February 2014 - Devel - Libvirt List Archives

[libvirt] [PATCH v3] Ensure systemd cgroup ownership is delegated to container with userns

by Daniel P. Berrange

From: Richard Weinberger <richard(a)nod.at> This function is needed for user namespaces, where we need to chmod() the cgroup to the initial uid/gid such that systemd is allowed to use the cgroup. Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> Changed in v3: - Centralized all error reporting - Use virReportSystemError not VIR_WARN/VIR_ERROR --- src/libvirt_private.syms | 1 + src/lxc/lxc_cgroup.c | 12 +++++++++ src/util/vircgroup.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++ src/util/vircgroup.h | 5 ++++ 4 files changed, 88 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 0b28bac..cfa9f75 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1056,6 +1056,7 @@ virCgroupSetMemory; virCgroupSetMemoryHardLimit; virCgroupSetMemorySoftLimit; virCgroupSetMemSwapHardLimit; +virCgroupSetOwner; virCgroupSupportsCpuBW; diff --git a/src/lxc/lxc_cgroup.c b/src/lxc/lxc_cgroup.c index cc0d5e8..39d955c 100644 --- a/src/lxc/lxc_cgroup.c +++ b/src/lxc/lxc_cgroup.c @@ -484,6 +484,18 @@ virCgroupPtr virLXCCgroupCreate(virDomainDefPtr def) &cgroup) < 0) goto cleanup; + /* setup control group permissions for user namespace */ + if (def->idmap.uidmap) { + if (virCgroupSetOwner(cgroup, + def->idmap.uidmap[0].target, + def->idmap.gidmap[0].target, + (1 << VIR_CGROUP_CONTROLLER_SYSTEMD)) < 0) { + virCgroupFree(&cgroup); + cgroup = NULL; + goto cleanup; + } + } + cleanup: return cgroup; } diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index a6d60c5..18c891c 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -3253,6 +3253,76 @@ cleanup: } +int virCgroupSetOwner(virCgroupPtr cgroup, + uid_t uid, + gid_t gid, + int controllers) +{ + int ret = -1; + size_t i; + char *base = NULL, *entry = NULL; + DIR *dh = NULL; + + for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { + struct dirent *de; + + if (!((1 << i) & controllers)) + continue; + + if (!cgroup->controllers[i].mountPoint) + continue; + + if (virAsprintf(&base, "%s%s", cgroup->controllers[i].mountPoint, + cgroup->controllers[i].placement) < 0) + goto cleanup; + + if (!(dh = opendir(base))) { + virReportSystemError(errno, + _("Unable to open dir '%s'"), base); + goto cleanup; + } + + while ((de = readdir(dh)) != NULL) { + if (STREQ(de->d_name, ".") || + STREQ(de->d_name, "..")) + continue; + + if (virAsprintf(&entry, "%s/%s", base, de->d_name) < 0) + goto cleanup; + + if (chown(entry, uid, gid) < 0) { + virReportSystemError(errno, + _("cannot chown '%s' to (%u, %u)"), + entry, uid, gid); + goto cleanup; + } + + VIR_FREE(entry); + } + + if (chown(base, uid, gid) < 0) { + virReportSystemError(errno, + _("cannot chown '%s' to (%u, %u)"), + base, uid, gid); + goto cleanup; + } + + VIR_FREE(base); + closedir(dh); + dh = NULL; + } + + ret = 0; + + cleanup: + if (dh) + closedir(dh); + VIR_FREE(entry); + VIR_FREE(base); + return ret; +} + + /** * virCgroupSupportsCpuBW(): * Check whether the host supports CFS bandwidth. diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h index a70eb18..38d94f3 100644 --- a/src/util/vircgroup.h +++ b/src/util/vircgroup.h @@ -225,4 +225,9 @@ int virCgroupIsolateMount(virCgroupPtr group, bool virCgroupSupportsCpuBW(virCgroupPtr cgroup); +int virCgroupSetOwner(virCgroupPtr cgroup, + uid_t uid, + gid_t gid, + int controllers); + #endif /* __VIR_CGROUP_H__ */ -- 1.8.5.3

