nbd patches for 2021-11-16
- Rich Jones: Add 'qemu-nbd --selinux-label' option for running Unix socket with appropriate SELinux labeling - Eric Blake: Address clang sanitizer warning -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEccLMIrHEYCkn0vOqp6FrSiUnQ2oFAmGT3RoACgkQp6FrSiUn Q2oFEQf/XPOCJHluoE/BN9iL2kggqXQR65hEWPkITBGTxkADlqo1u9XwQRL8YbCF KvYp+tE1sCg4JmD81bUvAtu+foIE3GE/E3U6K8FhBsVI8kV3i/HJdUycmzxSbjU9 yrf6uhnnmc95I3po50tojZM93L69JVcUKmIahj1c1BnwwdGuMaEZJ+rzpSLB5eiF iPCCjgpcZGv4LqbPG240foAF7bTeyMf0l4MjftiB+CBvgeO4NIxHSiN+IE3B5hHX +caNY9mcTGESwWf4bXVIlAhWAuHhP8YxlZZKQRQnUopKDF846oYhXJWLhgm9Q43z MHP8cn0oVJIKz+w1e/8MPC95tji+QA== =1qRZ -----END PGP SIGNATURE----- Merge tag 'pull-nbd-2021-11-16' of https://repo.or.cz/qemu/ericb into staging nbd patches for 2021-11-16 - Rich Jones: Add 'qemu-nbd --selinux-label' option for running Unix socket with appropriate SELinux labeling - Eric Blake: Address clang sanitizer warning # gpg: Signature made Tue 16 Nov 2021 05:32:26 PM CET # gpg: using RSA key 71C2CC22B1C4602927D2F3AAA7A16B4A2527436A # gpg: Good signature from "Eric Blake <eblake@redhat.com>" [full] # gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>" [full] # gpg: aka "[jpeg image of size 6874]" [full] * tag 'pull-nbd-2021-11-16' of https://repo.or.cz/qemu/ericb: nbd/server: Add --selinux-label option nbd/server: Silence clang sanitizer warning Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
commit
56f4f41e02
10
meson.build
10
meson.build
|
@ -1195,6 +1195,11 @@ keyutils = dependency('libkeyutils', required: false,
|
||||||
|
|
||||||
has_gettid = cc.has_function('gettid')
|
has_gettid = cc.has_function('gettid')
|
||||||
|
|
||||||
|
# libselinux
|
||||||
|
selinux = dependency('libselinux',
|
||||||
|
required: get_option('selinux'),
|
||||||
|
method: 'pkg-config', kwargs: static_kwargs)
|
||||||
|
|
||||||
# Malloc tests
|
# Malloc tests
|
||||||
|
|
||||||
malloc = []
|
malloc = []
|
||||||
|
@ -1473,6 +1478,7 @@ config_host_data.set('CONFIG_SPICE_PROTOCOL', spice_protocol.found())
|
||||||
config_host_data.set('CONFIG_SPICE', spice.found())
|
config_host_data.set('CONFIG_SPICE', spice.found())
|
||||||
config_host_data.set('CONFIG_X11', x11.found())
|
config_host_data.set('CONFIG_X11', x11.found())
|
||||||
config_host_data.set('CONFIG_CFI', get_option('cfi'))
|
config_host_data.set('CONFIG_CFI', get_option('cfi'))
|
||||||
|
config_host_data.set('CONFIG_SELINUX', selinux.found())
|
||||||
config_host_data.set('QEMU_VERSION', '"@0@"'.format(meson.project_version()))
|
config_host_data.set('QEMU_VERSION', '"@0@"'.format(meson.project_version()))
|
||||||
config_host_data.set('QEMU_VERSION_MAJOR', meson.project_version().split('.')[0])
|
config_host_data.set('QEMU_VERSION_MAJOR', meson.project_version().split('.')[0])
|
||||||
config_host_data.set('QEMU_VERSION_MINOR', meson.project_version().split('.')[1])
|
config_host_data.set('QEMU_VERSION_MINOR', meson.project_version().split('.')[1])
|
||||||
|
@ -3048,7 +3054,8 @@ if have_tools
|
||||||
qemu_io = executable('qemu-io', files('qemu-io.c'),
|
qemu_io = executable('qemu-io', files('qemu-io.c'),
|
||||||
dependencies: [block, qemuutil], install: true)
|
dependencies: [block, qemuutil], install: true)
|
||||||
qemu_nbd = executable('qemu-nbd', files('qemu-nbd.c'),
|
qemu_nbd = executable('qemu-nbd', files('qemu-nbd.c'),
|
||||||
dependencies: [blockdev, qemuutil, gnutls], install: true)
|
dependencies: [blockdev, qemuutil, gnutls, selinux],
|
||||||
|
install: true)
|
||||||
|
|
||||||
subdir('storage-daemon')
|
subdir('storage-daemon')
|
||||||
subdir('contrib/rdmacm-mux')
|
subdir('contrib/rdmacm-mux')
|
||||||
|
@ -3424,6 +3431,7 @@ summary_info += {'libdaxctl support': libdaxctl}
|
||||||
summary_info += {'libudev': libudev}
|
summary_info += {'libudev': libudev}
|
||||||
# Dummy dependency, keep .found()
|
# Dummy dependency, keep .found()
|
||||||
summary_info += {'FUSE lseek': fuse_lseek.found()}
|
summary_info += {'FUSE lseek': fuse_lseek.found()}
|
||||||
|
summary_info += {'selinux': selinux}
|
||||||
summary(summary_info, bool_yn: true, section: 'Dependencies')
|
summary(summary_info, bool_yn: true, section: 'Dependencies')
|
||||||
|
|
||||||
if not supported_cpus.contains(cpu)
|
if not supported_cpus.contains(cpu)
|
||||||
|
|
|
@ -201,3 +201,6 @@ option('slirp', type: 'combo', value: 'auto',
|
||||||
option('fdt', type: 'combo', value: 'auto',
|
option('fdt', type: 'combo', value: 'auto',
|
||||||
choices: ['disabled', 'enabled', 'auto', 'system', 'internal'],
|
choices: ['disabled', 'enabled', 'auto', 'system', 'internal'],
|
||||||
description: 'Whether and how to find the libfdt library')
|
description: 'Whether and how to find the libfdt library')
|
||||||
|
|
||||||
|
option('selinux', type: 'feature', value: 'auto',
|
||||||
|
description: 'SELinux support in qemu-nbd')
|
||||||
|
|
13
nbd/server.c
13
nbd/server.c
|
@ -1,5 +1,5 @@
|
||||||
/*
|
/*
|
||||||
* Copyright (C) 2016-2020 Red Hat, Inc.
|
* Copyright (C) 2016-2021 Red Hat, Inc.
|
||||||
* Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
|
* Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
|
||||||
*
|
*
|
||||||
* Network Block Device Server Side
|
* Network Block Device Server Side
|
||||||
|
@ -879,7 +879,9 @@ static bool nbd_meta_qemu_query(NBDClient *client, NBDExportMetaContexts *meta,
|
||||||
if (!*query) {
|
if (!*query) {
|
||||||
if (client->opt == NBD_OPT_LIST_META_CONTEXT) {
|
if (client->opt == NBD_OPT_LIST_META_CONTEXT) {
|
||||||
meta->allocation_depth = meta->exp->allocation_depth;
|
meta->allocation_depth = meta->exp->allocation_depth;
|
||||||
memset(meta->bitmaps, 1, meta->exp->nr_export_bitmaps);
|
if (meta->exp->nr_export_bitmaps) {
|
||||||
|
memset(meta->bitmaps, 1, meta->exp->nr_export_bitmaps);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
trace_nbd_negotiate_meta_query_parse("empty");
|
trace_nbd_negotiate_meta_query_parse("empty");
|
||||||
