shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-25 01:34:11 +03:00
Code Releases Activity
63f6e0e950
libvirt/config-post.h

93 lines
2.7 KiB
C
Raw Normal View History

Don't link virt-login-shell against libvirt.so (CVE-2013-4400) The libvirt.so library has far too many library deps to allow linking against it from setuid programs. Those libraries can do stuff in __attribute__((constructor) functions which is not setuid safe. The virt-login-shell needs to link directly against individual files that it uses, with all library deps turned off except for libxml2 and libselinux. Create a libvirt-setuid-rpc-client.la library which is linked to by virt-login-shell. A config-post.h file allows this library to disable all external deps except libselinux and libxml2. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-10-10 16:09:08 +04:00
/*
* Copyright (C) 2013 Red Hat, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library. If not, see
* <http://www.gnu.org/licenses/>.
*/
/*
* Since virt-login-shell will be setuid, we must do everything
* we can to avoid linking to other libraries. Many of them do
* unsafe things in functions marked __atttribute__((constructor)).
config-post.h:fix a typo Signed-off-by: Nitesh Konkar <nitkon12@linux.vnet.ibm.com>
2016-09-20 21:52:15 +03:00
* The only way to avoid such deps is to re-compile the
Don't link virt-login-shell against libvirt.so (CVE-2013-4400) The libvirt.so library has far too many library deps to allow linking against it from setuid programs. Those libraries can do stuff in __attribute__((constructor) functions which is not setuid safe. The virt-login-shell needs to link directly against individual files that it uses, with all library deps turned off except for libxml2 and libselinux. Create a libvirt-setuid-rpc-client.la library which is linked to by virt-login-shell. A config-post.h file allows this library to disable all external deps except libselinux and libxml2. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-10-10 16:09:08 +04:00
* functions with the code in question disabled, and for that we
* must override the main config.h rules. Hence this file :-(
*/
#ifdef LIBVIRT_SETUID_RPC_CLIENT
# undef HAVE_LIBNL
# undef HAVE_LIBNL3
# undef HAVE_LIBSASL2
virfile: Introduce ACL helpers Namely, virFileGetACLs, virFileSetACLs, virFileFreeACLs and virFileCopyACLs. These functions are going to be required when we are creating /dev for qemu. We have copy anything that's in host's /dev exactly as is. Including ACLs. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2016-11-22 13:14:08 +03:00
# undef HAVE_SYS_ACL_H
Don't link virt-login-shell against libvirt.so (CVE-2013-4400) The libvirt.so library has far too many library deps to allow linking against it from setuid programs. Those libraries can do stuff in __attribute__((constructor) functions which is not setuid safe. The virt-login-shell needs to link directly against individual files that it uses, with all library deps turned off except for libxml2 and libselinux. Create a libvirt-setuid-rpc-client.la library which is linked to by virt-login-shell. A config-post.h file allows this library to disable all external deps except libselinux and libxml2. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-10-10 16:09:08 +04:00
# undef WITH_CAPNG
# undef WITH_CURL
libvirt-lxc: add virDomainLxcEnterCGroup API Add the virDomainLxcEnterCGroup API to the libvirt-lxc.so file. This method moves the calling process into the cgroups associated with the container. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2016-04-14 17:16:22 +03:00
# undef WITH_DBUS
m4/virt-devmapper: use LIBVIRT_CHECK_(PKG|LIB) Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2016-12-12 15:33:42 +03:00
# undef WITH_DEVMAPPER
Don't link virt-login-shell against libvirt.so (CVE-2013-4400) The libvirt.so library has far too many library deps to allow linking against it from setuid programs. Those libraries can do stuff in __attribute__((constructor) functions which is not setuid safe. The virt-login-shell needs to link directly against individual files that it uses, with all library deps turned off except for libxml2 and libselinux. Create a libvirt-setuid-rpc-client.la library which is linked to by virt-login-shell. A config-post.h file allows this library to disable all external deps except libselinux and libxml2. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-10-10 16:09:08 +04:00
# undef WITH_DTRACE_PROBES
# undef WITH_GNUTLS
build: undef WITH_JANSSON for SETUID_RPC_CLIENT There is no code using WITH_JANSSON yet, but once we add it, it should not be compiled for the setuid_rpc_client. Signed-off-by: Ján Tomko <jtomko@redhat.com>
2018-05-09 15:32:05 +03:00
# undef WITH_JANSSON
libssh_transport: add new libssh-based transport Implement a new libssh transport, which uses libssh to communicate with remote hosts, and add all the build system stuff (search of libssh, private symbols, etc) to built it. This new transport supports all the common ssh authentication methods, making use of libvirt's auth callbacks for interaction with the user.
