[libvirt] [PATCH v2 1/2] nwfilter: Disallow binding creation in session mode

John Ferlan jferlan at redhat.com
Thu Aug 30 15:06:07 UTC 2018


Similar to nwfilterDefineXML, let's be sure the a filter binding
creation is not attempted in session mode and generate the proper
error message.

Failure to open nwfilter in session mode (nwfilterConnectOpen)
fails already, but that doesn't stop the free thinker from using
a different connection in order to attempt to attempt to create
the binding. Although even doing that would result in a failure:

$ virsh nwfilter-binding-create QEMUGuest1-binding.xml
error: Failed to create network filter from QEMUGuest1-binding.xml
error: internal error: Could not get access to ACL tech driver 'ebiptables'

$

Signed-off-by: John Ferlan <jferlan at redhat.com>
---
 src/nwfilter/nwfilter_driver.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c
index ac3a964388..1ee5162b9a 100644
--- a/src/nwfilter/nwfilter_driver.c
+++ b/src/nwfilter/nwfilter_driver.c
@@ -745,6 +745,12 @@ nwfilterBindingCreateXML(virConnectPtr conn,
 
     virCheckFlags(0, NULL);
 
+    if (!driver->privileged) {
+        virReportError(VIR_ERR_OPERATION_INVALID, "%s",
+                       _("Can't define NWFilter bindings in session mode"));
+        return NULL;
+    }
+
     def = virNWFilterBindingDefParseString(xml);
     if (!def)
         return NULL;
-- 
2.17.1




More information about the libvir-list mailing list