return true;
|
return true;
|
||||||
|
@ -894,7 +896,8 @@ static bool nbd_meta_qemu_query(NBDClient *client, NBDExportMetaContexts *meta,
|
||||||
if (nbd_strshift(&query, "dirty-bitmap:")) {
|
if (nbd_strshift(&query, "dirty-bitmap:")) {
|
||||||
trace_nbd_negotiate_meta_query_parse("dirty-bitmap:");
|
trace_nbd_negotiate_meta_query_parse("dirty-bitmap:");
|
||||||
if (!*query) {
|
if (!*query) {
|
||||||
if (client->opt == NBD_OPT_LIST_META_CONTEXT) {
|
if (client->opt == NBD_OPT_LIST_META_CONTEXT &&
|
||||||
|
meta->exp->nr_export_bitmaps) {
|
||||||
memset(meta->bitmaps, 1, meta->exp->nr_export_bitmaps);
|
memset(meta->bitmaps, 1, meta->exp->nr_export_bitmaps);
|
||||||
}
|
}
|
||||||
trace_nbd_negotiate_meta_query_parse("empty");
|
trace_nbd_negotiate_meta_query_parse("empty");
|
||||||
|
@ -1024,7 +1027,9 @@ static int nbd_negotiate_meta_queries(NBDClient *client,
|
||||||
/* enable all known contexts */
|
/* enable all known contexts */
|
||||||
meta->base_allocation = true;
|
meta->base_allocation = true;
|
||||||
meta->allocation_depth = meta->exp->allocation_depth;
|
meta->allocation_depth = meta->exp->allocation_depth;
|
||||||
memset(meta->bitmaps, 1, meta->exp->nr_export_bitmaps);
|
if (meta->exp->nr_export_bitmaps) {
|
||||||
|
memset(meta->bitmaps, 1, meta->exp->nr_export_bitmaps);
|
||||||
|
}
|
||||||
} else {
|
} else {
|
||||||
for (i = 0; i < nb_queries; ++i) {
|
for (i = 0; i < nb_queries; ++i) {
|
||||||
ret = nbd_negotiate_meta_query(client, meta, errp);
|
ret = nbd_negotiate_meta_query(client, meta, errp);
|
||||||
|
|
46
qemu-nbd.c
46
qemu-nbd.c
|
@ -47,6 +47,10 @@
|
||||||
#include "trace/control.h"
|
#include "trace/control.h"
|
||||||
#include "qemu-version.h"
|
#include "qemu-version.h"
|
||||||
|
|
||||||
|
#ifdef CONFIG_SELINUX
|
||||||
|
#include <selinux/selinux.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
#ifdef __linux__
|
#ifdef __linux__
|
||||||
#define HAVE_NBD_DEVICE 1
|
#define HAVE_NBD_DEVICE 1
|
||||||
#else
|
#else
|
||||||
|
@ -64,6 +68,7 @@
|
||||||
#define QEMU_NBD_OPT_FORK 263
|
#define QEMU_NBD_OPT_FORK 263
|
||||||
#define QEMU_NBD_OPT_TLSAUTHZ 264
|
#define QEMU_NBD_OPT_TLSAUTHZ 264
|
||||||
#define QEMU_NBD_OPT_PID_FILE 265
|
#define QEMU_NBD_OPT_PID_FILE 265
|
||||||
|
#define QEMU_NBD_OPT_SELINUX_LABEL 266
|
||||||
|
|
||||||
#define MBR_SIZE 512
|
#define MBR_SIZE 512
|
||||||
|
|
||||||
|
@ -116,6 +121,9 @@ static void usage(const char *name)
|
||||||
" --fork fork off the server process and exit the parent\n"
|
" --fork fork off the server process and exit the parent\n"
|
||||||
" once the server is running\n"
|
" once the server is running\n"
|
||||||
" --pid-file=PATH store the server's process ID in the given file\n"
|
" --pid-file=PATH store the server's process ID in the given file\n"
|
||||||
|
#ifdef CONFIG_SELINUX
|
||||||
|
" --selinux-label=LABEL set SELinux process label on listening socket\n"
|
||||||
|
#endif
|
||||||
#if HAVE_NBD_DEVICE
|
