debian/changelog

-libvirt (5.2.0~rc1-1~3.gbp21533c) UNRELEASED; urgency=medium
+libvirt (5.2.0-1) experimental; urgency=medium
 
-  ** SNAPSHOT build @21533cff1685c78c610fa9e9ad7452a03a0ce620 **
+  * Team upload.
 
-  * [932fa9d] New upstream version 5.2.0~rc1
-  * [0b5e54e] Bump symbol versions
-  * [bf0bc67] New upstream version 5.2.0~rc2
+  [ Christian Ehrhardt ]
+  * [3997186] d/libvirt-daemon-system.maintscript: remove obsolete conffile
+    /etc/logrotate.d/libvirtd.uml became obsolete since UML was dropped in
+    libvirt 5.0 (Closes: #920574)
+  * [c64d020] d/libvirt-daemon-system.libvirtd.default: clarify libvirtd_opts
+    example (Closes: #921713)
+
+  [ Guido Günther ]
   * [dd9d74f] New upstream version 5.2.0
+  * [790365e] CVE-2019-3886: Don't allow unprivileged users to use the guest
+    agent. Apply upstream patches
+    remote-enforce-ACL-write-permission-for-getting-guest-tim.patch
+    api-disallow-virDomainGetHostname-for-read-only-connectio.patch
+    (Closes: #926418)
 
- -- Guido Günther <agx@sigxcpu.org>  Fri, 05 Apr 2019 09:17:27 +0200
+  [ Andrea Bolognani ]
+  * [453f85d] Rediff patches. The patches
+    security-aa-helper-allow-virt-aa-helper-to-read-dev-dri.patch
+    security-aa-helper-generate-more-rules-for-gl-devices.patch
+    security-aa-helper-gl-devices-in-sysfs-at-arbitrary-depth.patch
+    security-aa-helper-nvidia-rules-for-gl-devices.patch
+    virt-aa-helper-generate-rules-for-gl-enabled-graphics-dev.patch
+    are included in libvirt 5.2.0 and have thus been dropped.
+  * [a4294ef] Bump symbol versions.
+  * [68394f6] Add tests-Avoid-writing-into-HOME-during-virsh-snapshot.patch
+
+ -- Andrea Bolognani <eof@kiyuko.org>  Sun, 07 Apr 2019 18:39:49 +0200
 
 libvirt (5.1.0-1) experimental; urgency=medium
 
@@ -23,6 +44,37 @@ libvirt (5.1.0-1) experimental; urgency=medium
 
  -- Guido Günther <agx@sigxcpu.org>  Thu, 28 Mar 2019 13:03:29 +0100
 
+libvirt (5.0.0-2) unstable; urgency=medium
+
+  [ Laurent Bigonville ]
+  * [76e2cb7] Don't recommend ebtables.  It's part of the iptables package now.
+    (Closes: #918472)
+
+  [ intrigeri ]
+  * [d7a7218] Fix virtio-gpu + virgl support by cherry-picking upstream
+    commits virt-manager in current sid still creates new VMs with QXL
+    graphics by default, so this bug only affects users who opt in for
+    virtio-gpu 3D acceleration.  Still, the option for virtio-gpu + 3D
+    acceleration is offered in the virt-manager GUI, so having it broken by
+    default is an important problem.
+    (Closes: #916587)
+
+  [ Christian Ehrhardt ]
+  * [3997186] d/libvirt-daemon-system.maintscript: remove obsolete conffile
+    /etc/logrotate.d/libvirtd.uml became obsolete since UML was dropped in
+    libvirt 5.0 (Closes: #920574)
+  * [c64d020] d/libvirt-daemon-system.libvirtd.default: clarify libvirtd_opts
+    example (Closes: #921713)
+
+  [ Guido Günther ]
+  * [790365e] CVE-2019-3886: Don't allow unprivileged users to use the guest
+    agent. Apply upstream patches
+    remote-enforce-ACL-write-permission-for-getting-guest-tim.patch
+    api-disallow-virDomainGetHostname-for-read-only-connectio.patch
+    (Closes: #926418)
+
+ -- Guido Günther <agx@sigxcpu.org>  Sun, 07 Apr 2019 12:36:21 +0200
+
 libvirt (5.0.0-1) unstable; urgency=medium
 
