RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1455491 - spice/vnc password should keep when clone a guest
Summary: spice/vnc password should keep when clone a guest
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: virt-manager
Version: 7.4
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Pavel Hrdina
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks: 1473046
TreeView+ depends on / blocked
 
Reported: 2017-05-25 10:24 UTC by zhoujunqin
Modified: 2018-04-10 11:42 UTC (History)
5 users (show)

Fixed In Version: virt-manager-1.4.3-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-10 11:40:46 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
virt-manager debug log for cloning (40.86 KB, text/plain)
2017-05-25 10:24 UTC, zhoujunqin 		no flags Details
password info shows in virt-manager debug log (35.07 KB, text/plain)
2017-09-21 08:03 UTC, zhoujunqin 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:0726 0 None None None 2018-04-10 11:42:12 UTC

Description zhoujunqin 2017-05-25 10:24:59 UTC 
Created attachment 1282223 [details]
virt-manager debug log for cloning

Description of problem:
spice/vnc password should keep when clone a guest

Version-Release number of selected component (if applicable):
virt-manager-1.4.1-5.el7.noarch
libvirt-3.2.0-6.virtcov.el7.x86_64
qemu-kvm-rhev-2.9.0-6.el7.x86_64


How reproducible:
100%

Steps to Reproduce:
1. Prepare a spice guest with password setting.
# virsh dumpxml rhel7.4 --security-info
...
    <graphics type='spice' autoport='yes' passwd='aabb'>
      <listen type='address'/>
      <image compression='off'/>
    </graphics>

2. Start guest, then connect to guest via virt-manager.
Launch virt-manager-> Double click guest -> Input password 'aabb' in next page ->click 'Login'
Result: Connect to guest console with correct password.

3. Force off guest.
4. Clone guest.
Right click guest-> select 'Clone' button -> Click 'Clone' in next 'Clone Virtual Machine' page.


Actual results:
Clone finished without error, then check guest xml ,finding that no password showing for spice graphics.

# virsh dumpxml rhel7.4-clone --security-info
...
    <graphics type='spice' autoport='yes'>
      <listen type='address'/>
      <image compression='off'/>
    </graphics>


Expected results:
spice/vnc password should keep when clone a guest

Additional info:
I can also reproduce this issue with vnc guest.
Comment 2 Xiaodai Wang 2017-05-26 08:24:38 UTC 
May be can add a new option like --security-info to support clone security info explicitly.
Comment 3 Pavel Hrdina 2017-09-15 17:00:19 UTC 
Upstream patch posted:

https://www.redhat.com/archives/virt-tools-list/2017-September/msg00098.html
Comment 4 Pavel Hrdina 2017-09-18 07:06:03 UTC 
Upstream commit:

commit 8e0303059ee540040ec01cf6ccb12f0303791192
Author: Pavel Hrdina <phrdina>
Date:   Fri Sep 15 18:34:58 2017 +0200

    cloner: get original XML with security informations
Comment 6 zhoujunqin 2017-09-21 07:38:18 UTC 
I can reproduce this bug with package:
virt-manager-1.4.1-7.el7.noarch

Then try to verify this bug with new build:
virt-manager-1.4.3-1.el7.noarch
virt-install-1.4.3-1.el7.noarch
libvirt-3.7.0-2.el7.x86_64
qemu-kvm-rhev-2.9.0-16.el7_4.8.x86_64

Steps:

1. Prepare a spice guest with password setting.
# virsh dumpxml rhel7.4 --security-info
...
    <graphics type='spice' autoport='yes' passwd='aabb'>
      <listen type='address'/>
      <image compression='off'/>
    </graphics>

2. Start guest, then connect to guest via virt-manager.
Launch virt-manager-> Double click guest -> Input password 'aabb' in next page ->click 'Login'
Result: Connect to guest console with correct password.

3. Force off guest.
4. Clone guest.
Right click guest-> select 'Clone' button -> Click 'Clone' in next 'Clone Virtual Machine' page.


Actual results:
1. Clone finished without error, then check guest xml ,finding that graphics password keep while cloning.

# virsh dumpxml rhel7.4-clone --security-info
...
    <graphics type='spice' port='5900' autoport='yes' listen='127.0.0.1' passwd='aabb'>
      <listen type='address' address='127.0.0.1'/>
      <image compression='off'/>
    </graphics>

2. I find that security graphics password we can see in virt-manager debug log, it's not safe.
Details please see attachment.
Comment 7 zhoujunqin 2017-09-21 08:03:13 UTC 
Created attachment 1328851 [details]
password info shows in virt-manager debug log
Comment 8 Pavel Hrdina 2017-09-21 08:35:14 UTC 
Right, that's not safe since the debug log is located at ~/.cache/virt-clone.log and that might be accessible.  This was probably the reason why we didn't include the security info while cloning a guest.

I'll look into it to fix it.
Comment 9 zhoujunqin 2017-09-21 10:08:51 UTC 
(In reply to Pavel Hrdina from comment #8)
> Right, that's not safe since the debug log is located at
> ~/.cache/virt-clone.log and that might be accessible.  This was probably the
> reason why we didn't include the security info while cloning a guest.
> 
> I'll look into it to fix it.

Yes, so shall we move this bug back to ASSIGNED status or file a new bug to track, thanks.
Comment 10 Pavel Hrdina 2017-09-22 08:52:16 UTC 
Well, the issue here is that virt-manager/virt-clone doesn't have any knowledge which parts of XML contains security information.  Currently it's only the graphics password.  This will require some extra coding to hide the password from debug logs.  I would create a new BUG to track it.
Comment 11 zhoujunqin 2017-09-25 02:46:03 UTC 
(In reply to Pavel Hrdina from comment #10)
> Well, the issue here is that virt-manager/virt-clone doesn't have any
> knowledge which parts of XML contains security information.  Currently it's
> only the graphics password.  This will require some extra coding to hide the
> password from debug logs.  I would create a new BUG to track it.

Ok, Pavel, after you file that bug, please leave bug id here, thanks.
Then i can change bug status.
Comment 12 Pavel Hrdina 2017-09-26 08:28:11 UTC 
BZ 1495505 created to track the debug log issue.
Comment 13 zhoujunqin 2017-09-26 08:54:53 UTC 
Since bug itself has been fixed, and as Comment 12 said, move this bug from ON_QA to VERIFIED status, thanks Pavel.
Comment 16 errata-xmlrpc 2018-04-10 11:40:46 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0726
Note You need to log in before you can comment on or make changes to this bug.