rng: restrict passthrough names to known-good files

There is some controversy[1] on the qemu list on whether qemu should
have ever allowed arbitrary file name passthrough, or whether it
should be restricted to JUST /dev/random and /dev/hwrng.  It is
always easier to add support for additional filenames than it is
to remove support for something once released, so this patch
restricts libvirt 1.0.3 (where the virtio-random backend was first
supported) to just the two uncontroversial names, letting us defer
to a later date any decision on whether supporting arbitrary files
makes sense. Additionally, since qemu 1.4 does NOT support
/dev/fdset/nnn fd passthrough for the backend, limiting to just
two known names means that we don't get tempted to try fd
passthrough where it won't work.

[1]https://lists.gnu.org/archive/html/qemu-devel/2013-03/threads.html#00023

* src/conf/domain_conf.c (virDomainRNGDefParseXML): Only allow
/dev/random and /dev/hwrng.
* docs/schemas/domaincommon.rng: Flag invalid files.
* docs/formatdomain.html.in (elementsRng): Document this.
* tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.args:
Update test to match.
* tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.xml:
Likewise.

diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 1835b39911b2ea4fbc09e411b6922a919017a5ec..4cafc92aba7bd8cee6fadb5d40f7828af93d61d8 100644 (file)
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -4310,7 +4310,8 @@ qemu-kvm -net nic,model=? /dev/null
           <code>model</code> attribute. Supported source models are:
         </p>
         <ul>
-          <li>'random' &mdash; /dev/random (default) or similar device as source</li>
+          <li>'random' &mdash; /dev/random (default) or /dev/hwrng
+            device as source (for now, no other sources are permitted)</li>
           <li>'egd' &mdash; a EGD protocol backend</li>
         </ul>
       </dd>

diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index e7231cc0bf9fadf8b1bbfb79ba56bdd1e9875c92..4b608855affb27294c8d12c5e35a92f8c0622fa8 100644 (file)
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -3511,7 +3511,10 @@
           <attribute name="model">
             <value>random</value>
           </attribute>
-          <ref name="filePath"/>
+          <choice>
+            <value>/dev/random</value>
+            <value>/dev/hwrng</value>
+          </choice>
         </group>
         <group>
           <attribute name="model">

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 995cf0cae307919f38077ec44ec8f6a6875bd18f..9c96cf1af0f2437cc26a04097fbb1081210e4ead 100644 (file)
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -7423,6 +7423,13 @@ virDomainRNGDefParseXML(const xmlNodePtr node,
     switch ((enum virDomainRNGBackend) def->backend) {
     case VIR_DOMAIN_RNG_BACKEND_RANDOM:
         def->source.file = virXPathString("string(./backend)", ctxt);
+        if (STRNEQ(def->source.file, "/dev/random") &&
+            STRNEQ(def->source.file, "/dev/hwrng")) {
+            virReportError(VIR_ERR_XML_ERROR,
+                           _("file '%s' is not a supported random source"),
+                           def->source.file);
+            goto error;
+        }
         break;
 
     case VIR_DOMAIN_RNG_BACKEND_EGD:

diff --git a/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.args b/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.args
index ad271321e7dfccc8e6fbf317180327948f6aa8f1..7ab9dbc0c02de1c1787a8107ebebe50b0b218f9e 100644 (file)
--- a/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.args
+++ b/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.args
@@ -2,5 +2,5 @@ LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu \
 -S -M pc -m 214 -smp 1 -nographic -nodefaults \
 -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -usb \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \
--object 'rng-random,id=rng0,filename=/test/ph<ile' \
+-object rng-random,id=rng0,filename=/dev/hwrng \
 -device virtio-rng-pci,rng=rng0,bus=pci.0,addr=0x4

diff --git a/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.xml b/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.xml
index 0658f4b21ad721753d737d4930a9b945a0f5c16d..1e2c4be95a6f51eb35311713513e815aa96c26e2 100644 (file)
--- a/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.xml
+++ b/tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.xml
@@ -17,7 +17,7 @@
     <controller type='usb' index='0'/>
     <memballoon model='virtio'/>
     <rng model='virtio'>
-      <backend model='random'>/test/ph&lt;ile</backend>
+      <backend model='random'>/dev/hwrng</backend>
     </rng>
   </devices>
 </domain>