[fedora-virt-maint] rpms/libvirt/F-11 libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch, NONE, 1.1 libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch, NONE, 1.1 libvirt.spec, 1.134, 1.135

[Mark McLoughlin]

Author: markmc

Update of /cvs/pkgs/rpms/libvirt/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18128

Modified Files:
	libvirt.spec 
Added Files:
	libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch 
	libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch 
Log Message:
* Fri Jul  3 2009 Mark McLoughlin <markmc at redhat.com> - 0.6.2-13.fc11
- Fix libvirtd crash with bad capabilities data (bug #505635)
- Don't unnecessarily try to change a file context (bug #507555)


libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch:

--- NEW FILE libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch ---
>From ae4523336ac06e3ff7cc7b416fad9e57998c6b54 Mon Sep 17 00:00:00 2001
From: Tim Waugh <twaugh at redhat.com>
Date: Fri, 3 Jul 2009 10:29:01 +0100
Subject: [PATCH 2/3] Don't unnecessarily try to change a file context

As pointed out by Tim Waugh here:

  https://bugzilla.redhat.com/507555

We shouldn't bother trying to set the context of a file if it already
matches what we want.

(Fixed to use STREQ() and not use tabs, as pointed out by danpb)

Signed-off-by: Mark McLoughlin <markmc at redhat.com>
---
 src/security_selinux.c |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/src/security_selinux.c b/src/security_selinux.c
index db1c27d..c2015a1 100644
--- a/src/security_selinux.c
+++ b/src/security_selinux.c
@@ -280,10 +280,19 @@ static int
 SELinuxSetFilecon(virConnectPtr conn, const char *path, char *tcon)
 {
     char ebuf[1024];
+    security_context_t econ;
 
     VIR_INFO("Setting SELinux context on '%s' to '%s'", path, tcon);
 
-    if(setfilecon(path, tcon) < 0) {
+    if (setfilecon(path, tcon) < 0) {
+        if (getfilecon(path, &econ) >= 0) {
+            if (STREQ(tcon, econ)) {
+                freecon(econ);
+                /* It's alright, there's nothing to change anyway. */
+                return 0;
+            }
+            freecon(econ);
+        }
         virSecurityReportError(conn, VIR_ERR_ERROR,
                                _("%s: unable to set security context "
                                  "'\%s\' on %s: %s."), __func__,
-- 
1.6.2.5


libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch:

--- NEW FILE libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch ---
>From 80965bff6d46dea1808c8bbf02f50f0e289a0e65 Mon Sep 17 00:00:00 2001
From: Daniel P. Berrange <berrange at redhat.com>
Date: Mon, 29 Jun 2009 10:41:56 +0000
Subject: [PATCH] Fix crash in QEMU driver with bad capabilities data

---
 src/qemu_driver.c |   80 +++++++++++++++++++++++++++++++++++-----------------
 1 files changed, 54 insertions(+), 26 deletions(-)

diff -up libvirt-0.6.2/src/qemu_driver.c.bad-caps libvirt-0.6.2/src/qemu_driver.c
--- libvirt-0.6.2/src/qemu_driver.c.bad-caps	2009-07-03 10:07:03.275252815 +0100
+++ libvirt-0.6.2/src/qemu_driver.c	2009-07-03 10:08:52.143502961 +0100
@@ -360,12 +360,43 @@ next:
     return 0;
 }
 
+
+static int
+qemudSecurityCapsInit(virSecurityDriverPtr secdrv,
+                      virCapsPtr caps)
+{
+    const char *doi, *model;
+
+    doi = virSecurityDriverGetDOI(secdrv);
+    model = virSecurityDriverGetModel(secdrv);
+
+    caps->host.secModel.model = strdup(model);
+    if (!caps->host.secModel.model) {
+        char ebuf[1024];
+        VIR_ERROR(_("Failed to copy secModel model: %s"),
+                  virStrerror(errno, ebuf, sizeof ebuf));
+        return -1;
+    }
+
+    caps->host.secModel.doi = strdup(doi);
+    if (!caps->host.secModel.doi) {
+        char ebuf[1024];
+        VIR_ERROR(_("Failed to copy secModel DOI: %s"),
+                  virStrerror(errno, ebuf, sizeof ebuf));
+        return -1;
+    }
+
+    VIR_DEBUG("Initialized caps for security driver \"%s\" with "
+              "DOI \"%s\"", model, doi);
+
+    return 0;
+}
+
+
 static int
 qemudSecurityInit(struct qemud_driver *qemud_drv)
 {
     int ret;
-    const char *doi, *model;
-    virCapsPtr caps;
     virSecurityDriverPtr security_drv;
 
     ret = virSecurityDriverStartup(&security_drv,
@@ -381,36 +412,17 @@ qemudSecurityInit(struct qemud_driver *q
     }
 
     qemud_drv->securityDriver = security_drv;
-    doi = virSecurityDriverGetDOI(security_drv);
-    model = virSecurityDriverGetModel(security_drv);
 
