{"push_id":904844621,"size":4,"distinct_size":4,"ref":"refs/heads/v1.2.7-maint","head":"4ed8074672f9b847a10464d9c6be77d428c1eb1c","before":"8630f8dbacd240c1a01994b88ba5abb3a27bcdf0","commits":[{"sha":"cb76ad42cb3aa0b10e8d4d01b347c95a0bdad0ba","author":{"email":"87558058f6f829e5ec976c8ef960720af4ff9c7d@redhat.com","name":"John Ferlan"},"message":"qemu_driver: Resolve Coverity CONSTANT_EXPRESSION_RESULT\n\nThe call to virDomainSnapshotRedefinePrep() had a spurrious ! in front of\nit which caused Coverity to complan that the expression is always false.\n\n(cherry picked from commit 9d7254de430f7ef7a4c6a2a20718942369ce9d06)","distinct":true,"url":"https://api.github.com/repos/libvirt/libvirt/commits/cb76ad42cb3aa0b10e8d4d01b347c95a0bdad0ba"},{"sha":"f8c5522b4007b591ba8389052d6c590b549b3b1c","author":{"email":"bb938cf255e055ff3507f2627d214e8e62118fcf@redhat.com","name":"Daniel P. Berrange"},"message":"avoid using deprecated udev logging functions\n\nIn systemd >= 218, the udev_set_log_fn method has been marked\ndeprecated and turned into a no-op. Nothing in the udev client\nlibrary will print to stderr by default anymore, so we can\njust stop installing a logging hook for new enough udev.\n\n(cherry picked from commit a93a3b975cd0bad37ccae508d9b7a69aa72b6181)","distinct":true,"url":"https://api.github.com/repos/libvirt/libvirt/commits/f8c5522b4007b591ba8389052d6c590b549b3b1c"},{"sha":"7a9153a59131701d5b6eeaac841ffb0d729fc559","author":{"email":"e82f23e74d43760279ebcc505dac4ae70d5627d0@redhat.com","name":"Martin Kletzander"},"message":"util: Prepare URI formatting for libxml2 >= 2.9.2\n\nSince commit 8eb55d782a2b9afacc7938694891cc6fad7b42a5 libxml2 removes\ntwo slashes from the URI when there is no server part.  This is fixed\nwith beb7281055dbf0ed4d041022a67c6c5cfd126f25, but only if the calling\napplication calls xmlSaveUri() on URI that xmlURIParse() parsed.  And\nthat is not the case in virURIFormat().  virURIFormat() accepts\nvirURIPtr that can be created without parsing it and we do that when we\nformat network storage paths for gluster for example.  Even though\nvirStorageSourceParseBackingURI() uses virURIParse(), it throws that data\nstructure right away.\n\nSince we want to format URIs as URIs and not absolute URIs or opaque\nURIs (see RFC 3986), we can specify that with a special hack thanks to\ncommit beb7281055dbf0ed4d041022a67c6c5cfd126f25, by setting port to -1.\n\nThis fixes qemuxml2argvtest test where the disk-drive-network-gluster\ncase was failing.\n\nSigned-off-by: Martin Kletzander <mkletzan@redhat.com>\n(cherry picked from commit 8f17d0eaae7ee2fa3e214b79b188fc14ed5aa1eb)","distinct":true,"url":"https://api.github.com/repos/libvirt/libvirt/commits/7a9153a59131701d5b6eeaac841ffb0d729fc559"},{"sha":"4ed8074672f9b847a10464d9c6be77d428c1eb1c","author":{"email":"a9da18479c871fe903d9590822cfe2629c6a4d11@redhat.com","name":"Eric Blake"},"message":"CVE-2015-5313: storage: don't allow '/' in filesystem volume names\n\nThe libvirt file system storage driver determines what file to\nact on by concatenating the pool location with the volume name.\nIf a user is able to pick names like \"../../../etc/passwd\", then\nthey can escape the bounds of the pool.  For that matter,\nvirStoragePoolListVolumes() doesn't descend into subdirectories,\nso a user really shouldn't use a name with a slash.\n\nNormally, only privileged users can coerce libvirt into creating\nor opening existing files using the virStorageVol APIs; and such\nusers already have full privilege to create any domain XML (so it\nis not an escalation of privilege).  But in the case of\nfine-grained ACLs, it is feasible that a user can be granted\nstorage_vol:create but not domain:write, and it violates\nassumptions if such a user can abuse libvirt to access files\noutside of the storage pool.\n\nTherefore, prevent all use of volume names that contain \"/\",\nwhether or not such a name is actually attempting to escape the\npool.\n\nThis changes things from:\n\n$ virsh vol-create-as default ../../../../../../etc/haha --capacity 128\nVol ../../../../../../etc/haha created\n$ rm /etc/haha\n\nto:\n\n$ virsh vol-create-as default ../../../../../../etc/haha --capacity 128\nerror: Failed to create vol ../../../../../../etc/haha\nerror: Requested operation is not valid: volume name '../../../../../../etc/haha' cannot contain '/'\n\nSigned-off-by: Eric Blake <eblake@redhat.com>\n(cherry picked from commit 034e47c338b13a95cf02106a3af912c1c5f818d7)","distinct":true,"url":"https://api.github.com/repos/libvirt/libvirt/commits/4ed8074672f9b847a10464d9c6be77d428c1eb1c"}]}