Ubuntu
libvirt package

virsh save fails on oneiric when the apparmor security driver is enabled

Bug #795800 reported by Jamie Strandboge
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
libvirt (Ubuntu)
Fix Released
High
Jamie Strandboge
Ubuntu oneiric-alpha-2
Oneiric
Fix Released
High
Jamie Strandboge
Ubuntu oneiric-alpha-2

Bug Description

Upstream changed how save works and now passes a file descriptor to qemu for 'savevm'. The problem is, the apparmor security driver simply returns '0' in AppArmorSetFDLabel() (it never had to do anything else) and this is what libvirt now uses. I have developed a preliminary patch to implement this functionality but I need to test it more.

CVE References

Jamie Strandboge (jdstrand)
Changed in libvirt (Ubuntu Oneiric):
status: New → In Progress
importance: Undecided → High
assignee: nobody → Jamie Strandboge (jdstrand)
milestone: none → oneiric-alpha-2
tags: added: regression-release
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 0.9.1-1ubuntu4

---------------
libvirt (0.9.1-1ubuntu4) oneiric; urgency=low

  * SECURITY UPDATE: 0.8.8 regression which reopens disk probing
    (CVE-2010-2238). This can be dropped in 0.9.2.
    - 9025-CVE-2011-2178.patch: use correct pointer address in
      virSecurityManagerGetPrivateData()
    - CVE-2011-2178
  * fix virsh save when AppArmor driver is enabled
    - 9026-lp795800.patch: src/security/security_apparmor.c: implement
      AppArmorSetFDLabel(), which is now used by qemuMigrationToFile() if
      our version of qemu supports fd migraton. This can be dropped in 0.9.3.
    - LP: #795800
 -- Jamie Strandboge <email address hidden> Thu, 16 Jun 2011 14:16:00 -0500

Changed in libvirt (Ubuntu Oneiric):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.