{"push_id":1290921681,"size":9,"distinct_size":2,"ref":"refs/heads/seclabels3","head":"e9debb6bf84dc1787135429ff40f2e1f5da14b85","before":"e127338f9c3254faf68aff5115601b640e7f2e7c","commits":[{"sha":"97a87333a0ac8b6b33bf4c45a7b1a526caa554cb","author":{"name":"Jiri Denemark","email":"0b6e66718f66b2a8c4b2dc6a6a42b8beb145fd62@redhat.com"},"message":"Add helper for removing transient definition\n\nThe code for replacing domain's transient definition with the persistent\none is repeated in several places and we'll need to add one more. Let's\nmake a nice helper for it.\n\nSigned-off-by: Jiri Denemark <jdenemar@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zippy2/libvirt/commits/97a87333a0ac8b6b33bf4c45a7b1a526caa554cb"},{"sha":"66278d4bc38aecff6661c91ce9cd3fff26e54a91","author":{"name":"Jiri Denemark","email":"0b6e66718f66b2a8c4b2dc6a6a42b8beb145fd62@redhat.com"},"message":"qemu: Remove stale transient def when migration fails\n\nIf a migration of a domain which is already defined on the destination\nhost failed early (before we tried to start QEMU), we would forget to\nremove the incoming transient definition. Later on when someone starts\nthe domain on the destination host, we will use the stale incoming\ndefinition and the persistent definition will just be ignored.\n\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1368774\n\nSigned-off-by: Jiri Denemark <jdenemar@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zippy2/libvirt/commits/66278d4bc38aecff6661c91ce9cd3fff26e54a91"},{"sha":"c12cb5ed73ec25db184c0204c3476e26357a7314","author":{"name":"John Ferlan","email":"ea4b206ebea463545bcc9d546f93a642d7aeb984@redhat.com"},"message":"conf: Add new default TLS X.509 certificate default directory\n\nRather than specify perhaps multiple TLS X.509 certificate directories,\nlet's create a \"default\" directory which can then be used if the service\n(e.g. for now vnc and spice) does not supply a default directory.\n\nSince the default for vnc and spice may have existed before without being\nsupplied, the default check will first check if the service specific path\nexists and if so, set the cfg entry to that; otherwise, the default will\nbe set to the (now) new defaultTLSx509certdir.\n\nAdditionally add a \"default_tls_x509_verify\" entry which can also be used\nto force the peer verification option (for vnc it's a x509verify option).\nAdd/alter the macro for the option being found in the config file to accept\nthe default value.\n\nSigned-off-by: John Ferlan <jferlan@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zippy2/libvirt/commits/c12cb5ed73ec25db184c0204c3476e26357a7314"},{"sha":"3f60a9c32f21158cc498e7bebed6d2b79aeedba1","author":{"name":"John Ferlan","email":"ea4b206ebea463545bcc9d546f93a642d7aeb984@redhat.com"},"message":"conf: Introduce chartcp_tls_x509_cert_dir\n\nAdd a new TLS X.509 certificate type - \"chardev\". This will handle the\ncreation of a TLS certificate capability (and possibly repository) for\nproperly configured character device TCP backends.\n\nUnlike the vnc and spice there is no \"listen\" or \"passwd\" associated. The\ncredentials eventually will be handled via a libvirt secret provided to\na specific backend.\n\nMake use of the default verify option as well.\n\nSigned-off-by: John Ferlan <jferlan@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zippy2/libvirt/commits/3f60a9c32f21158cc498e7bebed6d2b79aeedba1"},{"sha":"ce61c16450d4992612d1fc6f39a39e79bfccead5","author":{"name":"John Ferlan","email":"ea4b206ebea463545bcc9d546f93a642d7aeb984@redhat.com"},"message":"qemu: Add support for TLS X.509 path to TCP chardev backend\n\nWhen building a chardev device string for tcp, add the necessary pieces to\naccess provide the TLS X.509 path to qemu.  This includes generating the\n'tls-creds-x509' object and then adding the 'tls-creds' parameter to the\nVIR_DOMAIN_CHR_TYPE_TCP command line.\n\nFinally add the tests for the qemu command line. This test will make use\nof the \"new(ish)\" /etc/pki/qemu setting for a TLS certificate environment\nby *not* \"resetting\" the chardevTLSx509certdir prior to running the test.