Commit Graph

11783 Commits

Author SHA1 Message Date
Richard W.M. Jones
6c0e5d7f8f protocol: Replace missing xdr_uint64_t on macOS
The macOS rpcgen actually generates calls to xdr_uint64_t but doesn't
define them.  Despite this we can just use xdr_int64_t instead since
it's just byte swapping.
2022-08-16 14:03:59 +01:00
Richard W.M. Jones
c51d1cfe9a m4: Check for GNU realpath program
It is a dependency of the ocaml-dep.sh script, required for all builds.
2022-08-16 13:45:14 +01:00
Richard W.M. Jones
be60075b16 m4: Don't check for DISTRO with --disable-appliance
It is only used when building the appliance and for nothing else.
2022-08-16 13:40:15 +01:00
Richard W.M. Jones
0b3c6cc0c0 daemon: Remove remaining uses of custom printf %Q and %R
We have traditionally used custom printf formatters %Q and %R, where
%Q replaces the argument with a shell-quoted string, and %R replaces
the argument with a sysroot-prefixed shell-quoted string.  They are
actually pretty useful, but unfortunately only supported by glibc.

We only used them in about a dozen places in the daemon (much code
having been replaced by OCaml which does not need them).

In every remaining case we were constructing a command using code like
this:

  asprintf_nowarn (&cmd,
         "cd %Q && find -print0 | %s -0 -o -H %s --quiet", ...);

We can replace this with:

  char *cmd;
  size_t cmd_size;
  fp = open_memstream (&cmd, &cmd_size);
  fprintf (fp, "cd ");
  shell_quote (dir, fp);
  fprintf (fp, " && find -print0 | %s -0 -o -H %s --quiet", ...);
  fclose (fp);
2022-08-16 10:39:01 +01:00
Richard W.M. Jones
ad8b1b09ee daemon: grub: Remove incorrect use of printf specifier %R
This code is attempting to construct a grub-install command like:

  grub-install --root-directory=/sysroot/boot /dev/sda

In fact it was adding quoting to the --root-directory parameter where
it was not needed (because our "command" function uses exec).

Remove use of %R here (to avoid the extra quoting) and just use the
sysroot prefix directly.
2022-08-16 10:21:33 +01:00
Richard W.M. Jones
0e784824e8 daemon: Add zstd support to guestfs_file_architecture
This is required so we can determine the file architecture of
zstd-compressed Linux kernel modules as used by OpenSUSE and maybe
other distros in future.

Note that zstd becomes a required package, but it is widely available
in current Linux distros.

The package names come from https://pkgs.org/download/zstd and my own
research.
2022-08-09 19:04:41 +01:00
Richard W.M. Jones
d8fce89eca Version 1.49.4. v1.49.4 2022-08-01 15:15:55 +01:00
rwmjones
6f8e014958 Merge pull request #93 from weblate/weblate-libguestfs-libguestfs-master
Translations update from Fedora Weblate
2022-08-01 13:49:31 +01:00
Yuri Chornoivan
7dbd49d1aa Translated using Weblate (Ukrainian)
Currently translated at 100.0% (965 of 965 strings)

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/uk/
2022-08-01 14:19:07 +02:00
Piotr Drąg
1fbdc4386a Translated using Weblate (Polish)
Currently translated at 53.8% (520 of 965 strings)

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/pl/
2022-08-01 14:19:06 +02:00
Weblate
0d4b8de8b1 Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/
2022-08-01 14:19:06 +02:00
Temuri Doghonadze
f968e9b955 Translated using Weblate (Georgian)
Currently translated at 0.8% (8 of 956 strings)

