qemu-edid$(EXESUF): qemu-edid.o hw/display/edid-generate.o $(COMMON_LDADDS)
|
||||
|
||||
fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/9p-marshal.o fsdev/9p-iov-marshal.o $(COMMON_LDADDS)
|
||||
fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap
|
||||
|
||||
scsi/qemu-pr-helper$(EXESUF): scsi/qemu-pr-helper.o scsi/utils.o $(authz-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
|
||||
ifdef CONFIG_MPATH
|
||||
|
||||
20
configure
vendored
20
configure
vendored
@ -3863,22 +3863,6 @@ else
|
||||
mpathpersist=no
|
||||
fi
|
||||
|
||||
##########################################
|
||||
# libcap probe
|
||||
|
||||
if test "$cap" != "no" ; then
|
||||
cat > $TMPC <<EOF
|
||||
#include <stdio.h>
|
||||
#include <sys/capability.h>
|
||||
int main(void) { cap_t caps; caps = cap_init(); return caps != NULL; }
|
||||
EOF
|
||||
if compile_prog "" "-lcap" ; then
|
||||
cap=yes
|
||||
else
|
||||
cap=no
|
||||
fi
|
||||
fi
|
||||
|
||||
##########################################
|
||||
# pthread probe
|
||||
PTHREADLIBS_LIST="-pthread -lpthread -lpthreadGC2"
|
||||
@ -6204,12 +6188,12 @@ if test "$want_tools" = "yes" ; then
|
||||
fi
|
||||
if test "$softmmu" = yes ; then
|
||||
if test "$linux" = yes; then
|
||||
if test "$virtfs" != no && test "$cap" = yes && test "$attr" = yes ; then
|
||||
if test "$virtfs" != no && test "$cap_ng" = yes && test "$attr" = yes ; then
|
||||
virtfs=yes
|
||||
tools="$tools fsdev/virtfs-proxy-helper\$(EXESUF)"
|
||||
else
|
||||
if test "$virtfs" = yes; then
|
||||
error_exit "VirtFS requires libcap devel and libattr devel"
|
||||
error_exit "VirtFS requires libcap-ng devel and libattr devel"
|
||||
fi
|
||||
virtfs=no
|
||||
fi
|
||||
|
||||
@ -13,7 +13,6 @@
|
||||
#include <sys/resource.h>
|
||||
#include <getopt.h>
|
||||
#include <syslog.h>
|
||||
#include <sys/capability.h>
|
||||
#include <sys/fsuid.h>
|
||||
#include <sys/vfs.h>
|
||||
#include <sys/ioctl.h>
|
||||
@ -21,6 +20,7 @@
|
||||
#ifdef CONFIG_LINUX_MAGIC_H
|
||||
#include <linux/magic.h>
|
||||
#endif
|
||||
#include <cap-ng.h>
|
||||
#include "qemu-common.h"
|
||||
#include "qemu/sockets.h"
|
||||
#include "qemu/xattr.h"
|
||||
@ -79,49 +79,10 @@ static void do_perror(const char *string)
|
||||
}
|
||||
}
|
||||
|
||||
static int do_cap_set(cap_value_t *cap_value, int size, int reset)
|
||||
{
|
||||
cap_t caps;
|
||||
if (reset) {
|
||||
/*
|
||||
* Start with an empty set and set permitted and effective
|
||||
*/
|
||||
caps = cap_init();
|
||||
if (caps == NULL) {
|
||||
do_perror("cap_init");
|
||||
return -1;
|
||||
}
|
||||
if (cap_set_flag(caps, CAP_PERMITTED, size, cap_value, CAP_SET) < 0) {
|
||||
do_perror("cap_set_flag");
|
||||
goto error;
|
||||
}
|
||||
} else {
|
||||
caps = cap_get_proc();
|
||||
if (!caps) {
|
||||
do_perror("cap_get_proc");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
if (cap_set_flag(caps, CAP_EFFECTIVE, size, cap_value, CAP_SET) < 0) {
|
||||
do_perror("cap_set_flag");
|
||||
goto error;
|
||||
}
|
||||
if (cap_set_proc(caps) < 0) {
|
||||
