From nobody Sat Oct 24 20:18:21 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1791969423; cv=none; d=zohomail.com; s=zohoarc; b=KCYO6DyOBuzGUNLIPD4Xgv0sFwjAef/IqpHAeSy6/s949IFW2qGRZ/FXeFrvic+80TBFmZRLrIpM8FsY7cYhSna3tPUTcTb8U7nddUfPlgj1+scEt+tE8KuKw1rhiwvC8coij9OJXWCFXJSlNu08Xcoh7gX/70+3FJTI4PRfIWI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791969423; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=5/akvor2ORcDCq4xvrwdufG/6BBTa5+VAdEKhADf8xQ=; b=WRGoXZRQ8TNO6a1XgCXUJ3FNa5qwV00H6l3oP9EvZu5BpWkfXJI7oHCAeNkYBA8bFnxmupKCo6b4wbLop3mmeIVwPrHoqYSZgrYiuokg6V/2vTzpXYVMbrdvulmALXJweIsIOyJ5xn1UKqbdlkDISzbPPhwdMirmC0YlA2mnaag= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791969423943354.43658337158297; Wed, 14 Oct 2026 02:17:03 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 335ED41AB5; Wed, 14 Oct 2026 05:17:02 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 8D8203F35F; Wed, 14 Oct 2026 05:16:00 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id F3A493F36C; Wed, 14 Oct 2026 05:15:49 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 4DB383F35B for ; Wed, 14 Oct 2026 05:15:49 -0400 (EDT) Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-219-VqKobGo6MdaKjXJEiPdvKQ-1; Wed, 14 Oct 2026 09:15:47 +0000 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 89A0319560BE for ; Wed, 14 Oct 2026 09:15:46 +0000 (UTC) Received: from mprivozn-thinkpadt14gen4.tpbc.csb (unknown [10.43.3.180]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E41F47C6 for ; Wed, 14 Oct 2026 09:15:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_SBL_CSS, SPF_HELO_PASS autolearn=no autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791969348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5/akvor2ORcDCq4xvrwdufG/6BBTa5+VAdEKhADf8xQ=; b=B9cKHHAXhO2GjBvgoppSfMWFRhPPbupNTFgi5GiMy0oTvk5fHFszE4zhth8XqzSJekxKbu M/vi5GXOcbXvgdy012yRgj0wwhBuYMAbEF+05HjQRE47w26e+DlaIPlj+xD5x5ER6Kbg1O GlnLuP/vvcI+PJKUnXoQk3yUNV9R0/g= X-MC-Unique: VqKobGo6MdaKjXJEiPdvKQ-1 X-Mimecast-MFC-AGG-ID: VqKobGo6MdaKjXJEiPdvKQ_1791969346 To: devel@lists.libvirt.org Subject: [PATCH 1/5] qemusecuritytest: Introduce new test case Date: Wed, 14 Oct 2026 11:15:35 +0200 Message-ID: <82e482224feb18792a5cc263075e0022102008e0.1791969289.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: giGhBjH8bizY5gbKDIas0-hK-QwJ4qMtHpk-_mYt4nM_1791969346 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: EFSDCLSRC2OMBXDBAHTZMERNN7SIHDS4 X-Message-ID-Hash: EFSDCLSRC2OMBXDBAHTZMERNN7SIHDS4 X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1791969427288158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik For now, this is a simple test case. It's added because the domain XML has a cdrom with a block device as its source dev. This will come up handy in following commits. Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- tests/qemusecuritytest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/qemusecuritytest.c b/tests/qemusecuritytest.c index ba9506d0a0..5c0d5244f2 100644 --- a/tests/qemusecuritytest.c +++ b/tests/qemusecuritytest.c @@ -249,6 +249,7 @@ mymain(void) DO_TEST_DOMAIN("x86_64-pc-headless"); DO_TEST_DOMAIN("x86_64-q35-graphics"); DO_TEST_DOMAIN("x86_64-q35-headless"); + DO_TEST_DOMAIN("boot-complex"); =20 cleanup: qemuTestDriverFree(&driver); --=20 2.56.0 From nobody Sat Oct 24 20:18:21 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1791969586; cv=none; d=zohomail.com; s=zohoarc; b=UUG/w4TfOUXSm9s7wHEZJHYSGlRXdwOFE5xtF9zAcIVXwHhAWNy9MG4oDTEQ1eeaEQdn8O1bsMNorfn39PcAtXbAhsdHmVzq+5AZMON2nmRpvBcsQq+Xxjyz8qBysR2Hn7adllc0oc280A6Lk6R0y1J7x8Zr9PEsuaFtBA4sElQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791969586; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=uwtlOgnLydfoIVmTvlEwVQVMuQ5LawAlULXEp9ZiWe0=; b=h+XWBKlN+eMH+iWUnnAch2ngb+iKsMJpKG5VvnPYBFCl4n8jc/GOdDZEnAhLR6Ug0+Ikni6xQYikvRLvVv5+yCfaSVwdAYvzLJVwdS9mcdJjX2Zjn13HVNywK7d9wHcibxLBQinbkJrbxPqy2P6EhMQeVkqfouCDJ/S8VLwuMfE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791969586585450.1575140053591; Wed, 14 Oct 2026 02:19:46 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 262D441B69; Wed, 14 Oct 2026 05:19:45 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 328A4419D0; Wed, 14 Oct 2026 05:16:16 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 278983F35B; Wed, 14 Oct 2026 05:15:51 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 22E6C3F383 for ; Wed, 14 Oct 2026 05:15:50 -0400 (EDT) Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-522-vcbj2AjXOvKtviujBDdgiQ-1; Wed, 14 Oct 2026 09:15:48 +0000 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 89F501956075 for ; Wed, 14 Oct 2026 09:15:47 +0000 (UTC) Received: from mprivozn-thinkpadt14gen4.tpbc.csb (unknown [10.43.3.180]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id EE5E2362 for ; Wed, 14 Oct 2026 09:15:46 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,RCVD_IN_SBL_CSS,SPF_HELO_PASS autolearn=no autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791969349; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uwtlOgnLydfoIVmTvlEwVQVMuQ5LawAlULXEp9ZiWe0=; b=NXJDvgDG2M1TMYfs75ICcfY02fbKul6nypMQer2Pe8ty7aReEB2i68R+698kQfCmhPUQJt oXews/Lp93k260zXQkYRBrwjEp+/50ah+kxAlonPM4aRdY1JYivmryG8HTY4vpykv3k/n8 GMNdazriCiOGxdX7rnlkQme4d8cTIo8= X-MC-Unique: vcbj2AjXOvKtviujBDdgiQ-1 X-Mimecast-MFC-AGG-ID: vcbj2AjXOvKtviujBDdgiQ_1791969347 To: devel@lists.libvirt.org Subject: [PATCH 2/5] security: Check if R/O or shared disk is not directory Date: Wed, 14 Oct 2026 11:15:36 +0200 Message-ID: <8a7cb6a29ee9772eede0a4603ff2bb17ec7c8c6c.1791969289.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: Ktg7YKSZtwXxWpJnyXXirfl4m576hOM1RcKI6buuiWY_1791969347 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: HJFJWFRAP55WF2JOAT33HX2ZJWH32JKG X-Message-ID-Hash: HJFJWFRAP55WF2JOAT33HX2ZJWH32JKG X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1791969588184158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik When starting a domain with a disk, or when hotplugging one, the seclabel on corresponding file is set (the original seclabel is recorded in XATTRs) and then on hotunplug or VM shutdown the original seclabel is restored. This works so well, that even if QEMU rejects hotplug seclabel of the file is the same before and after hotplug attempt. Except for read only and shared disks. For these restore is explicitly skipped. Now imagine a user, trying to hotplug a disk with the source as say /root and QEMU denying the hotplug request (this is in fact fairly easy to achieve - hotplug a cdrom with a directory as its source). We'd set seclabels on the directory (/root), tell QEMU to hotplug it (or change media in a cdrom, doesn't really matter) which fails. But there's no seclabel restore leaving the directory with incorrect seclabels. Check for this specific case in our DAC and SELinux secdrivers. AppArmor is not necessary because it doesn't actually touch the directory. NB, one might expect qemusecuritytest to fail after this commit, but in fact, our qemusecuritymock re-implements stat() and pretends everything is a file. This is fixed in next commits. Resolves: https://redhat.atlassian.net/browse/RHEL-262704 Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- src/security/security_dac.c | 37 +++++++++++++++++++++++++++++++++ src/security/security_selinux.c | 37 +++++++++++++++++++++++++++++++++ 2 files changed, 74 insertions(+) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index e7cffa8e59..32e3d20b6e 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -947,6 +947,43 @@ virSecurityDACSetImageLabelInternal(virSecurityManager= *mgr, if (src->seclabelSkipRemember) remember =3D false; =20 + /* If we don't remember the label, do an extra check if the + * storage source is actually of expected type. Ideally, if + * hypervisor rejects incorrect type then we'd just restore + * the remembered label, BUT if we do not remember it in the + * first place, then there's no restore. */ + if (!remember && src->path) { + struct stat sb; + + switch (src->type) { + case VIR_STORAGE_TYPE_FILE: + case VIR_STORAGE_TYPE_BLOCK: + case VIR_STORAGE_TYPE_DIR: + case VIR_STORAGE_TYPE_CTL: + if (stat(src->path, &sb) < 0) { + virReportSystemError(errno, _("Failed to stat %1$s"), src-= >path); + return -1; + } + + if ((src->type =3D=3D VIR_STORAGE_TYPE_DIR) !=3D !!S_ISDIR(sb.= st_mode)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Invalid file type for disk source %1$s"), + src->path); + return -1; + } + break; + + case VIR_STORAGE_TYPE_NONE: + case VIR_STORAGE_TYPE_NETWORK: + case VIR_STORAGE_TYPE_VOLUME: + case VIR_STORAGE_TYPE_NVME: + case VIR_STORAGE_TYPE_VHOST_USER: + case VIR_STORAGE_TYPE_VHOST_VDPA: + case VIR_STORAGE_TYPE_LAST: + break; + } + } + return virSecurityDACSetOwnership(mgr, src, NULL, user, group, remembe= r); } =20 diff --git a/src/security/security_selinux.c b/src/security/security_selinu= x.c index 423dcd0bd9..9dc6242cfa 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -2025,6 +2025,43 @@ virSecuritySELinuxSetImageLabelInternal(virSecurityM= anager *mgr, if (src->seclabelSkipRemember) remember =3D false; =20 + /* If we don't remember the label, do an extra check if the + * storage source is actually of expected type. Ideally, if + * hypervisor rejects incorrect type then we'd just restore + * the remembered label, BUT if we do not remember it in the + * first place, then there's no restore. */ + if (!remember) { + struct stat sb; + + switch (src->type) { + case VIR_STORAGE_TYPE_FILE: + case VIR_STORAGE_TYPE_BLOCK: + case VIR_STORAGE_TYPE_DIR: + case VIR_STORAGE_TYPE_CTL: + if (stat(path, &sb) < 0) { + virReportSystemError(errno, _("Failed to stat %1$s"), = path); + return -1; + } + + if ((src->type =3D=3D VIR_STORAGE_TYPE_DIR) !