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/ka/
2022-08-01 14:19:05 +02:00
Richard W.M. Jones
4a517601c7 daemon: Parse /etc/hostname files containing comments
Thanks: Dawid Zamirski
Link: https://www.freedesktop.org/software/systemd/man/hostname.html
Acked-by: Laszlo Ersek <lersek@redhat.com>
2022-07-20 13:22:39 +01:00
Richard W.M. Jones
adfaf25a12 m4: Fix ./configure --disable-ocaml
OCaml is required to compile libguestfs, however we should still be
able to disable the OCaml bindings.  This didn't work because using
--disable-ocaml caused various configure tests to be skipped which are
required to compile the daemon.  In particular the check for
caml_alloc_initialized_string, resulting in this error:

pcre-c.c:47:1: error: static declaration of ‘caml_alloc_initialized_string’ follows non-static declaration
 caml_alloc_initialized_string (mlsize_t len, const char *p)
 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Also OCaml gettext is not required by libguestfs.  There are no *.ml
files used by libguestfs which require translation.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2108425
Fixes: https://bugs.gentoo.org/820053
Fixes: commit 733d2182b6
2022-07-20 10:11:09 +01:00
Richard W.M. Jones
7149312632 lib: Don't use -cpu max on RISC-V
qemu (7.0) does not support -cpu max for TCG.

Note this change is necessary but not sufficient for getting
libguestfs to run on RISC-V, because there is also currently no
working path to make -kernel work.
2022-07-15 17:10:56 +01:00
Richard W.M. Jones
d68d1b2780 Version 1.49.3. v1.49.3 2022-07-01 15:27:25 +01:00
Richard W.M. Jones
1342626b33 valgrind: Add new suppressions for OCaml 4.14 2022-07-01 15:22:46 +01:00
Richard W.M. Jones
f16fcdcfa2 fuse/test-fuse.c: Partially disable test because of caching
Previously we noted in a comment that stat("hello.txt") is cached (and
not called again), so the test of the link count failed.  Something
has changed, possibly in the kernel, but it results in even more
aggressive caching so that an earlier, similar test also fails in the
same way.  I checked by enabling debugging that the stat call doesn't
result in guestfs_lstatns being called, and the old value for the
statbuf was being returned.
2022-07-01 15:12:23 +01:00
Laszlo Ersek
6a5b44f538 guestfish, guestmount: enable networking for "--key ID:clevis"
Call the C-language helper key_store_requires_network() in guestfish and
guestmount.

(Short log for the "common" submodule, commit range
35467027f657..af6cb55bc58a:

Laszlo Ersek (12):
      options: fix UUID comparison logic bug in get_keys()
      mltools/tools_utils: remove unused function "key_store_to_cli"
      mltools/tools_utils: allow multiple "--key" options for OCaml tools too
      options: replace NULL-termination with number-of-elements in get_keys()
      options: wrap each passphrase from get_keys() into a struct
      options: add back-end for LUKS decryption with Clevis+Tang
      options: introduce selector type "key_clevis"
      options: generalize "--key" selector parsing for C-language utilities
      mltools/tools_utils-c: handle internal type error with abort()
      mltools/tools_utils: generalize "--key" selector parsing for OCaml utils
      options, mltools/tools_utils: parse "--key ID:clevis" options
      options, mltools/tools_utils: add helper for network dependency
).

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Message-Id: <20220630122048.19335-4-lersek@redhat.com>
2022-07-01 15:11:06 +02:00
Laszlo Ersek
9a3e9a6c03 introduce the "clevis_luks_unlock" API
Introduce a new guestfs API called "clevis_luks_unlock". At the libguestfs
level, it is quite simple; it wraps the "clevis luks unlock" guest command
(implemented by the "clevis-luks-unlock" executable, which is in fact a
shell script).

The complexity is instead in the network-based disk encryption
(Clevis/Tang) scheme. Useful documentation:

- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/security_hardening/index#configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening
- https://github.com/latchset/clevis#clevis
- https://github.com/latchset/tang#tang

The package providing "clevis-luks-unlock" is usually called
"clevis-luks", occasionally "clevis". Some distros don't package clevis at
all. Add the new API under a new option group (which may not be available)
called "clevisluks".

