1#!/usr/bin/env python3
2# group: rw
3#
4# Test permissions taken by the mirror-top filter
5#
6# Copyright (C) 2021 Red Hat, Inc.
7#
8# This program is free software; you can redistribute it and/or modify
9# it under the terms of the GNU General Public License as published by
10# the Free Software Foundation; either version 2 of the License, or
11# (at your option) any later version.
12#
13# This program is distributed in the hope that it will be useful,
14# but WITHOUT ANY WARRANTY; without even the implied warranty of
15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16# GNU General Public License for more details.
17#
18# You should have received a copy of the GNU General Public License
19# along with this program.  If not, see <http://www.gnu.org/licenses/>.
20#
21
22import os
23
24from qemu.machine import machine
25from qemu.qmp import QMPConnectError
26
27import iotests
28from iotests import change_log_level, qemu_img
29
30
31image_size = 1 * 1024 * 1024
32source = os.path.join(iotests.test_dir, 'source.img')
33
34
35class TestMirrorTopPerms(iotests.QMPTestCase):
36    def setUp(self):
37        qemu_img('create', '-f', iotests.imgfmt, source, str(image_size))
38        self.vm = iotests.VM()
39        self.vm.add_drive(source)
40        self.vm.add_blockdev(f'null-co,node-name=null,size={image_size}')
41        self.vm.launch()
42
43        # Will be created by the test function itself
44        self.vm_b = None
45
46    def tearDown(self):
47        try:
48            self.vm.shutdown()
49        except machine.AbnormalShutdown:
50            pass
51
52        if self.vm_b is not None:
53            self.vm_b.shutdown()
54
55        os.remove(source)
56
57    def test_cancel(self):
58        """
59        Before commit 53431b9086b28, mirror-top used to not take any
60        permissions but WRITE and share all permissions.  Because it
61        is inserted between the source's original parents and the
62        source, there generally was no parent that would have taken or
63        unshared any permissions on the source, which means that an
64        external process could access the image unhindered by locks.
65        (Unless there was a parent above the protocol node that would
66        take its own locks, e.g. a format driver.)
67        This is bad enough, but if the mirror job is then cancelled,
68        the mirroring VM tries to take back the image, restores the
69        original permissions taken and unshared, and assumes this must
70        just work.  But it will not, and so the VM aborts.
71
72        Commit 53431b9086b28 made mirror keep the original permissions
73        and so no other process can "steal" the image.
74
75        (Note that you cannot really do the same with the target image
76        and then completing the job, because the mirror job always
77        took/unshared the correct permissions on the target.  For
78        example, it does not share READ_CONSISTENT, which makes it
79        difficult to let some other qemu process open the image.)
80        """
81
82        result = self.vm.qmp('blockdev-mirror',
83                             job_id='mirror',
84                             device='drive0',
85                             target='null',
86                             sync='full')
87        self.assert_qmp(result, 'return', {})
88
89        self.vm.event_wait('BLOCK_JOB_READY')
90
91        # We want this to fail because the image cannot be locked.
92        # If it does not fail, continue still and see what happens.
93        self.vm_b = iotests.VM(path_suffix='b')
94        # Must use -blockdev -device so we can use share-rw.
95        # (And we need share-rw=on because mirror-top was always
96        # forced to take the WRITE permission so it can write to the
97        # source image.)
98        self.vm_b.add_blockdev(f'file,node-name=drive0,filename={source}')
99        self.vm_b.add_device('virtio-blk,drive=drive0,share-rw=on')
100        try:
101            # Silence AQMP errors temporarily.
102            # TODO: Remove this and just allow the errors to be logged when
103            # AQMP fully replaces QMP.
104            with change_log_level('qemu.aqmp'):
105                self.vm_b.launch()
106                print('ERROR: VM B launched successfully, '
107                      'this should not have happened')
108        except (QMPConnectError, machine.VMLaunchFailure):
109            assert 'Is another process using the image' in self.vm_b.get_log()
110
111        result = self.vm.qmp('block-job-cancel',
112                             device='mirror')
113        self.assert_qmp(result, 'return', {})
114
115        self.vm.event_wait('BLOCK_JOB_COMPLETED')
116
117
118if __name__ == '__main__':
119    # No metadata format driver supported, because they would for
120    # example always unshare the WRITE permission.  The raw driver
121    # just passes through the permissions from the guest device, and
122    # those are the permissions that we want to test.
123    iotests.main(supported_fmts=['raw'],
124                 supported_protocols=['file'])
125