10 years, 9 months

3
2
0 / 0

[libvirt] [PATCH v2] lxc: Add virCgroupSetOwner()

by Richard Weinberger

Add a new helper function to change the permissions of a control group. This function is needed for user namespaces, we need to chmod() the cgroup to the initial uid/gid such that systemd is allowed to use the cgroup. Signed-off-by: Richard Weinberger <richard(a)nod.at> --- Changes between v1 and v2: - Addressed Martin Kletzander's comments - Fixed opendir() error handling --- src/libvirt_private.syms | 1 + src/lxc/lxc_cgroup.c | 12 ++++++++++ src/util/vircgroup.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++ src/util/vircgroup.h | 5 ++++ 4 files changed, 78 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 2c9536a..40e72f2 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1056,6 +1056,7 @@ virCgroupSetMemory; virCgroupSetMemoryHardLimit; virCgroupSetMemorySoftLimit; virCgroupSetMemSwapHardLimit; +virCgroupSetOwner; virCgroupSupportsCpuBW; diff --git a/src/lxc/lxc_cgroup.c b/src/lxc/lxc_cgroup.c index cc0d5e8..39d955c 100644 --- a/src/lxc/lxc_cgroup.c +++ b/src/lxc/lxc_cgroup.c @@ -484,6 +484,18 @@ virCgroupPtr virLXCCgroupCreate(virDomainDefPtr def) &cgroup) < 0) goto cleanup; + /* setup control group permissions for user namespace */ + if (def->idmap.uidmap) { + if (virCgroupSetOwner(cgroup, + def->idmap.uidmap[0].target, + def->idmap.gidmap[0].target, + (1 << VIR_CGROUP_CONTROLLER_SYSTEMD)) < 0) { + virCgroupFree(&cgroup); + cgroup = NULL; + goto cleanup; + } + } + cleanup: return cgroup; } diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index a6d60c5..4bef0db 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -3253,6 +3253,66 @@ cleanup: } +int virCgroupSetOwner(virCgroupPtr cgroup, + uid_t uid, + gid_t gid, + int controllers) +{ + size_t i; + + for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { + char *base, *entry; + DIR *dh; + struct dirent *de; + + if (!((1 << i) & controllers)) + continue; + + if (!cgroup->controllers[i].mountPoint) + continue; + + if (virAsprintf(&base, "%s%s", cgroup->controllers[i].mountPoint, + cgroup->controllers[i].placement) < 0) { + return -1; + } + + dh = opendir(base); + if (!dh) { + VIR_ERROR(_("Unable to open %s: %s"), base, strerror(errno)); + VIR_FREE(base); + return -1; + } + + while ((de = readdir(dh)) != NULL) { + if (STREQ(de->d_name, ".") || + STREQ(de->d_name, "..")) + continue; + + if (virAsprintf(&entry, "%s/%s", base, de->d_name) < 0) { + VIR_FREE(base); + closedir(dh); + return -1; + } + + if (chown(entry, uid, gid) < 0) + VIR_WARN(_("cannot chown '%s' to (%u, %u): %s"), entry, uid, gid, + strerror(errno)); + + VIR_FREE(entry); + } + closedir(dh); + + if (chown(base, uid, gid) < 0) + VIR_WARN(_("cannot chown '%s' to (%u, %u): %s"), entry, uid, gid, + strerror(errno)); + + VIR_FREE(base); + } + + return 0; +} + + /** * virCgroupSupportsCpuBW(): * Check whether the host supports CFS bandwidth. diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h index a70eb18..38d94f3 100644 --- a/src/util/vircgroup.h +++ b/src/util/vircgroup.h @@ -225,4 +225,9 @@ int virCgroupIsolateMount(virCgroupPtr group, bool virCgroupSupportsCpuBW(virCgroupPtr cgroup); +int virCgroupSetOwner(virCgroupPtr cgroup, + uid_t uid, + gid_t gid, + int controllers); + #endif /* __VIR_CGROUP_H__ */ -- 1.8.4.5

10 years, 9 months

2
3
0 / 0

[libvirt] Error while running event-test.c in Libvirt package

by Avanti Ajay

Hello, I am trying to run event-test.c code available in libvirt-0.10.2 package under the folder /examples/domain-events/events-c. I am getting the following error /usr/bin/ld: cannot find -lvirt collect2: ld returned 1 exit status Please help me to solve this issue.

