Commit 35081f79 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/gkurz/tags/9p-next-2019-12-12' into staging 



- conversion of virtfs-proxy-helper from libcap to libcap-ng
- removal of libcap-dev from docker, travis and gitlab CI
- removal of deprecate "-virtfs_synth" option

# gpg: Signature made Thu 12 Dec 2019 19:55:53 GMT
# gpg:                using RSA key B4828BAF943140CEF2A3491071D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <groug@kaod.org>" [full]
# gpg:                 aka "Gregory Kurz <gregory.kurz@free.fr>" [full]
# gpg:                 aka "[jpeg image of size 3330]" [full]
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6

* remotes/gkurz/tags/9p-next-2019-12-12:
  virtfs: Remove the deprecated "-virtfs_synth" option
  travis.yml: Drop libcap-dev
  ci: Use libcap-ng
  docker: remove libcap development packages
  virtfs-proxy-helper: switch from libcap to libcap-ng

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents ba997502 b3e2bb94

.gitlab-ci.yml

+1 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ build-user: 


build-clang:

 script:

 - apt-get install -y -qq clang libsdl2-dev libattr1-dev libcap-dev

 - apt-get install -y -qq clang libsdl2-dev libattr1-dev libcap-ng-dev

      xfslibs-dev libiscsi-dev libnfs-dev libseccomp-dev gnutls-dev librbd-dev

 - ./configure --cc=clang --cxx=clang++ --enable-werror

      --target-list="alpha-softmmu arm-softmmu m68k-softmmu mips64-softmmu

.travis.yml

+0 −1
Original line number Diff line number Diff line
@@ -26,7 +26,6 @@ addons: 
      - libaio-dev

      - libattr1-dev

      - libbrlapi-dev

      - libcap-dev

      - libcap-ng-dev

      - libgcc-4.8-dev

      - libgnutls28-dev

Makefile

+0 −1
Original line number Diff line number Diff line
@@ -575,7 +575,6 @@ qemu-keymap$(EXESUF): qemu-keymap.o ui/input-keymap.o $(COMMON_LDADDS) 
qemu-edid$(EXESUF): qemu-edid.o hw/display/edid-generate.o $(COMMON_LDADDS)



fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/9p-marshal.o fsdev/9p-iov-marshal.o $(COMMON_LDADDS)

fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap



scsi/qemu-pr-helper$(EXESUF): scsi/qemu-pr-helper.o scsi/utils.o $(authz-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)

ifdef CONFIG_MPATH

configure

+2 −18
Original line number Diff line number Diff line
@@ -3863,22 +3863,6 @@ else 
  mpathpersist=no

fi



##########################################

# libcap probe



if test "$cap" != "no" ; then

  cat > $TMPC <<EOF

#include <stdio.h>

#include <sys/capability.h>

int main(void) { cap_t caps; caps = cap_init(); return caps != NULL; }

EOF

  if compile_prog "" "-lcap" ; then

    cap=yes

  else

    cap=no

  fi

fi



##########################################

# pthread probe

PTHREADLIBS_LIST="-pthread -lpthread -lpthreadGC2"
@@ -6204,12 +6188,12 @@ if test "$want_tools" = "yes" ; then 
fi

if test "$softmmu" = yes ; then

  if test "$linux" = yes; then

    if test "$virtfs" != no && test "$cap" = yes && test "$attr" = yes ; then

    if test "$virtfs" != no && test "$cap_ng" = yes && test "$attr" = yes ; then

      virtfs=yes

      tools="$tools fsdev/virtfs-proxy-helper\$(EXESUF)"

    else

      if test "$virtfs" = yes; then

        error_exit "VirtFS requires libcap devel and libattr devel"

        error_exit "VirtFS requires libcap-ng devel and libattr devel"

      fi

      virtfs=no

    fi

fsdev/virtfs-proxy-helper.c

+45 −55
Original line number Diff line number Diff line
@@ -13,7 +13,6 @@ 
#include <sys/resource.h>

