[libvirt] Problems using unix_sock_group
by Niraj Tolia
Hi,
I am sure I am missing something simple but I can't seem to figure it
out. I am trying to allow a non-root user rw access to libvirt 0.6.2.
The user is a member of the libvirtd group,
unix_sock_group="libvirtd", and
unix_sock_rw_perms=0770. However, 'virsh list' doesn't seem to work.
The permissions seem correct
srwxrwx--- 1 root libvirtd 0 2009-04-08 17:32 libvirt-sock
srwxrwxrwx 1 root libvirtd 0 2009-04-08 17:32 libvirt-sock-ro
When I strace 'virsh list', it doesn't attempt to connect to
/usr/local/var/run/libvirt/libvirt-sock but when I strace 'virsh
--readonly list', it successfully connects to the "-ro" socket.
configure reported that polkit wasn't configured. This is on a system
with Xen.
Any ideas on what I might be doing wrong?
Thanks,
Niraj
15 years, 7 months
[libvirt] 0.6.2: git mirror tagged, too
by Jim Meyering
Mark McLoughlin mentioned that the LIBVIRT_0_6_2 tag was not automatically
mirrored into the git tree, so I've added it. I also added a signed
tag on the same change set. Among other things, that makes it so that
"git describe" now generates sensible output for recent changes.
But adding all the rest would be nice, too, so I did it with this
for tag in $(git tag -l 'LIBVIRT_0_[0-5]*'); do
v=$(echo $tag|sed 's/LIBVIRT_/v/;s/_/./g')
git tag -s -m $v $v $tag
done
and pushed those tags.
15 years, 7 months
[libvirt] migration by libvirt
by Zvi Dubitzky
Using libvirt virDomainMigrate () do I have to set the target VM with
same XML config as the source VM machine before the
migrate starts or the source machine Host libvirt takes care of this
preparation before it starts the live migration.
I am talking about the equivalent of a tcp migration as defined per the
qemu/kvm migrate command done via the qemu monitor
thanks
Zvi Dubitzky
Virtualization and System Architecture Email:dubi@il.ibm.com
IBM Haifa Research Laboratory Phone: +972-4-8296182
Haifa, 31905, ISRAEL
15 years, 7 months
[libvirt] Changing the QEMU svn VERSION string
by Anthony Liguori
Hi,
I'd like to update the VERSION string in QEMU's svn tree. Right now,
it's 0.10.0 and since we have a 0.10.2 release, that's somewhat confusing.
I don't want to make it 0.11.0 either because that's not going to be
reliable from a feature detection perspective. What I would like is to
make it 0.11.0-devel or something similar to that.
Being the nice guy I am, I thought I would check that this didn't make
libvirt go bonkers :-) This is the relevant detection code in libvirt:
if (sscanf(help, "QEMU PC emulator version %u.%u.%u (kvm-%u)",
&major, &minor, µ, &kvm_version) != 4)
kvm_version = 0;
if (!kvm_version && sscanf(help, "QEMU PC emulator version u.%u.%u",
&major, &minor, µ) != 3)
goto cleanup2;
If I change SVN to 0.11.0-devel, that's going to break the KVM string
although the QEMU string will continue to work. Avi could potentially
carry a patch to keep it 0.10.x and since kvm-%u will be used to
identify features, that should keep things working.
Anyone have any objections/suggestions?
Regards,
Anthony Liguori
15 years, 7 months
[libvirt] Thoughts on svirt configuration files.
by Daniel J Walsh
Currently we do not want to hard code virtual image names into libvirt,
so libvirt and virtual-manager can use libselinux to get the default
image label and process label. svirt_t and svirt_image_t. The idea was
one policy writer might want his virtual images labeled differently than
another.
One problem with this is I added to interfaces one for the domain, and
one for the image label. Now we realize we have other images.
We have
process Label - svirt_t:MCS
Exclusive RW Image - svirt_image_t:MCS
Shared RW Image - svirt_image_t:s0
Read Only Image - virt_content_t:s0
So I am suggesting that we remove the virtual_image_context file and
allowing policy writers to define context in the virtual_domain_context
files but have multiple records and multiple fields.
Something like a space separated list where each field corresponds to above.
system_u:system_r:svirt_t:s0 system_u:object_r:svirt_image_t:s0
system_u:object_r:svirt_image_t:s0 system_u:object_r:virt_content_t:s0
Then you could add optional types with similar fields
system_u:system_r:svirt_nonet_t:s0 system_u:object_r:svirt_image_t:s0
system_u:object_r:svirt_image_t:s0 system_u:object_r:virt_content_t:s0
Since SELinux just returns a path, the virt team could choose the format
of the file if a space separated list is not addequate. (xml?) Name
Value Pairs? Policy writers would have to enter the format that is chosen.
