1 diff -ur libvirt-8.0.0.orig/docs/auth.rst libvirt-8.0.0/docs/auth.rst
2 --- libvirt-8.0.0.orig/docs/auth.rst 2022-01-23 12:13:11.662032954 +0100
3 +++ libvirt-8.0.0/docs/auth.rst 2022-01-23 12:13:54.286119215 +0100
6 Since the libvirt SASL config file defaults to using ``GSSAPI`` (Kerberos), a
7 config change is required to enable plain password auth. This is done by
8 -editing ``/etc/sasl2/libvirt.conf`` to set the ``mech_list``
9 +editing ``/etc/sasl/libvirt.conf`` to set the ``mech_list``
10 parameter to ``scram-sha-256``.
12 **Note:** previous versions of libvirt suggested ``DIGEST-MD5`` and
13 diff -ur libvirt-8.0.0.orig/src/qemu/qemu.conf libvirt-8.0.0/src/qemu/qemu.conf
14 --- libvirt-8.0.0.orig/src/qemu/qemu.conf 2022-01-23 12:13:11.768033168 +0100
15 +++ libvirt-8.0.0/src/qemu/qemu.conf 2022-01-23 12:13:54.287119217 +0100
17 # Examples include vinagre, virt-viewer and virt-manager
18 # itself. UltraVNC, RealVNC, TightVNC do not support this
20 -# It is necessary to configure /etc/sasl2/qemu.conf to choose
21 +# It is necessary to configure /etc/sasl/qemu.conf to choose
22 # the desired SASL plugin (eg, GSSPI for Kerberos)
27 -# The default SASL configuration file is located in /etc/sasl2/
28 +# The default SASL configuration file is located in /etc/sasl/
29 # When running libvirtd unprivileged, it may be desirable to
30 # override the configs in this location. Set this parameter to
31 # point to the directory, and create a qemu.conf in that location
33 -#vnc_sasl_dir = "/some/directory/sasl2"
34 +#vnc_sasl_dir = "/some/directory/sasl"
37 # QEMU implements an extension for providing audio over a VNC connection,
39 # Enable use of SASL encryption on the SPICE server. This requires
40 # a SPICE client which supports the SASL protocol extension.
42 -# It is necessary to configure /etc/sasl2/qemu.conf to choose
43 +# It is necessary to configure /etc/sasl/qemu.conf to choose
44 # the desired SASL plugin (eg, GSSPI for Kerberos)
48 -# The default SASL configuration file is located in /etc/sasl2/
49 +# The default SASL configuration file is located in /etc/sasl/
50 # When running libvirtd unprivileged, it may be desirable to
51 # override the configs in this location. Set this parameter to
52 # point to the directory, and create a qemu.conf in that location
54 -#spice_sasl_dir = "/some/directory/sasl2"
55 +#spice_sasl_dir = "/some/directory/sasl"
57 # Enable use of TLS encryption on the chardev TCP transports.
59 diff -ur libvirt-8.0.0.orig/src/qemu/test_libvirtd_qemu.aug.in libvirt-8.0.0/src/qemu/test_libvirtd_qemu.aug.in
60 --- libvirt-8.0.0.orig/src/qemu/test_libvirtd_qemu.aug.in 2022-01-23 12:13:11.775033183 +0100
61 +++ libvirt-8.0.0/src/qemu/test_libvirtd_qemu.aug.in 2022-01-23 12:13:54.287119217 +0100
63 { "vnc_tls_x509_verify" = "1" }
64 { "vnc_password" = "XYZ12345" }
66 -{ "vnc_sasl_dir" = "/some/directory/sasl2" }
67 +{ "vnc_sasl_dir" = "/some/directory/sasl" }
68 { "vnc_allow_host_audio" = "0" }
69 { "spice_listen" = "0.0.0.0" }
72 { "spice_auto_unix_socket" = "1" }
73 { "spice_password" = "XYZ12345" }
74 { "spice_sasl" = "1" }
75 -{ "spice_sasl_dir" = "/some/directory/sasl2" }
76 +{ "spice_sasl_dir" = "/some/directory/sasl" }
77 { "chardev_tls" = "1" }
78 { "chardev_tls_x509_cert_dir" = "/etc/pki/libvirt-chardev" }
79 { "chardev_tls_x509_verify" = "1" }
80 diff -ur libvirt-8.0.0.orig/src/remote/libvirtd.conf.in libvirt-8.0.0/src/remote/libvirtd.conf.in
81 --- libvirt-8.0.0.orig/src/remote/libvirtd.conf.in 2022-01-23 12:13:11.775033183 +0100
82 +++ libvirt-8.0.0/src/remote/libvirtd.conf.in 2022-01-23 12:13:54.287119217 +0100
84 # the network providing auth (eg, TLS/x509 certificates)
86 # - sasl: use SASL infrastructure. The actual auth scheme is then
87 -# controlled from @sysconfdir@/sasl2/libvirt.conf. For the TCP
88 +# controlled from @sysconfdir@/sasl/libvirt.conf. For the TCP
89 # socket only GSSAPI & DIGEST-MD5 mechanisms will be used.
