3 Commits

Author	SHA1	Message	Date
Peter Krempa	1dcba456fa	qemu: caps: Always assume presence of 'ide-hd' and 'ide-cd' devices ... The split of ide-disk into the two separate devices was introduced by qemu commit 1f56e32a7f4b3 released in qemu v0.15. Note that when compared to the previous commit which made sure that no disk related tests were touched, in this case it's not as careful. Signed-off-by: Peter Krempa <pkrempa@redhat.com>	2019-02-08 08:34:17 +01:00
Peter Krempa	caccbba64a	qemu: capabilities: Always assume QEMU_CAPS_BOOTINDEX ... The field was added in qemu v0.13.0-rc0-731-g1ca4d09ae0 so all supported qemu versions now use it. There's a LOT of test fallout as we did not use capabilities close enough to upstream for many of our tests. Several tests had a 'bootindex' variant. Since they'd become redundant they are also removed here. Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com>	2018-08-09 17:00:54 +02:00
Ján Tomko	3527f9dde6	qemu: deny privilege elevation and spawn in seccomp ... If QEMU uses a seccomp blacklist (since 2.11), -sandbox on no longer tries to whitelist all the calls, but uses sets of blacklists: default (always blacklisted with -sandbox on) obsolete (defaults to deny) elevateprivileges (setuid & co, default: allow) spawn (fork & execve, default: allow) resourcecontrol (setaffinity, setscheduler, default: allow) If these are supported, default to sandbox with all four categories blacklisted. https://bugzilla.redhat.com/show_bug.cgi?id=1492597 Signed-off-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: John Ferlan <jferlan@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>	2018-04-17 16:29:38 +02:00