Bug 680398 - Sound device major number mistakenly added to cgroups ACL with VNC/SPICE graphics
Sound device major number mistakenly added to cgroups ACL with VNC/SPICE grap...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt (Show other bugs)
Unspecified Unspecified
high Severity medium
: rc
: ---
Assigned To: Eric Blake
Virtualization Bugs
Depends On:
Blocks: RHEL62CCC 642785 683163 683276 683305 846801 846802
  Show dependency treegraph
Reported: 2011-02-25 07:43 EST by Daniel Berrange
Modified: 2012-08-08 14:29 EDT (History)
11 users (show)

See Also:
Fixed In Version: libvirt-0.8.7-11.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2011-05-19 09:28:19 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Daniel Berrange 2011-02-25 07:43:02 EST
Description of problem:
In this code:

int qemuSetupCgroup(struct qemud_driver *driver,
                    virDomainObjPtr vm)
        if (vm->def->nsounds) {
            rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR);
            qemuDomainCgroupAudit(vm, cgroup, "allow", "major", "sound",
                                  rc == 0);
            if (rc != 0) {
                virReportSystemError(-rc, "%s",
                                     _("unable to allow /dev/snd/ devices"));
                goto cleanup;

We have granted QEMU access to the host sound devices, regardless of whether the guest XML config needs it. 

We only need to grant access if the graphics type is SDL, or if the graphics type is VNC & vnc_allow_host_audio == 1.

ie, we should be denying access when VNC is used by default, or if SPICE is used.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Create a guest with VNC graphics, and  vnc_allow_host_audio == 0
Actual results:
Sound devices allowed in cgroups ACL

Expected results:
Sound devices denied.

Additional info:
Comment 3 Eric Blake 2011-02-25 14:05:28 EST
Upstream patch posted:
Comment 6 Vivian Bian 2011-03-11 03:28:05 EST
checked with : libvirt-0.8.7-11.el6.x86_64

Steps to Verify:
1. look up the Major number for the sound device 
   # ll /dev/snd/controlC0
   crw-rw----+ 1 root audio 116, 8 Mar 10 07:51 /dev/snd/controlC0

so the major number is 116 

2. set vnc_allow_host_audio == 0 in /etc/libvirt/qemu.conf and restart libvirtd service 
3. create a guest with vnc graphical framebuffer 

4. check the cgroup ACL 
   # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list 

5. create a guest with spice graphical framebuffer 

6. check the cgroup ACL 
   # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list 

Actual result :
1. with buggy libvirt-0.8.7-6 , could get "c 116:* rwm" 
2. with bug fixed libvirt-, the audio devices is not record to cgroups ACL 

So set bug status to VERIFIED
Comment 9 errata-xmlrpc 2011-05-19 09:28:19 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.