August 2012 - Devel - libvirt List Archives

[libvirt] [PATCH] conf: Fix parsing of seclabels without model
by Marcelo Cerri 30 Aug '12

30 Aug '12

With this patch libvirt tries to assign a model to seclabels when model is missing. Libvirt will look up at host's capabilities and assign a model in order to each seclabel that doesn't have a model assigned. This patch fixes: 1. The problem with existing guests that have a seclabel defined in its XML. 2. A XML parse error when a guest is restored. Signed-off-by: Marcelo Cerri <mhcerri(a)linux.vnet.ibm.com> --- src/conf/domain_conf.c | 56 ++++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 27 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 224aec5..5316b59 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3102,22 +3102,10 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, def->baselabel = p; } - /* Only parse model, if static labelling, or a base - * label is set, or doing active XML - */ - if (def->type == VIR_DOMAIN_SECLABEL_STATIC || - def->baselabel || - (!(flags & VIR_DOMAIN_XML_INACTIVE) && - def->type != VIR_DOMAIN_SECLABEL_NONE)) { - - p = virXPathStringLimit("string(./@model)", - VIR_SECURITY_MODEL_BUFLEN-1, ctxt); - if (p == NULL && def->type != VIR_DOMAIN_SECLABEL_NONE) { - virReportError(VIR_ERR_XML_ERROR, - "%s", _("missing security model")); - } - def->model = p; - } + /* Always parse model */ + p = virXPathStringLimit("string(./@model)", + VIR_SECURITY_MODEL_BUFLEN-1, ctxt); + def->model = p; return def; @@ -3129,10 +3117,12 @@ error: static int virSecurityLabelDefsParseXML(virDomainDefPtr def, xmlXPathContextPtr ctxt, + virCapsPtr caps, unsigned int flags) { - int i = 0, n; + int i, j, n; xmlNodePtr *list = NULL, saved_node; + virCapsHostPtr host = &caps->host; /* Check args and save context */ if (def == NULL || ctxt == NULL) @@ -3159,14 +3149,26 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, ctxt->node = saved_node; VIR_FREE(list); - /* Checking missing model information - * when there is more than one seclabel */ - if (n > 1) { - for(; n; n--) { - if (def->seclabels[n - 1]->model == NULL) { + /* Check missing model information */ + for (i = j = 0; i < n; i++) { + /* If model is missing, try to assign it based on driver's + * capabilities. + */ + if (def->seclabels[i]->model == NULL) { + /* Check if there's any host's security model that wasn't + * assigned yet. + */ + if (j >= host->nsecModels) { virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing security model " - "when using multiple labels")); + _("missing security model and " + "it can't be assigned based on " + "host's capabilities")); + goto error; + } + /* Copy model from host. */ + def->seclabels[i]->model = strdup(host->secModels[j++].model); + if (def->seclabels[i]->model == NULL) { + virReportOOMError(); goto error; } } @@ -3175,8 +3177,8 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, error: ctxt->node = saved_node; - for (; i > 0; i--) { - virSecurityLabelDefFree(def->seclabels[i - 1]); + for (i = 0; i < n; i++) { + virSecurityLabelDefFree(def->seclabels[i]); } VIR_FREE(def->seclabels); def->nseclabels = 0; @@ -8166,7 +8168,7 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps, /* analysis of security label, done early even though we format it * late, so devices can refer to this for defaults */ - if (virSecurityLabelDefsParseXML(def, ctxt, flags) == -1) + if (virSecurityLabelDefsParseXML(def, ctxt, caps, flags) == -1) goto error; /* Extract domain memory */ -- 1.7.12

3 13

[libvirt] [PATCH] Fix issue of PF brought down if VF is 8021.Qbh and pci passthrough
by Nishank Trivedi 30 Aug '12

30 Aug '12

If a 8021.Qbh network device supports SRIOV and its VF is being used in pci passthrough mode, when the guest is shutdown or destroyed, the PF inteface is also brought down. qemuDomainHostdevNetConfigRestore() finds out the PF for provided hostdev (which is VF) and passes it to virNetDevPortProfileDisassociate() as linkdev. Later, linkdev gets passed to virNetDevSetOnline() where the interface is brought down by clearing IFF_UP flag. Bringing down a PF, when only VF is being brought down is not expected behavior. This patch adds a check so that virNetDevSetOnline() is called only for PF and not if device is a VF. Signed-off-by: Nishank Trivedi <nistrive(a)cisco.com> --- src/util/virnetdevvportprofile.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/virnetdevvportprofile.c b/src/util/virnetdevvportprofile.c index 5213378..e231fca 100644 --- a/src/util/virnetdevvportprofile.c +++ b/src/util/virnetdevvportprofile.c @@ -1235,7 +1235,8 @@ virNetDevVPortProfileDisassociate(const char *macvtap_ifname, /* avoid disassociating twice */ if (vmOp == VIR_NETDEV_VPORT_PROFILE_OP_MIGRATE_IN_FINISH) break; - ignore_value(virNetDevSetOnline(linkdev, false)); + if (vf < 0) + ignore_value(virNetDevSetOnline(linkdev, false)); rc = virNetDevVPortProfileOp8021Qbh(linkdev, macvtap_macaddr, vf, virtPort, NULL, VIR_NETDEV_VPORT_PROFILE_LINK_OP_DISASSOCIATE); -- 1.7.11.4