\nAlso use the default \"verify\" option (which is \"no\").\n\nSigned-off-by: John Ferlan <jferlan@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zippy2/libvirt/commits/ce61c16450d4992612d1fc6f39a39e79bfccead5"},{"sha":"2c3223785c121eafbdd503f11549d7964461934f","author":{"name":"John Ferlan","email":"ea4b206ebea463545bcc9d546f93a642d7aeb984@redhat.com"},"message":"qemu: Add the ability to hotplug the TLS X.509 environment\n\nIf the incoming XML defined a path to a TLS X.509 certificate environment,\nadd the necessary 'tls-creds-x509' object to the VIR_DOMAIN_CHR_TYPE_TCP\ncharacter device.\n\nLikewise, if the environment exists the hot unplug needs adjustment as\nwell.  Note that all the return ret were changed to goto cleanup since\nthe cfg needs to be unref'd\n\nSigned-off-by: John Ferlan <jferlan@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zippy2/libvirt/commits/2c3223785c121eafbdd503f11549d7964461934f"},{"sha":"13350a17e4c6546d754b6c1214d4d18b4707e7c4","author":{"name":"John Ferlan","email":"ea4b206ebea463545bcc9d546f93a642d7aeb984@redhat.com"},"message":"conf: Add new secret type \"tls\"\n\nAdd a new secret usage type known as \"tls\" - it will handle adding the\nsecret objects for various TLS objects that need to provide some sort\nof passphrase in order to access the credentials.\n\nThe format is:\n\n   <secret ephemeral='no' private='no'>\n     <description>Sample TLS secret</description>\n     <usage type='tls'>\n       <name>mumblyfratz</name>\n     </usage>\n</secret>\n\nOnce defined and a passphrase set, future patches will allow the UUID\nto be set in the qemu.conf file and thus used as a secret for various\nTLS options such as a chardev serial TCP connection, a NBD client/server\nconnection, and migration.\n\nSigned-off-by: John Ferlan <jferlan@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zippy2/libvirt/commits/13350a17e4c6546d754b6c1214d4d18b4707e7c4"},{"sha":"e2419789f585ce4a307b40dc75575886d949af6e","author":{"name":"Michal Privoznik","email":"ff52d8b477e4489d0b3b856d550bc61214c6ad4b@redhat.com"},"message":"lock_protocol: Add two new remote procedures\n\nThese procedures will be used to store and bring back security\nlabels. So far, the idea is that tuple (path, model, label) is\nenough. Well, certainly for DAC and SELinux. The functions are:\n\n  VIR_LOCK_SPACE_PROTOCOL_PROC_REMEMBER_SECLABEL\n  VIR_LOCK_SPACE_PROTOCOL_PROC_RECALL_SECLABEL\n\nYeah, they really need that VIR_LOCK_SPACE_PROTOCOL_PROC prefix\ndue to way we call gendispatch.pl.\n\nSo the former will take the whole tuple and remember it. The\nlatter will then take just pair of (path, model) and return label\nstored previously. Moreover, the return value of recall will be\nimportant: value greater than zero means @path is still in use,\ndon't relabel it. Value of zero means @path is no longer used,\nand a negative value means an error (e.g. @path not found, OOM,\netc.).\n\nSigned-off-by: Michal Privoznik <mprivozn@redhat.com>","distinct":true,"url":"https://api.github.com/repos/zippy2/libvirt/commits/e2419789f585ce4a307b40dc75575886d949af6e"},{"sha":"e9debb6bf84dc1787135429ff40f2e1f5da14b85","author":{"name":"Michal Privoznik","email":"ff52d8b477e4489d0b3b856d550bc61214c6ad4b@redhat.com"},"message":"locking: Introduce virSeclabelSpace\n\nThis module will handle all the security label remembering and\nrecalling for virlockd. We need to record a tuple of (path,\nsecurity model, security label). So I'm going with a hash table,\nwhere @path would be the key, and tuple of (model, label) is\ngoing to be the payload. Well, the payload tuple is wrapped into\nself inflating array (virSeclabelSpaceLabels). So for each path,\nwe will have to traverse through array of various models to find\nthe needed one. But since there's gonna be many paths and just a\nfew security models, it's going to be the best approach.\n\nSigned-off-by: Michal Privoznik <mprivozn@redhat.com>","distinct":true,"url":"https://api.github.com/repos/zippy2/libvirt/commits/e9debb6bf84dc1787135429ff40f2e1f5da14b85"}]}
{"actor":{"display_login":"zippy2"}}