Bug 680398 - Sound device major number mistakenly added to cgroups ACL with VNC/SPICE graphics
Summary: Sound device major number mistakenly added to cgroups ACL with VNC/SPICE grap...
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt
Version: 6.1
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Eric Blake
QA Contact: Virtualization Bugs
Depends On:
Blocks: RHEL62CCC 642785 683163 683276 683305 846801 846802
TreeView+ depends on / blocked
Reported: 2011-02-25 12:43 UTC by Daniel Berrangé
Modified: 2012-08-08 18:29 UTC (History)
11 users (show)

Fixed In Version: libvirt-0.8.7-11.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2011-05-19 13:28:19 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:0596 normal SHIPPED_LIVE libvirt bug fix and enhancement update 2011-05-18 17:56:36 UTC

Description Daniel Berrangé 2011-02-25 12:43:02 UTC
Description of problem:
In this code:

int qemuSetupCgroup(struct qemud_driver *driver,
                    virDomainObjPtr vm)
        if (vm->def->nsounds) {
            rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR);
            qemuDomainCgroupAudit(vm, cgroup, "allow", "major", "sound",
                                  rc == 0);
            if (rc != 0) {
                virReportSystemError(-rc, "%s",
                                     _("unable to allow /dev/snd/ devices"));
                goto cleanup;

We have granted QEMU access to the host sound devices, regardless of whether the guest XML config needs it. 

We only need to grant access if the graphics type is SDL, or if the graphics type is VNC & vnc_allow_host_audio == 1.

ie, we should be denying access when VNC is used by default, or if SPICE is used.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Create a guest with VNC graphics, and  vnc_allow_host_audio == 0
Actual results:
Sound devices allowed in cgroups ACL

Expected results:
Sound devices denied.

Additional info:

Comment 3 Eric Blake 2011-02-25 19:05:28 UTC
Upstream patch posted:

Comment 6 Vivian Bian 2011-03-11 08:28:05 UTC
checked with : libvirt-0.8.7-11.el6.x86_64

Steps to Verify:
1. look up the Major number for the sound device 
   # ll /dev/snd/controlC0
   crw-rw----+ 1 root audio 116, 8 Mar 10 07:51 /dev/snd/controlC0

so the major number is 116 

2. set vnc_allow_host_audio == 0 in /etc/libvirt/qemu.conf and restart libvirtd service 
3. create a guest with vnc graphical framebuffer 

4. check the cgroup ACL 
   # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list 

5. create a guest with spice graphical framebuffer 

6. check the cgroup ACL 
   # grep 116 /cgroup/devices/libvirt/qemu/guest/devices.list 

Actual result :
1. with buggy libvirt-0.8.7-6 , could get "c 116:* rwm" 
2. with bug fixed libvirt-, the audio devices is not record to cgroups ACL 

So set bug status to VERIFIED

Comment 9 errata-xmlrpc 2011-05-19 13:28:19 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.