Merge ~paelzer/ubuntu/+source/libvirt:lp-1871354-libpmem-1869796-systemd into ubuntu/+source/libvirt:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4020

[Christian Ehrhardt  (paelzer)]

All tests are good except one:

    4.3.6 (12:45:18): Check guest that stayed up during upgrade
    4.3.7 (12:45:19): Check if guest kvm-testguest-focal-2 on testkvm-focal-noupd is alive => Failed detail=guest that stayed no more alive after upgrade

Maybe the service fixes are not workign the same way in Ubuntu like they did in Debian.
Checking in detail tomorrow.

[Rafael David Tinoco (rafaeldtinoco)]

# checklist for fixes
----------------------------

 [.] changelog entry correct, targeted to correct codename
 [.] update-maintainer has been run previously
 ----
 [.] changes forwarded upstream/debian (if appropriate)
 [.] patches match what was proposed upstream
 ----
 [.] patches correctly included in debian/patches/series?
 [.] patches have correct DEP3 metadata
 ----
 [-] verified dpkg-buildpackage -S and -b
 [-] autopkgtest against PPA or built package passes
 ----
 [-] testcase provided
 [-] was able to reproduce
 [-] fix solved provided testcase

----------------------------
 [.] = ok
 [x] = not ok
 [?] = question
 [!] = note
 [-] = n/a

I'm +1 with all the patches.

The stabilization looks good for me (related to services and sockets restart).

CVEs are always good... and apparmor fixes make sense.

Good to go.

review: Approve

[Christian Ehrhardt  (paelzer)]

The test that failed is the one that checks if guests stay up during upgrade.
Chances are that the changes to libvirt-guests service trigger this.

Upgrade the following one by one:
libvirt-clients/focal 6.0.0-0ubuntu7~ppa1 s390x [upgradable from: 6.0.0-0ubuntu6]
libvirt-daemon-driver-qemu/focal 6.0.0-0ubuntu7~ppa1 s390x [upgradable from: 6.0.0-0ubuntu6]
libvirt-daemon-driver-storage-rbd/focal 6.0.0-0ubuntu7~ppa1 s390x [upgradable from: 6.0.0-0ubuntu6]
libvirt-daemon-system-systemd/focal 6.0.0-0ubuntu7~ppa1 s390x [upgradable from: 6.0.0-0ubuntu6]
libvirt-daemon-system/focal 6.0.0-0ubuntu7~ppa1 s390x [upgradable from: 6.0.0-0ubuntu6]
libvirt-daemon/focal 6.0.0-0ubuntu7~ppa1 s390x [upgradable from: 6.0.0-0ubuntu6]
libvirt0/focal 6.0.0-0ubuntu7~ppa1 s390x [upgradable from: 6.0.0-0ubuntu6]
qemu-block-extra/focal 1:4.2-3ubuntu5~ppa1 s390x [upgradable from: 1:4.2-3ubuntu4]
qemu-kvm/focal 1:4.2-3ubuntu5~ppa1 s390x [upgradable from: 1:4.2-3ubuntu4]
qemu-system-common/focal 1:4.2-3ubuntu5~ppa1 s390x [upgradable from: 1:4.2-3ubuntu4]
qemu-system-data/focal 1:4.2-3ubuntu5~ppa1 all [upgradable from: 1:4.2-3ubuntu4]
qemu-system-s390x/focal 1:4.2-3ubuntu5~ppa1 s390x [upgradable from: 1:4.2-3ubuntu4]
qemu-utils/focal 1:4.2-3ubuntu5~ppa1 s390x [upgradable from: 1:4.2-3ubuntu4]

I: # apt install qemu-kvm qemu-block-extra qemu-system-common qemu-system-data qemu-system-s390x qemu-utils
=> no change (as expected)

II: libvirt-clients libvirt-daemon libvirt-daemon-driver-qemu libvirt-daemon-driver-storage-rbd libvirt-daemon-system libvirt0

up until this step nothing happened:
Setting up libvirt0:s390x (6.0.0-0ubuntu7~ppa1) ...
Setting up libvirt-clients (6.0.0-0ubuntu7~ppa1) ...
Setting up libvirt-daemon-driver-qemu (6.0.0-0ubuntu7~ppa1) ...
Setting up libvirt-daemon (6.0.0-0ubuntu7~ppa1) ...
Setting up libvirt-daemon-driver-storage-rbd (6.0.0-0ubuntu7~ppa1) ...
Setting up libvirt-daemon-system (6.0.0-0ubuntu7~ppa1) ...

