From patchwork Tue Jun 4 15:32:29 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685576 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DE8F2C25B78 for ; Tue, 4 Jun 2024 15:34:02 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9a-0006ZE-E1; Tue, 04 Jun 2024 11:32:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9Z-0006Yl-HK for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:49 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9Y-0001Gt-0l for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:49 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nshYwZLSBkZ8aydLKTO7Ez7S8eYc459g0Uetg05gxRA=; b=CHRzx1/BNekNgg3GV4OSNrbw1dSaM+lfhmJWd4woubuf5+8zFKUuhhXVbiZzHQhsKtTqGk Lsv7m4mNXv5bQ0FsmJNqrVn/5yS9R4hYoHDAYGVfbWhalZrDcILOtBw3Xwi6CC1LYrX8i9 Mx/NGwNVucjhxdiA4l59OtHwlSSF5wA= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-630-DhOaNTAPPeCrFkdC-V9kHw-1; Tue, 04 Jun 2024 11:32:46 -0400 X-MC-Unique: DhOaNTAPPeCrFkdC-V9kHw-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id F28628007A1; Tue, 4 Jun 2024 15:32:45 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 2AC58492BCF; Tue, 4 Jun 2024 15:32:45 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 01/14] qapi: use "QAPI_FEATURE" as namespace for special features Date: Tue, 4 Jun 2024 16:32:29 +0100 Message-ID: <20240604153242.251334-2-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org This more clearly distinguishes the feature constants from other QAPI constants. Signed-off-by: Daniel P. Berrangé --- include/qapi/util.h | 4 ++-- qapi/qapi-util.c | 4 ++-- qapi/qobject-output-visitor.c | 4 ++-- scripts/qapi/gen.py | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/include/qapi/util.h b/include/qapi/util.h index 20dfea8a54..7698e789a9 100644 --- a/include/qapi/util.h +++ b/include/qapi/util.h @@ -12,8 +12,8 @@ #define QAPI_UTIL_H typedef enum { - QAPI_DEPRECATED, - QAPI_UNSTABLE, + QAPI_FEATURE_DEPRECATED, + QAPI_FEATURE_UNSTABLE, } QapiSpecialFeature; typedef struct QEnumLookup { diff --git a/qapi/qapi-util.c b/qapi/qapi-util.c index 65a7d18437..6bcab11117 100644 --- a/qapi/qapi-util.c +++ b/qapi/qapi-util.c @@ -43,13 +43,13 @@ bool compat_policy_input_ok(unsigned special_features, const char *kind, const char *name, Error **errp) { - if ((special_features & 1u << QAPI_DEPRECATED) + if ((special_features & 1u << QAPI_FEATURE_DEPRECATED) && !compat_policy_input_ok1("Deprecated", policy->deprecated_input, error_class, kind, name, errp)) { return false; } - if ((special_features & (1u << QAPI_UNSTABLE)) + if ((special_features & (1u << QAPI_FEATURE_UNSTABLE)) && !compat_policy_input_ok1("Unstable", policy->unstable_input, error_class, kind, name, errp)) { diff --git a/qapi/qobject-output-visitor.c b/qapi/qobject-output-visitor.c index 74770edd73..ca8be3fe06 100644 --- a/qapi/qobject-output-visitor.c +++ b/qapi/qobject-output-visitor.c @@ -214,9 +214,9 @@ static bool qobject_output_policy_skip(Visitor *v, const char *name, { CompatPolicy *pol = &v->compat_policy; - return ((special_features & 1u << QAPI_DEPRECATED) + return ((special_features & 1u << QAPI_FEATURE_DEPRECATED) && pol->deprecated_output == COMPAT_POLICY_OUTPUT_HIDE) - || ((special_features & 1u << QAPI_UNSTABLE) + || ((special_features & 1u << QAPI_FEATURE_UNSTABLE) && pol->unstable_output == COMPAT_POLICY_OUTPUT_HIDE); } diff --git a/scripts/qapi/gen.py b/scripts/qapi/gen.py index 6a8abe0041..9c590a1c2e 100644 --- a/scripts/qapi/gen.py +++ b/scripts/qapi/gen.py @@ -41,7 +41,7 @@ def gen_special_features(features: Sequence[QAPISchemaFeature]) -> str: - special_features = [f"1u << QAPI_{feat.name.upper()}" + special_features = [f"1u << QAPI_FEATURE_{feat.name.upper()}" for feat in features if feat.is_special()] return ' | '.join(special_features) or '0' From patchwork Tue Jun 4 15:32:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685574 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8AE25C25B78 for ; Tue, 4 Jun 2024 15:33:49 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9f-0006bl-9V; Tue, 04 Jun 2024 11:32:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9c-0006aY-Tv for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:52 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9b-0001HS-AO for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:52 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515170; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AIaB3FlYOdNycMQI4y5Czf/Cychjn1r+a6n6QQ5ZqR4=; b=gSuGGebd/0cEGmW04RDSrh522ceM2jeJ2C8Ncxq0Og7DS6VnKFAXSGYK74Yn66fgOhkxSQ wbLp7IiwbC6iK+RcIbRzPEj6L8olXog7NwQRHgGtNHw6htBgCp+8IK7tYDY2lphJT+QO+w SCvWSoGf/L3wfxtybx2dihgnb9ihYbc= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-346-74DsxByFOi2tuh1sCzb9aA-1; Tue, 04 Jun 2024 11:32:47 -0400 X-MC-Unique: 74DsxByFOi2tuh1sCzb9aA-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0056F1C0512B; Tue, 4 Jun 2024 15:32:47 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 30581492BCE; Tue, 4 Jun 2024 15:32:46 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 02/14] qapi: add helper for checking if a command feature is set Date: Tue, 4 Jun 2024 16:32:30 +0100 Message-ID: <20240604153242.251334-3-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org The 'qmp_command_has_feature' method returns true if the requested feature has been set. Signed-off-by: Daniel P. Berrangé --- include/qapi/qmp/dispatch.h | 1 + qapi/qmp-registry.c | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/include/qapi/qmp/dispatch.h b/include/qapi/qmp/dispatch.h index f2e956813a..0dfcb549b6 100644 --- a/include/qapi/qmp/dispatch.h +++ b/include/qapi/qmp/dispatch.h @@ -51,6 +51,7 @@ void qmp_disable_command(QmpCommandList *cmds, const char *name, void qmp_enable_command(QmpCommandList *cmds, const char *name); bool qmp_command_is_enabled(const QmpCommand *cmd); +bool qmp_command_has_feature(const QmpCommand *cmd, unsigned feature); bool qmp_command_available(const QmpCommand *cmd, Error **errp); const char *qmp_command_name(const QmpCommand *cmd); bool qmp_has_success_response(const QmpCommand *cmd); diff --git a/qapi/qmp-registry.c b/qapi/qmp-registry.c index 485bc5e6fc..392f0e5c5a 100644 --- a/qapi/qmp-registry.c +++ b/qapi/qmp-registry.c @@ -74,6 +74,11 @@ bool qmp_command_is_enabled(const QmpCommand *cmd) return cmd->enabled; } +bool qmp_command_has_feature(const QmpCommand *cmd, unsigned feature) +{ + return cmd->special_features & feature; +} + const char *qmp_command_name(const QmpCommand *cmd) { return cmd->name; From patchwork Tue Jun 4 15:32:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685573 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 47590C41513 for ; Tue, 4 Jun 2024 15:33:35 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9f-0006cw-Ui; Tue, 04 Jun 2024 11:32:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9e-0006b8-59 for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:54 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9c-0001HY-BU for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:53 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515171; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gteA63eoWPVp9NrJaZ7KLSuF00Gzpd2/hhrYyYjOdJQ=; b=eYbd7SuI4iyPqbkHIt5x/uFQ/k4Zdp5VafSNBkkwljPdW6y7ShNr7qyDyfJF2/IRHJXeer CTfmHBt5MLVcByBhoiP/VYZvXxuI94omUW3I88Xm8JpP9B1x0dZ6IMNNufjq/LPa7Gd8QJ eF7NSivOOCsdgl0P+FppF6vnZx1M3yA= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-670-Jlhy6BRIMFeDbi_8SnqIOA-1; Tue, 04 Jun 2024 11:32:48 -0400 X-MC-Unique: Jlhy6BRIMFeDbi_8SnqIOA-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 060FE800074; Tue, 4 Jun 2024 15:32:48 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 33D24492BD5; Tue, 4 Jun 2024 15:32:47 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 03/14] qapi: cope with special feature names containing a '-' Date: Tue, 4 Jun 2024 16:32:31 +0100 Message-ID: <20240604153242.251334-4-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org When we shortly allow custom special feature names to be defined, it will be valid to include a '-', which must be translated to a '_' when generating code. Signed-off-by: Daniel P. Berrangé --- scripts/qapi/gen.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/qapi/gen.py b/scripts/qapi/gen.py index 9c590a1c2e..650efc59ed 100644 --- a/scripts/qapi/gen.py +++ b/scripts/qapi/gen.py @@ -41,7 +41,7 @@ def gen_special_features(features: Sequence[QAPISchemaFeature]) -> str: - special_features = [f"1u << QAPI_FEATURE_{feat.name.upper()}" + special_features = [f"1u << QAPI_FEATURE_{feat.name.upper().replace('-','_')}" for feat in features if feat.is_special()] return ' | '.join(special_features) or '0' From patchwork Tue Jun 4 15:32:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685572 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E676DC25B78 for ; Tue, 4 Jun 2024 15:33:34 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9j-0006g4-PH; Tue, 04 Jun 2024 11:32:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9i-0006f7-1P for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:58 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9g-0001IO-Gy for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515175; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=o7tJ3bO80lxZEewEVW7HLEMavqplS8Nmt28huutAp+I=; b=XuCudweGB4WE30ePzAXCMJrAbNjAQCGRE8Vi/wEniuRnXT+f/wahuNuCB2BWPC/tl/uvbn EFjgSmi//abmljfJlcZ/YnbOjUEpv2lyG+/fA12opaxuOGl8aZq5EMAT7PHS4Bg6KZm5cr pgg2DLG0VlGQYlXhWIX46QyefX7ZvkI= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-385-zmBY7pfqOZ2cBayljcoVew-1; Tue, 04 Jun 2024 11:32:49 -0400 X-MC-Unique: zmBY7pfqOZ2cBayljcoVew-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 09104185A78E; Tue, 4 Jun 2024 15:32:49 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 380BE492BCE; Tue, 4 Jun 2024 15:32:48 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 04/14] qapi: add a 'command-features' pragma Date: Tue, 4 Jun 2024 16:32:32 +0100 Message-ID: <20240604153242.251334-5-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org The 'command-features' pragma allows for defining additional special features that are unique to a particular QAPI schema instance and its implementation. Signed-off-by: Daniel P. Berrangé --- scripts/qapi/parser.py | 2 ++ scripts/qapi/source.py | 2 ++ 2 files changed, 4 insertions(+) diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py index 7b13a583ac..36a9046243 100644 --- a/scripts/qapi/parser.py +++ b/scripts/qapi/parser.py @@ -243,6 +243,8 @@ def check_list_str(name: str, value: object) -> List[str]: pragma.documentation_exceptions = check_list_str(name, value) elif name == 'member-name-exceptions': pragma.member_name_exceptions = check_list_str(name, value) + elif name == 'command-features': + pragma.command_features = check_list_str(name, value) else: raise QAPISemError(info, "unknown pragma '%s'" % name) diff --git a/scripts/qapi/source.py b/scripts/qapi/source.py index 7b379fdc92..07c2958ac4 100644 --- a/scripts/qapi/source.py +++ b/scripts/qapi/source.py @@ -28,6 +28,8 @@ def __init__(self) -> None: self.documentation_exceptions: List[str] = [] # Types whose member names may violate case conventions self.member_name_exceptions: List[str] = [] + # Arbitrary extra features recorded against commands + self.command_features: List[str] = [] class QAPISourceInfo: From patchwork Tue Jun 4 15:32:33 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685577 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9A468C25B78 for ; Tue, 4 Jun 2024 15:34:17 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9h-0006eH-2m; Tue, 04 Jun 2024 11:32:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9e-0006bI-SD for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:54 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9d-0001Hb-6B for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:54 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515172; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4adVHmCbzeBezujTwCZuobD70x9l5Rn6nXDmdzXRVJg=; b=DIdSeb87OZKmox+H3KZi3eoextxl5QELTgiR9ayICS6DMWHn91CZjEwyIhmJkExyTFex0e iP8XhBFJzom5bKgAlibyYurhPtDqsENLL+8fuYcqen07NFV6eMOZe8OFimnbCl3Wr1FJOr bW1AjujSsYAHWagsfZVQhg7RYyHT2Ww= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-142-GCiby5NiPgqCeFAws9BTJA-1; Tue, 04 Jun 2024 11:32:50 -0400 X-MC-Unique: GCiby5NiPgqCeFAws9BTJA-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0BFA829ABA01; Tue, 4 Jun 2024 15:32:50 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3B142492BD3; Tue, 4 Jun 2024 15:32:49 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 05/14] qapi: stop hardcoding list of special features Date: Tue, 4 Jun 2024 16:32:33 +0100 Message-ID: <20240604153242.251334-6-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Use the additional list of special features for commands, previously defined by a pragma, to augment the standard 'unstable' and 'deprecated' ones. Signed-off-by: Daniel P. Berrangé --- scripts/qapi/schema.py | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/scripts/qapi/schema.py b/scripts/qapi/schema.py index 721c470d2b..b83a9bdcb7 100644 --- a/scripts/qapi/schema.py +++ b/scripts/qapi/schema.py @@ -932,8 +932,18 @@ def connect_doc(self, doc: Optional[QAPIDoc]) -> None: class QAPISchemaFeature(QAPISchemaMember): role = 'feature' + def __init__( + self, + name: str, + info: Optional[QAPISourceInfo], + ifcond: Optional[QAPISchemaIfCond] = None, + special: bool = False, + ): + super().