diff options
author | Mark Asselstine <mark.asselstine@windriver.com> | 2018-06-05 10:01:48 -0400 |
---|---|---|
committer | Bruce Ashfield <bruce.ashfield@windriver.com> | 2018-06-05 12:01:01 -0400 |
commit | 343b40ba0d44caeb22013a1586ae2159e415bd4c (patch) | |
tree | 3c5fdb72c38b060aeefccff3cd85091b5a5421c3 /recipes-extended/libvirt/libvirt-1.3.5/0001-qemu-Let-empty-default-VNC-password-work-as-document.patch | |
parent | 1fd1ff3720140baa3680d795f6d97597e5113e90 (diff) | |
download | meta-virtualization-343b40ba0d44caeb22013a1586ae2159e415bd4c.tar.gz |
libvirt: uprev to the latest release, v4.3.0
We have been using the 1.3.x release series for a long time now which
has been great for stability but is slowly becoming harder and harder
to track and port bug and CVE fixes. This is a big jump to the latest
upstream release which gives us access to a myriad of fixes as well as
puts us in a better position to contribute to the upstream project
when issues are found.
Several patches have been dropped as they are either no longer valid
against this release or have equivalent updates already applied to the
upstream project. Some patches were consolidated which should ease
future uprevs of this recipe. The majority of the updates were related
to ptest patches, which is not a huge surprise given this code has no
upstream equivalent.
The overall runtime behavior remains much the same from v1.3.5 with
the only notable configuration change being for 'seccomp_sandbox'
which has been disabled here but should possibly be revisited in the
near future.
As usual the normal runtime usecases for qemu/kvm and lxc have been
run successfully along with ptest results which are by and large OK:
====================================
Testsuite summary for libvirt 4.3.0
====================================
# TOTAL: 119
# PASS: 115
# SKIP: 0
# XFAIL: 0
# FAIL: 4
# XPASS: 0
# ERROR: 0
Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Diffstat (limited to 'recipes-extended/libvirt/libvirt-1.3.5/0001-qemu-Let-empty-default-VNC-password-work-as-document.patch')
-rw-r--r-- | recipes-extended/libvirt/libvirt-1.3.5/0001-qemu-Let-empty-default-VNC-password-work-as-document.patch | 81 |
1 files changed, 0 insertions, 81 deletions
diff --git a/recipes-extended/libvirt/libvirt-1.3.5/0001-qemu-Let-empty-default-VNC-password-work-as-document.patch b/recipes-extended/libvirt/libvirt-1.3.5/0001-qemu-Let-empty-default-VNC-password-work-as-document.patch deleted file mode 100644 index 1d13dd36..00000000 --- a/recipes-extended/libvirt/libvirt-1.3.5/0001-qemu-Let-empty-default-VNC-password-work-as-document.patch +++ /dev/null | |||
@@ -1,81 +0,0 @@ | |||
1 | Upstream-Status: Backport | ||
2 | |||
3 | Backport patch to fix CVE-2016-5008 from: | ||
4 | |||
5 | https://libvirt.org/git/?p=libvirt.git;a=commit;h=f32441c69bf450d6ac593c3acd621c37e120cdaf | ||
6 | |||
7 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | ||
8 | --- | ||
9 | From f32441c69bf450d6ac593c3acd621c37e120cdaf Mon Sep 17 00:00:00 2001 | ||
10 | From: Jiri Denemark <jdenemar@redhat.com> | ||
11 | Date: Tue, 28 Jun 2016 14:39:58 +0200 | ||
12 | Subject: [PATCH] qemu: Let empty default VNC password work as documented | ||
13 | |||
14 | CVE-2016-5008 | ||
15 | |||
16 | Setting an empty graphics password is documented as a way to disable | ||
17 | VNC/SPICE access, but QEMU does not always behaves like that. VNC would | ||
18 | happily accept the empty password. Let's enforce the behavior by setting | ||
19 | password expiration to "now". | ||
20 | |||
21 | https://bugzilla.redhat.com/show_bug.cgi?id=1180092 | ||
22 | |||
23 | Signed-off-by: Jiri Denemark <jdenemar@redhat.com> | ||
24 | (cherry picked from commit bb848feec0f3f10e92dd8e5231ae7aa89b5598f3) | ||
25 | --- | ||
26 | src/qemu/qemu_hotplug.c | 14 +++++++------- | ||
27 | 1 file changed, 7 insertions(+), 7 deletions(-) | ||
28 | |||
29 | diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c | ||
30 | index 5f12d77..fda28b0 100644 | ||
31 | --- a/src/qemu/qemu_hotplug.c | ||
32 | +++ b/src/qemu/qemu_hotplug.c | ||
33 | @@ -3547,6 +3547,7 @@ qemuDomainChangeGraphicsPasswords(virQEMUDriverPtr driver, | ||
34 | time_t now = time(NULL); | ||
35 | char expire_time [64]; | ||
36 | const char *connected = NULL; | ||
37 | + const char *password; | ||
38 | int ret = -1; | ||
39 | virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); | ||
40 | |||
41 | @@ -3554,16 +3555,14 @@ qemuDomainChangeGraphicsPasswords(virQEMUDriverPtr driver, | ||
42 | ret = 0; | ||
43 | goto cleanup; | ||
44 | } | ||
45 | + password = auth->passwd ? auth->passwd : defaultPasswd; | ||
46 | |||
47 | if (auth->connected) | ||
48 | connected = virDomainGraphicsAuthConnectedTypeToString(auth->connected); | ||
49 | |||
50 | if (qemuDomainObjEnterMonitorAsync(driver, vm, asyncJob) < 0) | ||
51 | goto cleanup; | ||
52 | - ret = qemuMonitorSetPassword(priv->mon, | ||
53 | - type, | ||
54 | - auth->passwd ? auth->passwd : defaultPasswd, | ||
55 | - connected); | ||
56 | + ret = qemuMonitorSetPassword(priv->mon, type, password, connected); | ||
57 | |||
58 | if (ret == -2) { | ||
59 | if (type != VIR_DOMAIN_GRAPHICS_TYPE_VNC) { | ||
60 | @@ -3571,14 +3570,15 @@ qemuDomainChangeGraphicsPasswords(virQEMUDriverPtr driver, | ||
61 | _("Graphics password only supported for VNC")); | ||
62 | ret = -1; | ||
63 | } else { | ||
64 | - ret = qemuMonitorSetVNCPassword(priv->mon, | ||
65 | - auth->passwd ? auth->passwd : defaultPasswd); | ||
66 | + ret = qemuMonitorSetVNCPassword(priv->mon, password); | ||
67 | } | ||
68 | } | ||
69 | if (ret != 0) | ||
70 | goto end_job; | ||
71 | |||
72 | - if (auth->expires) { | ||
73 | + if (password[0] == '\0') { | ||
74 | + snprintf(expire_time, sizeof(expire_time), "now"); | ||
75 | + } else if (auth->expires) { | ||
76 | time_t lifetime = auth->validTo - now; | ||
77 | if (lifetime <= 0) | ||
78 | snprintf(expire_time, sizeof(expire_time), "now"); | ||
79 | -- | ||
80 | 2.9.0 | ||
81 | |||