2016-11-09 17:28:35 +03:00
# undef WITH_LIBSSH
Don't link virt-login-shell against libvirt.so (CVE-2013-4400) The libvirt.so library has far too many library deps to allow linking against it from setuid programs. Those libraries can do stuff in __attribute__((constructor) functions which is not setuid safe. The virt-login-shell needs to link directly against individual files that it uses, with all library deps turned off except for libxml2 and libselinux. Create a libvirt-setuid-rpc-client.la library which is linked to by virt-login-shell. A config-post.h file allows this library to disable all external deps except libselinux and libxml2. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-10-10 16:09:08 +04:00
# undef WITH_MACVTAP
# undef WITH_NUMACTL
# undef WITH_SASL
# undef WITH_SSH2
libvirt-lxc: add virDomainLxcEnterCGroup API Add the virDomainLxcEnterCGroup API to the libvirt-lxc.so file. This method moves the calling process into the cgroups associated with the container. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2016-04-14 17:16:22 +03:00
# undef WITH_SYSTEMD_DAEMON
Don't link virt-login-shell against libvirt.so (CVE-2013-4400) The libvirt.so library has far too many library deps to allow linking against it from setuid programs. Those libraries can do stuff in __attribute__((constructor) functions which is not setuid safe. The virt-login-shell needs to link directly against individual files that it uses, with all library deps turned off except for libxml2 and libselinux. Create a libvirt-setuid-rpc-client.la library which is linked to by virt-login-shell. A config-post.h file allows this library to disable all external deps except libselinux and libxml2. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-10-10 16:09:08 +04:00
# undef WITH_VIRTUALPORT
#endif
nss: Implement _nss_libvirt_gethostbyname3_r The implementation is pretty straightforward. Moreover, because of the nature of things, gethostbyname_r and gethostbyname2_r can be implemented at the same time too. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2016-02-14 13:38:37 +03:00
/*
* With the NSS module it's the same story as virt-login-shell. See the
* explanation above.
*/
#ifdef LIBVIRT_NSS
# undef HAVE_LIBNL
# undef HAVE_LIBNL3
# undef HAVE_LIBSASL2
virfile: Introduce ACL helpers Namely, virFileGetACLs, virFileSetACLs, virFileFreeACLs and virFileCopyACLs. These functions are going to be required when we are creating /dev for qemu. We have copy anything that's in host's /dev exactly as is. Including ACLs. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2016-11-22 13:14:08 +03:00
# undef HAVE_SYS_ACL_H
nss: Implement _nss_libvirt_gethostbyname3_r The implementation is pretty straightforward. Moreover, because of the nature of things, gethostbyname_r and gethostbyname2_r can be implemented at the same time too. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2016-02-14 13:38:37 +03:00
# undef WITH_CAPNG
# undef WITH_CURL
m4/virt-devmapper: use LIBVIRT_CHECK_(PKG|LIB) Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2016-12-12 15:33:42 +03:00
# undef WITH_DEVMAPPER
nss: Implement _nss_libvirt_gethostbyname3_r The implementation is pretty straightforward. Moreover, because of the nature of things, gethostbyname_r and gethostbyname2_r can be implemented at the same time too. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2016-02-14 13:38:37 +03:00
# undef WITH_DTRACE_PROBES
# undef WITH_GNUTLS
libssh_transport: add new libssh-based transport Implement a new libssh transport, which uses libssh to communicate with remote hosts, and add all the build system stuff (search of libssh, private symbols, etc) to built it. This new transport supports all the common ssh authentication methods, making use of libvirt's auth callbacks for interaction with the user.
2016-11-09 17:28:35 +03:00
# undef WITH_LIBSSH
nss: Implement _nss_libvirt_gethostbyname3_r The implementation is pretty straightforward. Moreover, because of the nature of things, gethostbyname_r and gethostbyname2_r can be implemented at the same time too. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2016-02-14 13:38:37 +03:00
# undef WITH_MACVTAP
# undef WITH_NUMACTL
# undef WITH_SASL
# undef WITH_SSH2
# undef WITH_VIRTUALPORT
# undef WITH_SECDRIVER_SELINUX
# undef WITH_SECDRIVER_APPARMOR
# undef WITH_CAPNG
#endif /* LIBVIRT_NSS */
gnulib: add getopt module Unconditionally use gnulib's getopt module. This is needed by the bhyve driver to provide a reentrant interface for getopt. Several gnulib headers rely on features.h being included by ctype.h to provide __GNUC_PREREQ, but on systems without glibc, this is not provided. In these cases __GNUC_PREREQ gets redefined to 0, which causes build errors from checks in src/internal.h. Therefore, define __GNUC_PREREQ as early as possible. config-post.h is probably the first header that is included, before any other headers.
2016-06-09 03:50:35 +03:00
Require use of GCC 4.4 or CLang compilers We only ever test libvirt with GCC or CLang which provides a GCC compatible compilation environment. Between them, these compilers cover every important operating system platform, even Windows. Mandate their use to make it explicit that we don't care about compilers like Microsoft VCC or other UNIX vendor C compilers. GCC 4.4 was picked as the baseline, since RHEL-6 ships 4.4.7 and that lets us remove a large set of checks. There is a slight issue that CLang reports itself as GCC 4.2, so we must also check if __clang__ is defined. We could check a particular CLang version too, but that would require someone to figure out a suitable min version which is fun because OS-X reports totally different CLang version numbers from CLang builds on Linux/BSD Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-05 12:35:32 +03:00
#ifndef __GNUC__
# error "Libvirt requires GCC >= 4.4, or CLang"
#endif
gnulib: add getopt module Unconditionally use gnulib's getopt module. This is needed by the bhyve driver to provide a reentrant interface for getopt. Several gnulib headers rely on features.h being included by ctype.h to provide __GNUC_PREREQ, but on systems without glibc, this is not provided. In these cases __GNUC_PREREQ gets redefined to 0, which causes build errors from checks in src/internal.h. Therefore, define __GNUC_PREREQ as early as possible. config-post.h is probably the first header that is included, before any other headers.
2016-06-09 03:50:35 +03:00
/*
Remove duplicate define of __GNUC_PREREQ Back in this commit: commit b436a8ae5ccb04f8cf893d882d52ab5efc713307 Author: Fabian Freyer <fabian.freyer@physik.tu-berlin.de> Date: Thu Jun 9 00:50:35 2016 +0000 gnulib: add getopt module config-post.h was modified to define __GNUC_PREREQ, but the original definition was never removed from internal.h, and that is now dead code since config.h is always the first file included. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-05 12:59:53 +03:00
* Define __GNUC_PREREQ to a sane default if it isn't yet defined.
gnulib: add getopt module Unconditionally use gnulib's getopt module. This is needed by the bhyve driver to provide a reentrant interface for getopt. Several gnulib headers rely on features.h being included by ctype.h to provide __GNUC_PREREQ, but on systems without glibc, this is not provided. In these cases __GNUC_PREREQ gets redefined to 0, which causes build errors from checks in src/internal.h. Therefore, define __GNUC_PREREQ as early as possible. config-post.h is probably the first header that is included, before any other headers.
2016-06-09 03:50:35 +03:00
* This is done here so that it's included as early as possible; gnulib relies
* on this to be defined in features.h, which should be included from ctype.h.
