Bug 680398

Summary: Sound device major number mistakenly added to cgroups ACL with VNC/SPICE graphics
Product: Red Hat Enterprise Linux 6 Reporter: Daniel Berrangé <berrange>
Component: libvirtAssignee: Eric Blake <eblake>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: high    
Version: 6.1CC: dallan, dyuan, eblake, mjenner, mkenneth, mkhusid, sgrubb, vbian, virt-maint, xen-maint, yoyzhang
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: libvirt-0.8.7-11.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-19 13:28:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 584498, 642785, 683163, 683276, 683305, 846801, 846802    

Description Daniel Berrangé 2011-02-25 12:43:02 UTC
Description of problem:
In this code:

int qemuSetupCgroup(struct qemud_driver *driver,
                    virDomainObjPtr vm)
        if (vm->def->nsounds) {
            rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR);
            qemuDomainCgroupAudit(vm, cgroup, "allow", "major", "sound",
                                  rc == 0);
            if (rc != 0) {
                virReportSystemError(-rc, "%s",
                                     _("unable to allow /dev/snd/ devices"));
                goto cleanup;

We have granted QEMU access to the host sound devices, regardless of whether the guest XML config needs it. 

We only need to grant access if the graphics type is SDL, or if the graphics type is VNC & vnc_allow_host_audio == 1.

ie, we should be denying access when VNC is used by default, or if SPICE is used.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Create a guest with VNC graphics, and  vnc_allow_host_audio == 0
Actual results:
Sound devices allowed in cgroups ACL

Expected results:
Sound devices denied.

Additional info:

Comment 3 Eric Blake 2011-02-25 19:05:28 UTC
Upstream patch posted:

Comment 6 Vivian Bian 2011-03-11 08:28:05 UTC
checked with : libvirt-0.8.7-11.el6.x86_64

Steps to Verify:
1. look up the Major number for the sound device 
   # ll /dev/snd/controlC0
   crw-rw----+ 1 root audio 116, 8 Mar 10 07:51 /dev/snd/controlC0

so the major number is 116 

2. set vnc_allow_host_audio == 0 in /etc/libvirt/qemu.conf and restart libvirtd service 
3. create a guest with vnc graphical framebuffer 

4. check the cgroup ACL 
   # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list 

5. create a guest with spice graphical framebuffer 

6. check the cgroup ACL 
   # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list 

Actual result :
1. with buggy libvirt-0.8.7-6 , could get "c 116:* rwm" 
2. with bug fixed libvirt-, the audio devices is not record to cgroups ACL 

So set bug status to VERIFIED

Comment 9 errata-xmlrpc 2011-05-19 13:28:19 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.