3 2

[libvirt] [PATCH 1/1] Fix adding ports to OVS bridges without VLAN tags
by Kyle Mestery 30 Aug '12

30 Aug '12

The introduction of the new VLAN code, along with the fix from 5e465df6be8bcb00f0b4bff831e91f4042fae272, caused the addition of OVS ports to fail with the following message: ovs-vsctl: 00002|vsctl|ERR|: missing column name This fix takes into account the VLAN arguments are optional, and correctly sets up the command line to run the "ovs-vsctl" command to add ports to the OVS bridge. Signed-off-by: Kyle Mestery <kmestery(a)cisco.com> --- src/util/virnetdevopenvswitch.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index 00271a0..fcf6d91 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -104,9 +104,15 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, } cmd = virCommandNew(OVSVSCTL); + + virCommandAddArgList(cmd, "--", "--may-exist", "add-port", + brname, ifname, NULL); + + if (virBufferCurrentContent(&buf) != "") + virCommandAddArgList(cmd, virBufferCurrentContent(&buf), NULL); + if (ovsport->profileID[0] == '\0') { - virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferCurrentContent(&buf), + virCommandAddArgList(cmd, "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, @@ -114,8 +120,7 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, "external-ids:iface-status=active", NULL); } else { - virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferCurrentContent(&buf), + virCommandAddArgList(cmd, "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, -- 1.7.11.4

3 3

[libvirt] [PATCH] Fix legacy xen driver when building without modules
by Jim Fehlig 30 Aug '12

30 Aug '12

When building without driver modules, I've noticed that the legacy xen driver no longer works. The attached patch fixes it, but I'm not sure if this is the correct fix. I need to do some more testing with and without modules, but wanted to raise this on the list for comments/suggestions. Thanks, Jim

2 4

[libvirt] [PATCH] nwfilter: fix loop generating too many rules
by Stefan Berger 30 Aug '12

30 Aug '12

The loop processing the trusted DHCP server generated one too many rules and added one final rules that accepted responses from all DHCP servers. Below patch fixes this. --- src/nwfilter/nwfilter_ebiptables_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3374,10 +3374,10 @@ ebtablesApplyDHCPOnlyRules(const char *i VIR_FREE(srcIPParam); - if (idx == num_dhcpsrvrs) - break; - idx++; + + if (idx >= num_dhcpsrvrs) + break; } virBufferAsprintf(&buf,

2 1

[libvirt] [PATCH] qemu: Clean up security driver initialisation and config file
by Peter Krempa 30 Aug '12

30 Aug '12

Commit d0c0e79ac646462aaa815f81ad324a0d3ef12954 left behind some dead code. (hasDAC can't be efectively set to true, because virSecurityManagerNew fails to load the "dac" driver) Also the configuration file for qemu driver still contains reference to the DAC driver that can't be enabled manualy. --- src/qemu/qemu.conf | 4 +++- src/qemu/qemu_driver.c | 16 ++++------------ 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index fb22b7c..d3175fa 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -162,7 +162,9 @@ # driver at the same time, for this use a list of names separated by # comma and delimited by square brackets. For example: # -# security_driver = [ "selinux", "dac" ] +# security_driver = [ "selinux", "apparmor" ] +# +# Note: The DAC security driver is always enabled. # #security_driver = "selinux" diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5d9f8c9..482a910 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -251,14 +251,10 @@ qemuSecurityInit(struct qemud_driver *driver) char **names; virSecurityManagerPtr mgr = NULL; virSecurityManagerPtr stack = NULL; - bool hasDAC = false; if (driver->securityDriverNames) { names = driver->securityDriverNames; while (names && *names) { - if (STREQ("dac", *names)) - hasDAC = true; - if (!(mgr = virSecurityManagerNew(*names, QEMU_DRIVER_NAME, driver->allowDiskFormatProbing, @@ -287,7 +283,7 @@ qemuSecurityInit(struct qemud_driver *driver) mgr = NULL; } - if (!hasDAC && driver->privileged) { + if (driver->privileged) { if (!(mgr = virSecurityManagerNewDAC(QEMU_DRIVER_NAME, driver->user, driver->group, @@ -296,13 +292,9 @@ qemuSecurityInit(struct qemud_driver *driver) driver->securityRequireConfined, driver->dynamicOwnership))) goto error; - if (!stack) { - if (!(stack = virSecurityManagerNewStack(mgr))) - goto error; - } else { - if (virSecurityManagerStackAddNested(stack, mgr) < 0) - goto error; - } + /* the stack is always initialized here */ + if (virSecurityManagerStackAddNested(stack, mgr) < 0) + goto error; mgr = NULL; } -- 1.7.12

