Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
libvirt.org/libvirt-go
.. image:: https://travis-ci.org/libvirt/libvirt-go.svg?branch=master :target: https://travis-ci.org/libvirt/libvirt-go :alt: Build Status .. image:: https://img.shields.io/static/v1?label=godev&message=reference&color=00add8 :target: https://pkg.go.dev/libvirt.org/libvirt-go :alt: API Documentation
Go bindings for libvirt.
Make sure to have libvirt-dev
package (or the development files
otherwise somewhere in your include path)
The libvirt go package provides API coverage for libvirt versions from 1.2.0 onwards, through conditional compilation of newer APIs.
By default the binding will support APIs in libvirt.so, libvirt-qemu.so and libvirt-lxc.so. Coverage for the latter two libraries can be dropped from the build using build tags 'without_qemu' or 'without_lxc' respectively.
The Go API is considered to be production ready and aims to be kept stable across future versions. Note, however, that the following changes may apply to future versions:
Existing structs can be augmented with new fields, but no existing fields will be changed / removed. New fields are needed when libvirt defines new typed parameters for various methods
Any method with an 'flags uint32' parameter will have its parameter type changed to a specific typedef, if & when the libvirt API defines constants for the flags. To avoid breakage, always pass a literal '0' to any 'flags uint32' parameter, since this will auto-cast to any future typedef that is introduced.
API documentation for the bindings <https://pkg.go.dev/libvirt.org/libvirt-go>
_API documentation for libvirt <https://libvirt.org/html/index.html>
_The libvirt project aims to add support for new APIs to libvirt-go as soon as they are added to the main libvirt C library. If you are submitting changes to the libvirt C library API, please submit a libvirt-go change at the same time. Bug fixes and other improvements to the libvirt-go library are welcome at any time.
For more information, see the CONTRIBUTING <CONTRIBUTING.rst>
_
file.
The core API unit tests are all written to use the built-in test driver (test:///default), so they have no interaction with the host OS environment.
Coverage of libvirt C library APIs / constants is verified using automated tests. These can be run by passing the 'api' build tag. eg go test -tags api
For areas where the test driver lacks functionality, it is possible to use the QEMU or LXC drivers to exercise code. Such tests must be part of the 'integration_test.go' file though, which is only run when passing the 'integration' build tag. eg go test -tags integration
In order to run the unit tests, libvirtd should be configured to allow your user account read-write access with no passwords. This can be easily done using polkit config files
::
[Passwordless libvirt access] Identity=unix-group:berrange Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes EOF
(Replace 'berrange' with your UNIX user name).
Two of the integration tests also requires that libvirtd is listening for TCP connections on localhost, with sasl auth This can be setup by editing /etc/libvirt/libvirtd.conf to set
::
listen_tls=0 listen_tcp=1 auth_tcp=sasl listen_addr="127.0.0.1"
and then start libvirtd with the --listen flag (this can be set in /etc/sysconfig/libvirtd to make it persistent).
sasl authentication must be configured_ to use either digest-md5
or
scram-sha-1
, and the needed sasl modules must be installed on the system.
.. _configured: https://libvirt.org/auth.html#ACL_server_sasl
Then create a sasl user
::
$ saslpasswd2 -a libvirt user
and enter "pass" as the password.
Alternatively a Vagrantfile
, requiring use of virtualbox,
is included to run the integration tests:
cd ./vagrant
vagrant up
to provision the virtual machinevagrant ssh
to login to the virtual machineOnce inside, sudo su -
and go test -tags integration libvirt
.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.