From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42286) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WOUlQ-0007XI-Bf for qemu-devel@nongnu.org; Fri, 14 Mar 2014 12:15:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WOUlJ-00089b-6J for qemu-devel@nongnu.org; Fri, 14 Mar 2014 12:15:16 -0400 Received: from mx1.redhat.com ([209.132.183.28]:32802) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WOUlI-00085x-O9 for qemu-devel@nongnu.org; Fri, 14 Mar 2014 12:15:09 -0400 From: Stefan Hajnoczi Date: Fri, 14 Mar 2014 17:14:48 +0100 Message-Id: <1394813693-17498-2-git-send-email-stefanha@redhat.com> In-Reply-To: <1394813693-17498-1-git-send-email-stefanha@redhat.com> References: <1394813693-17498-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL for-2.0 1/6] blockdev: Refuse to open encrypted image unless paused List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefan Hajnoczi , Markus Armbruster , Anthony Liguori From: Markus Armbruster Opening an encrypted image takes an additional step: setting the key. Between open and the key set, the image must not be used. We have some protection against accidental use in place: you can't unpause a guest while we're missing keys. You can, however, hot-plug block devices lacking keys into a running guest just fine, or insert media lacking keys. In the latter case, notifying the guest of the insert is delayed until the key is set, which may suffice to protect at least some guests in common usage. This patch makes the protection apply in more cases, in a rather heavy-handed way: it doesn't let you open encrypted images unless we're in a paused state. It doesn't extend the protection to users other than the guest (block jobs?). Use of runstate_check() from block.c is disgusting. Best I can do right now. Signed-off-by: Markus Armbruster Reviewed-by: Eric Blake Reviewed-by: Paolo Bonzini Signed-off-by: Stefan Hajnoczi --- block.c | 9 ++++++++- stubs/Makefile.objs | 1 + stubs/runstate-check.c | 6 ++++++ tests/qemu-iotests/087 | 17 +++++++++++++++++ tests/qemu-iotests/087.out | 11 ++++++++++- 5 files changed, 42 insertions(+), 2 deletions(-) create mode 100644 stubs/runstate-check.c diff --git a/block.c b/block.c index fae50c9..53f5b44 100644 --- a/block.c +++ b/block.c @@ -1388,12 +1388,19 @@ done: ret = -EINVAL; goto close_and_fail; } - QDECREF(options); if (!bdrv_key_required(bs)) { bdrv_dev_change_media_cb(bs, true); + } else if (!runstate_check(RUN_STATE_PRELAUNCH) + && !runstate_check(RUN_STATE_INMIGRATE) + && !runstate_check(RUN_STATE_PAUSED)) { /* HACK */ + error_setg(errp, + "Guest must be stopped for opening of encrypted image"); + ret = -EBUSY; + goto close_and_fail; } + QDECREF(options); *pbs = bs; return 0; diff --git a/stubs/Makefile.objs b/stubs/Makefile.objs index 59c5a54..5ed1d38 100644 --- a/stubs/Makefile.objs +++ b/stubs/Makefile.objs @@ -20,6 +20,7 @@ stub-obj-y += mon-set-error.o stub-obj-y += pci-drive-hot-add.o stub-obj-y += qtest.o stub-obj-y += reset.o +stub-obj-y += runstate-check.o stub-obj-y += set-fd-handler.o stub-obj-y += slirp.o stub-obj-y += sysbus.o diff --git a/stubs/runstate-check.c b/stubs/runstate-check.c new file mode 100644 index 0000000..bd2e375 --- /dev/null +++ b/stubs/runstate-check.c @@ -0,0 +1,6 @@ +#include "sysemu/sysemu.h" + +bool runstate_check(RunState state) +{ + return state == RUN_STATE_PRELAUNCH; +} diff --git a/tests/qemu-iotests/087 b/tests/qemu-iotests/087 index 53b6c43..a38bb70 100755 --- a/tests/qemu-iotests/087 +++ b/tests/qemu-iotests/087 @@ -99,6 +99,23 @@ echo === Encrypted image === echo _make_test_img -o encryption=on $size +run_qemu -S <