On Thu, Sep 10, 2026 at 11:36:15AM +0100, Daniel P. Berrangé wrote:
> This introduces a new flag "secure" against the Type/TypeInfo
> structs, and helpers to check this against the ObjectClass
> struct.
>
> If an object is considered to provide a security boundary to
> protect against untrusted code, the "secure" flag must be
> explicitly set to true.
>
> If it is set to false, or left unset, this indicates that
> the object does not intend to provide a security boundary.
> Bugs related to this object class will be ineligible for
> CVE assignment.
>
> Reviewed-by: Marc-André Lureau <[email protected]>
> Signed-off-by: Daniel P. Berrangé <[email protected]>
> ---
> include/qom/object.h | 13 +++++++++++++
> qom/object.c | 7 +++++++
> 2 files changed, 20 insertions(+)
Enabling the experimental Rust support flags an omission in this
patch, so I'll squash in the following trivial change when sending
a pull request:
diff --git a/rust/qom/src/qom.rs b/rust/qom/src/qom.rs
index bbb485e2cfd..81449eeefad 100644
--- a/rust/qom/src/qom.rs
+++ b/rust/qom/src/qom.rs
@@ -651,6 +651,9 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
/// Whether the object can be instantiated
const ABSTRACT: bool = false;
+ /// Whether the object provides a security boundary for untrusted
access
+ const SECURE: bool = false;
+
/// Function that is called to initialize an object. The parent class
will
/// have already been initialized so the type is only responsible for
/// initializing its own members.
@@ -687,6 +690,7 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
},
instance_finalize: Some(drop_object::<Self>),
abstract_: Self::ABSTRACT,
+ secure: Self::SECURE,
class_size: core::mem::size_of::<Self::Class>(),
class_init: Some(rust_class_init::<Self>),
class_base_init: Self::CLASS_BASE_INIT,
>
> diff --git a/include/qom/object.h b/include/qom/object.h
> index 7ecd0f210f..687ceb6bba 100644
> --- a/include/qom/object.h
> +++ b/include/qom/object.h
> @@ -453,6 +453,10 @@ struct Object
> * function.
> * @abstract: If this field is true, then the class is considered abstract
> and
> * cannot be directly instantiated.
> + * @secure: If this field is initialized to true, then the class is
> considered
> + * to provide a security boundary. If initialized to false, the class does
> + * not provide a security boundary. If uninitialized (and thus implicitly
> + * false) its status is not yet defined.
> * @class_size: The size of the class object (derivative of #ObjectClass)
> * for this object. If @class_size is 0, then the size of the class will
> be
> * assumed to be the size of the parent class. This allows a type to avoid
> @@ -487,6 +491,7 @@ struct TypeInfo
> void (*instance_finalize)(Object *obj);
>
> bool abstract;
> + bool secure;
> size_t class_size;
>
> void (*class_init)(ObjectClass *klass, const void *data);
> @@ -1074,6 +1079,14 @@ const char *object_class_get_name(ObjectClass *klass);
> */
> bool object_class_is_abstract(ObjectClass *klass);
>
> +/**
> + * object_class_is_secure:
> + * @klass: The class to check security of
> + *
> + * Returns: %true if @klass is declared to be secure, %false if not declared
> + */
> +bool object_class_is_secure(ObjectClass *klass);
> +
> /**
> * object_class_by_name:
> * @typename: The QOM typename to obtain the class for.
> diff --git a/qom/object.c b/qom/object.c
> index b1834a57cc..32736a0111 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -67,6 +67,7 @@ struct TypeImpl
> void (*instance_finalize)(Object *obj);
>
> bool abstract;
> + bool secure;
>
> const char *parent;
> TypeImpl *parent_type;
> @@ -122,6 +123,7 @@ static TypeImpl *type_new(const TypeInfo *info)
> ti->instance_finalize = info->instance_finalize;
>
> ti->abstract = info->abstract;
> + ti->secure = info->secure;
>
> for (i = 0; info->interfaces && info->interfaces[i].type; i++) {
> ti->interfaces[i].typename = g_strdup(info->interfaces[i].type);
> @@ -1144,6 +1146,11 @@ bool object_class_is_abstract(ObjectClass *klass)
> return klass->type->abstract;
> }
>
> +bool object_class_is_secure(ObjectClass *klass)
> +{
> + return klass->type->secure;
> +}
> +
> const char *object_class_get_name(ObjectClass *klass)
> {
> return klass->type->name;
> --
> 2.55.0
>
With regards,
Daniel
--
|: https://berrange.com ~~ https://hachyderm.io/@berrange :|
|: https://libvirt.org ~~ https://entangle-photo.org :|
|: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
