Bug 680398
| Summary: | Sound device major number mistakenly added to cgroups ACL with VNC/SPICE graphics | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Daniel Berrangé <berrange> |
| Component: | libvirt | Assignee: | Eric Blake <eblake> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.1 | CC: | dallan, dyuan, eblake, mjenner, mkenneth, mkhusid, sgrubb, vbian, virt-maint, xen-maint, yoyzhang |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-0.8.7-11.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-05-19 13:28:19 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 584498, 642785, 683163, 683276, 683305, 846801, 846802 | ||
Upstream patch posted: https://www.redhat.com/archives/libvir-list/2011-February/msg01179.html checked with : libvirt-0.8.7-11.el6.x86_64 Steps to Verify: 1. look up the Major number for the sound device # ll /dev/snd/controlC0 crw-rw----+ 1 root audio 116, 8 Mar 10 07:51 /dev/snd/controlC0 so the major number is 116 2. set vnc_allow_host_audio == 0 in /etc/libvirt/qemu.conf and restart libvirtd service 3. create a guest with vnc graphical framebuffer 4. check the cgroup ACL # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list 5. create a guest with spice graphical framebuffer 6. check the cgroup ACL # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list Actual result : 1. with buggy libvirt-0.8.7-6 , could get "c 116:* rwm" 2. with bug fixed libvirt-0.8.7.11, the audio devices is not record to cgroups ACL So set bug status to VERIFIED An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0596.html |
Description of problem: In this code: int qemuSetupCgroup(struct qemud_driver *driver, virDomainObjPtr vm) .... if (vm->def->nsounds) { rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR); qemuDomainCgroupAudit(vm, cgroup, "allow", "major", "sound", rc == 0); if (rc != 0) { virReportSystemError(-rc, "%s", _("unable to allow /dev/snd/ devices")); goto cleanup; } } We have granted QEMU access to the host sound devices, regardless of whether the guest XML config needs it. We only need to grant access if the graphics type is SDL, or if the graphics type is VNC & vnc_allow_host_audio == 1. ie, we should be denying access when VNC is used by default, or if SPICE is used. Version-Release number of selected component (if applicable): libvirt-0.8.7-6.el6 How reproducible: Always Steps to Reproduce: 1. Create a guest with VNC graphics, and vnc_allow_host_audio == 0 2. 3. Actual results: Sound devices allowed in cgroups ACL Expected results: Sound devices denied. Additional info: