api: disallow virConnectGetDomainCapabilities on read-only connections

This API can be used to execute arbitrary emulators.
Forbid it on read-only connections.

Fixes: CVE-2019-10167
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 8afa68bac0)
Signed-off-by: Ján Tomko <jtomko@redhat.com>

src/libvirt-domain.c

@@ -1077,9 +1077,7 @@ virDomainRestoreFlags(virConnectPtr conn, const char *from, const char *dxml,
  * previously by virDomainSave() or virDomainSaveFlags().
  *
  * No security-sensitive data will be included unless @flags contains
- * VIR_DOMAIN_XML_SECURE; this flag is rejected on read-only
+ * VIR_DOMAIN_XML_SECURE.
- * connections.  For this API, @flags should not contain either
- * VIR_DOMAIN_XML_INACTIVE or VIR_DOMAIN_XML_UPDATE_CPU.
  *
  * Returns a 0 terminated UTF-8 encoded XML instance, or NULL in case of
  * error.  The caller must free() the returned value.
@@ -1095,12 +1093,7 @@ virDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *file,
 
     virCheckConnectReturn(conn, NULL);
     virCheckNonNullArgGoto(file, error);
-
+    virCheckReadOnlyGoto(conn->flags, error);
-    if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) {
-        virReportError(VIR_ERR_OPERATION_DENIED, "%s",
-                       _("virDomainSaveImageGetXMLDesc with secure flag"));
-        goto error;
-    }
 
     if (conn->driver->domainSaveImageGetXMLDesc) {
         char *ret;
@@ -11321,6 +11314,7 @@ virConnectGetDomainCapabilities(virConnectPtr conn,
     virResetLastError();
 
     virCheckConnectReturn(conn, NULL);
+    virCheckReadOnlyGoto(conn->flags, error);
 
     if (conn->driver->connectGetDomainCapabilities) {
         char *ret;

src/qemu/qemu_command.c

@@ -3102,6 +3102,7 @@ qemuBuildMemoryBackendStr(unsigned long long size,
     int ret = -1;
     virJSONValuePtr props = NULL;
     bool nodeSpecified = virDomainNumatuneNodeSpecified(def->numa, guestNode);
+    bool needHugepage = !!pagesize;
 
     *backendProps = NULL;
     *backendType = NULL;
@@ -3124,10 +3125,10 @@ qemuBuildMemoryBackendStr(unsigned long long size,
         mode = VIR_DOMAIN_NUMATUNE_MEM_STRICT;
 
     if (pagesize == 0) {
+        bool thisHugepage = false;
+
         /* Find the huge page size we want to use */
         for (i = 0; i < def->mem.nhugepages; i++) {
-            bool thisHugepage = false;
-
             hugepage = &def->mem.hugepages[i];
 
             if (!hugepage->nodemask) {
@@ -3149,6 +3150,7 @@ qemuBuildMemoryBackendStr(unsigned long long size,
 
             if (thisHugepage) {
                 /* Hooray, we've found the page size */
+                needHugepage = true;
                 break;
             }
         }
@@ -3255,7 +3257,7 @@ qemuBuildMemoryBackendStr(unsigned long long size,
     }
 
     /* If none of the following is requested... */
-    if (!pagesize && !userNodeset && !memAccess && !nodeSpecified && !force) {
+    if (!needHugepage && !userNodeset && !memAccess && !nodeSpecified && !force) {
         /* report back that using the new backend is not necessary
          * to achieve the desired configuration */
         ret = 1;

src/qemu/qemu_driver.c

@@ -6628,7 +6628,7 @@ qemuDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *path,
     if (fd < 0)
         goto cleanup;
 
-    if (virDomainSaveImageGetXMLDescEnsureACL(conn, def, flags) < 0)
+    if (virDomainSaveImageGetXMLDescEnsureACL(conn, def) < 0)
         goto cleanup;
 
     ret = qemuDomainDefFormatXML(driver, def, flags);

src/remote/remote_protocol.x

@@ -4984,8 +4984,7 @@ enum remote_procedure {
     /**
      * @generate: both
      * @priority: high
-     * @acl: domain:read
+     * @acl: domain:write
-     * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE
      */
     REMOTE_PROC_DOMAIN_SAVE_IMAGE_GET_XML_DESC = 235,
 

tests/qemuxml2argvdata/qemuxml2argv-hugepages-pages2.args

@@ -10,12 +10,10 @@ QEMU_AUDIO_DRV=none \
 -M pc \
 -m 1024 \
 -smp 2,sockets=2,cores=1,threads=1 \
--object memory-backend-file,id=ram-node0,prealloc=yes,\
+-mem-prealloc \
-mem-path=/dev/hugepages2M/libvirt/qemu,size=268435456 \
+-mem-path /dev/hugepages2M/libvirt/qemu \
--numa node,nodeid=0,cpus=0,memdev=ram-node0 \
+-numa node,nodeid=0,cpus=0,mem=256 \
--object memory-backend-file,id=ram-node1,prealloc=yes,\
+-numa node,nodeid=1,cpus=1,mem=768 \
-mem-path=/dev/hugepages2M/libvirt/qemu,size=805306368 \
--numa node,nodeid=1,cpus=1,memdev=ram-node1 \
 -uuid ef1bdff4-27f3-4e85-a807-5fb4d58463cc \
 -nographic \
 -nodefaults \