90 # For non-TCP or TLS sockets, any scheme is allowed.
93 # If you don't enable SASL, then all TCP traffic is cleartext.
94 # Don't do this outside of a dev/test scenario. For real world
95 # use, always enable SASL and use the GSSAPI or DIGEST-MD5
96 -# mechanism in @sysconfdir@/sasl2/libvirt.conf
97 +# mechanism in @sysconfdir@/sasl/libvirt.conf
100 # Change the authentication scheme for TLS sockets.
101 diff -ur libvirt-8.0.0.orig/src/remote/meson.build libvirt-8.0.0/src/remote/meson.build
102 --- libvirt-8.0.0.orig/src/remote/meson.build 2022-01-23 12:13:11.776033185 +0100
103 +++ libvirt-8.0.0/src/remote/meson.build 2022-01-23 12:13:54.288119219 +0100
105 if conf.has('WITH_SASL')
108 - install_dir: sysconfdir / 'sasl2',
109 + install_dir: sysconfdir / 'sasl',
110 rename: [ 'libvirt.conf' ],
113 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-spice-sasl.x86_64-latest.args libvirt-8.0.0/tests/qemuxml2argvdata/graphics-spice-sasl.x86_64-latest.args
114 --- libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-spice-sasl.x86_64-latest.args 2022-01-23 12:13:11.959033556 +0100
115 +++ libvirt-8.0.0/tests/qemuxml2argvdata/graphics-spice-sasl.x86_64-latest.args 2022-01-23 12:15:32.706318406 +0100
117 XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest1/.local/share \
118 XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \
119 XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
120 -SASL_CONF_PATH=/root/.sasl2 \
121 +SASL_CONF_PATH=/root/.sasl \
122 /usr/bin/qemu-system-x86_64 \
123 -name guest=QEMUGuest1,debug-threads=on \
125 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-2.11.0.args libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-2.11.0.args
126 --- libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-2.11.0.args 2022-01-23 12:13:11.960033558 +0100
127 +++ libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-2.11.0.args 2022-01-23 12:15:44.141341542 +0100
129 XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \
130 XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
131 QEMU_AUDIO_DRV=none \
132 -SASL_CONF_PATH=/root/.sasl2 \
133 +SASL_CONF_PATH=/root/.sasl \
134 /usr/bin/qemu-system-x86_64 \
135 -name guest=QEMUGuest1,debug-threads=on \
137 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-latest.args libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-latest.args
138 --- libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-latest.args 2022-01-23 12:13:11.960033558 +0100
139 +++ libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-sasl.x86_64-latest.args 2022-01-23 12:15:47.578348507 +0100
141 XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest1/.local/share \
142 XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \
143 XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
144 -SASL_CONF_PATH=/root/.sasl2 \
145 +SASL_CONF_PATH=/root/.sasl \
146 /usr/bin/qemu-system-x86_64 \
147 -name guest=QEMUGuest1,debug-threads=on \
149 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-5.2.0.args libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-5.2.0.args
150 --- libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-5.2.0.args 2022-01-23 12:13:11.960033558 +0100
151 +++ libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-5.2.0.args 2022-01-23 12:15:37.354327814 +0100
153 XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest1/.local/share \
154 XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \
155 XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
156 -SASL_CONF_PATH=/root/.sasl2 \
157 +SASL_CONF_PATH=/root/.sasl \
158 /usr/bin/qemu-system-x86_64 \
159 -name guest=QEMUGuest1,debug-threads=on \
161 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args
162 --- libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args 2022-01-23 12:13:11.960033558 +0100
163 +++ libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args 2022-01-23 12:15:20.475293652 +0100
165 XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest1/.local/share \
166 XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \
167 XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
168 -SASL_CONF_PATH=/root/.sasl2 \
169 +SASL_CONF_PATH=/root/.sasl \
170 /usr/bin/qemu-system-x86_64 \
171 -name guest=QEMUGuest1,debug-threads=on \
173 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.11.0.args libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.11.0.args
174 --- libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.11.0.args 2022-01-23 12:13:11.960033558 +0100
175 +++ libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.11.0.args 2022-01-23 12:15:28.153309190 +0100
177 XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \
178 XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
179 QEMU_AUDIO_DRV=none \
180 -SASL_CONF_PATH=/root/.sasl2 \
181 +SASL_CONF_PATH=/root/.sasl \
182 /usr/bin/qemu-system-x86_64 \
183 -name guest=QEMUGuest1,debug-threads=on \
185 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args
186 --- libvirt-8.0.0.orig/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args 2022-01-23 12:13:11.960033558 +0100
187 +++ libvirt-8.0.0/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args 2022-01-23 12:15:40.112333398 +0100
189 XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest1/.local/share \
190 XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \
191 XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
192 -SASL_CONF_PATH=/root/.sasl2 \
193 +SASL_CONF_PATH=/root/.sasl \
194 /usr/bin/qemu-system-x86_64 \
195 -name guest=QEMUGuest1,debug-threads=on \
197 diff -ur libvirt-8.0.0.orig/tests/qemuxml2argvtest.c libvirt-8.0.0/tests/qemuxml2argvtest.c
198 --- libvirt-8.0.0.orig/tests/qemuxml2argvtest.c 2022-01-23 12:13:12.005033649 +0100
199 +++ libvirt-8.0.0/tests/qemuxml2argvtest.c 2022-01-23 12:15:08.509269432 +0100
200 @@ -1552,7 +1552,7 @@
202 driver.config->vncSASL = 1;
203 VIR_FREE(driver.config->vncSASLdir);
204 - driver.config->vncSASLdir = g_strdup("/root/.sasl2");
205 + driver.config->vncSASLdir = g_strdup("/root/.sasl");
206 DO_TEST_CAPS_VER("graphics-vnc-sasl", "2.11.0");
207 DO_TEST_CAPS_LATEST("graphics-vnc-sasl");
208 driver.config->vncTLS = 1;
209 @@ -1577,7 +1577,7 @@
210 DO_TEST_CAPS_LATEST("graphics-spice");
211 DO_TEST_CAPS_LATEST("graphics-spice-no-args");
212 driver.config->spiceSASL = 1;
213 - driver.config->spiceSASLdir = g_strdup("/root/.sasl2");
214 + driver.config->spiceSASLdir = g_strdup("/root/.sasl");
215 DO_TEST_CAPS_LATEST("graphics-spice-sasl");
216 VIR_FREE(driver.config->spiceSASLdir);
217 driver.config->spiceSASL = 0;
218 diff -ur libvirt-8.0.0.orig/tests/virconfdata/libvirtd.conf libvirt-8.0.0/tests/virconfdata/libvirtd.conf
219 --- libvirt-8.0.0.orig/tests/virconfdata/libvirtd.conf 2022-01-23 12:13:12.112033865 +0100
220 +++ libvirt-8.0.0/tests/virconfdata/libvirtd.conf 2022-01-23 12:14:04.741140369 +0100
222 # the network providing auth (eg, TLS/x509 certificates)
224 # - sasl: use SASL infrastructure. The actual auth scheme is then
225 -# controlled from /etc/sasl2/libvirt.conf. For the TCP
226 +# controlled from /etc/sasl/libvirt.conf. For the TCP
227 # socket only GSSAPI & DIGEST-MD5 mechanisms will be used.
228 # For non-TCP or TLS sockets, any scheme is allowed.
231 # If you don't enable SASL, then all TCP traffic is cleartext.
232 # Don't do this outside of a dev/test scenario. For real world
233 # use, always enable SASL and use the GSSAPI or DIGEST-MD5
234 -# mechanism in /etc/sasl2/libvirt.conf
235 +# mechanism in /etc/sasl/libvirt.conf
238 # Change the authentication scheme for TLS sockets.
239 diff -ur libvirt-8.0.0.orig/tests/virconfdata/libvirtd.out libvirt-8.0.0/tests/virconfdata/libvirtd.out
240 --- libvirt-8.0.0.orig/tests/virconfdata/libvirtd.out 2022-01-23 12:13:12.112033865 +0100
241 +++ libvirt-8.0.0/tests/virconfdata/libvirtd.out 2022-01-23 12:14:04.741140369 +0100
243 # the network providing auth (eg, TLS/x509 certificates)
245 # - sasl: use SASL infrastructure. The actual auth scheme is then
246 -# controlled from /etc/sasl2/libvirt.conf. For the TCP
247 +# controlled from /etc/sasl/libvirt.conf. For the TCP
248 # socket only GSSAPI & DIGEST-MD5 mechanisms will be used.
249 # For non-TCP or TLS sockets, any scheme is allowed.
252 # If you don't enable SASL, then all TCP traffic is cleartext.
253 # Don't do this outside of a dev/test scenario. For real world
254 # use, always enable SASL and use the GSSAPI or DIGEST-MD5
255 -# mechanism in /etc/sasl2/libvirt.conf
256 +# mechanism in /etc/sasl/libvirt.conf
258 # Change the authentication scheme for TLS sockets.