do_perror("cap_set_proc");
|
||||
goto error;
|
||||
}
|
||||
cap_free(caps);
|
||||
return 0;
|
||||
|
||||
error:
|
||||
cap_free(caps);
|
||||
return -1;
|
||||
}
|
||||
|
||||
static int init_capabilities(void)
|
||||
{
|
||||
/* helper needs following capabilities only */
|
||||
cap_value_t cap_list[] = {
|
||||
int cap_list[] = {
|
||||
CAP_CHOWN,
|
||||
CAP_DAC_OVERRIDE,
|
||||
CAP_FOWNER,
|
||||
@ -130,7 +91,34 @@ static int init_capabilities(void)
|
||||
CAP_MKNOD,
|
||||
CAP_SETUID,
|
||||
};
|
||||
return do_cap_set(cap_list, ARRAY_SIZE(cap_list), 1);
|
||||
int i;
|
||||
|
||||
capng_clear(CAPNG_SELECT_BOTH);
|
||||
for (i = 0; i < ARRAY_SIZE(cap_list); i++) {
|
||||
if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
|
||||
cap_list[i]) < 0) {
|
||||
do_perror("capng_update");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
if (capng_apply(CAPNG_SELECT_BOTH) < 0) {
|
||||
do_perror("capng_apply");
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Prepare effective set for setugid. */
|
||||
for (i = 0; i < ARRAY_SIZE(cap_list); i++) {
|
||||
if (cap_list[i] == CAP_DAC_OVERRIDE) {
|
||||
continue;
|
||||
}
|
||||
|
||||
if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE,
|
||||
cap_list[i]) < 0) {
|
||||
do_perror("capng_update");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int socket_read(int sockfd, void *buff, ssize_t size)
|
||||
@ -295,14 +283,6 @@ static int setugid(int uid, int gid, int *suid, int *sgid)
|
||||
{
|
||||
int retval;
|
||||
|
||||
/*
|
||||
* We still need DAC_OVERRIDE because we don't change
|
||||
* supplementary group ids, and hence may be subjected DAC rules
|
||||
*/
|
||||
cap_value_t cap_list[] = {
|
||||
CAP_DAC_OVERRIDE,
|
||||
};
|
||||
|
||||
*suid = geteuid();
|
||||
*sgid = getegid();
|
||||
|
||||
@ -316,11 +296,21 @@ static int setugid(int uid, int gid, int *suid, int *sgid)
|
||||
goto err_sgid;
|
||||
}
|
||||
|
||||
if (uid != 0 || gid != 0) {
|
||||
if (do_cap_set(cap_list, ARRAY_SIZE(cap_list), 0) < 0) {
|
||||
retval = -errno;
|
||||
goto err_suid;
|
||||
}
|
||||
if (uid == 0 && gid == 0) {
|
||||
/* Linux has already copied the permitted set to the effective set. */
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* All capabilities have been cleared from the effective set. However
|
||||
* we still need DAC_OVERRIDE because we don't change supplementary
|
||||
* group ids, and hence may be subject to DAC rules. init_capabilities
|
||||
* left the set of capabilities that we want in libcap-ng's state.
|
||||
*/
|
||||
if (capng_apply(CAPNG_SELECT_CAPS) < 0) {
|
||||
retval = -errno;
|
||||
do_perror("capng_apply");
|
||||
goto err_suid;
|
||||
}
|
||||
return 0;
|
||||
|
||||
|
||||
@ -89,11 +89,6 @@ error in the future.
|
||||
The @code{-realtime mlock=on|off} argument has been replaced by the
|
||||
@code{-overcommit mem-lock=on|off} argument.
|
||||
|
||||
@subsection -virtfs_synth (since 4.1)
|
||||
|
||||
The ``-virtfs_synth'' argument is now deprecated. Please use ``-fsdev synth''
|
||||
and ``-device virtio-9p-...'' instead.