-    VIR_DEBUG("Initialized security driver \"%s\" with "
-              "DOI \"%s\"", model, doi);
+    VIR_INFO("Initialized security driver %s", security_drv->name);
 
     /*
      * Add security policy host caps now that the security driver is
      * initialized.
      */
-    caps = qemud_drv->caps;
-
-    caps->host.secModel.model = strdup(model);
-    if (!caps->host.secModel.model) {
-        char ebuf[1024];
-        VIR_ERROR(_("Failed to copy secModel model: %s"),
-                  virStrerror(errno, ebuf, sizeof ebuf));
-        return -1;
-    }
+    return qemudSecurityCapsInit(security_drv, qemud_drv->caps);
+}
 
-    caps->host.secModel.doi = strdup(doi);
-    if (!caps->host.secModel.doi) {
-        char ebuf[1024];
-        VIR_ERROR(_("Failed to copy secModel DOI: %s"),
-                  virStrerror(errno, ebuf, sizeof ebuf));
-        return -1;
-    }
 
-    return 0;
-}
 
 /**
  * qemudStartup:
@@ -1852,13 +1864,29 @@ static int qemudGetNodeInfo(virConnectPt
 
 static char *qemudGetCapabilities(virConnectPtr conn) {
     struct qemud_driver *driver = conn->privateData;
+    virCapsPtr caps;
     char *xml = NULL;
 
     qemuDriverLock(driver);
+    if ((caps = qemudCapsInit()) == NULL) {
+        virReportOOMError(conn);
+        goto cleanup;
+    }
+
+    if (qemu_driver->securityDriver &&
+        qemudSecurityCapsInit(qemu_driver->securityDriver, caps) < 0) {
+        virCapabilitiesFree(caps);
+        virReportOOMError(conn);
+        goto cleanup;
+    }
+
     virCapabilitiesFree(qemu_driver->caps);
-    if ((qemu_driver->caps = qemudCapsInit()) == NULL ||
-        (xml = virCapabilitiesFormatXML(driver->caps)) == NULL)
+    qemu_driver->caps = caps;
+
+    if ((xml = virCapabilitiesFormatXML(driver->caps)) == NULL)
         virReportOOMError(conn);
+
+cleanup:
     qemuDriverUnlock(driver);
 
     return xml;


Index: libvirt.spec
===================================================================
RCS file: /cvs/pkgs/rpms/libvirt/F-11/libvirt.spec,v
retrieving revision 1.134
retrieving revision 1.135
diff -u -p -r1.134 -r1.135
--- libvirt.spec	5 Jun 2009 11:47:31 -0000	1.134
+++ libvirt.spec	3 Jul 2009 10:05:41 -0000	1.135
@@ -66,7 +66,7 @@
 Summary: Library providing a simple API virtualization
 Name: libvirt
 Version: 0.6.2
-Release: 12%{?dist}%{?extra_release}
+Release: 13%{?dist}%{?extra_release}
 License: LGPLv2+
 Group: Development/Libraries
 Source: libvirt-%{version}.tar.gz
@@ -100,6 +100,10 @@ Patch12: libvirt-0.6.2-qemu-ppc-machine-
 Patch13: libvirt-0.6.2-libvirtd-double-free.patch
 # Fix broken networking with newer qemu releases (bz 503275)
 Patch14: libvirt-0.6.2-avoid-broken-networking-with-newer-qemu.patch
+# Fix libvirtd crash with bad capabilities data (bz 505635)
+Patch15: libvirt-0.6.2-fix-libvirtd-crash-with-bad-capabilities-data.patch
+# Don't unnecessarily try to change a file context (bug #507555)
+Patch16: libvirt-0.6.2-do-not-unnecessarily-try-to-change-a-file-context.patch
 
 # Not for upstream. Temporary hack till PulseAudio autostart
 # problems are sorted out when SELinux enforcing
@@ -266,6 +270,8 @@ of recent versions of Linux (and other O
 %patch12 -p1
 %patch13 -p1
 %patch14 -p1
+%patch15 -p1
+%patch16 -p1
 
 %patch200 -p0
 
@@ -589,6 +595,10 @@ fi
 %endif
 
 %changelog
+* Fri Jul  3 2009 Mark McLoughlin <markmc at redhat.com> - 0.6.2-13.fc11
+- Fix libvirtd crash with bad capabilities data (bug #505635)
+- Don't unnecessarily try to change a file context (bug #507555)
+
 * Fri Jun  5 2009 Mark McLoughlin <markmc at redhat.com> - 0.6.2-12.fc11
 - Use the correct QEMU machine type for ppc (bug #502862)
 - Fix crash with TLS connections (bug #503066)