August 2015 - Libguestfs - libguestfs List Archives

CVE-2015-5745: Vulnerability in qemu virtio-serial feature could affect libguestfs
by Richard W.M. Jones 06 Aug '15

06 Aug '15

https://bugzilla.redhat.com/show_bug.cgi?id=1251157 This is not a vulnerability in libguestfs, but because we always give a virtio-serial port to each guest (since that is how guest-host communication happens), an escalation from the appliance to the host qemu process is possible. This could affect you if: - your libguestfs program runs untrusted programs out of the guest (eg. using guestfs_sh etc) - another exploit was found in (eg) kernel filesystem code that allowed a malformed filesystem to take over the appliance If you use sVirt to confine qemu, that would thwart some/all attacks. Patching qemu recommended. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com libguestfs lets you edit virtual machines. Supports shell scripting, bindings from many languages. http://libguestfs.org

1 0

[PATCH] customize: Make dnf upgrade to the latest versions of packages.
by Richard W.M. Jones 05 Aug '15

05 Aug '15

I discovered that 'dnf upgrade' doesn't actually upgrade to the latest versions of packages unless you also supply the '--best' flag. This also changes update -> upgrade, since apparently 'dnf update' is deprecated. --- customize/customize_run.ml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/customize/customize_run.ml b/customize/customize_run.ml index bce0aca..828c711 100644 --- a/customize/customize_run.ml +++ b/customize/customize_run.ml @@ -123,7 +123,7 @@ exec >>%s 2>&1 apt-get $apt_opts upgrade " | "dnf" -> - sprintf "dnf -y update" + sprintf "dnf -y --best upgrade" | "pisi" -> sprintf "pisi upgrade" | "pacman" -> -- 2.5.0

2 1

[PATCH] automake: Admit defeat and use 'subdir-objects'.
by Richard W.M. Jones 05 Aug '15