#if HAVE_NBD_DEVICE
|
||||||
"\n"
|
"\n"
|
||||||
"Kernel NBD client support:\n"
|
"Kernel NBD client support:\n"
|
||||||
|
@ -454,6 +462,7 @@ static const char *socket_activation_validate_opts(const char *device,
|
||||||
const char *sockpath,
|
const char *sockpath,
|
||||||
const char *address,
|
const char *address,
|
||||||
const char *port,
|
const char *port,
|
||||||
|
const char *selinux,
|
||||||
bool list)
|
bool list)
|
||||||
{
|
{
|
||||||
if (device != NULL) {
|
if (device != NULL) {
|
||||||
|
@ -472,6 +481,10 @@ static const char *socket_activation_validate_opts(const char *device,
|
||||||
return "TCP port number can't be set when using socket activation";
|
return "TCP port number can't be set when using socket activation";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (selinux != NULL) {
|
||||||
|
return "SELinux label can't be set when using socket activation";
|
||||||
|
}
|
||||||
|
|
||||||
if (list) {
|
if (list) {
|
||||||
return "List mode is incompatible with socket activation";
|
return "List mode is incompatible with socket activation";
|
||||||
}
|
}
|
||||||
|
@ -534,6 +547,8 @@ int main(int argc, char **argv)
|
||||||
{ "trace", required_argument, NULL, 'T' },
|
{ "trace", required_argument, NULL, 'T' },
|
||||||
{ "fork", no_argument, NULL, QEMU_NBD_OPT_FORK },
|
{ "fork", no_argument, NULL, QEMU_NBD_OPT_FORK },
|
||||||
{ "pid-file", required_argument, NULL, QEMU_NBD_OPT_PID_FILE },
|
{ "pid-file", required_argument, NULL, QEMU_NBD_OPT_PID_FILE },
|
||||||
|
{ "selinux-label", required_argument, NULL,
|
||||||
|
QEMU_NBD_OPT_SELINUX_LABEL },
|
||||||
{ NULL, 0, NULL, 0 }
|
{ NULL, 0, NULL, 0 }
|
||||||
};
|
};
|
||||||
int ch;
|
int ch;
|
||||||
|
@ -560,6 +575,7 @@ int main(int argc, char **argv)
|
||||||
int old_stderr = -1;
|
int old_stderr = -1;
|
||||||
unsigned socket_activation;
|
unsigned socket_activation;
|
||||||
const char *pid_file_name = NULL;
|
const char *pid_file_name = NULL;
|
||||||
|
const char *selinux_label = NULL;
|
||||||
BlockExportOptions *export_opts;
|
BlockExportOptions *export_opts;
|
||||||
|
|
||||||
#ifdef CONFIG_POSIX
|
#ifdef CONFIG_POSIX
|
||||||
|
@ -749,6 +765,9 @@ int main(int argc, char **argv)
|
||||||
case QEMU_NBD_OPT_PID_FILE:
|
case QEMU_NBD_OPT_PID_FILE:
|
||||||
pid_file_name = optarg;
|
pid_file_name = optarg;
|
||||||
break;
|
break;
|
||||||
|
case QEMU_NBD_OPT_SELINUX_LABEL:
|
||||||
|
selinux_label = optarg;
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -788,6 +807,7 @@ int main(int argc, char **argv)
|
||||||
/* Using socket activation - check user didn't use -p etc. */
|
/* Using socket activation - check user didn't use -p etc. */
|
||||||
const char *err_msg = socket_activation_validate_opts(device, sockpath,
|
const char *err_msg = socket_activation_validate_opts(device, sockpath,
|
||||||
bindto, port,
|
bindto, port,
|
||||||
|
selinux_label,
|
||||||
list);
|
list);
|
||||||
if (err_msg != NULL) {
|
if (err_msg != NULL) {
