libvirt bug fix and enhancement update

Updated libvirt packages that fix multiple bugs and add two enhancements are now
available for Red Hat Enterprise Linux 6.

The libvirt library is a C API for managing and interacting with the
virtualization capabilities of Linux and other operating systems.

These updated libvirt packages include multiple bug fixes and enhancements. The
most significant changes are as follow:

* This update forces all libvirt managed KVM guests with virtio drives to run
with the "scsi=off" option. This will prevent SCSI requests in guests being
passed to underlying block devices on the host; however, a separate bug is
preventing "scsi=off" from working correctly. A malicious, privileged guest user
could issue a crafted request that would still be passed to the underlying block
device.

A future qemu-kvm update will correct the "scsi=off" functionality, blocking
such crafted requests, and allowing CVE-2011-4127 to be mitigated before the
kernel update is applied.

As "scsi=off" may break legitimate pass through of SCSI requests, this update
also adds a new value for the device attribute in the disk XML element, "lun".
This type is like the default "disk" device, but will allow SCSI requests from
guests to be passed to the underlying block device on the host. (Using the
"lun" device attribute causes the guest to run with "scsi=on".)

Note: After installing the RHSA-2011:1849 kernel update, it will not be possible
for guests to issue SCSI requests on virtio drives backed by partitions or LVM
volumes, even if "device='lun'" is used. It will only be possible to issue SCSI
requests on virtio drives backed by whole disks.

Refer to Red Hat Knowledgebase for details about CVE-2011-4127 (BZ#768469):

https://access.redhat.com/kb/docs/DOC-67874

* This update adds support for VMware vSphere Hypervisor (ESXi) 5 installations.
(BZ#759061)

* The libvirt package was missing a dependency on the avahi package. The
dependency is required due to mDNS support which is turned on by default. As a
consequence, the libvirtd daemon failed to start if the libvirt package was
installed on the system without Avahi. With this update, the dependency on avahi
is now defined in the libvirt.spec file, and Avahi is installed along with
libvirt. (BZ#770957)

Space precludes documenting all of these changes in this advisory. Users are
directed to the Red Hat Enterprise Linux 6.2 Technical Notes for information on
these changes:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Technical_Notes/libvirt.html#RHBA-2012-0013

All users of libvirt are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

759061 - Add support for ESXi 5
769674 - libvirt adds iptables rules for bridge device of network with <forward mode='bridge'>
770957 - libvirtd fails to start due to mDNS requirement
770959 - Shutting Down VM changes its state to "Pause" for 10sec

https://www.redhat.com/security/data/cve/CVE-2011-4600.html
https://www.redhat.com/security/data/cve/CVE-2011-4127.html
https://rhn.redhat.com/errata/RHSA-2011-1849.html
https://access.redhat.com/kb/docs/DOC-67874
https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Technical_Notes/libvirt.html#RHBA-2012-0013

ESX, libvirt, virtualization