Stéphane Graber
11a82f81ce
incusd/daemon: Drop else branches in project expansion
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 14:46:09 -04:00
Stéphane Graber
b406a0397c
incus/low-level: Fix naming inconsistency
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 19:12:41 -04:00
Benjamin Somers
0653a5b1df
incus/low-level: Support more formats in NVRAM getter and setter
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 11:36:34 -04:00
Benjamin Somers
a25e45aeea
incusd/instances: Add headers to raw NVRAM variable response
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 11:36:33 -04:00
Benjamin Somers
fd63243512
client: Make GetRawInstanceNVRAMGUIDVar return attributes
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 11:36:30 -04:00
Stéphane Graber
8e2eab60d8
incusd: Fail closed on unknown authorization project expansion
...
The project expansion used for authorization silently returned the
requested project for any object type without an explicit branch, so a
new project-scoped API missing from the switch would bypass project
confinement. Handle every object type explicitly and error out otherwise.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:46 -04:00
Stéphane Graber
b76f970a63
incusd/instance: Confine exec-output access to its directory
...
Serve, list and delete exec output files through an os.OpenRoot handle so
a symlink in the exec-output directory can't be followed outside of it.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:45 -04:00
Stéphane Graber
620c836181
incusd: Expand network address set project for authorization
...
The project expansion used for authorization had no branch for network
address sets, so their access checks ran against the requested project
rather than the effective one, letting a restricted project act on the
default project's address sets.
This addresses GHSA-6v6x-387m-rj4w (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:43 -04:00
Stéphane Graber
f1c75c6c48
incusd/instance: Enforce project restrictions on migration overrides
...
The migration handler applied user-supplied config, device and profile
overrides without any project restriction check, letting a restricted
project set keys like security.privileged or raw.lxc.
This addresses CVE-2026-62940
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:41 -04:00
Stéphane Graber
7cec16a23c
incusd/instances: Re-check restrictions after copy config merge
...
The source instance's config is merged into the request only after the
initial project restriction check, letting a cross-project copy carry
restricted keys into the target project. Re-check the merged config.
This addresses CVE-2026-62941
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:40 -04:00
Stéphane Graber
c203fcf255
incusd/instances: Validate instance name on backup import
...
This addresses GHSA-26gp-p5fw-3r2h (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:39 -04:00
Stéphane Graber
e2547b834f
incusd/storage: Validate volume name on ISO and backup import
...
This addresses GHSA-67qw-68v3-36h6 (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:38 -04:00
Stéphane Graber
42be307a14
incusd/images: Validate image fingerprint for all protocols
...
The fingerprint validation added for CVE-2026-48769 was only applied to
the direct protocol. Validate it for all protocols and re-check after it
is taken from the remote server's response.
This addresses GHSA-p2v3-6wvc-cv3p (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:37 -04:00
Stéphane Graber
443e845023
incusd/instance: Confine metadata.yaml access to instance root
...
This addresses CVE-2026-63343
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:35 -04:00
Stéphane Graber
6a61823949
Merge pull request #3748 from bensmrs/nvram
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Add NVRAM rebuild
2026-07-30 15:38:07 -04:00
Benjamin Somers
8bb9e6ef38
incusd/instances: Fix capitalization
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 06:31:32 -04:00
Benjamin Somers
7cac94fc05
incus/low-level: Add rebuild-nvram to the list of repair actions
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 06:31:30 -04:00
Benjamin Somers
31a37dca07
incusd/instances: Add NVRAM rebuild as a repair action
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 06:31:27 -04:00
Stéphane Graber
001e0d9bca
incusd: Only load referenced profile data
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:21 -04:00
Stéphane Graber
ab062097ff
generate-database: Add ReferenceID filtering for reference tables
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:52:52 -04:00
Stéphane Graber
42d9d15249
incusd: Fix goroutine leak when cluster instance list times out
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:52:49 -04:00
Stéphane Graber
dfb97c68cb
incus/storage_volume: Add bitmap subcommand
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 00:43:33 -04:00
Stéphane Graber
99d66fa419
incus/low-level: Add repair subcommand
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 00:43:31 -04:00
Stéphane Graber
ad9d42436a
incus/low-level: Add bitmaps subcommand
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 00:43:30 -04:00
Stéphane Graber
593775c736
incusd: Fix repair endpoint swagger method
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 00:43:28 -04:00
Benjamin Somers
0f614c25f8
incus/low-level: Add nvram edit subcommand
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:51:09 -04:00
Benjamin Somers
52f88ddc16
incus/low-level: Add nvram set subcommand
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:51:08 -04:00
Benjamin Somers
b010421942
incus/usage: Add AsSingleton
...