|
||||||
error_report("%s", err_msg);
|
error_report("%s", err_msg);
|
||||||
|
@ -827,6 +847,18 @@ int main(int argc, char **argv)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (selinux_label) {
|
||||||
|
#ifdef CONFIG_SELINUX
|
||||||
|
if (sockpath == NULL && device == NULL) {
|
||||||
|
error_report("--selinux-label is not permitted without --socket");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
#else
|
||||||
|
error_report("SELinux support not enabled in this binary");
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
if (list) {
|
if (list) {
|
||||||
saddr = nbd_build_socket_address(sockpath, bindto, port);
|
saddr = nbd_build_socket_address(sockpath, bindto, port);
|
||||||
return qemu_nbd_client_list(saddr, tlscreds, bindto);
|
return qemu_nbd_client_list(saddr, tlscreds, bindto);
|
||||||
|
@ -940,6 +972,13 @@ int main(int argc, char **argv)
|
||||||
} else {
|
} else {
|
||||||
backlog = MIN(shared, SOMAXCONN);
|
backlog = MIN(shared, SOMAXCONN);
|
||||||
}
|
}
|
||||||
|
#ifdef CONFIG_SELINUX
|
||||||
|
if (selinux_label && setsockcreatecon_raw(selinux_label) == -1) {
|
||||||
|
error_report("Cannot set SELinux socket create context to %s: %s",
|
||||||
|
selinux_label, strerror(errno));
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
#endif
|
||||||
saddr = nbd_build_socket_address(sockpath, bindto, port);
|
saddr = nbd_build_socket_address(sockpath, bindto, port);
|
||||||
if (qio_net_listener_open_sync(server, saddr, backlog,
|
if (qio_net_listener_open_sync(server, saddr, backlog,
|
||||||
&local_err) < 0) {
|
&local_err) < 0) {
|
||||||
|
@ -947,6 +986,13 @@ int main(int argc, char **argv)
|
||||||
error_report_err(local_err);
|
error_report_err(local_err);
|
||||||
exit(EXIT_FAILURE);
|
exit(EXIT_FAILURE);
|
||||||
}
|
}
|
||||||
|
#ifdef CONFIG_SELINUX
|
||||||
|
if (selinux_label && setsockcreatecon_raw(NULL) == -1) {
|
||||||
|
error_report("Cannot clear SELinux socket create context: %s",
|
||||||
|
strerror(errno));
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
#endif
|
||||||
} else {
|
} else {
|
||||||
size_t i;
|
size_t i;
|
||||||
/* See comment in check_socket_activation above. */
|
/* See comment in check_socket_activation above. */
|
||||||
|
|
|
@ -72,6 +72,7 @@ meson_options_help() {
|
||||||
printf "%s\n" ' sdl SDL user interface'
|
printf "%s\n" ' sdl SDL user interface'
|
||||||
printf "%s\n" ' sdl-image SDL Image support for icons'
|
printf "%s\n" ' sdl-image SDL Image support for icons'
|
||||||
printf "%s\n" ' seccomp seccomp support'
|
printf "%s\n" ' seccomp seccomp support'
|
||||||
|
printf "%s\n" ' selinux SELinux support in qemu-nbd'
|
||||||
printf "%s\n" ' smartcard CA smartcard emulation support'
|
printf "%s\n" ' smartcard CA smartcard emulation support'
|
||||||
printf "%s\n" ' snappy snappy compression support'
|
printf "%s\n" ' snappy snappy compression support'
|
||||||
printf "%s\n" ' sparse sparse checker'
|
printf "%s\n" ' sparse sparse checker'