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-Id: <20220630122048.19335-3-lersek@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
2022-07-01 15:07:26 +02:00
Laszlo Ersek
99844660b4 docs/guestfs-security: document CVE-2022-2211
Short log for the common submodule, commit range
f8de5508fe75..35467027f657:

Laszlo Ersek (2):
      mlcustomize: factor out pkg install/update/uninstall from guestfs-tools
      options: fix buffer overflow in get_keys() [CVE-2022-2211]

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2100862
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-Id: <20220628115418.5376-2-lersek@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
2022-06-29 15:29:37 +02:00
rwmjones
4159f72bb7 Merge pull request #91 from weblate/weblate-libguestfs-libguestfs-master
Translations update from Fedora Weblate
2022-06-21 10:43:15 +01:00
Weblate
661c4f0bfb Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/
2022-06-18 19:45:25 +02:00
Temuri Doghonadze
2fdf19e49f Added translation using Weblate (Georgian) 2022-06-18 19:45:24 +02:00
Richard W.M. Jones
60e8ea0312 lib/readdir.c: Include unistd.h for unlink(2)
On riscv64:

readdir.c: In function ‘guestfs_impl_readdir’:
readdir.c:127:3: error: implicit declaration of function ‘unlink’ [-Werror=implicit-function-declaration]
  127 |   unlink (tmpfn);
      |   ^~~~~~

I also changed the #include lines to make them look a bit more
like use in other files.
2022-06-17 13:25:48 +01:00
Richard W.M. Jones
1087d314cc daemon: Remove workaround for -Wanalyzer-mismatching-deallocation
On older GCC:

debug.c:116:32: error: unknown option after ‘#pragma GCC diagnostic’ kind [-Werror=pragmas]
  116 | #pragma GCC diagnostic ignored "-Wanalyzer-mismatching-deallocation"
      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[3]: *** [Makefile:2039: guestfsd-debug.o] Error 1

The upstream bug (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99193)
has now been fixed so the workaround is not necessary with the latest
GCC, so just delete the workaround.
2022-06-17 13:24:19 +01:00
Geoff Amey
ec27979398 php: add arginfo to php bindings
Starting with PHP8, arginfo is mandatory for PHP extensions. This patch
updates the generator for the PHP bindings to generate the arginfo
structures, using the Zend API macros. Only basic arginfo is added,
without full documentation of argument and return types, in order to
ensure compatibility with as many versions of PHP as possible.
2022-06-15 22:29:28 +01:00
Laszlo Ersek
8fc4d16715 appliance, daemon: disable lvm2 devicesfile
In guestfs-tools commit 4fe8a03cd2d3 ('sysprep: remove lvm2's default
"system.devices" file', 2022-04-11), we disabled the use of LVM2's new
"devicesfile" feature, which could interfere with the cloning of virtual
machines.

We suspected in

  https://bugzilla.redhat.com/show_bug.cgi?id=2072493#c6

that the same lvm2 feature could affect the libguestfs appliance itself,
but decided in

  https://bugzilla.redhat.com/show_bug.cgi?id=2072493#c8
  https://bugzilla.redhat.com/show_bug.cgi?id=2072493#c10

that this would not be the case, because "appliance/init" already
constructed a pristine LVM_SYSTEM_DIR.

Unfortunately, that's not enough: due to the "use_devicesfile=1" default
(on RHEL9 anyway), some "lvm" invocation, possibly inside the
lvm-set-filter API, *creates* "$LVM_SYSTEM_DIR/devices/system.devices".
And then we get (minimally) warnings such as

> Please remove the lvm.conf global_filter, it is ignored with the devices
> file.
> Please remove the lvm.conf filter, it is ignored with the devices file.

when using the lvm-set-filter API.

Explicitly disable the "devices file" in "appliance/init", and also
whenever we rewrite "lvm.conf" -- that is, in set_filter()
[daemon/lvm-filter.c]. In the former, check for the feature by locating
the devicesfile-related utilities "lvmdevices" and "vgimportdevices". In
the C code, invoke the utilities with the "--help" option instead. (In
"appliance/init",  I thought it was best not to call any lvm2 utilities
even with "--help", with our lvm2.conf still under construction there.) If
either utility is available, set "use_devicesfile = 0".

Cc: David Teigland <teigland@redhat.com>
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1965941
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-Id: <20220530141027.16167-1-lersek@redhat.com>
Acked-by: Richard W.M. Jones <rjones@redhat.com>
[lersek@redhat.com: style fix: break "devicesfile_feature" in the function
 definition to a new line]
2022-05-31 08:47:58 +02:00
Richard W.M. Jones
7afbf5ee44 build: Pick first field in ID_LIKE
CentOS Stream has:

ID_LIKE="rhel fedora"

which confused the existing script.  If there are multiple "likes"
arbitrarily pick the first one in the list.