* This doesn't happen on many non-glibc systems.
Remove duplicate define of __GNUC_PREREQ Back in this commit: commit b436a8ae5ccb04f8cf893d882d52ab5efc713307 Author: Fabian Freyer <fabian.freyer@physik.tu-berlin.de> Date: Thu Jun 9 00:50:35 2016 +0000 gnulib: add getopt module config-post.h was modified to define __GNUC_PREREQ, but the original definition was never removed from internal.h, and that is now dead code since config.h is always the first file included. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-05 12:59:53 +03:00
* When __GNUC_PREREQ is not defined, gnulib defines it to 0, which breaks things.
gnulib: add getopt module Unconditionally use gnulib's getopt module. This is needed by the bhyve driver to provide a reentrant interface for getopt. Several gnulib headers rely on features.h being included by ctype.h to provide __GNUC_PREREQ, but on systems without glibc, this is not provided. In these cases __GNUC_PREREQ gets redefined to 0, which causes build errors from checks in src/internal.h. Therefore, define __GNUC_PREREQ as early as possible. config-post.h is probably the first header that is included, before any other headers.
2016-06-09 03:50:35 +03:00
*/
Require use of GCC 4.4 or CLang compilers We only ever test libvirt with GCC or CLang which provides a GCC compatible compilation environment. Between them, these compilers cover every important operating system platform, even Windows. Mandate their use to make it explicit that we don't care about compilers like Microsoft VCC or other UNIX vendor C compilers. GCC 4.4 was picked as the baseline, since RHEL-6 ships 4.4.7 and that lets us remove a large set of checks. There is a slight issue that CLang reports itself as GCC 4.2, so we must also check if __clang__ is defined. We could check a particular CLang version too, but that would require someone to figure out a suitable min version which is fun because OS-X reports totally different CLang version numbers from CLang builds on Linux/BSD Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-05 12:35:32 +03:00
#ifndef __GNUC_PREREQ
Remove backslash alignment attempts Right-aligning backslashes when defining macros or using complex commands in Makefiles looks cute, but as soon as any changes is required to the code you end up with either distractingly broken alignment or unnecessarily big diffs where most of the changes are just pushing all backslashes a few characters to one side. Generated using $ git grep -El '[[:blank:]][[:blank:]]\\$' | \ grep -E '*\.([chx]|am|mk)$$' | \ while read f; do \ sed -Ei 's/[[:blank:]]*[[:blank:]]\\$/ \\/g' "$f"; \ done Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2017-11-03 15:09:47 +03:00
# define __GNUC_PREREQ(maj, min) \
Require use of GCC 4.4 or CLang compilers We only ever test libvirt with GCC or CLang which provides a GCC compatible compilation environment. Between them, these compilers cover every important operating system platform, even Windows. Mandate their use to make it explicit that we don't care about compilers like Microsoft VCC or other UNIX vendor C compilers. GCC 4.4 was picked as the baseline, since RHEL-6 ships 4.4.7 and that lets us remove a large set of checks. There is a slight issue that CLang reports itself as GCC 4.2, so we must also check if __clang__ is defined. We could check a particular CLang version too, but that would require someone to figure out a suitable min version which is fun because OS-X reports totally different CLang version numbers from CLang builds on Linux/BSD Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-07-05 12:35:32 +03:00
((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
#endif
#if !(__GNUC_PREREQ(4, 4) || defined(__clang__))
# error "Libvirt requires GCC >= 4.4, or CLang"
gnulib: add getopt module Unconditionally use gnulib's getopt module. This is needed by the bhyve driver to provide a reentrant interface for getopt. Several gnulib headers rely on features.h being included by ctype.h to provide __GNUC_PREREQ, but on systems without glibc, this is not provided. In these cases __GNUC_PREREQ gets redefined to 0, which causes build errors from checks in src/internal.h. Therefore, define __GNUC_PREREQ as early as possible. config-post.h is probably the first header that is included, before any other headers.
2016-06-09 03:50:35 +03:00
#endif
Copy Permalink