__init__(name, info, ifcond) + self.special = special + def is_special(self) -> bool: - return self.name in ('deprecated', 'unstable') + return self.special class QAPISchemaObjectTypeMember(QAPISchemaMember): @@ -1143,6 +1153,9 @@ def __init__(self, fname: str): self._predefining = True self._def_predefineds() self._predefining = False + self._custom_special_features: Dict[str, List[str]] = { + 'command': parser.info.pragma.command_features + } self._def_exprs(exprs) self.check() @@ -1254,12 +1267,21 @@ def _make_features( self, features: Optional[List[Dict[str, Any]]], info: Optional[QAPISourceInfo], + custom_special_features: Optional[List[str]] = [], ) -> List[QAPISchemaFeature]: if features is None: return [] - return [QAPISchemaFeature(f['name'], info, - QAPISchemaIfCond(f.get('if'))) - for f in features] + ret = [] + for f in features: + name = f['name'] + special = name in ["unstable", "deprecated"] + if custom_special_features is not None: + if name in custom_special_features: + special = True + ret.append(QAPISchemaFeature(name, info, + QAPISchemaIfCond(f.get('if')), + special)) + return ret def _make_enum_member( self, @@ -1430,7 +1452,8 @@ def _def_command(self, expr: QAPIExpression) -> None: coroutine = expr.get('coroutine', False) ifcond = QAPISchemaIfCond(expr.get('if')) info = expr.info - features = self._make_features(expr.get('features'), info) + features = self._make_features(expr.get('features'), info, + self._custom_special_features['command']) if isinstance(data, OrderedDict): data = self._make_implicit_object_type( name, info, ifcond, From patchwork Tue Jun 4 15:32:34 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685580 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E0DA2C27C54 for ; Tue, 4 Jun 2024 15:34:39 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9i-0006ex-0l; Tue, 04 Jun 2024 11:32:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9f-0006bz-Db for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:55 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9d-0001Hs-Qt for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515172; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=LhJGSDZ4EPSyDcTb/UIgC5oAmgl4HhjH70MRGxKNRxY=; b=M8uRtmoBPhspYrNVuSCsbwmekBibtWC3h49nzkPy76D44zsfoebvI7gqtfsD+hlDR7cXX6 aDbyAMYvolnllKBX9ofKjQKfMP93vqll5BBgdlmRIs7aVyHhiZ8jzwT8+tw0GW6QMkSi0Q GXggpx1SuQECYe72URlpi2ye+lgafkU= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-445-sWAXfsigPTayNG6KmBO86Q-1; Tue, 04 Jun 2024 11:32:51 -0400 X-MC-Unique: sWAXfsigPTayNG6KmBO86Q-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1186A3801F4A; Tue, 4 Jun 2024 15:32:51 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 40A00492BD6; Tue, 4 Jun 2024 15:32:50 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 06/14] qapi: define enum for custom special features on commands Date: Tue, 4 Jun 2024 16:32:34 +0100 Message-ID: <20240604153242.251334-7-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org In order to register custom special features against a command, they have to have enum constants defined. The defined constant values start where the last built-in special feature stops. Signed-off-by: Daniel P. Berrangé --- include/qapi/util.h | 2 ++ scripts/qapi/commands.py | 20 ++++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/include/qapi/util.h b/include/qapi/util.h index 7698e789a9..3c3c9e401c 100644 --- a/include/qapi/util.h +++ b/include/qapi/util.h @@ -14,6 +14,8 @@ typedef enum { QAPI_FEATURE_DEPRECATED, QAPI_FEATURE_UNSTABLE, + + QAPI_FEATURE_BUILT_IN_LAST, } QapiSpecialFeature; typedef struct QEnumLookup { diff --git a/scripts/qapi/commands.py b/scripts/qapi/commands.py index 79951a841f..50a60968d4 100644 --- a/scripts/qapi/commands.py +++ b/scripts/qapi/commands.py @@ -347,7 +347,27 @@ def visit_begin(self, schema: QAPISchema) -> None: self._add_module('./init', ' * QAPI Commands initialization') self._genh.add(mcgen(''' #include "qapi/qmp/dispatch.h" +''')) + + features = schema._custom_special_features['command'] + if len(features) > 0: + self._genh.add(mcgen(''' + +typedef enum { +''')) + suffix = " = QAPI_FEATURE_BUILT_IN_LAST" + for f in features: + self._genh.add(mcgen(''' + QAPI_FEATURE_%(name)s%(suffix)s, +''', suffix=suffix, name=f.upper().replace('-', '_'))) + suffix = "" + self._genh.add(mcgen(''' +} QapiSpecialFeatureCustom; + +''')) + + self._genh.add(mcgen(''' void %(c_prefix)sqmp_init_marshal(QmpCommandList *cmds); ''', c_prefix=c_name(self._prefix, protect=False))) From patchwork Tue Jun 4 15:32:35 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685575 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 74EC7C25B78 for ; Tue, 4 Jun 2024 15:33:52 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9l-0006hD-Il; Tue, 04 Jun 2024 11:33:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9j-0006fw-Jo for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9h-0001Ie-6w for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515176; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=LZ7XhB389gErPmQqZrRj2jtKor6/J0PzR8obW4Gr+Tc=; b=VhTQttFME+i7FaLMiXqskUBmLJwXR9iQhcaOrD2RuE7LlY0naPHtqu/5c1lqRfQ3wch29C q03nsT8Rg5qOkKiWTNnn7+hJWg7HIO9+iHFnkWt7bd0jjjdxqUuPT4mKXXKkW8ESee6Kil VQEyVl8iNRWwmm37dTrt1hDVeMw61Fw= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-365-DmXzJVklM1206VFxXgpsnQ-1; Tue, 04 Jun 2024 11:32:53 -0400 X-MC-Unique: DmXzJVklM1206VFxXgpsnQ-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 29A541C05130; Tue, 4 Jun 2024 15:32:52 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 452BF492BD5; Tue, 4 Jun 2024 15:32:51 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 07/14] qga: use special feature to mark those that can run when FS are frozen Date: Tue, 4 Jun 2024 16:32:35 +0100 Message-ID: <20240604153242.251334-8-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Currently a list of commands which are safe to run when FS are frozen is hardcoded in the source. Now that the QAPI schema allows custom special features, a 'fs-frozen' feature can be added to track this metadata. This has the benefit that the restrictions on commands permitted when frozen are now recorded in the QGA generated documentation. Signed-off-by: Daniel P. Berrangé --- qga/main.c | 22 ++-------------------- qga/qapi-schema.json | 44 +++++++++++++++++++++++++++++++++++++++----- 2 files changed, 41 insertions(+), 25 deletions(-) diff --git a/qga/main.c b/qga/main.c index c7b7b0a9bc..7bf5ec49ba 100644 --- a/qga/main.c +++ b/qga/main.c @@ -128,17 +128,6 @@ struct GAState { struct GAState *ga_state; QmpCommandList ga_commands; -/* commands that are safe to issue while filesystems are frozen */ -static const char *ga_freeze_allowlist[] = { - "guest-ping", - "guest-info", - "guest-sync", - "guest-sync-delimited", - "guest-fsfreeze-status", - "guest-fsfreeze-thaw", - NULL -}; - #ifdef _WIN32 DWORD WINAPI service_ctrl_handler(DWORD ctrl, DWORD type, LPVOID data, LPVOID ctx); @@ -421,7 +410,6 @@ static gint ga_strcmp(gconstpointer str1, gconstpointer str2) static bool ga_command_is_allowed(const QmpCommand *cmd, GAState *state) { - int i = 0; GAConfig *config = state->config; const char *name = qmp_command_name(cmd); /* Fallback policy is allow everything */ @@ -453,15 +441,9 @@ static bool ga_command_is_allowed(const QmpCommand *cmd, GAState *state) * If frozen, this filtering must take priority over * absolutely everything */ - if (state->frozen) { + if (state->frozen && + !qmp_command_has_feature(cmd, QAPI_FEATURE_FS_FROZEN)) { allowed = false; - - while (ga_freeze_allowlist[i] != NULL) { - if (strcmp(name, ga_freeze_allowlist[i]) == 0) { - allowed = true; - } - i++; - } } return allowed; diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index 571be3a914..8b1eff3abc 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -36,7 +36,11 @@ 'guest-sync-delimited' ], # Types and commands with undocumented members: 'documentation-exceptions': [ - 'GuestNVMeSmart' ] } } + 'GuestNVMeSmart' ], + 'command-features': [ + # Commands permitted while FS are frozen + 'fs-frozen' + ] } } ## # @guest-sync-delimited: @@ -67,11 +71,16 @@ # # Returns: The unique integer id passed in by the client # +# Features: +# +# @fs-frozen: permitted to execute when filesystems are frozen +# # Since: 1.1 ## { 'command': 'guest-sync-delimited', 'data': { 'id': 'int' }, - 'returns': 'int' } + 'returns': 'int', + 'features': [ 'fs-frozen'] } ## # @guest-sync: @@ -104,20 +113,30 @@ # # Returns: The unique integer id passed in by the client # +# Features: +# +# @fs-frozen: permitted to execute when filesystems are frozen +# # Since: 0.15.0 ## { 'command': 'guest-sync', 'data': { 'id': 'int' }, - 'returns': 'int' } + 'returns': 'int', + 'features': [ 'fs-frozen'] } ## # @guest-ping: # # Ping the guest agent, a non-error return implies success # +# Features: +# +# @fs-frozen: permitted to execute when filesystems are frozen +# # Since: 0.15.0 ## -{ 'command': 'guest-ping' } +{ 'command': 'guest-ping', + 'features': [ 'fs-frozen'] } ## # @guest-get-time: @@ -196,10 +215,15 @@ # # Returns: @GuestAgentInfo # +# Features: +# +# @fs-frozen: permitted when filesystems are frozen +# # Since: 0.15.0 ## { 'command': 'guest-info', - 'returns': 'GuestAgentInfo' } + 'returns': 'GuestAgentInfo', + 'features': [ 'fs-frozen'] } ## # @guest-shutdown: @@ -426,10 +450,15 @@ # Note: This may fail to properly report the current state as a result # of some other guest processes having issued an fs freeze/thaw. # +# Features: +# +# @fs-frozen: permitted when filesystems are frozen +# # Since: 0.15.0 ## { 'command': 'guest-fsfreeze-status', 'returns': 'GuestFsfreezeStatus', + 'features': [ 'fs-frozen'], 'if': { 'any': ['CONFIG_WIN32', 'CONFIG_FSFREEZE'] } } ## @@ -488,10 +517,15 @@ # filesystems were unfrozen before this call, and that the # filesystem state may have changed before issuing this command. # +# Features: +# +# @fs-frozen: permitted when filesystems are frozen +# # Since: 0.15.0 ## { 'command': 'guest-fsfreeze-thaw', 'returns': 'int', + 'features': [ 'fs-frozen'], 'if': { 'any': ['CONFIG_WIN32', 'CONFIG_FSFREEZE'] } } ## From patchwork Tue Jun 4 15:32:36 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685578 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E0B95C25B78 for ; Tue, 4 Jun 2024 15:34:37 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9l-0006h4-3B; Tue, 04 Jun 2024 11:33:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9j-0006fh-Al for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9g-0001IZ-Ub for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515176; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PC9b9zdl5x37neT0fm6L/j00JU90/UGjPDU7u57umto=; b=iUWAGMqG8K2JQXO8/hpG28QxAoe0KqQ1s3jf9zO3fphr90tVbaRpBDv2Ed2AxC7U1vyqQk Ll5TKXLtqDdX7kSvWzjZdKZb2urjGu8JOhQsZ26ge6rbvVVZ9XKs8+JDLUCCobTS0xLohN PZ55dmy25qEMYt+TP3avdjFv3mcBY1c= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-481-UfIxTNOIO5KySLij-riYcw-1; Tue, 04 Jun 2024 11:32:53 -0400 X-MC-Unique: UfIxTNOIO5KySLij-riYcw-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 33BE81C05131; Tue, 4 Jun 2024 15:32:53 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5EC4A492BD5; Tue, 4 Jun 2024 15:32:52 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 08/14] qga: add command line to limit commands for confidential guests Date: Tue, 4 Jun 2024 16:32:36 +0100 Message-ID: <20240604153242.251334-9-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org When running in a confidential guest, a very large number of QGA commands are unsafe to permit, since they can be used to violate the privacy of the guest. This introduces a new command line "--confidential" / "-i" which, if set, will run the guest in confidential mode, which should avoid leaking information to the host, while still allowing important VM mgmt tasks to be performed. Signed-off-by: Daniel P. Berrangé --- qga/main.c | 14 ++++++++++++++ qga/qapi-schema.json | 5 ++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/qga/main.c b/qga/main.c index 7bf5ec49ba..12b91eb713 100644 --- a/qga/main.c +++ b/qga/main.c @@ -86,6 +86,7 @@ struct GAConfig { gchar *aliststr; /* allowedrpcs may point to this string */ GList *blockedrpcs; GList *allowedrpcs; + bool only_confidential; int daemonize; GLogLevelFlags log_level; int dumpconf; @@ -415,6 +416,15 @@ static bool ga_command_is_allowed(const QmpCommand *cmd, GAState *state) /* Fallback policy is allow everything */ bool allowed = true; + /* + * If running in confidential mode, block commands that + * would violate guest data privacy + */ + if (config->only_confidential && + !qmp_command_has_feature(cmd, QAPI_FEATURE_CONFIDENTIAL)) { + allowed = false; + } + if (config->allowedrpcs) { /* * If an allow-list is given, this changes the fallback @@ -1197,6 +1207,7 @@ static void config_parse(GAConfig *config, int argc, char **argv) #endif { "statedir", 1, NULL, 't' }, { "retry-path", 0, NULL, 'r' }, + { "confidential", 0, NULL, 'i' }, { NULL, 0, NULL, 0 } }; @@ -1293,6 +1304,9 @@ static void config_parse(GAConfig *config, int argc, char **argv) } break; #endif + case 'i': + config->only_confidential = true; + break; case 'h': usage(argv[0]); exit(EXIT_SUCCESS); diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index 8b1eff3abc..9a213dfc06 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -39,7 +39,10 @@ 'GuestNVMeSmart' ], 'command-features': [ # Commands permitted while FS are frozen - 'fs-frozen' + 'fs-frozen', + # Commands which do not violate privacy + # of a confidential guest + 'confidential' ] } } ## From patchwork Tue Jun 4 15:32:37 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685581 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F349FC27C53 for ; Tue, 4 Jun 2024 15:34:37 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9l-0006hE-IW; Tue, 04 Jun 2024 11:33:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9j-0006gB-Ul for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9h-0001Ic-45 for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515176; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NhNOG2TNYSsOZ5fCIRNGn6C26A53X/WFY2Ybv9oatgc=; b=dUR57LnYaZeNLgtshUbUomN1s1nMUzvAGTp8eDmaFvdAreye+Lz9rlM7sq71W3qiEc2K5X fbnNMkwQkMWfQ7F7RWQSmIiez5HI73XNtwg/NVpzsfQx1kovarCsAHvmT8tjT7e+5yQPjs 425Bdor2UcNAkAm88DEOLy3BFuV5D1c= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-319-l8vD4VqlP3aDUFh1B_7GcA-1; Tue, 04 Jun 2024 11:32:54 -0400 X-MC-Unique: l8vD4VqlP3aDUFh1B_7GcA-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 8096385A588; Tue, 4 Jun 2024 15:32:54 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 6A88D492BD5; Tue, 4 Jun 2024 15:32:53 