|
||||||
|
@ -215,6 +216,8 @@ _meson_option_parse() {
|
||||||
--disable-sdl-image) printf "%s" -Dsdl_image=disabled ;;
|
--disable-sdl-image) printf "%s" -Dsdl_image=disabled ;;
|
||||||
--enable-seccomp) printf "%s" -Dseccomp=enabled ;;
|
--enable-seccomp) printf "%s" -Dseccomp=enabled ;;
|
||||||
--disable-seccomp) printf "%s" -Dseccomp=disabled ;;
|
--disable-seccomp) printf "%s" -Dseccomp=disabled ;;
|
||||||
|
--enable-selinux) printf "%s" -Dselinux=enabled ;;
|
||||||
|
--disable-selinux) printf "%s" -Dselinux=disabled ;;
|
||||||
--enable-slirp) printf "%s" -Dslirp=enabled ;;
|
--enable-slirp) printf "%s" -Dslirp=enabled ;;
|
||||||
--disable-slirp) printf "%s" -Dslirp=disabled ;;
|
--disable-slirp) printf "%s" -Dslirp=disabled ;;
|
||||||
--enable-slirp=*) quote_sh "-Dslirp=$2" ;;
|
--enable-slirp=*) quote_sh "-Dslirp=$2" ;;
|
||||||
|
|
|
@ -51,6 +51,7 @@ ENV PACKAGES \
|
||||||
libpng-devel \
|
libpng-devel \
|
||||||
librbd-devel \
|
librbd-devel \
|
||||||
libseccomp-devel \
|
libseccomp-devel \
|
||||||
|
libselinux-devel \
|
||||||
libslirp-devel \
|
libslirp-devel \
|
||||||
libssh-devel \
|
libssh-devel \
|
||||||
libtasn1-devel \
|
libtasn1-devel \
|
||||||
|
|
|
@ -8,6 +8,7 @@ ENV PACKAGES \
|
||||||
gcc \
|
gcc \
|
||||||
git \
|
git \
|
||||||
libffi-devel.i686 \
|
libffi-devel.i686 \
|
||||||
|
libselinux-devel.i686 \
|
||||||
libtasn1-devel.i686 \
|
libtasn1-devel.i686 \
|
||||||
libzstd-devel.i686 \
|
libzstd-devel.i686 \
|
||||||
make \
|
make \
|
||||||
|
|
|
@ -53,6 +53,7 @@ ENV PACKAGES \
|
||||||
libpng-devel \
|
libpng-devel \
|
||||||
librbd-devel \
|
librbd-devel \
|
||||||
libseccomp-devel \
|
libseccomp-devel \
|
||||||
|
libselinux-devel \
|
||||||
libslirp-devel \
|
libslirp-devel \
|
||||||
libssh-devel \
|
libssh-devel \
|
||||||
libtasn1-devel \
|
libtasn1-devel \
|
||||||
|
|
|
@ -55,6 +55,7 @@ ENV PACKAGES \
|
||||||
libpulse-devel \
|
libpulse-devel \
|
||||||
librbd-devel \
|
librbd-devel \
|
||||||
libseccomp-devel \
|
libseccomp-devel \
|
||||||
|
libselinux-devel \
|
||||||
libspice-server-devel \
|
libspice-server-devel \
|
||||||
libssh-devel \
|
libssh-devel \
|
||||||
libtasn1-devel \
|
libtasn1-devel \
|
||||||
|
|
|
@ -60,6 +60,7 @@ ENV PACKAGES \
|
||||||
libsdl2-dev \
|
libsdl2-dev \
|
||||||
libsdl2-image-dev \
|
libsdl2-image-dev \
|
||||||
libseccomp-dev \
|
libseccomp-dev \
|
||||||
|
libselinux-dev \
|
||||||
libsnappy-dev \
|
libsnappy-dev \
|
||||||
libspice-protocol-dev \
|
libspice-protocol-dev \
|
||||||
libspice-server-dev \
|
libspice-server-dev \
|
||||||
|
|
|
@ -60,6 +60,7 @@ ENV PACKAGES \
|
||||||
libsdl2-dev \
|
libsdl2-dev \
|
||||||
libsdl2-image-dev \
|
libsdl2-image-dev \
|
||||||
libseccomp-dev \
|
libseccomp-dev \
|
||||||
|
libselinux-dev \
|
||||||
libslirp-dev \
|
libslirp-dev \
|
||||||
libsnappy-dev \
|
libsnappy-dev \
|
||||||
libspice-protocol-dev \
|
libspice-protocol-dev \
|
||||||
|
|
Loading…
Reference in New Issue