=3D !!S_ISDIR= (sb.st_mode)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Invalid file type for disk source %1= $s"), + path); + return -1; + } + break; + + case VIR_STORAGE_TYPE_NONE: + case VIR_STORAGE_TYPE_NETWORK: + case VIR_STORAGE_TYPE_VOLUME: + case VIR_STORAGE_TYPE_NVME: + case VIR_STORAGE_TYPE_VHOST_USER: + case VIR_STORAGE_TYPE_VHOST_VDPA: + case VIR_STORAGE_TYPE_LAST: + break; + } + } + ret =3D virSecuritySELinuxSetFilecon(mgr, path, use_label, remembe= r); } =20 --=20 2.56.0 From nobody Sat Oct 24 20:18:21 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1791969669; cv=none; d=zohomail.com; s=zohoarc; b=G650F0P2S4BkU6KZI2T9my3TsUPiOaQ3OeOvyjt/CFx+IOkWuMhw0OsTTss8Uu99aVbBl2Ddnq/YRLNDZ5hKXmTbjEtCaOGiWTdnJnwkWuPihy4PMFzQJyR0Hb22wxE5tnaw/8KGXQcBPIQ32fQg893INon8Ov86h4LSBvgJh4E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791969669; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=tI3+atZqcCXQtmTEYVE2kP7IjNwzlG8KWNT+PUQ9EkM=; b=SeZX8bE580oPKZlKrVqbJqfqxBPI7Xul3vs3MS92DGbafqg6M+75nfJ0h0jIe/81xvNsIi0Aj3oIL995AlKt20iTElUx4U8v57pbzT35Iq5n2ihawQpFNaqik7WexaTiQuqQ9hIC8/SJk9As34V2zC90PX9vq0SJs0PFdwpPCe8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791969669257478.305183372967; Wed, 14 Oct 2026 02:21:09 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 972E941A17; Wed, 14 Oct 2026 05:21:07 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 9E67E41C48; Wed, 14 Oct 2026 05:16:22 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id EF4DB3F383; Wed, 14 Oct 2026 05:15:51 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 6359E3F35B for ; Wed, 14 Oct 2026 05:15:51 -0400 (EDT) Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-446-UNKMHBUsNjqDm7EQeKKQmA-1; Wed, 14 Oct 2026 09:15:49 +0000 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7CD251955F5A for ; Wed, 14 Oct 2026 09:15:48 +0000 (UTC) Received: from mprivozn-thinkpadt14gen4.tpbc.csb (unknown [10.43.3.180]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E132A26C for ; Wed, 14 Oct 2026 09:15:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,RCVD_IN_SBL_CSS,SPF_HELO_PASS autolearn=no autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791969350; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tI3+atZqcCXQtmTEYVE2kP7IjNwzlG8KWNT+PUQ9EkM=; b=LqjhyhPydTiflLxZo0JRMnq0VKeUTcDjK8PAp7E433Ixgs9QVLvrRlzizVDZIIDNi5CSUy Kr+iO7edAKVegrbn8z0+vaK2xUgsbIGz9xX8Inhisqcxx+1uRKFfH46Oxsk9Z1YeYlPwi0 qKpL+qYUM6UUN73g+ONCSQEt6Jld8NI= X-MC-Unique: UNKMHBUsNjqDm7EQeKKQmA-1 X-Mimecast-MFC-AGG-ID: UNKMHBUsNjqDm7EQeKKQmA_1791969348 To: devel@lists.libvirt.org Subject: [PATCH 3/5] qemusecuritytest: Add machinery for negative test cases Date: Wed, 14 Oct 2026 11:15:37 +0200 Message-ID: In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: hJ3bMkWaxX6l1to2w98VIVqL-eiRzAiSDtegfaLM7KE_1791969348 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: TXEBLEQ3MJZSVJLL7AWJQ5LJQJGDTB3U X-Message-ID-Hash: TXEBLEQ3MJZSVJLL7AWJQ5LJQJGDTB3U X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1791969669666158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik So far, qemusecuritytest has only positive test cases (i.e. success is expected). Add machinery to have negative test cases (i.e. when a specific failure is expected) too. Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- tests/qemusecuritytest.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/tests/qemusecuritytest.c b/tests/qemusecuritytest.c index 5c0d5244f2..a46651e6bd 100644 --- a/tests/qemusecuritytest.c +++ b/tests/qemusecuritytest.c @@ -32,6 +32,7 @@ struct testData { virQEMUDriver *driver; const char *file; /* file name to load VM def XML from; qemuxmlconfdat= a/ */ + int expectError; }; =20 =20 @@ -117,8 +118,26 @@ testDomain(const void *opaque) if (g_setenv(ENVVAR, "1", FALSE) =3D=3D FALSE) return -1; =20 - if (qemuSecuritySetAllLabel(data->driver, vm, NULL, false) < 0) + if (qemuSecuritySetAllLabel(data->driver, vm, NULL, false) < 0) { + if (data->expectError !=3D VIR_ERR_OK) { + int errCode =3D virGetLastErrorCode(); + + if (errCode =3D=3D data->expectError) { + /* expected failure */ + ret =3D 0; + } else { + VIR_TEST_DEBUG("Unexpected error code %d, expected %d", + errCode, data->expectError); + } + } goto cleanup; + } + + if (data->expectError !=3D VIR_ERR_OK) { + VIR_TEST_DEBUG("passed instead of expected error code %d", + data->expectError); + goto cleanup; + } =20 qemuSecurityRestoreAllLabel(data->driver, vm, false); =20 @@ -191,14 +210,20 @@ mymain(void) =20 driver.securityManager =3D g_steal_pointer(&stack); =20 - -#define DO_TEST_DOMAIN(f) \ +#define DO_TEST_DOMAIN_FULL(f, err) \ do { \ - struct testData data =3D {.driver =3D &driver, .file =3D f}; \ + struct testData data =3D {.driver =3D &driver, .file =3D f, \ + .expectError =3D err}; \ if (virTestRun(f, testDomain, &data) < 0) \ ret =3D -1; \ } while (0) =20 +#define DO_TEST_DOMAIN(f) \ + DO_TEST_DOMAIN_FULL(f, VIR_ERR_OK) + +#define DO_TEST_DOMAIN_ERROR_UNSUPPORTED(f) \ + DO_TEST_DOMAIN_FULL(f, VIR_ERR_CONFIG_UNSUPPORTED) + DO_TEST_DOMAIN("acpi-table"); DO_TEST_DOMAIN("channel-unix-guestfwd"); DO_TEST_DOMAIN("console-virtio-unix"); --=20 2.56.0 From nobody Sat Oct 24 20:18:21 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1791969721; cv=none; d=zohomail.com; s=zohoarc; b=DbUxabm4JaCB3yhPZYYSCHCz83HrtPwQ9QaRyrSVnHNM47rhPeX2O1IWseNJg2w//4HvH+gI1VkHVn7vzX5E5pLbmDqk8rMAUwjO+QD1F7333/BusdAgFfshgBw7WoDIBEjit9nDkbCYKGAJgBp/mdXYz4oSlPEWHjKvOSiLnh8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791969721; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=kUkGqGesRZHdeA0t+UgNKDjoYP/aiV1t6HCpKFAut3s=; b=TGBSAwpHTC7zumrJfFoJbIGeuR9mCjMZrlVUujE/KOq/jx0jcs9cv0ZeVLnjO1SGAjKfCyjtlOXSIHbjQGFeQ9fzkir/vkr4giQ3nCazR9KS7Dh6QBTHmMm0GsvP1KXQ3IAdHOxFdBGj03B3CTVV/NH6oqfYDNzclUPCoy171zE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791969721938505.82666778432053; Wed, 14 Oct 2026 02:22:01 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 6992A41B1E; Wed, 14 Oct 2026 05:22:00 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 8E43C41CAA; Wed, 14 Oct 2026 05:16:26 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 0A33C3F35F; Wed, 14 Oct 2026 05:15:53 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 6615D3F35B for ; Wed, 14 Oct 2026 05:15:52 -0400 (EDT) Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-272-UsASIYHQM76vogoFQa9Wqw-1; Wed, 14 Oct 2026 09:15:50 +0000 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7083E1800667 for ; Wed, 14 Oct 2026 09:15:49 +0000 (UTC) Received: from mprivozn-thinkpadt14gen4.tpbc.csb (unknown [10.43.3.180]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D4383418 for ; Wed, 14 Oct 2026 09:15:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791969351; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kUkGqGesRZHdeA0t+UgNKDjoYP/aiV1t6HCpKFAut3s=; b=ezbJab3tvgDZEcUf4HJpe7xyDaJv4/2D6v7wcKo1Qs8IXgMI6Iqak/XFrC0aZD1sfUdXWA rQPKbn5mLo7oabMgaQdV1hsirW/NWE7VJwp0O0g4XGVc4VRgJNGKyS99uXKcNjwENW3X8B mgwrlAM+iPsIYAMwzTGufi0Wyoq8y5w= X-MC-Unique: UsASIYHQM76vogoFQa9Wqw-1 X-Mimecast-MFC-AGG-ID: UsASIYHQM76vogoFQa9Wqw_1791969349 To: devel@lists.libvirt.org Subject: [PATCH 4/5] qemusecuritymock: Allow pretending some paths are directories Date: Wed, 14 Oct 2026 11:15:38 +0200 Message-ID: <074c2ca079aed00f3e128f9d38fe4e2ff8101850.1791969289.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: wKwCveJdb40F-eSF-0e8XFNViFdZbOKuKE3G87bt3Bw_1791969349 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 54HJKAW5FP5CIDK2QF3JA3VLCF6OWP4L X-Message-ID-Hash: 54HJKAW5FP5CIDK2QF3JA3VLCF6OWP4L X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1791969722540158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik Our qemusecuritymock reimplements stat() (for the purpose of testing our DAC secdriver) and so far, for every path S_IFREG mode is set (i.e. pretending every path thrown into stat() is a regular file). Extend the mock so that a path can be directory (S_IFDIR). Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- tests/qemusecuritymock.c | 7 ++++++- tests/qemusecuritytest.h | 3 +++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/qemusecuritymock.c b/tests/qemusecuritymock.c index cbd928ab38..51ba584853 100644 --- a/tests/qemusecuritymock.c +++ b/tests/qemusecuritymock.c @@ -232,6 +232,7 @@ int virFileRemoveXAttr(const char *path, #define VIR_MOCK_STAT_HOOK \ do { \ if (g_getenv(ENVVAR)) { \ + const char *mimicDir =3D g_getenv(PATH_MIMIC_DIR); \ uint32_t *val; \ \ virMutexLock(&m); \ @@ -239,7 +240,11 @@ int virFileRemoveXAttr(const char *path, \ memset(sb, 0, sizeof(*sb)); \ \ - sb->st_mode =3D S_IFREG | 0666; \ + if (STREQ_NULLABLE(path, mimicDir)) { \ + sb->st_mode =3D S_IFDIR | 0666; \ + } else { \ + sb->st_mode =3D S_IFREG | 0666; \ + } \ sb->st_size =3D 123456; \ sb->st_ino =3D 1; \ \ diff --git a/tests/qemusecuritytest.h b/tests/qemusecuritytest.h index 696cfb4b63..68b37352f3 100644 --- a/tests/qemusecuritytest.h +++ b/tests/qemusecuritytest.h @@ -19,6 +19,9 @@ #pragma once =20 #define ENVVAR "LIBVIRT_QEMU_SECURITY_TEST" +/* If PATH_MIMIC_DIR is set then stat() mocked in qemusecuritymock.c prete= nds + * the value is a directory instead of a file. */ +#define PATH_MIMIC_DIR "LIBVIRT_QEMU_SECURITY_TEST_MIMIC_DIR" =20 #include "internal.h" =20 --=20 2.56.0 From nobody Sat Oct 24 20:18:21 