> This introduces a new 'insecure-types' option for the 'compat'
> argument that accepts three values
>
> * accept: Allow any usage
> * reject: Reject with an error reported
> * warn: Allow any usage, with a warning reported
>
> For historical compatibility it defaults to 'accept'.
>
> The 'reject' and 'warn' values will take effect for any type
> that has been explicitly marked insecure, or is lacking an
> explicit declaration of its security status.
>
> This new command line option is currently a no-op, but will
> become functional as following patches enable the checks.
>
> Signed-off-by: Daniel P. Berrangé <[email protected]>
> Message-ID: <[email protected]>
>
> diff --git a/include/qapi/compat-policy.h b/include/qapi/compat-policy.h
> index ea65e10744ab..f5af20906923 100644
> --- a/include/qapi/compat-policy.h
> +++ b/include/qapi/compat-policy.h
> @@ -24,6 +24,11 @@ bool compat_policy_input_ok(uint64_t features,
> const char *kind, const char *name,
> Error **errp);
>
> +bool compat_policy_check_security(const CompatPolicy *policy,
> + const char *typename,
> + bool is_secure,
> + Error **errp);
> +
> /*
> * Create a QObject input visitor for @obj for use with QMP
> *
> diff --git a/qapi/compat.json b/qapi/compat.json
> index 90b8d51cf27e..d57f25e112f8 100644
> --- a/qapi/compat.json
> +++ b/qapi/compat.json
> @@ -37,6 +37,23 @@
> { 'enum': 'CompatPolicyOutput',
> 'data': [ 'accept', 'hide' ] }
>
> +##
> +# @CompatPolicySecurity:
> +#
> +# Policy for handling any devices or backends which do not provide a
> +# security boundary to protect against untrusted environments
> +#
> +# @accept: Allow any usage
> +#
> +# @reject: Reject with an error reported
> +#
> +# @warn: Allow any usage, with a warning reported
> +#
> +# Since: 10.2
Since: 11.2
> +##
> +{ 'enum': 'CompatPolicySecurity',
> + 'data': [ 'accept', 'reject', 'warn' ] }
> +
> ##
> # @CompatPolicy:
> #
> @@ -62,10 +79,14 @@
> # @unstable-output: how to handle unstable output (default 'accept')
> # (since 6.2)
> #
> +# @insecure-types: how to handle types that are not declared secure
> +# (default 'accept') (since 10.2)
(since 11.2)
> +#
> # Since: 6.0
> ##
> { 'struct': 'CompatPolicy',
> 'data': { '*deprecated-input': 'CompatPolicyInput',
> '*deprecated-output': 'CompatPolicyOutput',
> '*unstable-input': 'CompatPolicyInput',
> - '*unstable-output': 'CompatPolicyOutput' } }
> + '*unstable-output': 'CompatPolicyOutput',
> + '*insecure-types': 'CompatPolicySecurity' } }
> diff --git a/qapi/qapi-util.c b/qapi/qapi-util.c
> index 3d849fe0347f..38b1cec7a415 100644
> --- a/qapi/qapi-util.c
> +++ b/qapi/qapi-util.c
> @@ -14,6 +14,7 @@
> #include "qapi/compat-policy.h"
> #include "qapi/error.h"
> #include "qemu/ctype.h"
> +#include "qemu/error-report.h"
> #include "qapi/qmp/qerror.h"
>
> CompatPolicy compat_policy;
> @@ -58,6 +59,35 @@ bool compat_policy_input_ok(uint64_t features,
> return true;
> }
>
> +bool compat_policy_check_security(const CompatPolicy *policy,
> + const char *typename,
> + bool is_secure,
> + Error **errp)
> +{
> + if (is_secure) {
> + return true;
> + }
> +
> + switch (policy->insecure_types) {
> + case COMPAT_POLICY_SECURITY_ACCEPT:
> + return true;
> +
> + case COMPAT_POLICY_SECURITY_REJECT:
> + error_setg(errp, "Type '%s' does not provide a security boundary "
> + "to protect against untrusted data or actions", typename);
> + return false;
> +
> + case COMPAT_POLICY_SECURITY_WARN:
> + warn_report("Type '%s' does not provide a security boundary "
> + "to protect against untrusted data or actions",
> typename);
> + return true;
> +
> + default:
> + g_assert_not_reached();
> + }
> +}
> +
> +
> const char *qapi_enum_lookup(const QEnumLookup *lookup, int val)
> {
> assert(val >= 0 && val < lookup->size);
Reviewed-by: Marc-André Lureau <[email protected]>
--
Marc-André Lureau <[email protected]>
