[libvirt] [PATCH] event: move event filtering to daemon (regression fix)

Eric Blake eblake at redhat.com
Wed Feb 5 13:43:13 UTC 2014


On 01/28/2014 03:48 PM, Eric Blake wrote:
> Commit f9f56340 for CVE-2014-0028 almost had the right idea - we
> need to check the ACL rules to filter which events to send.  But
> it overlooked one thing: the event dispatch queue is running in
> the main loop thread, and therefore does not normally have a
> current virIdentityPtr.  But filter checks can be based on current
> identity, so when libvirtd.conf contains access_drivers=["polkit"],
> we ended up rejecting access for EVERY event due to failure to
> look up the current identity, even if it should have been allowed.

Ping.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 604 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20140205/3bf4ff11/attachment-0001.sig>


More information about the libvir-list mailing list