Fixes: commit 63b722b6c0
2022-05-26 14:11:01 +01:00
Richard W.M. Jones
4b1fd3f154 Version 1.49.2. v1.49.2 2022-05-26 11:17:09 +01:00
Richard W.M. Jones
a1b0c4162e build: Add .gitpublish to EXTRA_DIST
Found by: make dist && make maintainer-check-extra-dist

Fixes: commit 8487e906d4
2022-05-26 10:48:32 +01:00
Richard W.M. Jones
488245ed6c daemon: rpm: Check return values from librpm calls
We previously didn't bother to check the return values from any librpm
calls.  In some cases where possibly the RPM database is faulty, this
caused us to return a zero-length list of installed applications (but
no error indication).

One way to reproduce this is given below.  Note this reproducer will
only work when run on a RHEL 8 host (or more specifically, with
rpm <= 4.16):

$ virt-builder fedora-28
$ guestfish -a fedora-28.img -i rm /var/lib/rpm/Packages
$ guestfish --ro -a fedora-28.img -i inspect-list-applications /dev/sda4 -vx
...
chroot: /sysroot: running 'librpm'
error: cannot open Packages index using db5 - Read-only file system (30)
error: cannot open Packages database in
error: cannot open Packages index using db5 - Read-only file system (30)
error: cannot open Packages database in
librpm returned 0 installed packages
...

With this commit we get an error instead:

...
chroot: /sysroot: running 'librpm'
error: cannot open Packages index using db5 - Read-only file system (30)
error: cannot open Packages database in
ocaml_exn: 'internal_list_rpm_applications' raised 'Failure' exception
guestfsd: error: rpmtsInitIterator
guestfsd: => internal_list_rpm_applications (0x1fe) took 0.01 secs
libguestfs: trace: internal_list_rpm_applications = NULL (error)
libguestfs: error: internal_list_rpm_applications: rpmtsInitIterator
libguestfs: trace: inspect_list_applications2 = NULL (error)
libguestfs: trace: inspect_list_applications = NULL (error)
...

Not in this case, but in some cases of corrupt RPM databases it is
possible to recover them by running "rpmdb --rebuilddb" as a guest
command (ie. with guestfs_sh).

See-also: https://bugzilla.redhat.com/show_bug.cgi?id=2089623#c12
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2089623
Fixes: commit c9ee831aff
Reported-by: Xiaodai Wang
Reported-by: Ming Xie
Acked-by: Laszlo Ersek <lersek@redhat.com>
2022-05-26 10:16:21 +01:00
Laszlo Ersek
9e69a38d82 update common submodule
Shortlog for 48527b8768d7..f8de5508fe75:

Laszlo Ersek (1):
      mlcustomize: refresh generated files

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2089748
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
2022-05-25 13:01:57 +02:00
Laszlo Ersek
4b9ee1052a generator/customize: reintroduce "--selinux-relabel" as a compat option
Removing "--selinux-relabel" in commit 2f6a27f107 ("generator/customize:
invert SELinux relabeling default", 2022-05-11) breaks existing scripts
that invoke virt-customize and/or virt-sysprep with that option. Restore
the option, with no functionality tied to it.

Fixes: 2f6a27f107
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2089748
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-Id: <20220525071958.9612-1-lersek@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
2022-05-25 12:58:51 +02:00
Richard W.M. Jones
63b722b6c0 build: When parsing distro from /etc/os-release, try $ID_LIKE first
The current code for working out the distro uses the ID entry from
/etc/os-release, and then we map those strings into a smaller set of
values (basically, what package manager to use).  However it was
suggested that we should try ID_LIKE first so that distros which act
like other distros would work.  On an Arch Linux 32 system:

