On Thu, Oct 29, 2026 at 07:15:38AM +0100, Markus Armbruster wrote:
> Daniel P. Berrangé <[email protected]> writes:
>
> > With CompatPolicyInput gaining a "warn" option, the CompatPolicySecurity
> > type is redundant.
> >
> > Note the error message for insecure-input changes from
> >
> > Type 'rtl8139' does not provide a security boundary
> > to protect against untrusted data or actions
> >
> > To
> >
> > Insecure QOM type rtl8139 disabled by policy
>
> This loses a bit of information. Do we care? I show a way to retain it
> below.
>
> >
> > Signed-off-by: Daniel P. Berrangé <[email protected]>
> > ---
> > qapi/compat.json | 18 +-----------------
> > qapi/qapi-util.c | 21 ++++-----------------
> > 2 files changed, 5 insertions(+), 34 deletions(-)
> >
> > diff --git a/qapi/compat.json b/qapi/compat.json
> > index f28c24149c8..7790a7896a8 100644
> > --- a/qapi/compat.json
> > +++ b/qapi/compat.json
> > @@ -37,22 +37,6 @@
> > { 'enum': 'CompatPolicyOutput',
> > 'data': [ 'accept', 'hide' ] }
> >
> > -##
> > -# @CompatPolicySecurity:
> > -# Policy for handling any devices or backends which do not provide
> > -# a security boundary to protect against untrusted environments
> > -#
> > -# @accept: Allow any usage
> > -#
> > -# @reject: Reject with an error reported
> > -#
> > -# @warn: Allow any usage, with a warning reported
> > -#
> > -# Since: 11.2
> > -##
> > -{ 'enum': 'CompatPolicySecurity',
> > - 'data': [ 'accept', 'reject', 'warn' ] }
> > -
> > ##
> > # @CompatPolicy:
> > # Policy for handling deprecated management interfaces.
> > @@ -87,4 +71,4 @@
> > '*deprecated-output': 'CompatPolicyOutput',
> > '*unstable-input': 'CompatPolicyInput',
> > '*unstable-output': 'CompatPolicyOutput',
> > - '*insecure-input': 'CompatPolicySecurity' } }
> > + '*insecure-input': 'CompatPolicyInput' } }
>
> This adds policy value "crash", doesn't it? The commit message should
> mention it.
Ok
>
> > diff --git a/qapi/qapi-util.c b/qapi/qapi-util.c
> > index e6f3006b16c..36926b5003d 100644
> > --- a/qapi/qapi-util.c
> > +++ b/qapi/qapi-util.c
> > @@ -72,23 +72,10 @@ bool compat_policy_check_security(const CompatPolicy
> > *policy,
> > return true;
> > }
> >
> > - switch (policy->insecure_input) {
> > - case COMPAT_POLICY_SECURITY_ACCEPT:
> > - return true;
> > -
> > - case COMPAT_POLICY_SECURITY_REJECT:
> > - error_setg(errp, "Type '%s' does not provide a security boundary "
> > - "to protect against untrusted data or actions",
> > typename);
> > - return false;
> > -
> > - case COMPAT_POLICY_SECURITY_WARN:
> > - warn_report("Type '%s' does not provide a security boundary "
> > - "to protect against untrusted data or actions",
> > typename);
> > - return true;
> > -
> > - default:
> > - g_assert_not_reached();
> > - }
> > + return compat_policy_input_ok1(policy->insecure_input,
> > + "Insecure",
> > + ERROR_CLASS_GENERIC_ERROR,
> > + "QOM type", typename, errp);
> > }
>
> ... then try something like this:
>
> if (!compat_policy_input_ok1(...) {
> error_append_hint(errp, ...);
> }
>
> Don't forget ERRP_GUARD() then, error_append_hint() needs it.
Yep, that's a nice idea.
With regards,
Daniel
--
|: https://berrange.com ~~ https://hachyderm.io/@berrange :|
|: https://libvirt.org ~~ https://entangle-photo.org :|
|: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
