Commit c3adb58f authored by Markus Armbruster's avatar Markus Armbruster Committed by Stefan Hajnoczi
Browse files

blockdev: Refuse to open encrypted image unless paused 



Opening an encrypted image takes an additional step: setting the key.
Between open and the key set, the image must not be used.

We have some protection against accidental use in place: you can't
unpause a guest while we're missing keys.  You can, however, hot-plug
block devices lacking keys into a running guest just fine, or insert
media lacking keys.  In the latter case, notifying the guest of the
insert is delayed until the key is set, which may suffice to protect
at least some guests in common usage.

This patch makes the protection apply in more cases, in a rather
heavy-handed way: it doesn't let you open encrypted images unless
we're in a paused state.

It doesn't extend the protection to users other than the guest (block
jobs?).  Use of runstate_check() from block.c is disgusting.  Best I
can do right now.

Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent 5d92c74f

block.c

+8 −1
Original line number Diff line number Diff line
@@ -1388,12 +1388,19 @@ done: 
        ret = -EINVAL;

        goto close_and_fail;

    }

    QDECREF(options);



    if (!bdrv_key_required(bs)) {

        bdrv_dev_change_media_cb(bs, true);

    } else if (!runstate_check(RUN_STATE_PRELAUNCH)

               && !runstate_check(RUN_STATE_INMIGRATE)

               && !runstate_check(RUN_STATE_PAUSED)) { /* HACK */

        error_setg(errp,

                   "Guest must be stopped for opening of encrypted image");

        ret = -EBUSY;

        goto close_and_fail;

    }



    QDECREF(options);

    *pbs = bs;

    return 0;

stubs/Makefile.objs

+1 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ stub-obj-y += mon-set-error.o 
stub-obj-y += pci-drive-hot-add.o

stub-obj-y += qtest.o

stub-obj-y += reset.o

stub-obj-y += runstate-check.o

stub-obj-y += set-fd-handler.o

stub-obj-y += slirp.o

stub-obj-y += sysbus.o

stubs/runstate-check.c

0 → 100644
+6 −0
Original line number Diff line number Diff line 
#include "sysemu/sysemu.h"



bool runstate_check(RunState state)

{

    return state == RUN_STATE_PRELAUNCH;

}

tests/qemu-iotests/087

+17 −0
Original line number Diff line number Diff line
@@ -99,6 +99,23 @@ echo === Encrypted image === 
echo



_make_test_img -o encryption=on $size

run_qemu -S <<EOF

{ "execute": "qmp_capabilities" }

{ "execute": "blockdev-add",

  "arguments": {

      "options": {

        "driver": "$IMGFMT",

        "id": "disk",

        "file": {

            "driver": "file",

            "filename": "$TEST_IMG"

        }

      }

    }

  }

{ "execute": "quit" }

EOF



run_qemu <<EOF

{ "execute": "qmp_capabilities" }

{ "execute": "blockdev-add",

tests/qemu-iotests/087.out

+10 −1
Original line number Diff line number Diff line
@@ -28,7 +28,7 @@ QMP_VERSION 
=== Encrypted image ===



Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on 

Testing:

Testing: -S

QMP_VERSION

{"return": {}}

{"error": {"class": "GenericError", "desc": "blockdev-add doesn't support encrypted devices"}}
@@ -37,4 +37,13 @@ QMP_VERSION 
{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_TRAY_MOVED", "data": {"device": "ide1-cd0", "tray-open": true}}

{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_TRAY_MOVED", "data": {"device": "floppy0", "tray-open": true}}



Testing:

QMP_VERSION

{"return": {}}

{"error": {"class": "GenericError", "desc": "could not open disk image disk: Guest must be stopped for opening of encrypted image"}}

{"return": {}}

{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN"}

{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_TRAY_MOVED", "data": {"device": "ide1-cd0", "tray-open": true}}

{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_TRAY_MOVED", "data": {"device": "floppy0", "tray-open": true}}



*** done