qemu: Let empty default VNC password work as documented

CVE-2016-5008

Setting an empty graphics password is documented as a way to disable
VNC/SPICE access, but QEMU does not always behaves like that. VNC would
happily accept the empty password. Let's enforce the behavior by setting
password expiration to "now".

https://bugzilla.redhat.com/show_bug.cgi?id=1180092

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
(cherry picked from commit bb848feec0)

docs/schemas/domaincommon.rng

@@ -30,8 +30,8 @@
   <define name="domain">
     <element name="domain">
       <ref name="hvs"/>
-      <ref name="ids"/>
       <interleave>
+        <ref name="ids"/>
         <optional>
           <ref name="title"/>
         </optional>

src/driver.c

@@ -62,7 +62,7 @@ virDriverLoadModule(const char *name)
         return NULL;
 
     if (access(modfile, R_OK) < 0) {
-        VIR_WARN("Module %s not accessible", modfile);
+        VIR_INFO("Module %s not accessible", modfile);
         goto cleanup;
     }
 

src/network/leaseshelper.c

@@ -439,7 +439,7 @@ main(int argc, char **argv)
 
     case VIR_LEASE_ACTION_OLD:
     case VIR_LEASE_ACTION_ADD:
-        if (virJSONValueArrayAppend(leases_array_new, lease_new) < 0) {
+        if (lease_new && virJSONValueArrayAppend(leases_array_new, lease_new) < 0) {
             virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                            _("failed to create json"));
             goto cleanup;

src/qemu/qemu_hotplug.c

@@ -3811,6 +3811,7 @@ qemuDomainChangeGraphicsPasswords(virQEMUDriverPtr driver,
     time_t now = time(NULL);
     char expire_time [64];
     const char *connected = NULL;
+    const char *password;
     int ret = -1;
     virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver);
 
@@ -3818,16 +3819,14 @@ qemuDomainChangeGraphicsPasswords(virQEMUDriverPtr driver,
         ret = 0;
         goto cleanup;
     }
+    password = auth->passwd ? auth->passwd : defaultPasswd;
 
     if (auth->connected)
         connected = virDomainGraphicsAuthConnectedTypeToString(auth->connected);
 
     if (qemuDomainObjEnterMonitorAsync(driver, vm, asyncJob) < 0)
         goto cleanup;
-    ret = qemuMonitorSetPassword(priv->mon,
-                                 type,
-                                 auth->passwd ? auth->passwd : defaultPasswd,
-                                 connected);
+    ret = qemuMonitorSetPassword(priv->mon, type, password, connected);
 
     if (ret == -2) {
         if (type != VIR_DOMAIN_GRAPHICS_TYPE_VNC) {
@@ -3835,14 +3834,15 @@ qemuDomainChangeGraphicsPasswords(virQEMUDriverPtr driver,
                            _("Graphics password only supported for VNC"));
             ret = -1;
         } else {
-            ret = qemuMonitorSetVNCPassword(priv->mon,
-                                            auth->passwd ? auth->passwd : defaultPasswd);
+            ret = qemuMonitorSetVNCPassword(priv->mon, password);
         }
     }
     if (ret != 0)
         goto end_job;
 
-    if (auth->expires) {
+    if (password[0] == '\0') {
+        snprintf(expire_time, sizeof(expire_time), "now");
+    } else if (auth->expires) {
         time_t lifetime = auth->validTo - now;
         if (lifetime <= 0)
             snprintf(expire_time, sizeof(expire_time), "now");

src/rpc/gensystemtap.pl

@@ -72,7 +72,7 @@ function libvirt_rpc_auth_name(type, verbose)
 {
 EOF
 my $first = 1;
-foreach my $type (keys %auth) {
+foreach my $type (sort(keys %auth)) {
     my $cond = $first ? "if" : "} else if";
     $first = 0;
     print "  $cond (type == ", $type, ") {\n";
@@ -95,7 +95,7 @@ function libvirt_rpc_type_name(type, verbose)
 {
 EOF
 $first = 1;
-foreach my $type (keys %type) {
+foreach my $type (sort(keys %type)) {
     my $cond = $first ? "if" : "} else if";
     $first = 0;
     print "  $cond (type == ", $type, ") {\n";
@@ -118,7 +118,7 @@ function libvirt_rpc_status_name(status, verbose)
 {
 EOF
 $first = 1;
-foreach my $status (keys %status) {
+foreach my $status (sort(keys %status)) {
     my $cond = $first ? "if" : "} else if";
     $first = 0;
     print "  $cond (status == ", $status, ") {\n";
@@ -141,7 +141,7 @@ function libvirt_rpc_program_name(program, verbose)
 {
 EOF
 $first = 1;
-foreach my $prog (keys %funcs) {
+foreach my $prog (sort(keys %funcs)) {
     my $cond = $first ? "if" : "} else if";
     $first = 0;
     print "  $cond (program == ", $funcs{$prog}->{id}, ") {\n";
@@ -165,7 +165,7 @@ function libvirt_rpc_procedure_name(program, version, proc, verbose)
 {
 EOF
 $first = 1;
-foreach my $prog (keys %funcs) {
+foreach my $prog (sort(keys %funcs)) {
     my $cond = $first ? "if" : "} else if";
     $first = 0;
     print "  $cond (program == ", $funcs{$prog}->{id}, " && version == ", $funcs{$prog}->{version}, ") {\n";

src/rpc/virnetsocket.c

@@ -542,11 +542,15 @@ int virNetSocketNewConnectUNIX(const char *path,
     char *lockpath = NULL;
     int lockfd = -1;
     int fd = -1;
-    int retries = 100;
+    int retries = 500;
     virSocketAddr localAddr;
     virSocketAddr remoteAddr;
     char *rundir = NULL;
     int ret = -1;
+    bool daemonLaunched = false;
+
+    VIR_DEBUG("path=%s spawnDaemon=%d binary=%s", path, spawnDaemon,
+        NULLSTR(binary));
 
     memset(&localAddr, 0, sizeof(localAddr));
     memset(&remoteAddr, 0, sizeof(remoteAddr));
@@ -608,19 +612,30 @@ int virNetSocketNewConnectUNIX(const char *path,
     if (remoteAddr.data.un.sun_path[0] == '@')
         remoteAddr.data.un.sun_path[0] = '\0';
 
-    while (retries &&
-           connect(fd, &remoteAddr.data.sa, remoteAddr.len) < 0) {
-        if (!(spawnDaemon && errno == ENOENT)) {
+    while (retries) {
+        if (connect(fd, &remoteAddr.data.sa, remoteAddr.len) == 0) {
+            VIR_DEBUG("connect() succeeded");
+            break;
+        }
+        VIR_DEBUG("connect() failed: retries=%d errno=%d", retries, errno);
+
+        retries--;
+        if (!spawnDaemon ||
+            retries == 0 ||
+            (errno != ENOENT && errno != ECONNREFUSED)) {
             virReportSystemError(errno, _("Failed to connect socket to '%s'"),
                                  path);
             goto cleanup;
         }
 
-        if (virNetSocketForkDaemon(binary) < 0)
-            goto cleanup;
+        if (!daemonLaunched) {
+            if (virNetSocketForkDaemon(binary) < 0)
+                goto cleanup;
 
-        retries--;
-        usleep(5000);
+            daemonLaunched = true;
+        }
+
+        usleep(10000);
     }
 
     localAddr.len = sizeof(localAddr.data);

src/security/security_dac.c

@@ -971,14 +971,6 @@ virSecurityDACRestoreSecurityAllLabel(virSecurityManagerPtr mgr,
         virSecurityDACRestoreSecurityFileLabel(def->os.loader->nvram) < 0)
         rc = -1;
 
-    if (def->os.kernel &&
-        virSecurityDACRestoreSecurityFileLabel(def->os.kernel) < 0)
-        rc = -1;
-
-    if (def->os.initrd &&
-        virSecurityDACRestoreSecurityFileLabel(def->os.initrd) < 0)
-        rc = -1;
-
     if (def->os.dtb &&
         virSecurityDACRestoreSecurityFileLabel(def->os.dtb) < 0)
         rc = -1;

src/security/security_selinux.c

@@ -1953,14 +1953,6 @@ virSecuritySELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr,
         virSecuritySELinuxRestoreSecurityFileLabel(mgr, def->os.loader->nvram) < 0)
         rc = -1;
 
-    if (def->os.kernel &&
-        virSecuritySELinuxRestoreSecurityFileLabel(mgr, def->os.kernel) < 0)
-        rc = -1;
-
-    if (def->os.initrd &&
-        virSecuritySELinuxRestoreSecurityFileLabel(mgr, def->os.initrd) < 0)
-        rc = -1;
-
     if (def->os.dtb &&
         virSecuritySELinuxRestoreSecurityFileLabel(mgr, def->os.dtb) < 0)
         rc = -1;