This allows using function like kvToMap on a non-list atom.
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:51:07 -04:00
Benjamin Somers
fa0809fde0
incus/usage: Add MakeKV
...
This allows building KV-like atoms.
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:51:06 -04:00
Benjamin Somers
1d967dc872
incus: Modify argument order in flag helpers
...
This allows making default values optional where needed.
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:51:05 -04:00
Benjamin Somers
3e774be90e
incusd/instances: Add NVRAM variable update
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:51:03 -04:00
Benjamin Somers
982b10a111
incusd/instances: Diverse fixes
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:51:01 -04:00
Benjamin Somers
3b74d3cc41
incusd/instances: Add ETag on NVRAM variable getter
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:50:59 -04:00
Benjamin Somers
7b79813ebd
client: Add ETag on NVRAM variable getter
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-29 22:50:58 -04:00
Benoit TAPIA
24b477b8ca
incus/list: Add --all-remotes
...
Signed-off-by: Benoit TAPIA <benoit.tapia@sidhes.com>
2026-07-29 22:17:01 -04:00
Stéphane Graber
c3c39c1428
incusd/images: Prefer pigz for compression when available
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-29 21:24:45 -04:00
René Jochum
571befc069
incusd/images: Support reproducible pigz output
...
Signed-off-by: René Jochum <rene@jochum.dev>
2026-07-29 21:24:43 -04:00
Stéphane Graber
e096b818db
Merge pull request #3734 from gagath/launch-instance-type-link
...
incus/launch: Link to the supported instance types
2026-07-29 20:44:04 -04:00
Agathe Porte
d82f6e4ae2
incus/launch: Link to the supported instance types
...
Having to consult the documentation to find the list of supported
instances is a bit painful. Add a link to the supported instances
in the help message as well to avoid having to dig through the
documentation first.
Signed-off-by: Agathe Porte <989521+gagath@users.noreply.github.com>
2026-07-29 18:55:10 -04:00
René Jochum
82914f8647
incus-agent: Set SFTP max packet size to 128KiB
...
Signed-off-by: René Jochum <rene@jochum.dev>
2026-07-29 18:33:01 -04:00
René Jochum
fa6d37aa19
incusd/main_forkfile: Set SFTP max packet size to 128KiB
...
Signed-off-by: René Jochum <rene@jochum.dev>
2026-07-29 18:32:42 -04:00
Piotr Resztak
7ec79d0778
Merge pull request #3740 from stgraber/storage
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Storage fixes
2026-07-29 12:48:56 +02:00
Stéphane Graber
c125b0b915
Merge pull request #3739 from stgraber/api
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Update swagger response codes
2026-07-28 19:30:07 -04:00
Stéphane Graber
d37ae5fa24
incusd: Strip sub-path from dependent volume sources
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:59:40 -04:00
Stéphane Graber
5a4709d663
incusd: Document baseline error codes for endpoints using SmartError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:32:51 -04:00
Stéphane Graber
954b014a23
incusd: Document HTTP 412 on instance and snapshot PUT/PATCH
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:17:12 -04:00
Stéphane Graber
acf129d4de
incusd/network_integrations: Return 201 with Location on rename
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:17:11 -04:00
Stéphane Graber
50197c41b8
incusd: Fix incorrect return codes in Swagger specs
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:17:10 -04:00
Stéphane Graber
876747133a
incusd: Document HTTP 201 return code in Swagger specs
...
Closes #3732
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:17:09 -04:00
Stéphane Graber
cf84e3ce69
incusd/instance-types: Add support for root disk size
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 17:46:46 -04:00
