Oliver Kurth [Fri, 15 Sep 2017 18:22:55 +0000 (11:22 -0700)]
Allow SAML authn to bypass impersonation if the user is unchanged
vmwsu can't create an impersonation token for SYSTEM since its
not a 'real' account. So bypass the impersonation phase since
toolsd is already running as SYSTEM.
Oliver Kurth [Fri, 15 Sep 2017 18:22:55 +0000 (11:22 -0700)]
Remove an assert and save vSock family reference in vmsvc only.
VMCISock_GetAFValueFd API does not open a vsock device if kernel
has upstreamed drivers. So, the ASSERT for vsock fd is not valid
in such cases and has to go. Instead, save the reference only when
family as well as fd are valid, because there is no need to save
the reference in case of upstreamed drivers case anyway.
If 'vmusr' holds a reference to vSock address family, it could
come in the way of upgrade because 'vmusr' keeps running during
upgrade. To avoid that issue and given that we just need one
reference, we limit the reference to main service only.
Also fix the VMCISock_GetAFValueFd API to initialize outFd in
case of upstreamed drivers.
Oliver Kurth [Fri, 15 Sep 2017 18:22:55 +0000 (11:22 -0700)]
Changes to support valgrind with Tools
Allow Tools to be built with valgrind support. With these changes,
adding "export USE_VALGRIND=1" in Local.mk will build a version of
Tools that works with valgrind.
Also includes a change to turn off appLoader for vmtoosld
and toolbox-cmd.
Oliver Kurth [Fri, 15 Sep 2017 18:22:55 +0000 (11:22 -0700)]
add toolbox-cmd for tools.conf config entries
Add a generic tools.conf set/get mechanism that can
be used for any config entry. The first specific use case
is to enable/disable the allowLocalSystem pref for SRM.
Oliver Kurth [Fri, 15 Sep 2017 18:22:54 +0000 (11:22 -0700)]
Don't auto-retry RpcChannel_Send when error is final.
RpcChannel_Send retries in case of any error. However, retry makes
sense only when there is a transport error. When there is a failure
returned from VMware in handling the RPC command, the error is final
and retrying does not make any sense. We need to avoid retry when
it is not a transport error. In order to differentiate between
the two types of errors the internal function signatures required
changes. As there are not many direct consumers for RpcOut_send, fix
all of its callers to check rpcStatus along with the return value of
the function. New API behavior also allows removal of some string
comparisons on "reply".
There are no other behavioral changes intended in RpcChannel_Send,
so all the callers of this function remain untouched.
Oliver Kurth [Fri, 15 Sep 2017 18:22:54 +0000 (11:22 -0700)]
Fix guestproxycerttool to properly handle non-ASCII filenames
Filenames are being passed as UTF-8, but file
opens (both CreateFile and fopen()) were assuming
ASCII. Switch to a conversion & CreateFielW and g_fopen(),
which handles full UTF-8 filenames.
Also tweak the error logging to dump the error code
for easier debugging on non-english OSes.
Oliver Kurth [Fri, 15 Sep 2017 18:22:53 +0000 (11:22 -0700)]
Fix a namespace tool crash.
The namespace tool core-dumps when running the following command
vmware-namespace-cmd -V get-value name -k key
This is because glib options parser removed the -V from the argv,
and passed the ValidateNsCommands() check. However, the later
RunNamespacecommand shall ASSERT() on the NULL nscmd.
Oliver Kurth [Fri, 15 Sep 2017 18:22:53 +0000 (11:22 -0700)]
open-vm-tools: add udev rules to set scsi timeout
To avoid volumes going read-only of offline, a longer timeout
is needed, see bug #271286. This is already done for tar tools
and OSPs using udev rules, but not yet for open-vm-tools. This change adds
a udev rule for open-vm-tools.
A static file is used, and it will be installed for Linux always and only.
There used to be a different format for udev rules, but that is very old
(before 2010 at least), and used for RHEL up until RHEL 5 and SLE until
SLE 10. It is not thought that we need to support these old udev versions for
open-vm-tools.
Oliver Kurth [Fri, 15 Sep 2017 18:22:53 +0000 (11:22 -0700)]
Make NullProvider race-free to be thread-safe.
NullProvider start function was sending 'prov.snapshotCommit'
message to VMX which was being done on the worker thread.
This led to a race condition where VMX state machine advanced
faster than guest side state machine. Later, when VMX state
machine sent 'vmbackup.snapshotDone' to vmbackup plugin it
did not like it because it was not ready for that message.