ID=arch32
ID_LIKE=arch

See-also: https://github.com/libguestfs/libguestfs/issues/81
Thanks: S D Rausty
2022-05-22 18:36:11 +01:00
Richard W.M. Jones
4418e6345a appliance: Error out if QUERY_FILES_CMD cannot be set
Instead of continuing on regardless and failing with a weird error
later, error out early if we don't know about the distro and so cannot
set QUERY_FILES_CMD.  This avoids situations like
https://github.com/libguestfs/libguestfs/issues/81
2022-05-21 17:19:54 +01:00
Richard W.M. Jones
bf5fcdbc9b appliance: Print guestfsd.deps after generation
Sometimes generating this file fails.  To help with debugging these
situatons, print the guestfsd.deps file after it has been generated.
2022-05-21 11:11:59 +01:00
rwmjones
79010dec83 Merge pull request #88 from weblate/weblate-libguestfs-libguestfs-master
Translations update from Fedora Weblate
2022-05-20 21:19:00 +01:00
Jan Kuparinen
7bbd5f9394 Translated using Weblate (Finnish)
Currently translated at 9.4% (90 of 956 strings)

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/fi/
2022-05-20 20:18:43 +02:00
Laszlo Ersek
544bb0ff50 guestfs.pod: document encrypted RBD disk limitation
Under "REMOTE STORAGE", the "NETWORK BLOCK DEVICE" section already
documents some limitations. Turns out we need to describe a quirky
exception for accessing encrypted RBD disks, too.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2033247
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-Id: <20220518083014.9890-1-lersek@redhat.com>
Acked-by: Richard W.M. Jones <rjones@redhat.com>
2022-05-19 14:11:43 +02:00
rwmjones
307757f850 Merge pull request #87 from weblate/weblate-libguestfs-libguestfs-master
Translations update from Fedora Weblate
2022-05-19 08:48:02 +01:00
Yuri Chornoivan
3f0c0a3a1a Translated using Weblate (Ukrainian)
Currently translated at 100.0% (956 of 956 strings)

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/uk/
2022-05-18 22:18:35 +02:00
Richard W.M. Jones
feaec2497f website: Fix typo in previous commit
Fixes: commit 53d6c000b4
2022-05-18 16:09:24 +01:00
Richard W.M. Jones
53d6c000b4 website: List only the 1.48 stable branch on the website 2022-05-18 16:08:22 +01:00
Kashyap Chamarthy
8487e906d4 git: Add 'git-publish' config file
The `git-publish`[1] tool is a wrapper around `git-format-patch` and
`git-send-email`.  It's a handy tool that automates some of the tedious
aspects of manual patch submission:

  - Submitting a patch to the list (with a small config in place) is as
    simple as `git publish`

  - On next revisions, it automatically increments version numbers

  - It auto-copies the list of To: and Cc: from your previous iteration

  - It lets you preview/edit emails before submission

  - You can also use standard `git-format-patch` and `git-send-email`
    options with `git publish`

  - You can send pull requests with `git publish --pull-request`

  - It also provides custom hooks ... and more[2]

[1] https://github.com/stefanha/git-publish
[2] https://github.com/stefanha/git-publish/blob/master/git-publish.pod

Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
2022-05-18 16:03:18 +01:00
Kashyap Chamarthy
16cf069b61 website: Update 'git clone' protocol
GitHub dropped[1] support for git: protocol, so cloing with "git://"
will fail.  Use "https://" instead.

[1] https://github.blog/2021-09-01-improving-git-protocol-security-github/

Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
2022-05-18 16:03:18 +01:00
rwmjones
8a111cb82a Merge pull request #86 from weblate/weblate-libguestfs-libguestfs-master
Translations update from Fedora Weblate
2022-05-17 21:22:35 +01:00
Weblate
856a87041c Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: libguestfs/libguestfs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-master/
2022-05-17 21:20:01 +02:00
Jan Kuparinen
ae4ae83007 Translated using Weblate (Finnish)
Currently translated at 0.8% (137 of 16048 strings)

Translation: libguestfs/libguestfs-docs-master
Translate-URL: https://translate.fedoraproject.org/projects/libguestfs/libguestfs-docs-master/fi/
2022-05-17 21:20:01 +02:00
Neil Hanlon
a3487ef4c5 build: Add ROCKY to REDHAT distros list 2022-05-16 09:48:05 +01:00