10 years, 9 months

2
1
0 / 0

[libvirt] [libvirt-glib 0/2] Fix make distcheck

by Christophe Fergeau

Hey, After the introduction of the GTest unit tests, make distcheck still has a few issues, with this series, make distcheck passes on my box (using glib 2.38). Christophe

10 years, 9 months

2
4
0 / 0

[libvirt] [PATCH glib] Disable test suite unless glib >= 2.38

by Daniel P. Berrange

The TAP harness for glib only works with version 2.38 or later, so must be disabled for earlier versions Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- configure.ac | 8 +++++++- tests/Makefile.am | 18 ++++++++++++++---- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/configure.ac b/configure.ac index 4ad636a..d5b2971 100644 --- a/configure.ac +++ b/configure.ac @@ -12,6 +12,7 @@ AM_SILENT_RULES([yes]) LIBVIRT_REQUIRED=0.10.2 AC_SUBST([LIBVIRT_REQUIRED]) dnl used in the .spec file GLIB2_REQUIRED=2.22.0 +GLIB2_TEST_REQUIRED=2.38.0 GOBJECT2_REQUIRED=2.10.0 GIO_REQUIRED=2.10.0 GOBJECT_INTROSPECTION_REQUIRED=0.10.8 @@ -91,12 +92,17 @@ m4_if(m4_version_compare([2.61a.100], LIBVIRT_GLIB_COMPILE_WARNINGS PKG_CHECK_MODULES(LIBVIRT, libvirt >= $LIBVIRT_REQUIRED) -PKG_CHECK_MODULES(GLIB2, glib-2.0 >= $GLIB2_REQUIRED) +enable_tests=no +PKG_CHECK_MODULES(GLIB2, glib-2.0 >= $GLIB2_TEST_REQUIRED, + [enable_tests=yes], + [PKG_CHECK_MODULES(GLIB2, glib-2.0 >= $GLIB2_REQUIRED)]) PKG_CHECK_MODULES(GTHREAD2, gthread-2.0 >= $GLIB2_REQUIRED) PKG_CHECK_MODULES(GOBJECT2, gobject-2.0 >= $GLIB2_REQUIRED) PKG_CHECK_MODULES(GIO2, gio-2.0 >= $GLIB2_REQUIRED) PKG_CHECK_MODULES(LIBXML2, libxml-2.0 >= $LIBXML2_REQUIRED) +AM_CONDITIONAL([ENABLE_TESTS], [test "$enable_tests" = "yes"]) + LIBVIRT_GLIB_GETTEXT dnl Should be in m4/virt-gettext.m4 but intltoolize is too dnl dumb to find it there diff --git a/tests/Makefile.am b/tests/Makefile.am index 56887ce..8cb98e5 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -1,3 +1,11 @@ +EXTRA_DIST = \ + xml/gconfig-domain.xml \ + xml/gconfig-domain-clock.xml \ + xml/gconfig-domain-os.xml \ + $(NULL) + +if ENABLE_TESTS + include $(top_srcdir)/build-aux/glib-tap.mk AM_CFLAGS = \ @@ -14,7 +22,9 @@ LDADD = \ test_programs = test-gconfig test-events -dist_test_data = \ - xml/gconfig-domain.xml \ - xml/gconfig-domain-clock.xml \ - xml/gconfig-domain-os.xml +else +EXTRA_DIST += \ + test-events.c \ + test-gconfig.c \ + $(NULL) +endif -- 1.8.5.3