05 Aug '15

Because this 'feature' is broken (since 2013): https://debbugs.gnu.org/cgi/bugreport.cgi?bug=13928 we have to replace all instances of $(top_srcdir) in *_SOURCES lines with a relative path. According to what I read, this shouldn't break split builds, but I didn't test it. The only things automake moans about now are: * Unescaped left brace in regex is deprecated, passed through in regex; marked by <-- HERE in m/\${ <-- HERE ([^ \t=:+{}]+)}/ at /usr/bin/automake line 3936. - This is another bug in automake * autoreconf: configure.ac: AM_GNU_GETTEXT is used, but not AM_GNU_GETTEXT_VERSION - This is a feature, not a bug. --- .gitignore | 1 + builder/Makefile.am | 14 +++++++------- configure.ac | 2 +- customize/Makefile.am | 8 ++++---- dib/Makefile.am | 2 +- get-kernel/Makefile.am | 4 ++-- mllib/Makefile.am | 4 ++-- resize/Makefile.am | 10 +++++----- sparsify/Makefile.am | 4 ++-- sysprep/Makefile.am | 12 ++++++------ tests/mount-local/Makefile.am | 4 ++-- v2v/Makefile.am | 2 +- 12 files changed, 34 insertions(+), 33 deletions(-) diff --git a/.gitignore b/.gitignore index 361da6d..e35a7b3 100644 --- a/.gitignore +++ b/.gitignore @@ -23,6 +23,7 @@ bindtests.tmp cscope.out .deps +.dirstamp .gdb_history .libs Makefile diff --git a/builder/Makefile.am b/builder/Makefile.am index 083e3a4..fcaa70a 100644 --- a/builder/Makefile.am +++ b/builder/Makefile.am @@ -72,13 +72,13 @@ SOURCES_ML = \ builder.ml SOURCES_C = \ - $(top_srcdir)/mllib/fsync-c.c \ - $(top_srcdir)/mllib/uri-c.c \ - $(top_srcdir)/mllib/mkdtemp-c.c \ - $(top_srcdir)/customize/perl_edit-c.c \ - $(top_srcdir)/customize/crypt-c.c \ - $(top_srcdir)/fish/uri.c \ - $(top_srcdir)/fish/file-edit.c \ + ../mllib/fsync-c.c \ + ../mllib/uri-c.c \ + ../mllib/mkdtemp-c.c \ + ../customize/perl_edit-c.c \ + ../customize/crypt-c.c \ + ../fish/uri.c \ + ../fish/file-edit.c \ index-scan.c \ index-struct.c \ index-parse.c \ diff --git a/configure.ac b/configure.ac index 5cf582e..8ed6db8 100644 --- a/configure.ac +++ b/configure.ac @@ -47,7 +47,7 @@ m4_define([serial_tests], [ }' ]) ]) -AM_INIT_AUTOMAKE(foreign serial_tests) dnl NB: Do not [quote] this parameter. +AM_INIT_AUTOMAKE(foreign serial_tests subdir-objects) dnl NB: Do not [quote] this parameter. m4_ifndef([AM_SILENT_RULES], [m4_define([AM_SILENT_RULES],[])]) AM_SILENT_RULES([yes]) # make --enable-silent-rules the default. diff --git a/customize/Makefile.am b/customize/Makefile.am index dcc1421..f213604 100644 --- a/customize/Makefile.am +++ b/customize/Makefile.am @@ -66,10 +66,10 @@ SOURCES_ML = \ customize_main.ml SOURCES_C = \ - $(top_srcdir)/fish/uri.c \ - $(top_srcdir)/fish/file-edit.c \ - $(top_srcdir)/fish/file-edit.h \ - $(top_srcdir)/mllib/uri-c.c \ + ../fish/uri.c \ + ../fish/file-edit.c \ + ../fish/file-edit.h \ + ../mllib/uri-c.c \ crypt-c.c \ perl_edit-c.c diff --git a/dib/Makefile.am b/dib/Makefile.am index 8932e64..0a7975c 100644 --- a/dib/Makefile.am +++ b/dib/Makefile.am @@ -30,7 +30,7 @@ SOURCES_ML = \ dib.ml SOURCES_C = \ - $(top_srcdir)/mllib/mkdtemp-c.c + ../mllib/mkdtemp-c.c bin_PROGRAMS = diff --git a/get-kernel/Makefile.am b/get-kernel/Makefile.am index f217128..a4a23a4 100644 --- a/get-kernel/Makefile.am +++ b/get-kernel/Makefile.am @@ -27,8 +27,8 @@ SOURCES_ML = \ get_kernel.ml SOURCES_C = \ - $(top_srcdir)/mllib/uri-c.c \ - $(top_srcdir)/fish/uri.c + ../mllib/uri-c.c \ + ../fish/uri.c man_MANS = noinst_DATA = diff --git a/mllib/Makefile.am b/mllib/Makefile.am index bef33d9..3dfa2fb 100644 --- a/mllib/Makefile.am +++ b/mllib/Makefile.am @@ -52,8 +52,8 @@ SOURCES_ML = \ JSON.ml SOURCES_C = \ - $(top_srcdir)/fish/progress.c \ - $(top_srcdir)/fish/uri.c \ + ../fish/progress.c \ + ../fish/uri.c \ fsync-c.c \ mkdtemp-c.c \ progress-c.c \ diff --git a/resize/Makefile.am b/resize/Makefile.am index 773eac4..3a23d9a 100644 --- a/resize/Makefile.am +++ b/resize/Makefile.am @@ -32,11 +32,11 @@ SOURCES_ML = \ resize.ml SOURCES_C = \ - $(top_srcdir)/mllib/fsync-c.c \ - $(top_srcdir)/fish/progress.c \ - $(top_srcdir)/mllib/progress-c.c \ - $(top_srcdir)/fish/uri.c \ - $(top_srcdir)/mllib/uri-c.c + ../mllib/fsync-c.c \ + ../fish/progress.c \ + ../mllib/progress-c.c \ + ../fish/uri.c \ + ../mllib/uri-c.c if HAVE_OCAML diff --git a/sparsify/Makefile.am b/sparsify/Makefile.am index 4e0b8c9..1112c17 100644 --- a/sparsify/Makefile.am +++ b/sparsify/Makefile.am @@ -35,8 +35,8 @@ SOURCES_ML = \ sparsify.ml SOURCES_C = \ - $(top_srcdir)/fish/progress.c \ - $(top_srcdir)/mllib/progress-c.c \ + ../fish/progress.c \ + ../mllib/progress-c.c \ statvfs-c.c if HAVE_OCAML diff --git a/sysprep/Makefile.am b/sysprep/Makefile.am index c430671..c3bd24f 100644 --- a/sysprep/Makefile.am +++ b/sysprep/Makefile.am @@ -83,12 +83,12 @@ SOURCES_ML = \ main.ml SOURCES_C = \ - $(top_srcdir)/mllib/uri-c.c \ - $(top_srcdir)/mllib/mkdtemp-c.c \ - $(top_srcdir)/customize/crypt-c.c \ - $(top_srcdir)/customize/perl_edit-c.c \ - $(top_srcdir)/fish/uri.c \ - $(top_srcdir)/fish/file-edit.c + ../mllib/uri-c.c \ + ../mllib/mkdtemp-c.c \ + ../customize/crypt-c.c \ + ../customize/perl_edit-c.c \ + ../fish/uri.c \ + ../fish/file-edit.c if HAVE_OCAML diff --git a/tests/mount-local/Makefile.am b/tests/mount-local/Makefile.am index 172fff9..809019e 100644 --- a/tests/mount-local/Makefile.am +++ b/tests/mount-local/Makefile.am @@ -27,8 +27,8 @@ if HAVE_FUSE test_parallel_mount_local_SOURCES = \ test-parallel-mount-local.c \ - $(top_srcdir)/df/estimate-max-threads.c \ - $(top_srcdir)/df/estimate-max-threads.h + ../../df/estimate-max-threads.c \ + ../../df/estimate-max-threads.h test_parallel_mount_local_CPPFLAGS = \ -DGUESTFS_WARN_DEPRECATED=1 \ -I$(top_srcdir)/gnulib/lib -I$(top_builddir)/gnulib/lib \ diff --git a/v2v/Makefile.am b/v2v/Makefile.am index 7435d5c..cbc14be 100644 --- a/v2v/Makefile.am +++ b/v2v/Makefile.am @@ -86,7 +86,7 @@ SOURCES_ML = \ v2v.ml SOURCES_C = \ - $(top_srcdir)/mllib/mkdtemp-c.c \ + ../mllib/mkdtemp-c.c \ domainxml-c.c \ kvmuid-c.c \ utils-c.c \ -- 2.5.0

2 2

[PATCH v3 01/16] tests: Introduce test harness for running tests.
by Richard W.M. Jones 04 Aug '15

04 Aug '15

Since v2: - Add perl tests. - Reworked and fixed the tests for virt-builder. - Some further minor bug fixes.

1 16