Re: [libvirt] [RFC: PATCHv3 3/3] save: generate idempotent inactive xml for running domain
On 07/28/2011 12:59 PM, Laine Stump wrote:
On 07/22/2011 12:21 AM, Eric Blake wrote:
> Noticed by comparing the xml generated by virDomainSave with the
> xml produced by reparsing and redumping that xml.
>
> * src/conf/domain_conf.c (virDomainDeviceInfoIsSet): Add
> parameter, and update all callers. Make static.
> (virDomainNetDefFormat): Skip generated ifname.
> * src/conf/domain_conf.h (virDomainDeviceInfoIsSet): Delete.
> * src/libvirt_private.syms (domain_conf.h): Update.
> ---
>
> Sending this now, to get review started, but I still have some
> more fixing to do - right now, active domains still include:
>
> +<seclabel type='dynamic' model='selinux'
relabel='yes'/>
>
> which is not present on reparse, but I'm too tired to find out why.
I know the feeling :-)
Now that I've had some sleep (and 6 days have elapsed), I've finally
gotten back to this patch. :-)
So does it turn out that this is important, or not?
It _would_ be, if we cared about non-empty model on inactive parse.
That is, if we _wanted_ to force a dynamic security model of selinux
instead of apparmor, then the inactive parse needs to be taught to parse
model, and enforce that the model is supported by the current host (and
prevent migrations between selinux and apparmor machines). But since
that particular <seclabel> merely represents the default, and by default
you want a secure machine regardless of which security model your host
supports, I simply fixed the formatter to omit default information
rather than teaching the parser to honor an explicit model (that is,
existing behavior has always been to ignore model on inactive parse).
> +
> + if (def->ifname&&
> + !((flags& VIR_DOMAIN_XML_INACTIVE)&&
> + (STRPREFIX(def->ifname, "vnet")))) {
> + /* Skip auto-generated target names for inactive config. */
It's kind of bothersome that use of this magic device name prefix isn't
self-contained in domain_conf.c (or somewhere else). Perhaps the string
could be defined in domain_conf.h, then used here and in qemu_command.c
(is it used any place else?).
Split into a separate patch - uml_conf.c also used it.
v4 now posted, and my audit of domain_conf.c is now complete.
https://www.redhat.com/archives/libvir-list/2011-July/msg02064.html
--
Eric Blake eblake(a)redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org