In order to fix this issue, we need to split the code that
sends 'prov.snapshotCommit' message into a separate callback
that gets called by the main thread instead of the worker
thread. To do that, we needed to create a VmBackupOp for
NullProvider so that it can be monitored by the top level
state machine.
While there also fixed a subtle race found by Victor in
VmBackupAsyncCallback. Basically, it can prematurely release
an op if the op was set by worker thread between QueryStatus
and Release calls (i.e. line 483-488). This is possible
due the initial value of status. Fixed the initial value of
status to make it impossible.
Oliver Kurth [Fri, 15 Sep 2017 18:22:52 +0000 (11:22 -0700)]
Hold a reference to vSocket address family in vmtoolsd.
On old hosts that do not support secure guestRpc vmtoolsd
falls back to use backdoor. However, there could be vmci
and vsocket drivers loaded in the guest that make vSocket
consumers (e.g. guestLib and namespace-cmd) try vSocket
all the time before falling back to backdoor. On old Linux
guests like RHEL 5, 6 (kernels below 3.9 that do not have
upstreamed vmci and vsocket drivers) this causes log spew
in guest system logs because of vSocket address family being
registered and unregistered on each RPC call (RpcChannel_SendOne).
This could be solved in multiple ways involving some
work from user. In order to solve this problem in a user
friendly way, we hold a reference to vSocket device in
vmtoolsd service, so that the reference goes away during
Tools upgrade.
Oliver Kurth [Fri, 15 Sep 2017 18:22:51 +0000 (11:22 -0700)]
open-vm-tools: fix build error in Ubuntu 16.04
The -std=c++11 causes an error when used with the GNU C compiler, but it
is in GTKMM_CPPFLAGS. So this change moves GTKMM_CPPFLAGS from
libdndcp_la_CPPFLAGS to libdndcp_la_CXXFLAGS in
services/plugins/dndcp/Makefile.am.
Oliver Kurth [Fri, 15 Sep 2017 18:22:51 +0000 (11:22 -0700)]
Hgfs Linux Client: fix editor prompts for file changes
When using some editors such as gedit to modify files on the HGFS
shares the editor can become confused thinking that the file has
been modified remotely and therefore needs to refresh the contents.
This occurs due to the file's modify and change times being updated
after the last writes from the editor and the modify/change times
in the inode not being updated immediately.
Oliver Kurth [Fri, 15 Sep 2017 18:22:51 +0000 (11:22 -0700)]
Detect slow running systems in guestInfo.
- Added a new function in guestInfo. The new function checks the last
time when the guest info was captured and prints a warning and sends
a RPC message to the VMX if the elapsed interval was more than the
expected poll interval.
Oliver Kurth [Fri, 15 Sep 2017 18:22:49 +0000 (11:22 -0700)]
Tools: Implement resolutionKMS for linux
tools: Enable the use of the PKG_CHECK_MODULES macro for open-vm-tools
Adds a path to the pkg-config utility and sets up the open-vm-tools test
build environment to be aware of its m4 macros.
Also sets up a local directory for .pc files and adds the libdrm and libudev
pc files to that directory (during open-vm-tools configure time) to prepare
for resolutionKMS testing.
tools: Prepare resolutionSet for resolutionKMS on Linux
- Add a set of utilities for detecting the DRM version, the Xorg driver
version and to dlopen libudev and libdrm if they are not available at
build time. The utilities also include opening and closing a DRM file
descriptor from a given type of device node.
- Change the check for Xorg driver version in resolutionX11 to use the
new utility
- Pass a ToolsAppCtx to the resolutionSet backend for access to the
configuration database.
- Finally, detect if there is system and / or configuration support for
resolutionKMS and in that case back off resolutionSet
- Added some license information to resolutionDL.h
- Added an include to resolutionDL.h
- Fixed some ifdefs around HAVE_RESOLUTIONKMS
- Modified other backends for the new resolutionToolkitInit() interface.
tools: Add the resolutionKMS plugin
What's resolutionKMS
ResolutionKMS is a plugin that takes over the resolutionSet functionality,
but as a vmsvc plugin rather than a vmusr plugin. Instead of talking to the
X server it talks to the Kernel Mode Setting (KMS) functionality of the
vmwgfx kernel module. This enables the following functionality.
- Resolution / Topology switching at the login screen
- Resolution / Topology switching when multiple users have launched multiple
X servers as part of fast user-switching.
- Resolution / Topology switching for new native compositors that support
the KMS way of communicating resolution / topology (as preferred mode and
connector properties) As far as I know, only gnome-shell / Wayland can do the
topology switching today, since I implemented the missing support for it.