Thoughts?
I am thinking we might eventually want to allow an admin to select
dynamic labels but specify alternative types.
So svirt_t would be default but if someone wanted svirt_nonet_t, they
could choose that also and get separation with a different type.
15 years, 7 months
[libvirt] [PATCH 1/2] VirtualBox support
by Pritesh Kothari
Hi All,
I have attached a patch which when applied on the HEAD as of today would allow
virtualbox support in libvirt. It takes cares of all the stuff mentioned on
the list earlier. Still if I have missed anything, please do tell me.
The patch works very well with the VirtualBox OSE version and the 2.2 release.
[PATCH 1/2] contains diff of files already in libvirt.
[PATCH 2/2] contains new files needed for VirtualBox support.
Regards,
Pritesh
15 years, 7 months
[libvirt] [PATCH] lxc: fix veth off by 1 error
by Serge E. Hallyn
When not specifying a target for veth device, veth.c:getFreeVethName()
is supposed to scan for unused veth devices in /sys/class/net.
However, when it finds one, it bumps the index by one before
returning it.
So, if you have one container running, veth0 is passed into
the container, veth1 is taken and still sitting in /sys/class/net.
When you now start a second container, getFreeVethName() finds
veth0 is unused, but returns 1. Now container creation dies
becuase /sys/class/net/veth1 exists.
Signed-off-by: Serge Hallyn <serue(a)us.ibm.com>
---
src/veth.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/veth.c b/src/veth.c
index 93173e4..90c1dcb 100644
--- a/src/veth.c
+++ b/src/veth.c
@@ -35,12 +35,12 @@
static int getFreeVethName(char *veth, int maxLen, int startDev)
{
int rc = -1;
- int devNum = startDev;
+ int devNum = startDev-1;
char path[PATH_MAX];
do {
- snprintf(path, PATH_MAX, "/sys/class/net/veth%d/", devNum);
++devNum;
+ snprintf(path, PATH_MAX, "/sys/class/net/veth%d/", devNum);
} while (virFileExists(path));
snprintf(veth, maxLen, "veth%d", devNum);
@@ -97,6 +97,7 @@ int vethCreate(char* veth1, int veth1MaxLen,
while ((1 > strlen(veth2)) || STREQ(veth1, veth2)) {
vethDev = getFreeVethName(veth2, veth2MaxLen, vethDev);
+ ++vethDev;
DEBUG("assigned veth2: %s", veth2);
}
--
1.6.2
15 years, 7 months
[libvirt] [PATCH 0/1] Trigger SCSI scans on pool refresh
by David Allan
This patch is a small piece of code that causes the SCSI midlayer to
rescan all targets for new LUs by echoing "- - -" into
/sys/class/scsi_host/hostN/scan
It does not attempt to cause a LIP to be issued.
Dave
15 years, 7 months
[libvirt] [PATCH] lxc: make the pivot_root more robust.
by Serge E. Hallyn
libvirt/lxc is broken on F11. The pivot_root() call returns
-EINVAL. The below is one way we can fix it. I'm also sending
another patch which takes the simpler approach of using chroot.
However, chroot is trivially escapable (see for instance
http://www.linuxsecurity.com/content/view/117632/49/). I don't
know whether the typical libvirt user would care. If so, then
the below patch is probably the way to go.
>From 26cac415771a2d9712af0e1ce60a0bcb41b44665 Mon Sep 17 00:00:00 2001
From: root <root(a)localhost.localdomain>
Date: Sat, 4 Apr 2009 22:49:20 -0400
Subject: [PATCH 1/1] lxc: make the pivot_root more robust.
The libvirt lxc driver uses pivot_root instead of chroot, because
the latter is trivially escapable. However, the pivot_root(2)
system call can fail for several subtle reasons. Depending upon
your distro init sequence you may get lucky and have the old
recipe work, but on a Fedora 11 standard install, for instance,
it will fail.
Do a few more steps to make pivot_root hopefully always
succeed. We mark / as MS_PRIVATE, create an empty tmpfs,
and bind-mount the container root onto /new in that fs.
In this way, we ensure two reasons for pivot_root to fail -
namely old_root->parent being MS_SHARED and old_root and
new_root being on the same fs - won't happen.
