Format drivers such as qcow2 don't allow sharing the same image between
two QEMU instances in order to prevent image corruptions, because of
metadata cache. LUKS driver don't modify metadata except for when
creating image, so it is safe to relax the permission. This makes
share-rw=on property work on virtual devices.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
---
 block/crypto.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/block/crypto.c b/block/crypto.c
index 146d81c90a..33ee01bebd 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -627,7 +627,9 @@ BlockDriver bdrv_crypto_luks = {
     .bdrv_probe         = block_crypto_probe_luks,
     .bdrv_open          = block_crypto_open_luks,
     .bdrv_close         = block_crypto_close,
-    .bdrv_child_perm    = bdrv_format_default_perms,
+    /* This driver doesn't modify LUKS metadata except when creating image.
+     * Allow share-rw=on as a special case. */
+    .bdrv_child_perm    = bdrv_filter_default_perms,
     .bdrv_co_create     = block_crypto_co_create_luks,
     .bdrv_co_create_opts = block_crypto_co_create_opts_luks,
     .bdrv_co_truncate   = block_crypto_co_truncate,
-- 
2.17.1

On Tue, Aug 14, 2018 at 03:25:51PM +0800, Fam Zheng wrote:
> Format drivers such as qcow2 don't allow sharing the same image between
> two QEMU instances in order to prevent image corruptions, because of
> metadata cache. LUKS driver don't modify metadata except for when
> creating image, so it is safe to relax the permission. This makes
> share-rw=on property work on virtual devices.
> 
> Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
> Signed-off-by: Fam Zheng <famz@redhat.com>
> ---
>  block/crypto.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/block/crypto.c b/block/crypto.c
> index 146d81c90a..33ee01bebd 100644
> --- a/block/crypto.c
> +++ b/block/crypto.c
> @@ -627,7 +627,9 @@ BlockDriver bdrv_crypto_luks = {
>      .bdrv_probe         = block_crypto_probe_luks,
>      .bdrv_open          = block_crypto_open_luks,
>      .bdrv_close         = block_crypto_close,
> -    .bdrv_child_perm    = bdrv_format_default_perms,
> +    /* This driver doesn't modify LUKS metadata except when creating image.
> +     * Allow share-rw=on as a special case. */
> +    .bdrv_child_perm    = bdrv_filter_default_perms,
>      .bdrv_co_create     = block_crypto_co_create_luks,
>      .bdrv_co_create_opts = block_crypto_co_create_opts_luks,
>      .bdrv_co_truncate   = block_crypto_co_truncate,

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Am 14.08.2018 um 09:27 hat Daniel P. Berrangé geschrieben:
> On Tue, Aug 14, 2018 at 03:25:51PM +0800, Fam Zheng wrote:
> > Format drivers such as qcow2 don't allow sharing the same image between
> > two QEMU instances in order to prevent image corruptions, because of
> > metadata cache. LUKS driver don't modify metadata except for when
> > creating image, so it is safe to relax the permission. This makes
> > share-rw=on property work on virtual devices.
> > 
> > Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
> > Signed-off-by: Fam Zheng <famz@redhat.com>
> > ---
> >  block/crypto.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/block/crypto.c b/block/crypto.c
> > index 146d81c90a..33ee01bebd 100644
> > --- a/block/crypto.c
> > +++ b/block/crypto.c
> > @@ -627,7 +627,9 @@ BlockDriver bdrv_crypto_luks = {
> >      .bdrv_probe         = block_crypto_probe_luks,
> >      .bdrv_open          = block_crypto_open_luks,
> >      .bdrv_close         = block_crypto_close,
> > -    .bdrv_child_perm    = bdrv_format_default_perms,
> > +    /* This driver doesn't modify LUKS metadata except when creating image.
> > +     * Allow share-rw=on as a special case. */
> > +    .bdrv_child_perm    = bdrv_filter_default_perms,
> >      .bdrv_co_create     = block_crypto_co_create_luks,
> >      .bdrv_co_create_opts = block_crypto_co_create_opts_luks,
> >      .bdrv_co_truncate   = block_crypto_co_truncate,
> 
> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

Thanks, applied to the block branch.

Kevin