   * [7346f30] New upstream version 5.0.0

debian/libvirt-daemon-system.libvirtd.default

@@ -4,7 +4,9 @@
 # Start libvirtd to handle qemu/kvm:
 start_libvirtd="yes"
 
-# options passed to libvirtd, add "-l" to listen on tcp
+# options passed to libvirtd, see man libvirtd for details.
+# For example to enable listening on tcp add -l here
+# and set up the TLS Certificates that libvirtd will need.
 #libvirtd_opts=""
 
 # pass in location of kerberos keytab

debian/libvirt-daemon-system.maintscript

+rm_conffile /etc/logrotate.d/libvirtd.uml 5.0.0-2~

debian/patches/api-disallow-virDomainGetHostname-for-read-only-connectio.patch

+From: =?utf-8?b?IkRhbmllbCBQLiBCZXJyYW5nw6ki?= <berrange@redhat.com>
+Date: Wed, 3 Apr 2019 15:00:49 +0100
+Subject: api: disallow virDomainGetHostname for read-only connections
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+The virDomainGetHostname API is fetching guest information and this may
+involve use of an untrusted guest agent. As such its use must be
+forbidden on a read-only connection to libvirt.
+
+Fixes CVE-2019-3886
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ src/libvirt-domain.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
+index be5b1f6..baf2182 100644
+--- a/src/libvirt-domain.c
++++ b/src/libvirt-domain.c
+@@ -11031,6 +11031,8 @@ virDomainGetHostname(virDomainPtr domain, unsigned int flags)
+     virCheckDomainReturn(domain, NULL);
+     conn = domain->conn;
+ 
++    virCheckReadOnlyGoto(domain->conn->flags, error);
++
+     if (conn->driver->domainGetHostname) {
+         char *ret;
+         ret = conn->driver->domainGetHostname(domain, flags);

debian/patches/debian/Don-t-enable-default-network-on-boot.patch

@@ -9,10 +9,10 @@ to not interfere with existing network configurations
  2 files changed, 2 insertions(+), 4 deletions(-)
 
 diff --git a/src/Makefile.in b/src/Makefile.in
-index 25f1b9d..f4e3fa5 100644
+index fe2d19f..2700a1d 100644
 --- a/src/Makefile.in
 +++ b/src/Makefile.in
-@@ -13372,8 +13372,7 @@ lxc/lxc_controller_dispatch.h: $(srcdir)/rpc/gendispatch.pl \
+@@ -13398,8 +13398,7 @@ lxc/lxc_controller_dispatch.h: $(srcdir)/rpc/gendispatch.pl \
  @WITH_NETWORK_TRUE@	      $(DESTDIR)$(confdir)/qemu/networks/default.xml && \
  @WITH_NETWORK_TRUE@	    rm $(DESTDIR)$(confdir)/qemu/networks/default.xml.t; }
  @WITH_NETWORK_TRUE@	( cd $(DESTDIR)$(confdir)/qemu/networks/autostart && \

debian/patches/debian/Prefer-sbin-over-usr-sbin.patch

@@ -11,7 +11,7 @@ Closes: #895145
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 4dcdd12..94438db 100644
+index 880a3a7..307aff0 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -110,7 +110,7 @@ then

