Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
---
src/qemu/qemu_tpm.c | 47 +++++++++++++++++----------------------------
1 file changed, 18 insertions(+), 29 deletions(-)
diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
index 592fcc62fa..e8e7e8b5c1 100644
--- a/src/qemu/qemu_tpm.c
+++ b/src/qemu/qemu_tpm.c
@@ -347,9 +347,7 @@ qemuTPMVirCommandAddEncryption(virCommand *cmd,
* @vmname: the name of the VM
* @vmuuid: the UUID of the VM
* @privileged: whether we are running in privileged mode
- * @swtpm_user: The userid to switch to when setting up the TPM;
- * typically this should be the uid of 'tss' or 'root'
- * @swtpm_group: The group id to switch to
+ * @cfg: virQEMUDriverConfig
* @emulator: emulator parameters
* @secretuuid: UUID describing virStorageEncryption holding secret
* @incomingMigration: whether we have an incoming migration
@@ -362,8 +360,7 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
const char *vmname,
const unsigned char *vmuuid,
bool privileged,
- uid_t swtpm_user,
- gid_t swtpm_group,
+ const virQEMUDriverConfig *cfg,
const virDomainTPMEmulatorDef *emulator,
const unsigned char *secretuuid,
bool incomingMigration)
@@ -391,8 +388,8 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
virUUIDFormat(vmuuid, uuid);
vmid = g_strdup_printf("%s:%s", vmname, uuid);
- virCommandSetUID(cmd, swtpm_user);
- virCommandSetGID(cmd, swtpm_group);
+ virCommandSetUID(cmd, cfg->swtpm_user); /* should be uid of 'tss' or 'root' */
+ virCommandSetGID(cmd, cfg->swtpm_group);
switch (emulator->version) {
case VIR_DOMAIN_TPM_VERSION_1_2:
@@ -463,9 +460,7 @@ qemuTPMPcrBankBitmapToStr(virBitmap *activePcrBanks)
*
*
* @storagepath: path to the directory for TPM state
- * @swtpm_user: The userid to switch to when setting up the TPM;
- * typically this should be the uid of 'tss' or 'root'
- * @swtpm_group: The group id to switch to
+ * @cfg: virQEMUDriverConfig
* @emulator: emulator parameters
* @secretuuid: The secret's UUID needed for state encryption
*
@@ -473,8 +468,7 @@ qemuTPMPcrBankBitmapToStr(virBitmap *activePcrBanks)
*/
static int
qemuTPMEmulatorReconfigure(const char *storagepath,
- uid_t swtpm_user,
- gid_t swtpm_group,
+ const virQEMUDriverConfig *cfg,
const virDomainTPMEmulatorDef *emulator,
const unsigned char *secretuuid)
{
@@ -493,8 +487,8 @@ qemuTPMEmulatorReconfigure(const char *storagepath,
cmd = virCommandNew(swtpm_setup);
- virCommandSetUID(cmd, swtpm_user);
- virCommandSetGID(cmd, swtpm_group);
+ virCommandSetUID(cmd, cfg->swtpm_user); /* should be uid of 'tss' or 'root' */
+ virCommandSetGID(cmd, cfg->swtpm_group);
virCommandAddArgList(cmd, "--tpm2", NULL);
@@ -528,8 +522,7 @@ qemuTPMEmulatorReconfigure(const char *storagepath,
* @vmname: The name of the VM
* @vmuuid: The UUID of the VM
* @privileged: whether we are running in privileged mode
- * @swtpm_user: The uid for the swtpm to run as (drop privileges to from root)
- * @swtpm_group: The gid for the swtpm to run as
+ * @cfg: virQEMUDriverConfig
* @incomingMigration: whether we have an incoming migration
*
* Create the virCommand use for starting the emulator
@@ -541,8 +534,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm,
const char *vmname,
const unsigned char *vmuuid,
bool privileged,
- uid_t swtpm_user,
- gid_t swtpm_group,
+ const virQEMUDriverConfig *cfg,
bool incomingMigration)
{
g_autoptr(virCommand) cmd = NULL;
@@ -565,7 +557,8 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm,
create_storage = false;
if (create_storage &&
- qemuTPMEmulatorCreateStorage(tpm, &created, swtpm_user, swtpm_group) < 0)
+ qemuTPMEmulatorCreateStorage(tpm, &created,
+ cfg->swtpm_user, cfg->swtpm_group) < 0)
return NULL;
if (tpm->data.emulator.hassecretuuid)
@@ -573,16 +566,13 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm,
if (created &&
qemuTPMEmulatorRunSetup(tpm->data.emulator.storagepath, vmname, vmuuid,
- privileged, swtpm_user, swtpm_group,
- &tpm->data.emulator,
+ privileged, cfg, &tpm->data.emulator,
secretuuid, incomingMigration) < 0)
goto error;
if (!incomingMigration &&
- qemuTPMEmulatorReconfigure(tpm->data.emulator.storagepath,
- swtpm_user, swtpm_group,
- &tpm->data.emulator,
- secretuuid) < 0)
+ qemuTPMEmulatorReconfigure(tpm->data.emulator.storagepath, cfg,
+ &tpm->data.emulator, secretuuid) < 0)
goto error;
unlink(tpm->data.emulator.source->data.nix.path);
@@ -608,8 +598,8 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm,
virCommandAddArg(cmd, "--terminate");
- virCommandSetUID(cmd, swtpm_user);
- virCommandSetGID(cmd, swtpm_group);
+ virCommandSetUID(cmd, cfg->swtpm_user);
+ virCommandSetGID(cmd, cfg->swtpm_group);
switch (tpm->data.emulator.version) {
case VIR_DOMAIN_TPM_VERSION_1_2:
@@ -926,8 +916,7 @@ qemuTPMEmulatorStart(virQEMUDriver *driver,
if (!(cmd = qemuTPMEmulatorBuildCommand(tpm, vm->def->name, vm->def->uuid,
driver->privileged,
- cfg->swtpm_user,
- cfg->swtpm_group,
+ cfg,
incomingMigration)))
return -1;
--
2.46.1