And then as assumed the services restart in a bad way.
Plenty of socket restart related errors (more than before).
Restarting libvirt-guests.sh bringing down the guests.

Ok assumption confirmed.
Lets remove that from the proposed change.
bug 1869796 is non critical and low prio anyway.
Better do this slowly and thoroughly in 20.10 then.

Will retest with the rest of the changes once rebuilt.

[Christian Ehrhardt  (paelzer)]

Tests good now:
prep (x86_64) : Pass 20 F/S/N 0/0/0 - RC 0 (14 min 52815 lin)
migrate (x86_64) : Pass 288 F/S/N 0/0/0 - RC 0 (61 min 214364 lin)
cross (x86_64) : Pass 24 F/S/N 0/1/3 - RC 0 (50 min 47742 lin)
misc (x86_64) : Pass 73 F/S/N 0/0/0 - RC 0 (31 min 41276 lin)

prep (s390x) : Pass 20 F/S/N 0/0/0 - RC 0 (11 min 44238 lin)
migrate (s390x) : Pass 268 F/S/N 0/5/0 - RC 0 (86 min 160565 lin)
cross (s390x) : Pass 30 F/S/N 0/1/2 - RC 0 (60 min 47716 lin)
misc (s390x) : Pass 67 F/S/N 0/0/0 - RC 0 (38 min 32915 lin)

Although one last minute fix slipped in for bug 1872107 and I'll retest.

[Christian Ehrhardt  (paelzer)]

accepted in focal

diff --git a/debian/changelog b/debian/changelog
index 2be6236..8aae264 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+libvirt (6.0.0-0ubuntu7) focal; urgency=medium
+
+  * d/p/ubuntu-aa/lp-1871354*: fix apparmor denials on libpmem init
+    (LP: #1871354)
+  * d/p/ubuntu/CVE-CVE-2020-10701-api-disallow-virDomainAgentSetResponseTimeout
+    -on-rea.patch: avoid DOS through read only connections
+    CVE-2020-10701
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 15 Apr 2020 12:29:12 +0200
+
 libvirt (6.0.0-0ubuntu6) focal; urgency=medium
 