debian/patches/debian/Use-upstreams-polkit-rule.patch

@@ -9,10 +9,10 @@ As of 1.2.16 upstream ships a Polkit rule like Debian does.
  2 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/src/Makefile.in b/src/Makefile.in
-index f4e3fa5..99a185e 100644
+index 2700a1d..4abd388 100644
 --- a/src/Makefile.in
 +++ b/src/Makefile.in
-@@ -13421,12 +13421,12 @@ lxc/lxc_controller_dispatch.h: $(srcdir)/rpc/gendispatch.pl \
+@@ -13447,12 +13447,12 @@ lxc/lxc_controller_dispatch.h: $(srcdir)/rpc/gendispatch.pl \
  @WITH_LIBVIRTD_TRUE@@WITH_POLKIT_TRUE@		$(DESTDIR)$(polkitactionsdir)/org.libvirt.unix.policy
  @WITH_LIBVIRTD_TRUE@@WITH_POLKIT_TRUE@	$(MKDIR_P) $(DESTDIR)$(polkitrulesdir)
  @WITH_LIBVIRTD_TRUE@@WITH_POLKIT_TRUE@	$(INSTALL_DATA) $(srcdir)/remote/libvirtd.rules \
@@ -28,10 +28,10 @@ index f4e3fa5..99a185e 100644
  
  .PHONY: \
 diff --git a/src/remote/Makefile.inc.am b/src/remote/Makefile.inc.am
-index 3d0ff29..7835ed8 100644
+index dccecf8..c1916bd 100644
 --- a/src/remote/Makefile.inc.am
 +++ b/src/remote/Makefile.inc.am
-@@ -219,12 +219,12 @@ install-polkit:
+@@ -213,12 +213,12 @@ install-polkit:
  		$(DESTDIR)$(polkitactionsdir)/org.libvirt.unix.policy
  	$(MKDIR_P) $(DESTDIR)$(polkitrulesdir)
  	$(INSTALL_DATA) $(srcdir)/remote/libvirtd.rules \

debian/patches/remote-enforce-ACL-write-permission-for-getting-guest-tim.patch

+From: =?utf-8?b?IkRhbmllbCBQLiBCZXJyYW5nw6ki?= <berrange@redhat.com>
+Date: Wed, 3 Apr 2019 15:00:50 +0100
+Subject: remote: enforce ACL write permission for getting guest time &
+ hostname
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+Getting the guest time and hostname both require use of guest agent
+commands. These must not be allowed for read-only users, so the
+permissions check must validate "write" permission not "read".
+
+Fixes CVE-2019-3886
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ src/remote/remote_protocol.x | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
+index 74be4b3..11f44ee 100644
+--- a/src/remote/remote_protocol.x
++++ b/src/remote/remote_protocol.x
+@@ -5513,7 +5513,7 @@ enum remote_procedure {
+ 
+     /**
+      * @generate: both
+-     * @acl: domain:read
++     * @acl: domain:write
+      */
+     REMOTE_PROC_DOMAIN_GET_HOSTNAME = 277,
+ 
+@@ -5908,7 +5908,7 @@ enum remote_procedure {
+ 
+     /**
+      * @generate: none
+-     * @acl: domain:read
++     * @acl: domain:write
+      */
+     REMOTE_PROC_DOMAIN_GET_TIME = 337,
+ 

debian/patches/series

@@ -14,3 +14,6 @@ Set-defaults-for-zfs-tools.patch
 Pass-GPG_TTY-env-var-to-the-ssh-binary.patch
 apparmor-Allow-virt-aa-helper-to-access-the-name-service-.patch
 debian/Prefer-sbin-over-usr-sbin.patch
+api-disallow-virDomainGetHostname-for-read-only-connectio.patch
+remote-enforce-ACL-write-permission-for-getting-guest-tim.patch
+tests-Avoid-writing-into-HOME-during-virsh-snapshot.patch

