NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity
Read-only mirror. Please submit merge requests / issues to https://gitlab.com/libvirt/libvirt
15,213 Commits 67 Branches 632 Tags 1.1 GiB
C 94.8%
Python 2%
Meson 0.9%
Shell 0.8%
Dockerfile 0.6%
Other 0.8%
a21cfb0f48
Go to file
Eric Blake a21cfb0f48 qemu: ask for -enable-fips when FIPS is required 
On a system that is enforcing FIPS, most libraries honor the
current mode by default.  Qemu, on the other hand, refused to
honor FIPS mode unless you add the '-enable-fips' command
line option; worse, this option is not discoverable via QMP,
and is only present on binaries built for Linux.  So, if we
detect FIPS mode, then we unconditionally ask for FIPS; either
qemu is new enough to have the option and then correctly
cripple insecure VNC passwords, or it is so old that we are
correctly avoiding a FIPS violation by preventing qemu from
starting.  Meanwhile, if we don't detect FIPS mode, then
omitting the argument is safe whether the qemu has the option
(but it would do nothing because FIPS is disabled) or whether
qemu lacks the option (including in the case where we are not
running on Linux).

The testsuite was a bit interesting: we don't want our test
to depend on whether it is being run in FIPS mode, so I had
to tweak things to set the capability bit outside of our
normal interaction with capability parsing.

This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1035474

* src/qemu/qemu_capabilities.h (QEMU_CAPS_ENABLE_FIPS): New bit.
* src/qemu/qemu_capabilities.c (virQEMUCapsInitQMP): Conditionally
set capability according to detection of FIPS mode.
* src/qemu/qemu_command.c (qemuBuildCommandLine): Use it.
* tests/qemucapabilitiestest.c (testQemuCaps): Conditionally set
capability to test expected output.
* tests/qemucapabilitiesdata/caps_1.2.2-1.caps: Update list.
* tests/qemucapabilitiesdata/caps_1.6.0-1.caps: Likewise.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-12-18 07:05:29 -07:00
.gnulib@831b84c59e maint: update to latest gnulib 2013-11-23 21:05:15 -07:00
build-aux maint: enforce comma style usage 2013-11-20 09:24:18 -07:00
daemon Add network events to the remote driver 2013-12-11 13:26:25 +00:00
docs docs: fix address type for disks 2013-12-17 11:00:12 +01:00
examples Update event demo program to support network events too 2013-12-13 16:07:54 +00:00
gnulib Don't link virt-login-shell against libvirt.so (CVE-2013-4400) 2013-10-21 14:03:52 +01:00
include Added Network events API and virNetworkEventLifecycle. 2013-12-11 13:10:41 +00:00
m4 storage: initial support for linking with libgfapi 2013-11-25 11:02:52 -07:00
po Extracted common parts of domain_event.[ch] to object_event.[ch] 2013-12-10 13:12:35 +00:00
src qemu: ask for -enable-fips when FIPS is required 2013-12-18 07:05:29 -07:00
tests qemu: ask for -enable-fips when FIPS is required 2013-12-18 07:05:29 -07:00
tools tools: Fix virsh connect man page 2013-12-16 14:51:58 +01:00
.ctags maint: Make ctags work out of the box 2013-07-18 08:47:21 +02:00
.dir-locals.el build: avoid tabs that failed syntax-check 2012-09-06 09:43:46 -06:00
.gitignore Move examples/domain-events/event-c to examples/object-events 2013-12-13 16:07:54 +00:00
.gitmodules make .gnulib a submodule 2009-07-08 16:17:51 +02:00
.mailmap Autogenerate AUTHORS 2012-10-19 12:44:56 -04:00
AUTHORS.in Add John Ferlan to the committers list 2013-02-05 10:59:32 -05:00
autobuild.sh Remove python binding 2013-11-25 16:08:00 +00:00
autogen.sh autogen.sh: Correctly detect .git as a file 2013-08-29 13:19:45 +02:00
bootstrap maint: update to latest gnulib 2013-09-24 06:53:07 -06:00
bootstrap.conf Add helpers for getting env vars in a setuid environment 2013-10-21 14:03:52 +01:00
cfg.mk Move examples/domain-events/event-c to examples/object-events 2013-12-13 16:07:54 +00:00
ChangeLog-old maint: typo fixes 2013-10-22 16:49:32 +01:00
config-post.h build: fix build of virt-login-shell on systems with older gnutls 2013-10-22 09:41:50 -06:00
configure.ac configure: make --with-test-suite work 2013-12-18 14:13:25 +01:00
COPYING maint: follow recommended practice for using LGPL 2013-05-20 14:15:21 -06:00
COPYING.LESSER maint: follow recommended practice for using LGPL 2013-05-20 14:15:21 -06:00
HACKING maint: enforce comma style usage 2013-11-20 09:24:18 -07:00
libvirt.pc.in Add missing 'libvirt_lxc_api' variable in pkg-config file 2013-09-04 14:52:40 +01:00
libvirt.spec.in specfile: fix make rpm when with_driver_modules is 1 2013-12-17 14:33:00 +02:00
Makefile.am Move examples/domain-events/event-c to examples/object-events 2013-12-13 16:07:54 +00:00
Makefile.nonreentrant maint: use LGPL correctly 2013-05-20 14:03:48 -06:00
mingw-libvirt.spec.in Remove python binding 2013-11-25 16:08:00 +00:00
README Correct typos in the documentation (Atsushi SAKAI) 2008-01-24 10:15:13 +00:00
README-hacking maint: relax git minimum version 2010-02-24 14:29:27 -05:00
run.in Remove python binding 2013-11-25 16:08:00 +00:00
TODO Update todo list file to point at bugzilla/website 2010-10-13 16:45:26 +01:00

README 

         LibVirt : simple API for virtualization

  Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). It is free software
available under the GNU Lesser General Public License. Virtualization of
the Linux Operating System means the ability to run multiple instances of
Operating Systems concurrently on a single hardware system where the basic
resources are driven by a Linux instance. The library aim at providing
long term stable C API initially for the Xen paravirtualization but
should be able to integrate other virtualization mechanisms if needed.

Daniel Veillard <veillard@redhat.com>