   * d/p/ubuntu/lp-1867460-*: fix domcapabilities before capabilities
diff --git a/debian/patches/series b/debian/patches/series
index 867b899..3f54079 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -78,3 +78,5 @@ ubuntu/lp-1853200-cpu_map-Add-decode-element-to-x86-CPU-model-definiti.patch
 ubuntu/lp-1853200-cpu_x86-Honor-CPU-models-decode-element.patch
 ubuntu/lp-1853200-cpu_map-Don-t-use-new-noTSX-models-for-host-model-CP.patch
 ubuntu/lp-1868528-util-virhostcpu-Fail-when-fetching-CPU-Stats-for-inv.patch
+ubuntu-aa/lp-1871354-apparmor-avoid-denials-on-libpmem-initialization.patch
+ubuntu/CVE-CVE-2020-10701-api-disallow-virDomainAgentSetResponseTimeout-on-rea.patch
diff --git a/debian/patches/ubuntu-aa/lp-1871354-apparmor-avoid-denials-on-libpmem-initialization.patch b/debian/patches/ubuntu-aa/lp-1871354-apparmor-avoid-denials-on-libpmem-initialization.patch
new file mode 100644
index 0000000..0ebeb8e
--- /dev/null
+++ b/debian/patches/ubuntu-aa/lp-1871354-apparmor-avoid-denials-on-libpmem-initialization.patch
@@ -0,0 +1,47 @@
+From 8f61fd6bf2dc7e1107e010fdc14bab9ecfde43af Mon Sep 17 00:00:00 2001
+From: Christian Ehrhardt <[e-mail]>
+Date: Wed, 8 Apr 2020 16:47:58 +0200
+Subject: [PATCH] apparmor: avoid denials on libpmem initialization
+
+With libpmem support compiled into qemu it will trigger the following
+denials on every startup.
+  apparmor="DENIED" operation="open" name="/"
+  apparmor="DENIED" operation="open" name="/sys/bus/nd/devices/"
+
+This is due to [1] that tries to auto-detect if the platform supports
+auto flush for all region.
+
+Once we know all the paths that are potentially needed if this feature
+is really used we can add them conditionally in virt-aa-helper and labelling
+calls in case </pmem> is enabled.
+
+But until then the change here silences the denial warnings seen above.
+
+[1]: https://github.com/pmem/pmdk/blob/master/src/libpmem2/auto_flush_linux.c#L131
+
+Bug: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1871354
+
+Signed-off-by: Christian Ehrhardt <[e-mail]>
+Acked-by: Jamie Strandboge <[e-mail]>
+
+Origin: backport, https://libvirt.org/git/?p=libvirt.git;a=commit;h=8f61fd6b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1871354
+Last-Update: 2020-04-15
+
+---
+ src/security/apparmor/libvirt-qemu | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/src/security/apparmor/libvirt-qemu
++++ b/src/security/apparmor/libvirt-qemu
+@@ -259,5 +259,10 @@
+   /etc/gss/mech.d/ r,
+   /etc/gss/mech.d/* r,
+ 
++  # required by libpmem init to fts_open()/fts_read() the symlinks in
++  # /sys/bus/nd/devices
++  / r, # harmless on any lsb compliant system
++  /sys/bus/nd/devices/{,**/} r,
++
+   # Site-specific additions and overrides. See local/README for details.
+   #include <local/abstractions/libvirt-qemu>
diff --git a/debian/patches/ubuntu/CVE-CVE-2020-10701-api-disallow-virDomainAgentSetResponseTimeout-on-rea.patch b/debian/patches/ubuntu/CVE-CVE-2020-10701-api-disallow-virDomainAgentSetResponseTimeout-on-rea.patch
new file mode 100644
index 0000000..39b2024
--- /dev/null
+++ b/debian/patches/ubuntu/CVE-CVE-2020-10701-api-disallow-virDomainAgentSetResponseTimeout-on-rea.patch
@@ -0,0 +1,38 @@
+From 4cc90c2e62df653e909ad31fd810224bf8bcf913 Mon Sep 17 00:00:00 2001
+From: Jonathon Jongsma <[e-mail]>
+Date: Fri, 20 Mar 2020 09:43:13 -0500
+Subject: [PATCH] api: disallow virDomainAgentSetResponseTimeout() on read-only
+ connections
+
+This function changes the amount of time that libvirt waits for a
+response from the guest agent for all guest agent commands. Since this
+is a configuration change, it should not be allowed on read-only
+connections.
+
+Signed-off-by: Jonathon Jongsma <[e-mail]>
+Reviewed-by: Daniel Henrique Barboza <[e-mail]>
+Reviewed-by: Michal Privoznik <[e-mail]>
+
+Origin: upstream, https://libvirt.org/git/?p=libvirt.git;a=commit;h=4cc90c2e62df653e909ad31fd810224bf8bcf913
+Last-Update: 2020-04-15
+
+---
+ src/libvirt-domain.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
+index 65813b68cc..a12809c2d5 100644
+--- a/src/libvirt-domain.c
++++ b/src/libvirt-domain.c
+@@ -12576,6 +12576,8 @@ virDomainAgentSetResponseTimeout(virDomainPtr domain,
+     virCheckDomainReturn(domain, -1);
+     conn = domain->conn;
+ 
++    virCheckReadOnlyGoto(conn->flags, error);
++
+     if (conn->driver->domainAgentSetResponseTimeout) {
+         if (conn->driver->domainAgentSetResponseTimeout(domain, timeout, flags) < 0)
+             goto error;
+-- 
+2.26.0
+