We need to address this issue also with Mir and other Wayland implementations.
New dependencies.
The new code requires libudev and libdrm. For open-vm-tools, I've opted to
require those libraries at configure time. There's no option to build linux
open-vm-tools without resolutionKMS support, although that should be easy to
add if needed. For vmware-tools, there is code to enable resolutionKMS iff
libudev.so.1 and libdrm.so.2 are present at load time and can be dlopened.
For vmware tools there are no new build dependencies introduced at load time
AFAIK. (dlopen?)
Enablement
ResolutionKMS requires vmwgfx 2.10.0+ and xf86-video-vmware 13.2.0+ to
guarantee that we don't lose functionality compared to old resolutionSet. The
vmwgfx kernel module has a way to check version at runtime. For the xorg driver
the situation is different since resolutionKMS is typically launched before
Xorg. Therefore we fall back to the hackish way previously implemented in
resolutionX11.c to find the driver file and scan it for version info. Oh well.
In any case, there is also an option to override this and enable or disable
resolutionKMS in the tools.conf file. If resolutionKMS is disable either by
lacking system support or by configuration, the old resolutionSet functionality
kicks in. Extensive debugging info will be present in the tools daemon logs.
Oliver Kurth [Fri, 15 Sep 2017 18:22:47 +0000 (11:22 -0700)]
Hgfs Fuse Client: fix symlinks
Symlinks were not being handled correctly for some cases.
The symlink creation call tried to make the target an absolute path which
it should not do. Only the source is passed as the absolute path which
is created and links to the target which can be relative or absolute but
is dependent on what the user passes.
The readlink was broken and incorrectly creating a target name to pass
to the FUSE library.
This was obvious when alternative mount points are used
e.g. .host:/Users -> /Users
instead of
.host:/ /mnt/hgfs
This was discovered when used in the containers environment with docker.
However, it is a standard option for HGFS client usage in any hosted product.
Oliver Kurth [Fri, 15 Sep 2017 18:22:47 +0000 (11:22 -0700)]
vmxnet3_defs.h: Common header file changes; not directly relevant to
open-vm-tools.
- Fix Rx Ring2 max size
- Add Tx Data Ring Desc Size config support
Oliver Kurth [Fri, 15 Sep 2017 18:22:47 +0000 (11:22 -0700)]
Correct the freeze and thaw ordering for mount points
There were two issues with the way we were doing quiescing on Linux:
1. Thaw was following the same order as freeze, actually it should
follow the reverse order of freeze. Fixed the thaw order.
2. Freeze was following the order provided by getmntent API which is
the order in which system created the mount points. This could
be problematic when a mount point depends on other mount point,
e.g. loopback mount point. In order to honor the dependency
among mount points, we need to reverse the order of mount points
listed by getmntent API.
While reviewing this change it was found that the interface used for
passing the mount points around was not very clean. It was a ':'
separated string of mount points. There were multiple problems with it.
We were converting a list of strings into one string and then tokenizing
it later. As part of this change, we fix that interface too by replacing
the string with single-linked list, GSList. Using GSList brings glib
dependency to lib/syncDriver.
Oliver Kurth [Fri, 15 Sep 2017 18:22:47 +0000 (11:22 -0700)]
Changes to common files.
- lib/file/fileIO.c: Make Fil3_SwapFilesi() path more robust wrt resource
contentions.
- Common header file change; not relevant to open-vm-tools.
Oliver Kurth [Fri, 15 Sep 2017 18:22:44 +0000 (11:22 -0700)]
Fix some leaks found by valgrind.
- leaking the 'data' pref value for a log handler.
- leaking an rpc message response if the caller doesn't want it.
- leaking username/password for every guestOp
Oliver Kurth [Fri, 15 Sep 2017 18:22:43 +0000 (11:22 -0700)]
lib/hashMap: Remove unused HasMap_Store() and _Retrieve() functions.
CheckSanity() should only be compiled if VMX86_DEBUG is set to avoid
an unused function warning from clang 3.4.
Oliver Kurth [Fri, 15 Sep 2017 18:22:43 +0000 (11:22 -0700)]
lib/log: make the default log level accessible - and use it
The default log level is known interally to the Log Facility. It needs
to be available "everywhere". Do that and deploy it to all places
that should use it.
Oliver Kurth [Fri, 15 Sep 2017 18:22:43 +0000 (11:22 -0700)]
Multiple fixes for common source code.
- File_FullPath() revised to return the canonical path of a file or
directory that exists or is about to be created as a child of an
existing directory.
- Common header file updates; not related to open-vm-tools