2 3

[libvirt] [PATCH 0/2] Fix segfault and infinite loop when doing VCPU pinning
by Peter Krempa 30 Aug '12

30 Aug '12

See patch comments for details. Peter Krempa (2): qemu: Fix possible infinite loop and segfault on error path. vcpupin: Fix returning of arrays from virDomainVcpuPinAdd src/conf/domain_conf.c | 22 +++++++++++++--------- src/conf/domain_conf.h | 2 +- src/libxl/libxl_driver.c | 2 +- src/qemu/qemu_driver.c | 6 +++--- src/xen/xend_internal.c | 2 +- 5 files changed, 19 insertions(+), 15 deletions(-) -- 1.7.12

2 6

[libvirt] [PATCH] security: Re-apply commit ce53382ba28179d3a504b29b4f888b6e130d53f0
by Peter Krempa 30 Aug '12

30 Aug '12

Recent changes in the security driver discarded changes that fixed labeling un-confined guests. --- src/security/security_manager.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 367f7ad..07f5a9b 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -340,10 +340,12 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, } if (seclabel->type == VIR_DOMAIN_SECLABEL_DEFAULT) { - if (sec_managers[i]->defaultConfined) + if (sec_managers[i]->defaultConfined) { seclabel->type = VIR_DOMAIN_SECLABEL_DYNAMIC; - else + } else { seclabel->type = VIR_DOMAIN_SECLABEL_NONE; + seclabel->norelabel = true; + } } if ((seclabel->type == VIR_DOMAIN_SECLABEL_NONE) && -- 1.7.12

2 2

[libvirt] [PATCH 0/2] Revert to blocking behavior of qemuAgentCommand
by Jiri Denemark 30 Aug '12

30 Aug '12

Commit 05447e3af44ec153314ff97cd611330d9b4b5730 made changes to qemuAgentCommand so that an arbitrary timeout can be passed to it. However, it did so partially in a very confusing way and partially in a totally wrong way. Jiri Denemark (2): qemu: Remove redundant parameter from qemuAgentSend qemu: Revert to blocking behavior of qemuAgentCommand src/qemu/qemu_agent.c | 46 ++++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 22 deletions(-) -- 1.7.12

3 6

[libvirt] [PATCH] Fix a crash when using Open vSwitch virtual ports
by Kyle Mestery 30 Aug '12

30 Aug '12

Fixup buffer usage when handling VLANs. Also fix the logic used to determine if the virNetDevVlanPtr is valid or not. Fixes crashes in the latest code when using Open vSwitch virtualports. Signed-off-by: Kyle Mestery <kmestery(a)cisco.com> --- src/util/virnetdevopenvswitch.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index b903ae4..cdbc5ef 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -59,7 +59,7 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, char *ifaceid_ex_id = NULL; char *profile_ex_id = NULL; char *vmid_ex_id = NULL; - virBufferPtr buf; + virBuffer buf = VIR_BUFFER_INITIALIZER; virMacAddrFormat(macaddr, macaddrstr); virUUIDFormat(ovsport->interfaceID, ifuuidstr); @@ -79,13 +79,12 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, ovsport->profileID) < 0) goto out_of_memory; } - if (virtVlan) { - if (VIR_ALLOC(buf) < 0) - goto out_of_memory; + + if (virtVlan && virtVlan->nTags > 0) { /* Trunk port first */ - if (virtVlan->trunk) { - virBufferAddLit(buf, "trunk="); + if (virtVlan->trunk == true) { + virBufferAddLit(&buf, "trunk="); /* * Trunk ports have at least one VLAN. Do the first one @@ -93,21 +92,21 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, * start of the for loop if there are more than one VLANs * on this trunk port. */ - virBufferAsprintf(buf, "%d", virtVlan->tag[i]); + virBufferAsprintf(&buf, "%d", virtVlan->tag[i]); for (i = 1; i < virtVlan->nTags; i++) { - virBufferAddLit(buf, ","); - virBufferAsprintf(buf, "%d", virtVlan->tag[i]); + virBufferAddLit(&buf, ","); + virBufferAsprintf(&buf, "%d", virtVlan->tag[i]); } } else if (virtVlan->nTags) { - virBufferAsprintf(buf, "tag=%d", virtVlan->tag[0]); + virBufferAsprintf(&buf, "tag=%d", virtVlan->tag[0]); } } cmd = virCommandNew(OVSVSCTL); if (ovsport->profileID[0] == '\0') { virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferContentAndReset(buf), + brname, ifname, virBufferCurrentContent(&buf), "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, @@ -116,7 +115,7 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, NULL); } else { virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferContentAndReset(buf), + brname, ifname, virBufferCurrentContent(&buf), "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, @@ -135,7 +134,8 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, ret = 0; cleanup: - VIR_FREE(buf); + if (virBufferUse(&buf) > 0) + virBufferFreeAndReset(&buf); VIR_FREE(attachedmac_ex_id); VIR_FREE(ifaceid_ex_id); VIR_FREE(vmid_ex_id); -- 1.7.11.4

6 9