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1791969770; cv=none; d=zohomail.com; s=zohoarc; b=YYZVGAxW9BcHF0XmhwL3bnuNc1b5ztlstSUDZ0gkUuMAdVesqobVQepf4CIS1ymVxnDkzoxyfChaYg1wU0/Fhg4IAmOpqSAHbgK/ShivFpBhPk93wGGKAm+oPQ/BG6SFW9yUSRfW+5BWCxjCVHuixFq9WGcBCDHJuj4pB8UWsg8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1791969770; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=Gjc/UWAye/PpEuWwmOxn/mf1+acKq5C6TYCX2+9k6MU=; b=jxUnwOHgofVN8ZLGF4Y+IhZdnCw807e/pmvurIXMS000B9nldBllaSv9eWv4ZbGXHz3OabZGIdZX2qokTGKkYKBFw6Kc0KzV63vUnrIyrOKLmnkadrWhqC9Wf+0H32mJCYLfvygrdxQ+lD3D9U1lWQBKf91iJ1zjHfDy8xbIoGM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1791969770080328.2470327049849; Wed, 14 Oct 2026 02:22:50 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 929EC419B7; Wed, 14 Oct 2026 05:22:48 -0400 (EDT) Received: from [172.19.199.16] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 2B6F741973; Wed, 14 Oct 2026 05:16:30 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 478193F35B; Wed, 14 Oct 2026 05:15:54 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 8F3983F35F for ; Wed, 14 Oct 2026 05:15:53 -0400 (EDT) Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-312-L3dR2Eh-OKq0-yQPnhnkjw-1; Wed, 14 Oct 2026 09:15:51 +0000 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6D2A41800617 for ; Wed, 14 Oct 2026 09:15:50 +0000 (UTC) Received: from mprivozn-thinkpadt14gen4.tpbc.csb (unknown [10.43.3.180]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C729826C for ; Wed, 14 Oct 2026 09:15:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791969352; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Gjc/UWAye/PpEuWwmOxn/mf1+acKq5C6TYCX2+9k6MU=; b=Tfna03BbWLVUMio+3Xo/SuNiJq23wQpclZ6I6dy00yhVSap/2GqgxJ/zLzKx0eaFByTReV eWLbgDT036VqpHsXiGTKOAzWCmoBorY2RN9wPnQ2DmhdFlAryoN/0evtvCtV4PlyejAG2T q7YGfWHM1NHMgWyJB8tlV3QBsIZBqNE= X-MC-Unique: L3dR2Eh-OKq0-yQPnhnkjw-1 X-Mimecast-MFC-AGG-ID: L3dR2Eh-OKq0-yQPnhnkjw_1791969350 To: devel@lists.libvirt.org Subject: [PATCH 5/5] qemusecuritytest: Introduce a test case for cdrom with directory Date: Wed, 14 Oct 2026 11:15:39 +0200 Message-ID: <9afc3dba4b2c3b7c248ae88db5809d94fbcfe30e.1791969289.git.mprivozn@redhat.com> In-Reply-To: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: FgaTQg-QpI5oG7E4zX7K1n1dBPQASt7RLDxZp-ZKGIg_1791969350 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 2KM23CUIMJFHXTTE6B5ZLXPY4ESDTNHO X-Message-ID-Hash: 2KM23CUIMJFHXTTE6B5ZLXPY4ESDTNHO X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1791969771443158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik This is a test case for one of previous commits that forbade relabelling cdroms with a directory as their source. Signed-off-by: Michal Privoznik Reviewed-by: J=C3=A1n Tomko --- tests/qemusecuritytest.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/qemusecuritytest.c b/tests/qemusecuritytest.c index a46651e6bd..43005c7260 100644 --- a/tests/qemusecuritytest.c +++ b/tests/qemusecuritytest.c @@ -275,6 +275,11 @@ mymain(void) DO_TEST_DOMAIN("x86_64-q35-graphics"); DO_TEST_DOMAIN("x86_64-q35-headless"); DO_TEST_DOMAIN("boot-complex"); + /* Rerun the same test but now mimic that one disk is a dir + * instead of regular file. */ + g_setenv(FILE_MIMIC_DIR, "/dev/HostVG/hdc", TRUE); + DO_TEST_DOMAIN_ERROR_UNSUPPORTED("boot-complex"); + g_unsetenv(FILE_MIMIC_DIR); =20 cleanup: qemuTestDriverFree(&driver); --=20 2.56.0