Commit fd8f164f33 for qemu.org

commit fd8f164f33ac785d9452f90ab6029b3d6918449e
Author: Daniel P. Berrangé <berrange@redhat.com>
Date:   Thu Sep 3 16:45:52 2026 +0100

    qom: add helper API for checking object class security policy compliance

    This helper simply avoids a verbose code pattern being repeated for
    many callers.

    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/include/qom/object.h b/include/qom/object.h
index 687ceb6bba..3285218664 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -2405,6 +2405,19 @@ Object *object_property_add_new_container(Object *obj, const char *name);
 char *object_property_help(const char *name, const char *type,
                            QObject *defval, const char *description);

+/**
+ * object_class_check_security:
+ * @klass: the object class to check
+ * @errp: a pointer to an Error that is filled if not compliant
+ *
+ * Check whether the object class @klass complies with the
+ * currently requested security policy. Reports an error
+ * in @errp if not compliant.
+ *
+ * Returns: true if compliant, false if an error was raised
+ */
+bool object_class_check_security(ObjectClass *klass, Error **errp);
+
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(Object, object_unref)

 #endif
diff --git a/qom/object.c b/qom/object.c
index 32736a0111..41b1ec81d4 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -23,6 +23,7 @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/forward-visitor.h"
 #include "qapi/qapi-builtin-visit.h"
+#include "qapi/compat-policy.h"
 #include "qobject/qdict.h"
 #include "qobject/qjson.h"
 #include "qemu/id.h"
@@ -3149,6 +3150,14 @@ void object_class_property_set_description(ObjectClass *klass,
     op->description = g_strdup(description);
 }

+bool object_class_check_security(ObjectClass *klass, Error **errp)
+{
+    return compat_policy_check_security(&compat_policy,
+                                        object_class_get_name(klass),
+                                        object_class_is_secure(klass),
+                                        errp);
+}
+
 static void object_class_init(ObjectClass *klass, const void *data)
 {
     object_class_property_add_str(klass, "type", object_get_type,