diff --git a/libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch b/libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch new file mode 100644 index 0000000..4669460 --- /dev/null +++ b/libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch @@ -0,0 +1,47 @@ +From ae4523336ac06e3ff7cc7b416fad9e57998c6b54 Mon Sep 17 00:00:00 2001 +From: Tim Waugh +Date: Fri, 3 Jul 2009 10:29:01 +0100 +Subject: [PATCH 2/3] Don't unnecessarily try to change a file context + +As pointed out by Tim Waugh here: + + https://bugzilla.redhat.com/507555 + +We shouldn't bother trying to set the context of a file if it already +matches what we want. + +(Fixed to use STREQ() and not use tabs, as pointed out by danpb) + +Signed-off-by: Mark McLoughlin +--- + src/security_selinux.c | 11 ++++++++++- + 1 files changed, 10 insertions(+), 1 deletions(-) + +diff --git a/src/security_selinux.c b/src/security_selinux.c +index db1c27d..c2015a1 100644 +--- a/src/security_selinux.c ++++ b/src/security_selinux.c +@@ -280,10 +280,19 @@ static int + SELinuxSetFilecon(virConnectPtr conn, const char *path, char *tcon) + { + char ebuf[1024]; ++ security_context_t econ; + + VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon); + +- if(setfilecon(path, tcon) < 0) { ++ if (setfilecon(path, tcon) < 0) { ++ if (getfilecon(path, &econ) >= 0) { ++ if (STREQ(tcon, econ)) { ++ freecon(econ); ++ /* It's alright, there's nothing to change anyway. */ ++ return 0; ++ } ++ freecon(econ); ++ } + virSecurityReportError(conn, VIR_ERR_ERROR, + _("%s: unable to set security context " + "'\%s\' on %s: %s."), __func__, +-- +1.6.2.5 + diff --git a/libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch b/libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch new file mode 100644 index 0000000..c39447a --- /dev/null +++ b/libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch @@ -0,0 +1,130 @@ +From 80965bff6d46dea1808c8bbf02f50f0e289a0e65 Mon Sep 17 00:00:00 2001 +From: Daniel P. Berrange +Date: Mon, 29 Jun 2009 10:41:56 +0000 +Subject: [PATCH] Fix crash in QEMU driver with bad capabilities data + +--- + src/qemu_driver.c | 80 +++++++++++++++++++++++++++++++++++----------------- + 1 files changed, 54 insertions(+), 26 deletions(-) + +diff -up libvirt-0.6.2/src/qemu_driver.c.bad-caps libvirt-0.6.2/src/qemu_driver.c +--- libvirt-0.6.2/src/qemu_driver.c.bad-caps 2009-07-03 10:07:03.275252815 +0100 ++++ libvirt-0.6.2/src/qemu_driver.c 2009-07-03 10:08:52.143502961 +0100 +@@ -360,12 +360,43 @@ next: + return 0; + } + ++ ++static int ++qemudSecurityCapsInit(virSecurityDriverPtr secdrv, ++ virCapsPtr caps) ++{ ++ const char *doi, *model; ++ ++ doi = virSecurityDriverGetDOI(secdrv); ++ model = virSecurityDriverGetModel(secdrv); ++ ++ caps->host.secModel.model = strdup(model); ++ if (!caps->host.secModel.model) { ++ char ebuf[1024]; ++ VIR_ERROR(_("Failed to copy secModel model: %s"), ++ virStrerror(errno, ebuf, sizeof ebuf)); ++ return -1; ++ } ++ ++ caps->host.secModel.doi = strdup(doi); ++ if (!caps->host.secModel.doi) { ++ char ebuf[1024]; ++ VIR_ERROR(_("Failed to copy secModel DOI: %s"), ++ virStrerror(errno, ebuf, sizeof ebuf)); ++ return -1; ++ } ++ ++ VIR_DEBUG("Initialized caps for security driver \"%s\" with " ++ "DOI \"%s\"", model, doi); ++ ++ return 0; ++} ++ ++ + static int + qemudSecurityInit(struct qemud_driver *qemud_drv) + { + int ret; +- const char *doi, *model; +- virCapsPtr caps; + virSecurityDriverPtr security_drv; + + ret = virSecurityDriverStartup(&security_drv, +@@ -381,36 +412,17 @@ qemudSecurityInit(struct qemud_driver *q + } + + qemud_drv->securityDriver = security_drv; +- doi = virSecurityDriverGetDOI(security_drv); +- model = virSecurityDriverGetModel(security_drv); + +- VIR_DEBUG("Initialized security driver \"%s\" with " +- "DOI \"%s\"", model, doi); ++ VIR_INFO("Initialized security driver %s", security_drv->name); + + /* + * Add security policy host caps now that the security driver is + * initialized. + */ +- caps = qemud_drv->caps; +- +- caps->host.secModel.model = strdup(model); +- if (!caps->host.secModel.model) { +- char ebuf[1024]; +- VIR_ERROR(_("Failed to copy secModel model: %s"), +- virStrerror(errno, ebuf, sizeof ebuf)); +- return -1; +- } ++ return qemudSecurityCapsInit(security_drv, qemud_drv->caps); ++} + +- caps->host.secModel.doi = strdup(doi); +- if (!caps->host.secModel.doi) { +- char ebuf[1024]; +- VIR_ERROR(_("Failed to copy secModel DOI: %s"), +- virStrerror(errno, ebuf, sizeof ebuf)); +- return -1; +- } + +- return 0; +-} + + /** + * qemudStartup: +@@ -1852,13 +1864,29 @@ static int qemudGetNodeInfo(virConnectPt + + static char *qemudGetCapabilities(virConnectPtr conn) { + struct qemud_driver *driver = conn->privateData; ++ virCapsPtr caps; + char *xml = NULL; + + qemuDriverLock(driver); ++ if ((caps = qemudCapsInit()) == NULL) { ++ virReportOOMError(conn); ++ goto cleanup; ++ } ++ ++ if (qemu_driver->securityDriver && ++ qemudSecurityCapsInit(qemu_driver->securityDriver, caps) < 0) { ++ virCapabilitiesFree(caps); ++ virReportOOMError(conn); ++ goto cleanup; ++ } ++ + virCapabilitiesFree(qemu_driver->caps); +- if ((qemu_driver->caps = qemudCapsInit()) == NULL || +- (xml = virCapabilitiesFormatXML(driver->caps)) == NULL) ++ qemu_driver->caps = caps; ++ ++ if ((xml = virCapabilitiesFormatXML(driver->caps)) == NULL) + virReportOOMError(conn); ++ ++cleanup: + qemuDriverUnlock(driver); + + return xml; diff --git a/libvirt.spec b/libvirt.spec index de6281f..d32224e 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -66,7 +66,7 @@ Summary: Library providing a simple API virtualization Name: libvirt Version: 0.6.2 -Release: 12%{?dist}%{?extra_release} +Release: 13%{?dist}%{?extra_release} License: LGPLv2+ Group: Development/Libraries Source: libvirt-%{version}.tar.gz @@ -100,6 +100,10 @@ Patch12: libvirt-0.6.2-qemu-ppc-machine-type.patch Patch13: libvirt-0.6.2-libvirtd-double-free.patch # Fix broken networking with newer qemu releases (bz 503275) Patch14: libvirt-0.6.2-avoid-broken-networking-with-newer-qemu.patch +# Fix libvirtd crash with bad capabilities data (bz 505635) +Patch15: libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch +# Don't unnecessarily try to change a file context (bug #507555) +Patch16: libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch # Not for upstream. Temporary hack till PulseAudio autostart # problems are sorted out when SELinux enforcing @@ -266,6 +270,8 @@ of recent versions of Linux (and other OSes). %patch12 -p1 %patch13 -p1 %patch14 -p1 +%patch15 -p1 +%patch16 -p1 %patch200 -p0 @@ -589,6 +595,10 @@ fi %endif %changelog +* Fri Jul 3 2009 Mark McLoughlin - 0.6.2-13.fc11 +- Fix libvirtd crash with bad capabilities data (bug #505635) +- Don't unnecessarily try to change a file context (bug #507555) + * Fri Jun 5 2009 Mark McLoughlin - 0.6.2-12.fc11 - Use the correct QEMU machine type for ppc (bug #502862) - Fix crash with TLS connections (bug #503066)