Re: [PATCH 4/8] qapi: drop CompatPolicySecurity and use CompatPolicyInput

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Oct 29, 2026 at 07:15:38AM +0100, Markus Armbruster wrote:
> Daniel P. Berrangé <berrange@redhat.com> writes:
> 
> > With CompatPolicyInput gaining a "warn" option, the CompatPolicySecurity
> > type is redundant.
> >
> > Note the error message for insecure-input changes from
> >
> >    Type 'rtl8139' does not provide a security boundary
> >    to protect against untrusted data or actions
> >
> > To
> >
> >    Insecure QOM type rtl8139 disabled by policy
> 
> This loses a bit of information.  Do we care?  I show a way to retain it
> below.
> 
> >
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> >  qapi/compat.json | 18 +-----------------
> >  qapi/qapi-util.c | 21 ++++-----------------
> >  2 files changed, 5 insertions(+), 34 deletions(-)
> >
> > diff --git a/qapi/compat.json b/qapi/compat.json
> > index f28c24149c8..7790a7896a8 100644
> > --- a/qapi/compat.json
> > +++ b/qapi/compat.json
> > @@ -37,22 +37,6 @@
> >  { 'enum': 'CompatPolicyOutput',
> >    'data': [ 'accept', 'hide' ] }
> >  
> > -##
> > -# @CompatPolicySecurity:
> > -#     Policy for handling any devices or backends which do not provide
> > -#     a security boundary to protect against untrusted environments
> > -#
> > -# @accept: Allow any usage
> > -#
> > -# @reject: Reject with an error reported
> > -#
> > -# @warn: Allow any usage, with a warning reported
> > -#
> > -# Since: 11.2
> > -##
> > -{ 'enum': 'CompatPolicySecurity',
> > -  'data': [ 'accept', 'reject', 'warn' ] }
> > -
> >  ##
> >  # @CompatPolicy:
> >  #     Policy for handling deprecated management interfaces.
> > @@ -87,4 +71,4 @@
> >              '*deprecated-output': 'CompatPolicyOutput',
> >              '*unstable-input': 'CompatPolicyInput',
> >              '*unstable-output': 'CompatPolicyOutput',
> > -            '*insecure-input': 'CompatPolicySecurity' } }
> > +            '*insecure-input': 'CompatPolicyInput' } }
> 
> This adds policy value "crash", doesn't it?  The commit message should
> mention it.

Ok

> 
> > diff --git a/qapi/qapi-util.c b/qapi/qapi-util.c
> > index e6f3006b16c..36926b5003d 100644
> > --- a/qapi/qapi-util.c
> > +++ b/qapi/qapi-util.c
> > @@ -72,23 +72,10 @@ bool compat_policy_check_security(const CompatPolicy *policy,
> >          return true;
> >      }
> >  
> > -    switch (policy->insecure_input) {
> > -    case COMPAT_POLICY_SECURITY_ACCEPT:
> > -        return true;
> > -
> > -    case COMPAT_POLICY_SECURITY_REJECT:
> > -        error_setg(errp, "Type '%s' does not provide a security boundary "
> > -                   "to protect against untrusted data or actions", typename);
> > -        return false;
> > -
> > -    case COMPAT_POLICY_SECURITY_WARN:
> > -        warn_report("Type '%s' does not provide a security boundary "
> > -                    "to protect against untrusted data or actions", typename);
> > -        return true;
> > -
> > -    default:
> > -        g_assert_not_reached();
> > -    }
> > +    return compat_policy_input_ok1(policy->insecure_input,
> > +                                   "Insecure",
> > +                                   ERROR_CLASS_GENERIC_ERROR,
> > +                                   "QOM type", typename, errp);
> >  }
> 
> ... then try something like this:
> 
>        if (!compat_policy_input_ok1(...) {
>            error_append_hint(errp, ...);
>        }
> 
> Don't forget ERRP_GUARD() then, error_append_hint() needs it.

Yep, that's a nice idea.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|