[libvirt] [PATCH] Fix handling of disk backing stores with cgroups

[Daniel P. Berrange]

The cgroups ACL code was only allowing the primary disk image.
It is possible to chain images together, so we need to search
for backing stores and add them to the ACL too. Since the ACL
only handles block devices, we ignore the EINVAL we get from
plain files.

* src/qemu/qemu_driver.c: Allow backing stores in cgroup ACLs
---
 src/qemu/qemu_driver.c |   47 +++++++++++++++++++++++++++++++++++------------
 1 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 326cb58..ae6addd 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -84,6 +84,7 @@
 #include "macvtap.h"
 #include "nwfilter/nwfilter_gentech_driver.h"
 #include "hooks.h"
+#include "storage_file.h"
 
 
 #define VIR_FROM_THIS VIR_FROM_QEMU
@@ -2957,18 +2958,40 @@ static int qemuSetupCgroup(struct qemud_driver *driver,
         }
 
         for (i = 0; i < vm->def->ndisks ; i++) {
-            if (vm->def->disks[i]->type != VIR_DOMAIN_DISK_TYPE_BLOCK ||
-                vm->def->disks[i]->src == NULL)
-                continue;
+            char *path = vm->def->disks[i]->src;
+            while (path != NULL) {
+                virStorageFileMetadata meta;
+                int ret;
+
+                VIR_DEBUG("Process path %s for disk %d", path, i);
+                rc = virCgroupAllowDevicePath(cgroup, path);
+                if (rc != 0) {
+                    /* Get this for non-block devices */
+                    if (rc == -EINVAL) {
+                        VIR_DEBUG("Ignoring EINVAL for %s", path);
+                    } else {
+                        virReportSystemError(-rc,
+                                             _("Unable to allow device %s for %s"),
+                                             path, vm->def->name);
+                        if (path != vm->def->disks[i]->src)
+                            VIR_FREE(path);
+                        goto cleanup;
+                    }
+                }
 
-            rc = virCgroupAllowDevicePath(cgroup,
-                                          vm->def->disks[i]->src);
-            if (rc != 0) {
-                virReportSystemError(-rc,
-                                     _("Unable to allow device %s for %s"),
-                                     vm->def->disks[i]->src, vm->def->name);
-                goto cleanup;
-            }
+                memset(&meta, 0, sizeof(meta));
+
+                ret = virStorageFileGetMetadata(path, &meta);
+
+                if (path != vm->def->disks[i]->src)
+                    VIR_FREE(path);
+                path = NULL;
+
+                if (ret < 0)
+                    goto cleanup;
+
+                path = meta.backingStore;
+            } while (path != NULL);
         }
 
         rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_PTY_MAJOR);
-- 
1.6.5.2