On Fri, Feb 25, 2011 at 12:03:52PM -0700, Eric Blake wrote:
> When a SPICE or VNC graphics controller is present, and sound is
> piggybacked over a channel to the graphics device rather than
> directly accessing host hardware, then there is no need to grant
> host hardware access to that qemu process.
>
> * src/qemu/qemu_cgroup.c (qemuSetupCgroup): Prevent sound with
> spice, and with vnc when vnc_allow_host_audio is 0.
> Reported by Daniel Berrange.
> ---
>
> Daniel noticed this while reviewing the audit code - the audit
> proved that we were allowing more resources than necessary.
>
> src/qemu/qemu_cgroup.c | 6 +++++-
> 1 files changed, 5 insertions(+), 1 deletions(-)
>
> diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
> index b39b5e1..e71d3fa 100644
> --- a/src/qemu/qemu_cgroup.c
> +++ b/src/qemu/qemu_cgroup.c
> @@ -241,7 +241,11 @@ int qemuSetupCgroup(struct qemud_driver *driver,
> goto cleanup;
> }
>
> - if (vm->def->nsounds) {
> + if (vm->def->nsounds &&
> + (!vm->def->ngraphics ||
> + ((vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
> + driver->vncAllowHostAudio) ||
> + (vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL)))) {
> rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR);
> qemuDomainCgroupAudit(vm, cgroup, "allow", "major", "sound",
> rc == 0);
ACK
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list