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 09/14] qga: define commands which can be run in confidential mode Date: Tue, 4 Jun 2024 16:32:37 +0100 Message-ID: <20240604153242.251334-10-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org This adds the 'confidential' feature tag to the commands which are safe to permit in confidential VMs. In a confidential virt scenario, the host must not be permitted to modify guest data, nor request information that could compromise guest data. This effectively limits the QGA to commands which either are part of the QGA operation, or are related to modifying virtual hardware to assist in a host mgmt tasks. This results in the following being permitted * guest-sync * guest-sync-delimited * guest-ping * guest-get-time * guest-set-time * guest-info * guest-shutdown * guest-fsfreeze-status * guest-fsfreeze-freeze * guest-fsfreeze-freeze-list * guest-fsfreeze-thaw * guest-fstrim * guest-suspend-disk * guest-suspend-ram * guest-suspend-hybrid * guest-get-vcpus * guest-set-vcpus * guest-get-memory-blocks * guest-set-memory-blocks * guest-get-memory-block-info * guest-get-host-name * guest-get-cpustats Signed-off-by: Daniel P. Berrangé --- qga/qapi-schema.json | 117 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 107 insertions(+), 10 deletions(-) diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index 9a213dfc06..48ea95cdba 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -78,12 +78,14 @@ # # @fs-frozen: permitted to execute when filesystems are frozen # +# @confidential: permitted when running inside a confidential VM +# # Since: 1.1 ## { 'command': 'guest-sync-delimited', 'data': { 'id': 'int' }, 'returns': 'int', - 'features': [ 'fs-frozen'] } + 'features': [ 'fs-frozen', 'confidential' ] } ## # @guest-sync: @@ -120,12 +122,14 @@ # # @fs-frozen: permitted to execute when filesystems are frozen # +# @confidential: permitted when running inside a confidential VM +# # Since: 0.15.0 ## { 'command': 'guest-sync', 'data': { 'id': 'int' }, 'returns': 'int', - 'features': [ 'fs-frozen'] } + 'features': [ 'fs-frozen', 'confidential' ] } ## # @guest-ping: @@ -136,10 +140,12 @@ # # @fs-frozen: permitted to execute when filesystems are frozen # +# @confidential: permitted when running inside a confidential VM +# # Since: 0.15.0 ## { 'command': 'guest-ping', - 'features': [ 'fs-frozen'] } + 'features': [ 'fs-frozen', 'confidential' ] } ## # @guest-get-time: @@ -149,10 +155,15 @@ # # Returns: Time in nanoseconds. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.5 ## { 'command': 'guest-get-time', - 'returns': 'int' } + 'returns': 'int', + 'features': [ 'confidential' ] } ## # @guest-set-time: @@ -175,10 +186,15 @@ # @time: time of nanoseconds, relative to the Epoch of 1970-01-01 in # UTC. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.5 ## { 'command': 'guest-set-time', - 'data': { '*time': 'int' } } + 'data': { '*time': 'int' }, + 'features': [ 'confidential' ] } ## # @GuestAgentCommandInfo: @@ -222,11 +238,13 @@ # # @fs-frozen: permitted when filesystems are frozen # +# @confidential: permitted when running inside a confidential VM +# # Since: 0.15.0 ## { 'command': 'guest-info', 'returns': 'GuestAgentInfo', - 'features': [ 'fs-frozen'] } + 'features': [ 'fs-frozen', 'confidential' ] } ## # @guest-shutdown: @@ -241,10 +259,15 @@ # when running with --no-shutdown, by issuing the query-status QMP # command to confirm the VM status is "shutdown". # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 0.15.0 ## { 'command': 'guest-shutdown', 'data': { '*mode': 'str' }, - 'success-response': false } + 'success-response': false, + 'features': [ 'confidential' ] } ## # @guest-file-open: @@ -457,11 +480,13 @@ # # @fs-frozen: permitted when filesystems are frozen # +# @confidential: permitted when running inside a confidential VM +# # Since: 0.15.0 ## { 'command': 'guest-fsfreeze-status', 'returns': 'GuestFsfreezeStatus', - 'features': [ 'fs-frozen'], + 'features': [ 'fs-frozen', 'confidential' ], 'if': { 'any': ['CONFIG_WIN32', 'CONFIG_FSFREEZE'] } } ## @@ -481,10 +506,15 @@ # Volume Shadow-copy Service DLL helper. The frozen state is # limited for up to 10 seconds by VSS. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 0.15.0 ## { 'command': 'guest-fsfreeze-freeze', 'returns': 'int', + 'features': [ 'confidential' ], 'if': { 'any': ['CONFIG_WIN32', 'CONFIG_FSFREEZE'] } } ## @@ -501,11 +531,16 @@ # # Returns: Number of file systems currently frozen. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 2.2 ## { 'command': 'guest-fsfreeze-freeze-list', 'data': { '*mountpoints': ['str'] }, 'returns': 'int', + 'features': [ 'confidential' ], 'if': { 'any': ['CONFIG_WIN32', 'CONFIG_FSFREEZE'] } } ## @@ -524,11 +559,13 @@ # # @fs-frozen: permitted when filesystems are frozen # +# @confidential: permitted when running inside a confidential VM +# # Since: 0.15.0 ## { 'command': 'guest-fsfreeze-thaw', 'returns': 'int', - 'features': [ 'fs-frozen'], + 'features': [ 'fs-frozen', 'confidential' ], 'if': { 'any': ['CONFIG_WIN32', 'CONFIG_FSFREEZE'] } } ## @@ -576,11 +613,16 @@ # Returns: A @GuestFilesystemTrimResponse which contains the status of # all trimmed paths. (since 2.4) # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.2 ## { 'command': 'guest-fstrim', 'data': { '*minimum': 'int' }, 'returns': 'GuestFilesystemTrimResponse', + 'features': [ 'confidential' ], 'if': { 'any': ['CONFIG_WIN32', 'CONFIG_FSTRIM'] } } ## @@ -608,9 +650,14 @@ # Notes: It's strongly recommended to issue the guest-sync command # before sending commands when the guest resumes # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.1 ## { 'command': 'guest-suspend-disk', 'success-response': false, + 'features': [ 'confidential' ], 'if': { 'any': ['CONFIG_LINUX', 'CONFIG_WIN32'] } } ## @@ -645,9 +692,14 @@ # Notes: It's strongly recommended to issue the guest-sync command # before sending commands when the guest resumes # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.1 ## { 'command': 'guest-suspend-ram', 'success-response': false, + 'features': [ 'confidential' ], 'if': { 'any': ['CONFIG_LINUX', 'CONFIG_WIN32'] } } ## @@ -681,9 +733,14 @@ # Notes: It's strongly recommended to issue the guest-sync command # before sending commands when the guest resumes # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.1 ## { 'command': 'guest-suspend-hybrid', 'success-response': false, + 'features': [ 'confidential' ], 'if': 'CONFIG_LINUX' } ## @@ -815,10 +872,15 @@ # Returns: The list of all VCPUs the guest knows about. Each VCPU is # put on the list exactly once, but their order is unspecified. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.5 ## { 'command': 'guest-get-vcpus', 'returns': ['GuestLogicalProcessor'], + 'features': [ 'confidential' ], 'if': { 'any': ['CONFIG_LINUX', 'CONFIG_WIN32'] } } ## @@ -857,11 +919,16 @@ # - If the reconfiguration of the first node in @vcpus failed. # Guest state has not been changed. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 1.5 ## { 'command': 'guest-set-vcpus', 'data': {'vcpus': ['GuestLogicalProcessor'] }, 'returns': 'int', + 'features': [ 'confidential' ], 'if': 'CONFIG_LINUX' } ## @@ -1180,10 +1247,15 @@ # memory block is put on the list exactly once, but their order is # unspecified. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 2.3 ## { 'command': 'guest-get-memory-blocks', 'returns': ['GuestMemoryBlock'], + 'features': [ 'confidential' ], 'if': 'CONFIG_LINUX' } ## @@ -1254,11 +1326,16 @@ # empty on input, or there is an error, and in this case, guest # state will not be changed. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 2.3 ## { 'command': 'guest-set-memory-blocks', 'data': {'mem-blks': ['GuestMemoryBlock'] }, 'returns': ['GuestMemoryBlockResponse'], + 'features': [ 'confidential' ], 'if': 'CONFIG_LINUX' } ## @@ -1268,10 +1345,15 @@ # minimal units of memory block online/offline operations (also # called Logical Memory Hotplug). # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 2.3 ## { 'struct': 'GuestMemoryBlockInfo', 'data': {'size': 'uint64'}, + 'features': [ 'confidential' ], 'if': 'CONFIG_LINUX' } ## @@ -1281,10 +1363,15 @@ # # Returns: @GuestMemoryBlockInfo # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 2.3 ## { 'command': 'guest-get-memory-block-info', 'returns': 'GuestMemoryBlockInfo', + 'features': [ 'confidential' ], 'if': 'CONFIG_LINUX' } ## @@ -1430,10 +1517,15 @@ # # Returns: the host name of the machine # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 2.10 ## { 'command': 'guest-get-host-name', - 'returns': 'GuestHostName' } + 'returns': 'GuestHostName', + 'features': [ 'confidential' ] } ## @@ -1882,9 +1974,14 @@ # # Returns: List of CPU stats of guest. # +# Features: +# +# @confidential: permitted when running inside a confidential VM +# # Since: 7.1 ## { 'command': 'guest-get-cpustats', 'returns': ['GuestCpuStats'], + 'features': [ 'confidential' ], 'if': 'CONFIG_LINUX' } From patchwork Tue Jun 4 15:32:38 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685584 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 38BF5C25B78 for ; Tue, 4 Jun 2024 15:34:54 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9m-0006hl-7Y; Tue, 04 Jun 2024 11:33:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9j-0006gC-UT for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9h-0001Im-Qt for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:32:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515177; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9zUc1+i0TloZjdrrmpIgHGps0532WQ7fdKFCuLWdL1I=; b=DM6WGQBxq/Oxo/HSwR5MgoQL0H1NICMvEYrFBl0rmxJTyu4ywX6YoQlsu8lSf+f/WUGrM8 7az+/LEC5WU2vtWN8jyCYMcOusnoYPT6krKybWSMXY90ZQNc+3jE79kdv7SdXezwd3MIY9 wMtZAmgMShwKzDY5QPfWBlK/U8ypvH8= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-221-yVh-L1_yO92AEeOifqAilw-1; Tue, 04 Jun 2024 11:32:55 -0400 X-MC-Unique: yVh-L1_yO92AEeOifqAilw-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 8A704811E81; Tue, 4 Jun 2024 15:32:55 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id B3BE8492BD3; Tue, 4 Jun 2024 15:32:54 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 10/14] qga: add command line to block unrestricted command/file access Date: Tue, 4 Jun 2024 16:32:38 +0100 Message-ID: <20240604153242.251334-11-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Historically there has been no default policy on command usage in the QEMU guest agent. A wide variety of commands have been added for various purposes * Co-ordinating host mgmt tasks (FS freezing, CPU hotplug, memory block hotplug) * Guest information querying (CPU stats, mount info, etc) * Arbitrary file read/write and command execution * User account auth setup (passwords, SSH keys) All of these have valid use cases, but they come with very different levels of risk to the guest OS. The commands supporting arbitrary file access / command exec though are giving the guest agent client effectively unrestricted access to do anything at all in the guest OS. The guest agent client is the host OS, so in effect running the QEMU guest agent gives the host admin a trivial direct backdoor into the guest OS, with no authentication, authorization or auditing of what they do. In the absense of confidential computing, the host admin already has to be considered largely trustworthy, as they will typically have direct access to any guest RAM regardless. None the less, to limit their exposure, guest OS admins may choose to limit these commands by passing '--no-unrestricted' / '-u' to QGA The --allowedrpcs / --blockedrpcs arguments take precedence over the --unrestricted arg (whether present or not), thus allowing fine tuning the defaults further. Signed-off-by: Daniel P. Berrangé --- qga/main.c | 15 +++++++++++++++ qga/qapi-schema.json | 5 ++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/qga/main.c b/qga/main.c index 12b91eb713..66068ad535 100644 --- a/qga/main.c +++ b/qga/main.c @@ -87,6 +87,7 @@ struct GAConfig { GList *blockedrpcs; GList *allowedrpcs; bool only_confidential; + bool no_unrestricted; int daemonize; GLogLevelFlags log_level; int dumpconf; @@ -425,6 +426,16 @@ static bool ga_command_is_allowed(const QmpCommand *cmd, GAState *state) allowed = false; } + /* + * If unrestricted commands are not allowed that sets + * a new default, but an explicit allow/block list can + * override + */ + if (config->no_unrestricted && + qmp_command_has_feature(cmd, QAPI_FEATURE_UNRESTRICTED)) { + allowed = false; + } + if (config->allowedrpcs) { /* * If an allow-list is given, this changes the fallback @@ -1208,6 +1219,7 @@ static void config_parse(GAConfig *config, int argc, char **argv) { "statedir", 1, NULL, 't' }, { "retry-path", 0, NULL, 'r' }, { "confidential", 0, NULL, 'i' }, + { "no-unrestricted", 0, NULL, 'u' }, { NULL, 0, NULL, 0 } }; @@ -1307,6 +1319,9 @@ static void config_parse(GAConfig *config, int argc, char **argv) case 'i': config->only_confidential = true; break; + case 'u': + config->no_unrestricted = true; + break; case 'h': usage(argv[0]); exit(EXIT_SUCCESS); diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index 48ea95cdba..de7c1de0b7 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -42,7 +42,10 @@ 'fs-frozen', # Commands which do not violate privacy # of a confidential guest - 'confidential' + 'confidential', + # Commands which allow unrestricted access to or + # modification of guest files or execute arbitrary commands + 'unrestricted' ] } } ## From patchwork Tue Jun 4 15:32:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685583 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A6833C27C52 for ; Tue, 4 Jun 2024 15:34:52 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9q-0006mW-PR; Tue, 04 Jun 2024 11:33:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9p-0006jn-4T for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:05 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9n-0001Jq-Ic