Signed-off-by: Serge Hallyn <serue(a)us.ibm.com>
---
src/lxc_container.c | 108 ++++++++++++++++++++++++++++++++++++++++-----------
1 files changed, 85 insertions(+), 23 deletions(-)
diff --git a/src/lxc_container.c b/src/lxc_container.c
index 3f17b8d..d3959f6 100644
--- a/src/lxc_container.c
+++ b/src/lxc_container.c
@@ -264,50 +264,113 @@ static int lxcContainerChildMountSort(const void *a, const void *b)
return strcmp(*sb, *sa);
}
+#ifndef MS_REC
+#define MS_REC 16384
+#endif
+
+#ifndef MNT_DETACH
+#define MNT_DETACH 0x00000002
+#endif
+
+#ifndef MS_PRIVATE
+#define MS_PRIVATE 1<<18
+#endif
+
static int lxcContainerPivotRoot(virDomainFSDefPtr root)
{
int rc;
- char *oldroot;
+ char *oldroot = NULL, *newroot = NULL;
- /* First step is to ensure the new root itself is
- a mount point */
- if (mount(root->src, root->src, NULL, MS_BIND, NULL) < 0) {
- virReportSystemError(NULL, errno,
- _("failed to bind new root %s"),
- root->src);
- return -1;
+ /* root->parent must be private, so make / private. */
+ if (mount("", "/", NULL, MS_PRIVATE|MS_REC, NULL) < 0) {
+ virReportSystemError(NULL, errno, "%s",
+ _("failed to make root private"));
+ goto err;
}
if (virAsprintf(&oldroot, "%s/.oldroot", root->src) < 0) {
virReportOOMError(NULL);
- return -1;
+ goto err;
}
if ((rc = virFileMakePath(oldroot)) < 0) {
virReportSystemError(NULL, rc,
_("failed to create %s"),
oldroot);
- VIR_FREE(oldroot);
- return -1;
+ goto err;
+ }
+
+ /* Create a tmpfs root since old and new roots must be
+ * on separate filesystems */
+ if (mount("", oldroot, "tmpfs", 0, NULL) < 0) {
+ virReportSystemError(NULL, errno,
+ _("failed to mount empty tmpfs at %s"),
+ oldroot);
+ goto err;
+ }
+
+ /* Create a directory called 'new' in tmpfs */
+ if (virAsprintf(&newroot, "%s/new", oldroot) < 0) {
+ virReportOOMError(NULL);
+ goto err;
+ }
+
+ if ((rc = virFileMakePath(newroot)) < 0) {
+ virReportSystemError(NULL, rc,
+ _("failed to create %s"),
+ newroot);
+ goto err;
+ }
+
+ /* ... and mount our root onto it */
+ if (mount(root->src, newroot, NULL, MS_BIND|MS_REC, NULL) < 0) {
+ virReportSystemError(NULL, errno,
+ _("failed to bind new root %s into tmpfs"),
+ root->src);
+ goto err;
+ }
+
+ /* Now we chroot into the tmpfs, then pivot into the
+ * root->src bind-mounted onto '/new' */
+ if (chroot(oldroot) < 0) {
+ virReportSystemError(NULL, errno, "%s",
+ _("failed to chroot into tmpfs"));
+ goto err;
+ }
+
+ if (chdir("/new") < 0) {
+ virReportSystemError(NULL, errno, "%s",
+ _("failed to chdir into /new on tmpfs"));
+ goto err;
}
/* The old root directory will live at /.oldroot after
* this and will soon be unmounted completely */
- if (pivot_root(root->src, oldroot) < 0) {
- virReportSystemError(NULL, errno,
- _("failed to pivot root %s to %s"),
- oldroot, root->src);
- VIR_FREE(oldroot);
- return -1;
+ if (pivot_root(".", ".oldroot") < 0) {
+ virReportSystemError(NULL, errno, "%s",
+ _("failed to pivot root"));
+ goto err;
}
- VIR_FREE(oldroot);
/* CWD is undefined after pivot_root, so go to / */
- if (chdir("/") < 0) {
- return -1;
+ if (chdir("/") < 0)
+ goto err;
+
+ if (umount2(".oldroot", MNT_DETACH) < 0) {
+ virReportSystemError(NULL, errno, "%s",
+ _("failed to lazily unmount old root"));
+ goto err;
}
+ VIR_FREE(oldroot);
+ VIR_FREE(newroot);
+
return 0;
+
+err:
+ if (oldroot) VIR_FREE(oldroot);
+ if (newroot) VIR_FREE(newroot);
+ return -1;
}
static int lxcContainerPopulateDevices(void)
@@ -349,10 +412,9 @@ static int lxcContainerPopulateDevices(void)
_("cannot create /dev/pts"));
return -1;
}
- if (mount("/.oldroot/dev/pts", "/dev/pts", NULL,
- MS_MOVE, NULL) < 0) {
+ if (mount("devpts", "/dev/pts", "devpts", 0, NULL) < 0) {
virReportSystemError(NULL, errno, "%s",
- _("failed to move /dev/pts into container"));
+ _("failed to mount /dev/pts in container"));
return -1;
}
--
1.6.2
15 years, 7 months