debian/patches/tests-Avoid-writing-into-HOME-during-virsh-snapshot.patch

+From: Eric Blake <eblake@redhat.com>
+Date: Wed, 27 Mar 2019 13:42:45 -0500
+Subject: tests: Avoid writing into $HOME during virsh-snapshot
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+In a constrained CI environment, where it is intentional that attempts
+to write outside the current directory will fail, virsh-snapshot was
+failing:
+
+ error: invalid argument: parent s3 for snapshot s2 not found
+ error: marker
++error: Failed to create '/home/travis/.cache/libvirt/virsh': Permission denied
+FAIL virsh-snapshot (exit status: 1)
+
+But we've already solved the problem in virsh-uriprecedence: tell
+virsh to use XDG locations pointing to somewhere we can write rather
+than its default of falling back to $HOME with the test being at risk
+of breaking due to the user's environment and/or unacceptably altering
+the user's normal cache.  Hoist that solution into test-lib.sh, so
+that all scripts can use it as needed. While at it, fix a latent typo
+where XDG_RUNTIME_HOME was set to a literal relative directory name
+"XDG_CACHE_HOME" (the typo did not affect virsh-uriprecedence, but
+could matter to other clients).
+
+Fixes: 280a2b41
+Fixes: 398de147
+Reported-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+
+(cherry picked from commit b18866086516b6fb1dc5bcc45dcde7b8df324850)
+---
+ tests/test-lib.sh         | 13 +++++++++++++
+ tests/virsh-snapshot      |  2 ++
+ tests/virsh-uriprecedence | 12 +-----------
+ 3 files changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/tests/test-lib.sh b/tests/test-lib.sh
+index 49e8d22..ef5a47b 100644
+--- a/tests/test-lib.sh
++++ b/tests/test-lib.sh
+@@ -222,6 +222,19 @@ mkfifo_or_skip_()
+   fi
+ }
+ 
++# Create mock XDG files/directories to avoid permission problems.
++# As it points inside $test_dir_, it is automatically cleaned.
++mock_xdg_()
++{
++  export XDG_CONFIG_HOME="$t_/.config"
++  export XDG_CACHE_HOME="$t_/.cache"
++  export XDG_RUNTIME_HOME="$XDG_CACHE_HOME"
++
++  mkdir -p "$XDG_CONFIG_HOME/libvirt" "$XDG_CONFIG_HOME/virsh"
++  mkdir -p "$XDG_CACHE_HOME/libvirt" "$XDG_CACHE_HOME/virsh"
++  mkdir -p "$XDG_RUNTIME_HOME/libvirt" "$XDG_RUNTIME_HOME/virsh"
++}
++
+ test_dir_=$(pwd)
+ 
+ this_test_() { echo "./$0" | sed 's,.*/,,'; }
+diff --git a/tests/virsh-snapshot b/tests/virsh-snapshot
+index fb8a99d..cb498cf 100755
+--- a/tests/virsh-snapshot
++++ b/tests/virsh-snapshot
+@@ -26,6 +26,8 @@ fi
+ 
+ fail=0
+ 
++mock_xdg_ || framework_failure
++
+ # The test driver loses states between restarts, so we perform a script
+ # with some convenient markers for later post-processing of output.
+ $abs_top_builddir/tools/virsh --connect test:///default >out 2>err '
+diff --git a/tests/virsh-uriprecedence b/tests/virsh-uriprecedence
+index 564e3dc..fd6ce10 100755
+--- a/tests/virsh-uriprecedence
++++ b/tests/virsh-uriprecedence
+@@ -11,17 +11,7 @@ virsh_cmd="$virsh_bin"
+ counter=0
+ ret=0
+ 
+-cleanup_() { rm -rf "$tmphome"; }
+-
+-# Create all mock files/directories to avoid permission problems
+-tmphome="$PWD/tmp_home"
+-export XDG_CONFIG_HOME="$tmphome/.config"
+-export XDG_CACHE_HOME="$tmphome/.cache"
+-export XDG_RUNTIME_HOME="XDG_CACHE_HOME"
+-
+-mkdir -p "$XDG_CONFIG_HOME/libvirt" "$XDG_CONFIG_HOME/virsh"
+-mkdir -p "$XDG_CACHE_HOME/libvirt" "$XDG_CACHE_HOME/virsh"
+-mkdir -p "$XDG_RUNTIME_HOME/libvirt" "$XDG_RUNTIME_HOME/virsh"
++mock_xdg_ || framework_failure
+ 
+ is_uri_good()
+ {