for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515182; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XoKurEtuVM1m6D7a7OV1LnPY9CvW0j2OIm2Cocy4AOk=; b=hvOJZOSxqWNuSRcwVcHzBywNDZPM2RxePSIs2Gfw5wFyy234Hioxzs20YGNKIjKfh8DfVz z2ncSQxfRdMC3HcCJ2wFXsjNJIfzhJt2KTYF4lLuQQkFsQOMsfvZOqs+DIzNJnyFk9WDaV DdAVpegD6xiZ5bzECAk3y5PBs6DMugk= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-145-gVG-jyPONnO3l5eOCdZZlg-1; Tue, 04 Jun 2024 11:32:57 -0400 X-MC-Unique: gVG-jyPONnO3l5eOCdZZlg-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B28813801F4A; Tue, 4 Jun 2024 15:32:56 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id BE261492BD8; Tue, 4 Jun 2024 15:32:55 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 11/14] qga: mark guest-file-* commands with 'unrestricted' flag Date: Tue, 4 Jun 2024 16:32:39 +0100 Message-ID: <20240604153242.251334-12-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org This blocks use of all the 'guest-file-*' commands unless the QGA is run with the --unrestricted command line argument. These commands allow the host admin to read and write arbitrary guest files and so directly compromise the guest OS. Signed-off-by: Daniel P. Berrangé --- qga/qapi-schema.json | 48 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 42 insertions(+), 6 deletions(-) diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index de7c1de0b7..2f80d89536 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -283,11 +283,17 @@ # # Returns: Guest file handle # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 0.15.0 ## { 'command': 'guest-file-open', 'data': { 'path': 'str', '*mode': 'str' }, - 'returns': 'int' } + 'returns': 'int', + 'features': [ 'unrestricted' ] } ## # @guest-file-close: @@ -296,10 +302,16 @@ # # @handle: filehandle returned by guest-file-open # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 0.15.0 ## { 'command': 'guest-file-close', - 'data': { 'handle': 'int' } } + 'data': { 'handle': 'int' }, + 'features': [ 'unrestricted' ] } ## # @GuestFileRead: @@ -332,11 +344,17 @@ # # Returns: @GuestFileRead # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 0.15.0 ## { 'command': 'guest-file-read', 'data': { 'handle': 'int', '*count': 'int' }, - 'returns': 'GuestFileRead' } + 'returns': 'GuestFileRead', + 'features': [ 'unrestricted' ] } ## # @GuestFileWrite: @@ -367,11 +385,17 @@ # # Returns: @GuestFileWrite # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 0.15.0 ## { 'command': 'guest-file-write', 'data': { 'handle': 'int', 'buf-b64': 'str', '*count': 'int' }, - 'returns': 'GuestFileWrite' } + 'returns': 'GuestFileWrite', + 'features': [ 'unrestricted' ] } ## @@ -434,12 +458,18 @@ # # Returns: @GuestFileSeek # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 0.15.0 ## { 'command': 'guest-file-seek', 'data': { 'handle': 'int', 'offset': 'int', 'whence': 'GuestFileWhence' }, - 'returns': 'GuestFileSeek' } + 'returns': 'GuestFileSeek', + 'features': [ 'unrestricted' ] } ## # @guest-file-flush: @@ -448,10 +478,16 @@ # # @handle: filehandle returned by guest-file-open # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 0.15.0 ## { 'command': 'guest-file-flush', - 'data': { 'handle': 'int' } } + 'data': { 'handle': 'int' }, + 'features': [ 'unrestricted' ] } ## # @GuestFsfreezeStatus: From patchwork Tue Jun 4 15:32:40 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E7B66C25B78 for ; Tue, 4 Jun 2024 15:34:56 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9n-0006iL-E5; Tue, 04 Jun 2024 11:33:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9l-0006hO-Ue for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:01 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9k-0001JW-DZ for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:01 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515179; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=j4oAbYct1l9t6g9PwqcePOZrHlz9FGf3N1fChZQN2iQ=; b=YfVS7kR4jMTqjNVO7VONXongMHjTxto1CeSrMPso2pXIiUlSQORkiDXwbXceUgjCcWEuel Easl9WhQ5bF+Nn+TTkYKGmINUsW7LYsa7Tp9I2kPyrFesHAh4xwUe+9VjkvLfE6O16Q0SY yC6vXMbtF2wA9QpxS8qySHmt8RY7DtE= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-207-7F5JR5IGN_Oa_D31ylMIGQ-1; Tue, 04 Jun 2024 11:32:58 -0400 X-MC-Unique: 7F5JR5IGN_Oa_D31ylMIGQ-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id E8F671C05130; Tue, 4 Jun 2024 15:32:57 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id E9DD7492BD5; Tue, 4 Jun 2024 15:32:56 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 12/14] qga: mark guest-exec-* commands with 'unrestricted' flag Date: Tue, 4 Jun 2024 16:32:40 +0100 Message-ID: <20240604153242.251334-13-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org This blocks use of all the 'guest-exec-*' commands unless the QGA is run with the --unrestricted command line argument. These commands allow the host admin to execute arbitrary programs and so directly compromise the guest OS. Signed-off-by: Daniel P. Berrangé --- qga/qapi-schema.json | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index 2f80d89536..a4f8653446 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -1454,11 +1454,17 @@ # # Returns: GuestExecStatus # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 2.5 ## { 'command': 'guest-exec-status', 'data': { 'pid': 'int' }, - 'returns': 'GuestExecStatus' } + 'returns': 'GuestExecStatus', + 'features': [ 'unrestricted' ] } ## # @GuestExec: @@ -1527,12 +1533,18 @@ # # Returns: PID # +# Features: +# +# @unrestricted: not permitted if agent disables unrestricted +# resource access mode +# # Since: 2.5 ## { 'command': 'guest-exec', 'data': { 'path': 'str', '*arg': ['str'], '*env': ['str'], '*input-data': 'str', '*capture-output': 'GuestExecCaptureOutput' }, - 'returns': 'GuestExec' } + 'returns': 'GuestExec', + 'features': [ 'unrestricted' ] } ## From patchwork Tue Jun 4 15:32:41 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685571 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0A6CAC27C53 for ; Tue, 4 Jun 2024 15:33:34 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9s-0006oH-Gn; Tue, 04 Jun 2024 11:33:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9n-0006iH-7F for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:03 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9l-0001Je-MD for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:02 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515181; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YJjYoiTj3WSsEa5+kzx49B/Y4qCMzV1a+UUijYo12BQ=; b=CF9WajvGcxT5rr8esgeijt2bGio37iTrU4G8M+Jtuk3uPlNsJGc1VdcscgnCngCTV9EZoa n7JcbBj9fiCOiUS3z5C0jbbB8Bznl541gTxbXfpBRwpcen/rfgKiUQ5KAAuNF4wiKLXOpc zcfaGrt7ObN0O6jFaAYWABySSmKgVww= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-147-5lfOiD3mN1imtGEcTBYA5A-1; Tue, 04 Jun 2024 11:32:59 -0400 X-MC-Unique: 5lfOiD3mN1imtGEcTBYA5A-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id F0584101A520; Tue, 4 Jun 2024 15:32:58 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 29F91492BCF; Tue, 4 Jun 2024 15:32:58 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 13/14] qga: add command line to block user authentication commands Date: Tue, 4 Jun 2024 16:32:41 +0100 Message-ID: <20240604153242.251334-14-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Historically there has been no default policy on command usage in the QEMU guest agent. A wide variety of commands have been added for various purposes * Co-ordinating host mgmt tasks (FS freezing, CPU hotplug, memory block hotplug) * Guest information querying (CPU stats, mount info, etc) * Arbitrary file read/write and command execution * User account auth setup (passwords, SSH keys) All of these have valid use cases, but they come with very different levels of risk to the guest OS. The commands supporting alteration of user authentication credentials are giving the guest agent client effectively unrestricted access to do anything at all in the guest OS by enabling them to subsequently access a user login shell. The guest agent client is the host OS, so in effect running the QEMU guest agent gives the host admin a trivial direct backdoor into the guest OS. In the absense of confidential computing, the host admin already has to be considered largely trustworthy, as they will typically have direct access to any guest RAM regardless. None the less, to limit their exposure, guest OS admins may choose to limit these commands by passing '--no-user-auth' / '-e' to QGA The --allowedrpcs / --blockedrpcs arguments take precedence over the --unrestricted arg (whether present or not), thus allowing fine tuning the defaults further. Signed-off-by: Daniel P. Berrangé --- qga/main.c | 15 +++++++++++++++ qga/qapi-schema.json | 5 ++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/qga/main.c b/qga/main.c index 66068ad535..0d792cd92e 100644 --- a/qga/main.c +++ b/qga/main.c @@ -88,6 +88,7 @@ struct GAConfig { GList *allowedrpcs; bool only_confidential; bool no_unrestricted; + bool no_user_auth; int daemonize; GLogLevelFlags log_level; int dumpconf; @@ -436,6 +437,16 @@ static bool ga_command_is_allowed(const QmpCommand *cmd, GAState *state) allowed = false; } + /* + * If user auth commands are not allowed that sets + * a new default, but an explicit allow/block list can + * override + */ + if (config->no_user_auth && + qmp_command_has_feature(cmd, QAPI_FEATURE_USER_AUTH)) { + allowed = false; + } + if (config->allowedrpcs) { /* * If an allow-list is given, this changes the fallback @@ -1220,6 +1231,7 @@ static void config_parse(GAConfig *config, int argc, char **argv) { "retry-path", 0, NULL, 'r' }, { "confidential", 0, NULL, 'i' }, { "no-unrestricted", 0, NULL, 'u' }, + { "no-user-auth", 0, NULL, 'e' }, { NULL, 0, NULL, 0 } }; @@ -1322,6 +1334,9 @@ static void config_parse(GAConfig *config, int argc, char **argv) case 'u': config->no_unrestricted = true; break; + case 'e': + config->no_user_auth = true; + break; case 'h': usage(argv[0]); exit(EXIT_SUCCESS); diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index a4f8653446..25068b8110 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -45,7 +45,10 @@ 'confidential', # Commands which allow unrestricted access to or # modification of guest files or execute arbitrary commands - 'unrestricted' + 'unrestricted', + # Commands which allow changes to user account + # authentication credentials (keys, passwords) + 'user-auth' ] } } ## From patchwork Tue Jun 4 15:32:42 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13685582 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E8960C25B78 for ; Tue, 4 Jun 2024 15:34:42 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sEW9u-0006pl-4e; Tue, 04 Jun 2024 11:33:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9q-0006mP-Lk for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:06 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sEW9p-0001KH-73 for qemu-devel@nongnu.org; Tue, 04 Jun 2024 11:33:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717515184; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=S2ZZ7ZPJISnpZt1cwBtV7RhIp0sWJo7jom/X++Viyag=; b=DOvLRWOqX6wfneygX0pQDDLVqI4UxNUztbLNoOcxHin9eQoxAgdhx1xEGnizdkpR6oiL/9 dbENVG8PV2oA8RxVa/QKZQqTg0tHxafUYtUDWuyvKNTCtk3k1EUpgkucZDe0BslZFDKxq+ Hu3Gy3Q+wmojKn1EBYh4us1z9wxVCHU= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-282-rBMWqbGVNFGQKktsmt72QQ-1; Tue, 04 Jun 2024 11:33:00 -0400 X-MC-Unique: rBMWqbGVNFGQKktsmt72QQ-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 049AD185B920; Tue, 4 Jun 2024 15:33:00 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.39.194.137]) by smtp.corp.redhat.com (Postfix) with ESMTP id 30A18492BD6; Tue, 4 Jun 2024 15:32:59 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Markus Armbruster , Michael Roth , Konstantin Kostiuk , =?utf-8?q?Daniel_P=2E_Berrang?= =?utf-8?q?=C3=A9?= Subject: [PATCH 14/14] qga: mark guest-ssh-* / guest-*-password commands with 'unrestricted' flag Date: Tue, 4 Jun 2024 16:32:42 +0100 Message-ID: <20240604153242.251334-15-berrange@redhat.com> In-Reply-To: <20240604153242.251334-1-berrange@redhat.com> References: <20240604153242.251334-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org This blocks use of all the 'guest-ssh-*' / 'guest-password' commands unless the QGA is runwith the --unrestricted command line argument. These commands allow the host admin to takeover user accounts and so directly compromise the guest OS. Signed-off-by: Daniel P. Berrangé --- qga/qapi-schema.json | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json index 25068b8110..e7ce80a479 100644 --- a/qga/qapi-schema.json +++ b/qga/qapi-schema.json @@ -1251,10 +1251,15 @@ # transmission, even if already crypt()d, to ensure it is 8-bit safe # when passed as JSON. # +# Features: +# +# @user-auth: not permitted if agent is limiting user auth +# # Since: 2.3 ## { 'command': 'guest-set-user-password', 'data': { 'username': 'str', 'password': 'str', 'crypted': 'bool' }, + 'features': [ 'user-auth' ], 'if': { 'any': [ 'CONFIG_WIN32', 'CONFIG_LINUX', 'CONFIG_FREEBSD'] } } ## @@ -1810,11 +1815,16 @@ # # Returns: @GuestAuthorizedKeys # +# Features: +# +# @user-auth: not permitted if agent is limiting user auth +# # Since: 5.2 ## { 'command': 'guest-ssh-get-authorized-keys', 'data': { 'username': 'str' }, - 'returns': 'GuestAuthorizedKeys' + 'returns': 'GuestAuthorizedKeys', + 'features': [ 'user-auth' ] } ## @@ -1830,10 +1840,15 @@ # # @reset: ignore the existing content, set it with the given keys only # +# Features: +# +# @user-auth: not permitted if agent is limiting user auth +# # Since: 5.2 ## { 'command': 'guest-ssh-add-authorized-keys', - 'data': { 'username': 'str', 'keys': ['str'], '*reset': 'bool' } + 'data': { 'username': 'str', 'keys': ['str'], '*reset': 'bool' }, + 'features': [ 'user-auth' ] } ## @@ -1848,10 +1863,15 @@ # @keys: the public keys to remove (in OpenSSH/sshd(8) authorized_keys # format) # +# Features: +# +# @user-auth: not permitted if agent is limiting user auth +# # Since: 5.2 ## { 'command': 'guest-ssh-remove-authorized-keys', - 'data': { 'username': 'str', 'keys': ['str'] } + 'data': { 'username': 'str', 'keys': ['str'] }, + 'features': [ 'user-auth' ] } ##