10 years, 9 months

3
2
0 / 0

[libvirt] [PATCH] build: fix build on 32-bit hosts

by Eric Blake

vircgrouptest.c: In function 'testCgroupGetPercpuStats': vircgrouptest.c:543: warning: integer constatnt is too large for 'long' type Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. tests/vircgrouptest.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/vircgrouptest.c b/tests/vircgrouptest.c index 5c14efb..5d5eccc 100644 --- a/tests/vircgrouptest.c +++ b/tests/vircgrouptest.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2013 Red Hat, Inc. + * Copyright (C) 2013-2014 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -540,7 +540,7 @@ static int testCgroupGetPercpuStats(const void *args ATTRIBUTE_UNUSED) // TODO: mock nodeGetCPUCount() as well & check 2nd cpu, too unsigned long long expected[] = { - 1413142688153030 + 1413142688153030ULL }; if ((rv = virCgroupNewPartition("/virtualmachines", true, @@ -632,8 +632,8 @@ static int testCgroupGetBlkioIoServiced(const void *args ATTRIBUTE_UNUSED) int rv, ret = -1; const long long expected_values[] = { - 119084214273, - 822880960513, + 119084214273ULL, + 822880960513ULL, 9665167, 73283807 }; @@ -681,14 +681,14 @@ static int testCgroupGetBlkioIoDeviceServiced(const void *args ATTRIBUTE_UNUSED) size_t i; int rv, ret = -1; const long long expected_values0[] = { - 59542107136, - 411440480256, + 59542107136ULL, + 411440480256ULL, 4832583, 36641903 }; const long long expected_values1[] = { - 59542107137, - 411440480257, + 59542107137ULL, + 411440480257ULL, 4832584, 36641904 }; -- 1.8.5.3

10 years, 9 months

1
0
0 / 0

[libvirt] [PATCH] maint: update to latest gnulib, for older autoconf

by Eric Blake

Based on a report from Pavel Hrdina, gnulib was fixed to support AC_PROG_SED even when using ancient autoconf 2.59 of RHEL 5. * .gnulib: Update to latest, to fix build on RHEL 5. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. * .gnulib 3f51bf4...72fb907 (3): > m4: fix gl_TIMER_TIME() detection of threads on uClibc > maintainer-makefiles: provide AC_PROG_SED for older autoconf > exclude: add support for posix regexps .gnulib | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gnulib b/.gnulib index 3f51bf4..72fb907 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 3f51bf41c8be8b310f57caff371377414701d5cc +Subproject commit 72fb9075b2812765d2ce55a1a26c3764392377cb -- 1.8.5.3

10 years, 9 months

1
0
0 / 0

[libvirt] [PATCH 0/4] Improve logging when QEMU caps fails

by Daniel P. Berrange

This improves the logging when we have a failure to probe QEMU capabilities for any binary. Daniel P. Berrange (4): Send virLogMetadata fields onto the journal Include error domain and code in log messages from errors Add comments describing the different log sources Generate a unique journald log for QEMU capabilities failure src/qemu/qemu_capabilities.c | 28 ++++++++++++++++++++++++++-- src/util/virerror.c | 8 +++++++- src/util/virlog.c | 18 ++++++++++++++++-- src/util/virlog.h | 10 +++++----- 4 files changed, 54 insertions(+), 10 deletions(-) -- 1.8.5.3