|
||||
|
||||
@subsection -numa node,mem=@var{size} (since 4.1)
|
||||
|
||||
The parameter @option{mem} of @option{-numa node} is used to assign a part of
|
||||
|
||||
@ -1468,16 +1468,6 @@ would still return entries from other devices).
|
||||
@end table
|
||||
ETEXI
|
||||
|
||||
DEF("virtfs_synth", 0, QEMU_OPTION_virtfs_synth,
|
||||
"-virtfs_synth Create synthetic file system image\n",
|
||||
QEMU_ARCH_ALL)
|
||||
STEXI
|
||||
@item -virtfs_synth
|
||||
@findex -virtfs_synth
|
||||
Create synthetic file system image. Note that this option is now deprecated.
|
||||
Please use @code{-fsdev synth} and @code{-device virtio-9p-...} instead.
|
||||
ETEXI
|
||||
|
||||
DEF("iscsi", HAS_ARG, QEMU_OPTION_iscsi,
|
||||
"-iscsi [user=user][,password=password]\n"
|
||||
" [,header-digest=CRC32C|CR32C-NONE|NONE-CRC32C|NONE\n"
|
||||
|
||||
@ -25,7 +25,6 @@ ENV PACKAGES \
|
||||
libasan \
|
||||
libattr-devel \
|
||||
libblockdev-mpath-devel \
|
||||
libcap-devel \
|
||||
libcap-ng-devel \
|
||||
libcurl-devel \
|
||||
libfdt-devel \
|
||||
|
||||
@ -23,7 +23,6 @@ ENV PACKAGES flex bison \
|
||||
libbrlapi-dev \
|
||||
libbz2-dev \
|
||||
libcacard-dev \
|
||||
libcap-dev \
|
||||
libcap-ng-dev \
|
||||
libcurl4-gnutls-dev \
|
||||
libdrm-dev \
|
||||
|
||||
@ -12,7 +12,6 @@ ENV PACKAGES flex bison \
|
||||
libbrlapi-dev \
|
||||
libbz2-dev \
|
||||
libcacard-dev \
|
||||
libcap-dev \
|
||||
libcap-ng-dev \
|
||||
libcurl4-gnutls-dev \
|
||||
libdrm-dev \
|
||||
|
||||
23
vl.c
23
vl.c
@ -3374,29 +3374,6 @@ int main(int argc, char **argv, char **envp)
|
||||
qemu_opt_get(opts, "mount_tag"), &error_abort);
|
||||
break;
|
||||
}
|
||||
case QEMU_OPTION_virtfs_synth: {
|
||||
QemuOpts *fsdev;
|
||||
QemuOpts *device;
|
||||
|
||||
warn_report("'-virtfs_synth' is deprecated, please use "
|
||||
"'-fsdev synth' and '-device virtio-9p-...' "
|
||||
"instead");
|
||||
|
||||
fsdev = qemu_opts_create(qemu_find_opts("fsdev"), "v_synth",
|
||||
1, NULL);
|
||||
if (!fsdev) {
|
||||
error_report("duplicate option: %s", "virtfs_synth");
|
||||
exit(1);
|
||||
}
|
||||
qemu_opt_set(fsdev, "fsdriver", "synth", &error_abort);
|
||||
|
||||
device = qemu_opts_create(qemu_find_opts("device"), NULL, 0,
|
||||
&error_abort);
|
||||
qemu_opt_set(device, "driver", "virtio-9p-pci", &error_abort);
|
||||
qemu_opt_set(device, "fsdev", "v_synth", &error_abort);
|
||||
qemu_opt_set(device, "mount_tag", "v_synth", &error_abort);
|
||||
break;
|
||||
}
|
||||
case QEMU_OPTION_serial:
|
||||
add_device_config(DEV_SERIAL, optarg);
|
||||
default_serial = 0;
|
||||
|
||||
Loading…
Reference in New Issue
Block a user