tests: Flesh out securityselinuxhelper

Add fake implementations of:

- is_selinux_enabled
- security_disable
- selinux_virtual_domain_context_path
- selinux_virtual_image_context_path
- selinux_lxc_contexts_path
- selabel_open
- selabel_close
- selabel_lookup_raw

The selabel_* functions back onto the real implementations if SELinux is
enabled on the test system, otherwise we just implement a fake selabel
handle which errors out on all labelling lookups.

With these changes in place, securityselinuxtest and
securityselinuxlabeltest don't need to skip all tests if SELinux isn't
available; they can exercise much of the security manager code.

Signed-off-by: Michael Chapman <mike@very.puzzling.org>
tests: SELinux tests do not need to be skipped

With the previous commit's securityselinuxhelper enhancements, the
SELinux security manager can be tested even without SELinux enabled on
the test system.

Signed-off-by: Michael Chapman <mike@very.puzzling.org>
virIdentityGetSystem: don't fail if SELinux is disabled

If SELinux is compiled into libvirt but it is disabled on the host,
libvirtd logs:

  error : virIdentityGetSystem:173 : Unable to lookup SELinux process
  context: Invalid argument

on each and every client connection.

Use is_selinux_enabled() to skip retrieval of the process's SELinux
context if SELinux is disabled.

Signed-off-by: Michael Chapman <mike@very.puzzling.org>
tests: Test virIdentityGetSystem

Test it once with SELinux enabled and once with it disabled.

Signed-off-by: Michael Chapman <mike@very.puzzling.org>
virscsi: Introduce virSCSIDeviceUsedByInfoFree

This resolves a Coverity RESOURCE_LEAK issue introduced by commit
id 'de6fa535' where the virSCSIDeviceSetUsedBy() didn't VIR_FREE
the 'copy' or possibly VIR_STRDUP()'d values.  It also ensures that
the VIR_APPEND_ELEMENT is successful...
tests: Fix SELinux tests in VPATH build
virsh: Sort options alphabetically

Man page, help output and also parsing is sorted in order to find
options smoothly.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Fix locking in virsh console

vshRunConsole() uses virCondWait() which is a wrapper around
pthread_cond_wait(). On FreeBSD, pthread_cond_wait needs mutex to be
locked, otherwise it immediately fails with EPERM. On Linux, the
behaviour in this case is undefined.

So lock the mutex before calling virCondWait().
Add a mutex to serialize updates to firewall

The nwfilter conf update mutex previously serialized
updates to the internal data structures for firewall
rules, and updates to the firewall itself. The latter
was recently turned into a read/write lock, and filter
instantiation allowed to proceed in parallel. It was
believed that this was ok, since each filter is created
on a separate iptables/ebtables chain.

It turns out that there is a subtle lock ordering problem
on virNWFilterObjPtr instances. __virNWFilterInstantiateFilter
will hold a lock on the virNWFilterObjPtr it is instantiating.
This in turn invokes virNWFilterInstantiate which then invokes
virNWFilterDetermineMissingVarsRec which then invokes
virNWFilterObjFindByName. This iterates over every single
virNWFilterObjPtr in the list, locking them and checking their
name. So if 2 or more threads try to instantiate a filter in
parallel, they'll all hold 1 lock at the top level in the
__virNWFilterInstantiateFilter method which will cause the
other thread to deadlock in virNWFilterObjFindByName.

The fix is to add an exclusive mutex to serialize the
execution of __virNWFilterInstantiateFilter.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
conf: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

This fixes a possible double free. In virNetworkAssignDef() if
virBitmapNew() fails, then virNetworkObjFree(network) is called.
However, with network->def pointing to actual @def. So if caller
frees @def again, ...

Moreover, this fixes one possible memory leak too. In
virInterfaceAssignDef() if appending to the list of interfaces
fails, we ought to call virInterfaceObjFree() instead of bare
VIR_FREE().

Although, in order to do that some array size variables needs
to be turned into size_t rather than int.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/lxc/: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/nwfilter: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/openvz: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/parallels: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/phyp: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/qemu: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/rpc: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/storage: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/test: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
src/util: Utilize more of VIR_(APPEND|INSERT|DELETE)_ELEMENT

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>