From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <pve-devel-bounces@lists.proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 37F731FF165 for <inbox@lore.proxmox.com>; Wed, 29 Jan 2025 16:54:30 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id D40F12F237; Wed, 29 Jan 2025 16:54:27 +0100 (CET) From: Filip Schauer <f.schauer@proxmox.com> To: pve-devel@lists.proxmox.com Date: Wed, 29 Jan 2025 16:53:30 +0100 Message-Id: <20250129155339.164696-1-f.schauer@proxmox.com> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.024 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH cluster/guest-common/manager/qemu-server v2 0/9] fix #5657: allow configuring RNG device as non-root user X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/> List-Post: <mailto:pve-devel@lists.proxmox.com> List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe> Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com> Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com> Allow users with the VM.Config.HWType privilege to configure VirtIO RNG devices on VMs with either /dev/urandom or /dev/random as the entropy source. Further introduce hardware RNG device mapping to be able to selectively allow non-root users with the Mapping.Use privilege to configure hardware RNG devices as entropy sources. Changes since v1: * Restrict use of /dev/hwrng to the root user * introduce hardware RNG mapping pve-guest-common: Filip Schauer (1): mapping: add a hardware RNG mapping config src/Makefile | 1 + src/PVE/Mapping/HWRNG.pm | 147 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 148 insertions(+) create mode 100644 src/PVE/Mapping/HWRNG.pm pve-cluster: Filip Schauer (1): cfs: add 'mapping/hwrng.cfg' to observed files src/PVE/Cluster.pm | 1 + src/pmxcfs/status.c | 1 + 2 files changed, 2 insertions(+) pve-manager: Filip Schauer (4): introduce hardware rng mapping api introduce hardware rng scanning api ui: add hardware RNG resource mapping ui: allow use of mapped hardware RNGs as entropy sources for VMs PVE/API2/Cluster/Mapping.pm | 7 + PVE/API2/Cluster/Mapping/HWRNG.pm | 286 ++++++++++++++++++++++++++ PVE/API2/Cluster/Mapping/Makefile | 5 +- PVE/API2/Hardware.pm | 7 + PVE/API2/Hardware/HWRNG.pm | 47 +++++ PVE/API2/Hardware/Makefile | 1 + www/manager6/Makefile | 3 + www/manager6/data/PermPathStore.js | 1 + www/manager6/dc/Config.js | 10 + www/manager6/dc/HWRNGMapView.js | 76 +++++++ www/manager6/form/HWRNGMapSelector.js | 99 +++++++++ www/manager6/qemu/HardwareView.js | 9 +- www/manager6/qemu/RNGEdit.js | 79 ++++--- www/manager6/window/HWRNGMapEdit.js | 149 ++++++++++++++ 14 files changed, 748 insertions(+), 31 deletions(-) create mode 100644 PVE/API2/Cluster/Mapping/HWRNG.pm create mode 100644 PVE/API2/Hardware/HWRNG.pm create mode 100644 www/manager6/dc/HWRNGMapView.js create mode 100644 www/manager6/form/HWRNGMapSelector.js create mode 100644 www/manager6/window/HWRNGMapEdit.js qemu-server: Filip Schauer (3): refactor: move rng related code into its own module allow non-root users to set /dev/u?random as an RNG source let VirtIO RNG devices source entropy from mapped HWRNGs PVE/API2/Qemu.pm | 47 ++++++++++++ PVE/QemuServer.pm | 101 +++++++------------------- PVE/QemuServer/Makefile | 1 + PVE/QemuServer/RNG.pm | 156 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 229 insertions(+), 76 deletions(-) create mode 100644 PVE/QemuServer/RNG.pm Summary over all repositories: 22 files changed, 1127 insertions(+), 107 deletions(-) -- Generated by git-murpp 0.6.0 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel