[libvirt] [PATCH] driver.h: Fix two driver documentation mistakes
by Wieland Hoffmann
---
src/driver.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/driver.h b/src/driver.h
index 9d0d3de..adc3e1c 100644
--- a/src/driver.h
+++ b/src/driver.h
@@ -945,7 +945,7 @@ typedef virInterfaceDriver *virInterfaceDriverPtr;
/**
* _virInterfaceDriver:
*
- * Structure associated to a network virtualization driver, defining the various
+ * Structure associated to a network interface driver, defining the various
* entry points for it.
*
* All drivers must support the following fields/methods:
@@ -1106,7 +1106,7 @@ typedef virStorageDriver *virStorageDriverPtr;
/**
* _virStorageDriver:
*
- * Structure associated to a network virtualization driver, defining the various
+ * Structure associated to a storage driver, defining the various
* entry points for it.
*
* All drivers must support the following fields/methods:
--
1.7.6
13 years, 4 months
Re: [libvirt] [Qemu-devel] live snapshot wiki updated
by Eric Blake
[adding the libvir-list]
On 07/19/2011 08:09 AM, Jes Sorensen wrote:
> On 07/19/11 15:58, Eric Blake wrote:
>> On 07/19/2011 07:27 AM, Jes Sorensen wrote:
>>> Eric, what happens if libvirt in an selinux environment tells QEMU to
>>> launch using an image file that is backed by backing file(s)?
>>
>> Before starting qemu, libvirt first parses all the image files, to see
>> if any of them have backing images. For every qcow2 or qed image with a
>> backing file, libvirt sets the SELinux context of both the qcow2 image
>> and its backing file so that qemu will be able to successfully open()
>> them. But if any of those files reside on NFS, then it is not possible
>> to label individual files, so it requires setting the SELinux bool
>> virt_use_nfs, which thus gives qemu the power to open() arbitrary files
>> on NFS, and you've lost security.
>
> Urgh, libvirt parsing image files is really unfortunate, it really
> doesn't give me warm fuzzy feelings :( libvirt really should not know
> about internals of image formats.
But even if you add new features to qemu to avoid needing this in the
future, it doesn't change the past - libvirt will always have to know
how to parse image files understood by older qemu, and so as long as
libvirt already knows how to do that parsing, we might as well take
advantage of it.
Besides, I feel that having a well-documented file format, so that
independent applications can both parse the same file with the same
semantics by obeying the file format specification, is a good design goal.
>
>> It would be nice if libvirt had a way to pass fds for every disk and
>> backing file up front; then, SELinux can work around the lack of NFS
>> per-file labelling by blocking open() in qemu. In fact, this has
>> already been proposed:
>
> A cleaner solution seems to have libvirt provide a call-back allowing
> QEMU to call out and have libvirt open a file descriptor instead. This
> way libvirt can validate it and open it for QEMU and pass it back.
Yes, that could probably be made to work with libvirt.
>
> If we cannot do something like this, I would prefer to have backing
> files on NFS should simply not be supported when running in an selinux
> setup.
As nice as that sentiment is, it will never fly, because it would be a
regression in current behavior. The whole reason that the virt_use_nfs
SELinux bool exists is that some people are willing to make the partial
security tradeoff. Besides, the use of sVirt via SELinux is more than
just open() protection - while the current virt_use_nfs bool makes NFS
less secure than otherwise possible, it still gives some nice guarantees
to the rest of the qemu process such as passthrough accesses to local
pci devices.
Just because it is currently not as secure to mix NFS shared storage
with backing files doesn't stop some people from wanting to do it [in
fact, that's my current development setup - I use qcow2 images on NFS
shared storage, keep SELinux enabled, and enable the virt_use_nfs bool].
This discussion is about adding enhancements that make SELinux even
more powerful when using NFS shared storage, by adding fd passing
(whether libvirt parses in advance, or whether qemu raises an event and
requires feedback from libvirt), and not about crippling the existing
capability to use the virt_use_nfs selinux bool.
--
Eric Blake eblake(a)redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org
13 years, 4 months
[libvirt] [PATCH] build: Use $(PYTHON) instead of python for the keycode map generator
by Matthias Bolte
Also prepend $(AM_V_GEN).
---
src/Makefile.am | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/Makefile.am b/src/Makefile.am
index 481caba..eef0669 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -90,7 +90,7 @@ EXTRA_DIST += $(srcdir)/util/virkeymaps.h $(srcdir)/util/keymaps.csv \
$(srcdir)/util/virkeymaps.h: $(srcdir)/util/keymaps.csv \
$(srcdir)/util/virkeycode-mapgen.py
- python $(srcdir)/util/virkeycode-mapgen.py <$(srcdir)/util/keymaps.csv >$@
+ $(AM_V_GEN)$(PYTHON) $(srcdir)/util/virkeycode-mapgen.py <$(srcdir)/util/keymaps.csv >$@
$(srcdir)/util/virkeycode.c: $(srcdir)/util/virkeycode.h $(srcdir)/util/virkeymaps.h
--
1.7.4.1
13 years, 4 months
[libvirt] [PATCH] Pre-create /var/lib/libvirt/sanlock directory
by Daniel P. Berrange
From: "Daniel P. Berrange" <berrange(a)redhat.com>
The sanlock plugin for libvirt expects the directory
/var/lib/libvirt/sanlock to exist. Create this and add
it to the RPM
* libvirt.spec.in: Add /var/lib/libvirt/sanlock
* src/Makefile.am: Create /var/lib/libvirt/sanlock
---
libvirt.spec.in | 1 +
src/Makefile.am | 6 ++++++
2 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/libvirt.spec.in b/libvirt.spec.in
index 6cbd9ac..7c8b2ec 100644
--- a/libvirt.spec.in
+++ b/libvirt.spec.in
@@ -1046,6 +1046,7 @@ fi
%attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so
%{_datadir}/augeas/lenses/libvirt_sanlock.aug
%{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug
+%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock
%{_sbindir}/virt-sanlock-cleanup
%{_mandir}/man8/virt-sanlock-cleanup.8*
%endif
diff --git a/src/Makefile.am b/src/Makefile.am
index 481caba..c1786cf 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1396,6 +1396,9 @@ install-data-local:
$(MKDIR_P) "$(DESTDIR)$(localstatedir)/cache/libvirt"
$(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/images"
$(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/boot"
+if HAVE_SANLOCK
+ $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/sanlock"
+endif
if WITH_QEMU
$(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu"
$(MKDIR_P) "$(DESTDIR)$(localstatedir)/run/libvirt/qemu"
@@ -1438,6 +1441,9 @@ uninstall-local::
rmdir "$(DESTDIR)$(localstatedir)/cache/libvirt" ||:
rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/images" ||:
rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/boot" ||:
+if HAVE_SANLOCK
+ rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/sanlock" ||:
+endif
if WITH_QEMU
rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu" ||:
rmdir "$(DESTDIR)$(localstatedir)/run/libvirt/qemu" ||:
--
1.7.6
13 years, 4 months
[libvirt] [PATCH 00/12] New API: virDominShutdownFlags
by Michal Privoznik
This series creates new API which adds flags to
virDomainShutdown. As mentioned here many times, it is
a bad luck all APIs don't have flags parameter.
Parameter for this might be needed to select different
ways of shutting down a domain.
Currently, no new functionality is implemented, but
this paves the way for creating multiple ways of domain
shutting down. Therefore, calling this new API is the
same as calling its predecessor.
Michal Privoznik (12):
shutdown: Define new public API virDomainShutdownFlags
shutdown: Wire up the remote protocol
shutdown: Implement internal API for qemu driver
shutdown: Implement internal API for ESX driver
shutdown: Implement internal API for libxl driver
shutdown: Implement internal API for openvz driver
shutdown: Implement internal API for phyp driver
shutdown: Implement internal API for uml driver
shutdown: Implement internal API for vbox driver
shutdown: Implement internal API for vmware driver
shutdown: Implement internal API for xen driver
shutdown: Implement internal API for xenapi driver
include/libvirt/libvirt.h.in | 6 ++++
src/driver.h | 4 +++
src/esx/esx_driver.c | 12 ++++++++-
src/libvirt.c | 54 ++++++++++++++++++++++++++++++++++++++++++
src/libvirt_public.syms | 1 +
src/libxl/libxl_driver.c | 12 ++++++++-
src/openvz/openvz_driver.c | 1 +
src/phyp/phyp_driver.c | 12 ++++++++-
src/qemu/qemu_driver.c | 12 ++++++++-
src/remote/remote_driver.c | 1 +
src/remote/remote_protocol.x | 8 +++++-
src/remote_protocol-structs | 5 ++++
src/uml/uml_driver.c | 15 +++++++++++-
src/vbox/vbox_tmpl.c | 14 ++++++++++-
src/vmware/vmware_driver.c | 1 +
src/xen/xen_driver.c | 14 ++++++++--
src/xen/xen_driver.h | 2 +-
src/xen/xen_hypervisor.c | 2 +-
src/xen/xen_inotify.c | 2 +-
src/xen/xend_internal.c | 10 +++++--
src/xen/xend_internal.h | 2 +-
src/xen/xm_internal.c | 2 +-
src/xen/xs_internal.c | 10 +++++--
src/xen/xs_internal.h | 3 +-
src/xenapi/xenapi_driver.c | 25 ++++++++++++++++++-
25 files changed, 206 insertions(+), 24 deletions(-)
--
1.7.5.rc3
13 years, 4 months
[libvirt] RFC: Implement virDomainGetIPAddress()
by Michal Novotny
Hi guys,
some time ago I've been investigating the options to get the guest's IP
address information without having to connect to guest's VNC window or
console. It was for one project I've been working on and I found that
the solution lies in the procfs, precisely in the /proc/{PID}/net/arp...
The format is as follows:
$ cat /proc/{PID}/net/arp
IP address HW type Flags HW address Mask
Device
192.168.122.36 0x1 0x2 52:54:00:35:76:e6 *
virbr0
where the HW address matches the MAC address associated to the guest's
NIC. Implementing such an API shouldn't be a big problem however I know
that there's some option to run libvirt on Windows machines. It should
be just the client so it shouldn't really matter however I'd like to ask
you whether it's really not an issue.
The function should return a string of the guest's IP address as read
from the procfs or return a NULL value if there's no IP address
associated with the guest.
If the multiple NICs are being used by the guest then the function
should return either the IP address matching the MAC address passed to
the function or the first IP address if omitted.
The prototype should be:
char *virDomainGetIPAddress(virDomainPtr domain, char *devmac);
For this the internal information about PID of the process spawned
should be used (this is already being tracked and stored by libvirt
IMHO) to access the /proc/{PID}/net/arp file.
This API function would be very useful since it would give libvirt users
option to get the information of the guest's IP address without having
to connect to guest's VNC window or console.
For virsh this could be implemented directly into the dominfo subcommand.
What do you think about implementing this ?
Thanks,
Michal
--
Michal Novotny <minovotn(a)redhat.com>, RHCE, Red Hat
Virtualization | libvirt-php bindings | php-virt-control.org
13 years, 4 months
[libvirt] [PATCH] xenapi: Fix double-freeing the session in xenapiClose
by Matthias Bolte
xen_session_logout already frees the whole session object.
Don't call xenSessionFree on a freed session object.
Reported by Sharmila Radhakrishnan.
---
src/xenapi/xenapi_driver.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/xenapi/xenapi_driver.c b/src/xenapi/xenapi_driver.c
index 97da1d1..dbc03cb 100644
--- a/src/xenapi/xenapi_driver.c
+++ b/src/xenapi/xenapi_driver.c
@@ -230,7 +230,7 @@ xenapiClose (virConnectPtr conn)
if (priv->session != NULL) {
xen_session_logout(priv->session);
- xenSessionFree(priv->session);
+ priv->session = NULL;
}
VIR_FREE(priv->url);
--
1.7.4.1
13 years, 4 months
[libvirt] [PATCH] remote/ssh: optional "keyfile" parameter.
by Oskari Saarenmaa
New optional parameter "keyfile" for ssh transport allows the user to select
the private key to be used to authenticate to the remote host.
---
docs/remote.html.in | 16 ++++++++++++++++
src/remote/remote_driver.c | 9 ++++++++-
src/rpc/virnetclient.c | 4 +++-
src/rpc/virnetclient.h | 1 +
src/rpc/virnetsocket.c | 3 +++
src/rpc/virnetsocket.h | 1 +
tests/virnetsockettest.c | 12 ++++++++++++
7 files changed, 44 insertions(+), 2 deletions(-)
diff --git a/docs/remote.html.in b/docs/remote.html.in
index 39d65aa..b554950 100644
--- a/docs/remote.html.in
+++ b/docs/remote.html.in
@@ -275,6 +275,22 @@ Note that parameter values must be
<td colspan="2"/>
<td> Example: <code>netcat=/opt/netcat/bin/nc</code> </td>
</tr>
+
+ <tr>
+ <td>
+ <code>keyfile</code>
+ </td>
+ <td> ssh </td>
+ <td>
+ The name of the private key file to use to authentication to the remote
+ machine. If this option is not used the default keys are used.
+ </td>
+ </tr>
+ <tr>
+ <td colspan="2"/>
+ <td> Example: <code>keyfile=/root/.ssh/example_key</code> </td>
+ </tr>
+
<tr>
<td>
<code>no_verify</code>
diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
index c2f8bbd..3878fc9 100644
--- a/src/remote/remote_driver.c
+++ b/src/remote/remote_driver.c
@@ -343,7 +343,7 @@ doRemoteOpen (virConnectPtr conn,
char *name = NULL, *command = NULL, *sockname = NULL, *netcat = NULL;
char *port = NULL, *authtype = NULL, *username = NULL;
int no_verify = 0, no_tty = 0;
- char *pkipath = NULL;
+ char *pkipath = NULL, *keyfile = NULL;
/* Return code from this function, and the private data. */
int retcode = VIR_DRV_OPEN_ERROR;
@@ -416,6 +416,11 @@ doRemoteOpen (virConnectPtr conn,
netcat = strdup (var->value);
if (!netcat) goto out_of_memory;
var->ignore = 1;
+ } else if (STRCASEEQ (var->name, "keyfile")) {
+ VIR_FREE(keyfile);
+ keyfile = strdup (var->value);
+ if (!keyfile) goto out_of_memory;
+ var->ignore = 1;
} else if (STRCASEEQ (var->name, "no_verify")) {
no_verify = atoi (var->value);
var->ignore = 1;
@@ -573,6 +578,7 @@ doRemoteOpen (virConnectPtr conn,
no_tty,
no_verify,
netcat ? netcat : "nc",
+ keyfile,
sockname)))
goto failed;
@@ -672,6 +678,7 @@ doRemoteOpen (virConnectPtr conn,
VIR_FREE(sockname);
VIR_FREE(authtype);
VIR_FREE(netcat);
+ VIR_FREE(keyfile);
VIR_FREE(username);
VIR_FREE(port);
VIR_FREE(pkipath);
diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
index d3965c6..1bda763 100644
--- a/src/rpc/virnetclient.c
+++ b/src/rpc/virnetclient.c
@@ -189,11 +189,13 @@ virNetClientPtr virNetClientNewSSH(const char *nodename,
bool noTTY,
bool noVerify,
const char *netcat,
+ const char *keyfile,
const char *path)
{
virNetSocketPtr sock;
- if (virNetSocketNewConnectSSH(nodename, service, binary, username, noTTY, noVerify, netcat, path, &sock) < 0)
+ if (virNetSocketNewConnectSSH(nodename, service, binary, username, noTTY,
+ noVerify, netcat, keyfile, path, &sock) < 0)
return NULL;
return virNetClientNew(sock, NULL);
diff --git a/src/rpc/virnetclient.h b/src/rpc/virnetclient.h
index 6acdf50..3e5659c 100644
--- a/src/rpc/virnetclient.h
+++ b/src/rpc/virnetclient.h
@@ -46,6 +46,7 @@ virNetClientPtr virNetClientNewSSH(const char *nodename,
bool noTTY,
bool noVerify,
const char *netcat,
+ const char *keyfile,
const char *path);
virNetClientPtr virNetClientNewExternal(const char **cmdargv);
diff --git a/src/rpc/virnetsocket.c b/src/rpc/virnetsocket.c
index 7ea1ab7..57373a0 100644
--- a/src/rpc/virnetsocket.c
+++ b/src/rpc/virnetsocket.c
@@ -578,6 +578,7 @@ int virNetSocketNewConnectSSH(const char *nodename,
bool noTTY,
bool noVerify,
const char *netcat,
+ const char *keyfile,
const char *path,
virNetSocketPtr *retsock)
{
@@ -594,6 +595,8 @@ int virNetSocketNewConnectSSH(const char *nodename,
virCommandAddArgList(cmd, "-p", service, NULL);
if (username)
virCommandAddArgList(cmd, "-l", username, NULL);
+ if (keyfile)
+ virCommandAddArgList(cmd, "-i", keyfile, NULL);
if (noTTY)
virCommandAddArgList(cmd, "-T", "-o", "BatchMode=yes",
"-e", "none", NULL);
diff --git a/src/rpc/virnetsocket.h b/src/rpc/virnetsocket.h
index 5f882ac..479be28 100644
--- a/src/rpc/virnetsocket.h
+++ b/src/rpc/virnetsocket.h
@@ -69,6 +69,7 @@ int virNetSocketNewConnectSSH(const char *nodename,
bool noTTY,
bool noVerify,
const char *netcat,
+ const char *keyfile,
const char *path,
virNetSocketPtr *addr);
diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c
index 1697ced..fd8151b 100644
--- a/tests/virnetsockettest.c
+++ b/tests/virnetsockettest.c
@@ -379,6 +379,7 @@ struct testSSHData {
bool noTTY;
bool noVerify;
const char *netcat;
+ const char *keyfile;
const char *path;
const char *expectOut;
@@ -400,6 +401,7 @@ static int testSocketSSH(const void *opaque)
data->noTTY,
data->noVerify,
data->netcat,
+ data->keyfile,
data->path,
&csock) < 0)
goto cleanup;
@@ -542,6 +544,16 @@ mymain(void)
if (virtTestRun("SSH test 5", 1, testSocketSSH, &sshData5) < 0)
ret = -1;
+ struct testSSHData sshData6 = {
+ .nodename = "example.com",
+ .path = "/tmp/socket",
+ .keyfile = "/root/.ssh/example_key",
+ .noVerify = true,
+ .expectOut = "-i /root/.ssh/example_key -o StrictHostKeyChecking=no example.com nc -U /tmp/socket\n",
+ };
+ if (virtTestRun("SSH test 6", 1, testSocketSSH, &sshData6) < 0)
+ ret = -1;
+
#endif
return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE);
--
1.7.6
13 years, 4 months
[libvirt] [PATCH RESEND RFC v4 0/6] support cpu bandwidth in libvirt
by Wen Congyang
Resend this patchset
TODO:
1. We create sub directory for each vcpu in cpu subsystem. So
we should recalculate cpu.shares for each vcpu.
Changelog:
v4: address Adam Litke's comment
v3: fix some small bugs
implement the simple way
v2: almost rewrite the patchset to support to control each vcpu's
bandwidth.
Limit quota to [-1, 2^64/1000] at the schemas level. We will
check it at cgroup level.
Wen Congyang (6):
Introduce the function virCgroupForVcpu
cgroup: Implement cpu.cfs_period_us and cpu.cfs_quota_us tuning API
Update XML Schema for new entries
qemu: Implement period and quota tunable XML configuration and
parsing
qemu: Implement cfs_period and cfs_quota's modification
doc: Add documentation for new cputune elements period and quota
docs/formatdomain.html.in | 19 ++
docs/schemas/domain.rng | 26 ++-
src/conf/domain_conf.c | 20 ++-
src/conf/domain_conf.h | 2 +
src/libvirt_private.syms | 5 +
src/qemu/qemu_cgroup.c | 137 ++++++++++
src/qemu/qemu_cgroup.h | 4 +
src/qemu/qemu_driver.c | 312 +++++++++++++++++++++--
src/qemu/qemu_process.c | 4 +
src/util/cgroup.c | 153 +++++++++++-
src/util/cgroup.h | 11 +
tests/qemuxml2argvdata/qemuxml2argv-cputune.xml | 2 +
12 files changed, 659 insertions(+), 36 deletions(-)
13 years, 4 months