10 years, 9 months

2
8
0 / 0

[libvirt] [PATCH] XML: Escape double-hyphens in XML comment

by Philipp Hahn

To quote <http://www.w3.org/TR/REC-xml/#sec-comments>: > For compatibility, the string "--" (double-hyphen) must not occur within comments. For example this breaks creating snapshots: $ virsh snapshot-create-as $VM "comment--bug" $ xmllint --noout /var/lib/libvirt/qemu/snapshot/$VM/comment--bug.xml /var/lib/libvirt/qemu/snapshot/$VM/comment--bug.xml:4: parser error : Comment not terminated <domain...<devices>...<disk...<source dev="/dev/sda"/>... It might break on the "/" as this is the only prohibited character for QEMU domains, as the name is directly used as a file name. To fix such broken files (by hand), remove the broken comment by doing something like this after making sure libvirtd is stopped: sed -i -ne '/^<domainsnapshot>$/,$p' /var/lib/libvirt/qemu/snapshot/*/*.xml sed -i -ne '/^<domain /,$p' /etc/libvirt/qemu/*.xml sed -i -ne '/^<pool /,$p' /etc/libvirt/storage/*.xml @Debian: The bug is also in libvirt-0.9.12. Signed-off-by: Philipp Hahn <hahn(a)univention.de> --- src/util/virxml.c | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/src/util/virxml.c b/src/util/virxml.c index dd530a6..ad45e68 100644 --- a/src/util/virxml.c +++ b/src/util/virxml.c @@ -798,6 +798,34 @@ const char *virXMLPickShellSafeComment(const char *str1, const char *str2) return NULL; } +/* + * Break sequence of hyphens by inserting (arbitrarily chosen) backslashes. + * <http://www.w3.org/TR/REC-xml/#sec-comments>: + * > For compatibility, the string "--" (double-hyphen) must not occur within + * > comments. + */ +static int virXMLEmitEscapedComment(int fd, + const char *str) +{ + size_t len; + + if (!strstr(str, "--")) { + len = strlen(str); + if (safewrite(fd, str, len) != len) + return -1; + return 0; + } + + for (;*str;str++) { + if (safewrite(fd, str, 1) != 1) + return -1; + if (str[0] == '-' && str[1] == '-') + if (safewrite(fd, "\\", 1) != 1) + return -1; + } + return 0; +} + static int virXMLEmitWarning(int fd, const char *name, const char *cmd) @@ -822,16 +850,14 @@ static int virXMLEmitWarning(int fd, if (safewrite(fd, prologue, len) != len) return -1; - len = strlen(cmd); - if (safewrite(fd, cmd, len) != len) + if (virXMLEmitEscapedComment(fd, cmd) < 0) return -1; if (name) { if (safewrite(fd, " ", 1) != 1) return -1; - len = strlen(name); - if (safewrite(fd, name, len) != len) + if (virXMLEmitEscapedComment(fd, name) < 0) return -1; } -- 1.8.5.3

10 years, 9 months

3
3
0 / 0

[libvirt] ANNOUNCE: libvirt-glib release 0.1.8

by Daniel P. Berrange

I am pleased to announce that a new release of the libvirt-glib package, version 0.1.8, is now available from ftp://libvirt.org/libvirt/glib/ The packages are GPG signed with Key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF (4096R) Changes in this release: - Add getter/setter for UUID in domain config - Remove dead code / unused variables - Add missing symbol exports - Add support for setting nwfilters in domain config - Switch to standard gobject introspection autotools macros - Fix typo preventing removal of clock config - Add getter/setters for disk driver type - Add unit tests based on glib tap harness - Add test for validating symbol file exports - Add getters for domain graphics config params - Add more getters for domain timer config - Add support for hpet timer type - Fix event loop impl on win32 - Fix parent class/object of pit timer class - Fix misc API doc bugs - Add more getters for domain clock config - Fix removal of domain CPU feature flags - Fix removal of capabilities CPU topology - Misc fixes to glib event loop integration libvirt-glib comprises three distinct libraries: - libvirt-glib - Integrate with the GLib event loop and error handling - libvirt-gconfig - Representation of libvirt XML documents as GObjects - libvirt-gobject - Mapping of libvirt APIs into the GObject type system NB: While libvirt aims to be API/ABI stable forever, with libvirt-glib we are not yet guaranteeing that libvirt-glib libraries are API/ABI permanently stable. As of the 0.0.8 release, we have tentatively frozen the API/ABI with the intent of being longterm stable hereafter, but there is still a small chance we might find flaws requiring an API/ABI change. The likelihood of this is low, however, and we will strive to avoid it. Follow up comments about libvirt-glib should be directed to the regular libvir-list(a)redhat.com development list. Thanks to all the people involved in contributing to this release. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

10 years, 9 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Devel February 2014