#include <getopt.h>

#include <syslog.h>

#include <sys/capability.h>

#include <sys/fsuid.h>

#include <sys/vfs.h>

#include <sys/ioctl.h>
@@ -21,6 +20,7 @@ 
#ifdef CONFIG_LINUX_MAGIC_H

#include <linux/magic.h>

#endif

#include <cap-ng.h>

#include "qemu-common.h"

#include "qemu/sockets.h"

#include "qemu/xattr.h"
@@ -79,49 +79,10 @@ static void do_perror(const char *string) 
    }

}



static int do_cap_set(cap_value_t *cap_value, int size, int reset)

{

    cap_t caps;

    if (reset) {

        /*

         * Start with an empty set and set permitted and effective

         */

        caps = cap_init();

        if (caps == NULL) {

            do_perror("cap_init");

            return -1;

        }

        if (cap_set_flag(caps, CAP_PERMITTED, size, cap_value, CAP_SET) < 0) {

            do_perror("cap_set_flag");

            goto error;

        }

    } else {

        caps = cap_get_proc();

        if (!caps) {

            do_perror("cap_get_proc");

            return -1;

        }

    }

    if (cap_set_flag(caps, CAP_EFFECTIVE, size, cap_value, CAP_SET) < 0) {

        do_perror("cap_set_flag");

        goto error;

    }

    if (cap_set_proc(caps) < 0) {

        do_perror("cap_set_proc");

        goto error;

    }

    cap_free(caps);

    return 0;



error:

    cap_free(caps);

    return -1;

}



static int init_capabilities(void)

{

    /* helper needs following capabilities only */

    cap_value_t cap_list[] = {

    int cap_list[] = {

        CAP_CHOWN,

        CAP_DAC_OVERRIDE,

        CAP_FOWNER,
@@ -130,7 +91,34 @@ static int init_capabilities(void) 
        CAP_MKNOD,

        CAP_SETUID,

    };

    return do_cap_set(cap_list, ARRAY_SIZE(cap_list), 1);

    int i;



    capng_clear(CAPNG_SELECT_BOTH);

    for (i = 0; i < ARRAY_SIZE(cap_list); i++) {

        if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,

                         cap_list[i]) < 0) {

            do_perror("capng_update");

            return -1;

        }

    }

    if (capng_apply(CAPNG_SELECT_BOTH) < 0) {

        do_perror("capng_apply");

        return -1;

    }



    /* Prepare effective set for setugid.  */

    for (i = 0; i < ARRAY_SIZE(cap_list); i++) {

        if (cap_list[i] == CAP_DAC_OVERRIDE) {

            continue;

        }



        if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE,

                         cap_list[i]) < 0) {

            do_perror("capng_update");

            return -1;

        }

    }

    return 0;

}



static int socket_read(int sockfd, void *buff, ssize_t size)
@@ -295,14 +283,6 @@ static int setugid(int uid, int gid, int *suid, int *sgid) 
{

    int retval;



    /*

     * We still need DAC_OVERRIDE because we don't change

     * supplementary group ids, and hence may be subjected DAC rules

     */

    cap_value_t cap_list[] = {

        CAP_DAC_OVERRIDE,

    };



    *suid = geteuid();

    *sgid = getegid();
@@ -316,12 +296,22 @@ static int setugid(int uid, int gid, int *suid, int *sgid) 
        goto err_sgid;

    }



    if (uid != 0 || gid != 0) {

        if (do_cap_set(cap_list, ARRAY_SIZE(cap_list), 0) < 0) {

    if (uid == 0 && gid == 0) {

        /* Linux has already copied the permitted set to the effective set.  */

        return 0;

    }



    /*

     * All capabilities have been cleared from the effective set.  However

     * we still need DAC_OVERRIDE because we don't change supplementary

     * group ids, and hence may be subject to DAC rules.  init_capabilities

     * left the set of capabilities that we want in libcap-ng's state.

     */

    if (capng_apply(CAPNG_SELECT_CAPS) < 0) {

        retval = -errno;

        do_perror("capng_apply");

        goto err_suid;

    }

    }

    return 0;



err_suid: