From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; Don't stop the DBus daemon if a slirp helper failed to start, as it may be shared with other helpers. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/qemu/qemu_slirp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_slirp.c b/src/qemu/qemu_slirp.c index 09c1247892..49bffa01b8 100644 --- a/src/qemu/qemu_slirp.c +++ b/src/qemu/qemu_slirp.c @@ -355,6 +355,6 @@ qemuSlirpStart(qemuSlirpPtr slirp, virProcessKillPainfully(pid, true); if (pidfile) unlink(pidfile); - qemuDBusStop(driver, vm); + /* leave dbus daemon running, it may be used by others */ return -1; } -- 2.26.0.rc2.42.g98cedd0233

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; Allow calling qemuDBusStart() multiple times (as may be done by qemu-slirp already). Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/qemu/qemu_dbus.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_dbus.c b/src/qemu/qemu_dbus.c index f3e6f3ee37..ae55bbb299 100644 --- a/src/qemu/qemu_dbus.c +++ b/src/qemu/qemu_dbus.c @@ -177,6 +177,9 @@ qemuDBusStart(virQEMUDriverPtr driver, pid_t cpid = -1; int ret = -1; + if (priv->dbusDaemonRunning) + return 0; + if (!virFileIsExecutable(cfg->dbusDaemonName)) { virReportSystemError(errno, _("'%s' is not a suitable dbus-daemon"), -- 2.26.0.rc2.42.g98cedd0233

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; External devices are started before cgroup is created. Add the DBus daemon to the VM cgroup with the rest of the external devices. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/qemu/qemu_dbus.c | 24 ++++++++++++++++++++++++ src/qemu/qemu_dbus.h | 3 +++ src/qemu/qemu_extdevice.c | 4 ++++ 3 files changed, 31 insertions(+) diff --git a/src/qemu/qemu_dbus.c b/src/qemu/qemu_dbus.c index 02dc3ebf07..53f6c45986 100644 --- a/src/qemu/qemu_dbus.c +++ b/src/qemu/qemu_dbus.c @@ -156,6 +156,30 @@ qemuDBusStop(virQEMUDriverPtr driver, } +int +qemuDBusSetupCgroup(virQEMUDriverPtr driver, + virDomainObjPtr vm) +{ + g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); + qemuDomainObjPrivatePtr priv = vm->privateData; + g_autofree char *shortName = NULL; + g_autofree char *pidfile = NULL; + pid_t cpid = -1; + + if (!priv->dbusDaemonRunning) + return 0; + + if (!(shortName = virDomainDefGetShortName(vm->def))) + return -1; + pidfile = qemuDBusCreatePidFilename(cfg, shortName); + if (virPidFileReadPath(pidfile, &cpid) < 0) { + VIR_WARN("Unable to get DBus PID"); + return -1; + } + + return virCgroupAddProcess(priv->cgroup, cpid); +} + int qemuDBusStart(virQEMUDriverPtr driver, virDomainObjPtr vm) diff --git a/src/qemu/qemu_dbus.h b/src/qemu/qemu_dbus.h index a96f19ac0d..474eb1058b 100644 --- a/src/qemu/qemu_dbus.h +++ b/src/qemu/qemu_dbus.h @@ -35,3 +35,6 @@ void qemuDBusStop(virQEMUDriverPtr driver, int qemuDBusVMStateAdd(virDomainObjPtr vm, const char *id); void qemuDBusVMStateRemove(virDomainObjPtr vm, const char *id); + +int qemuDBusSetupCgroup(virQEMUDriverPtr driver, + virDomainObjPtr vm); diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index dae3524307..2096272761 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -23,6 +23,7 @@ #include "qemu_command.h" #include "qemu_extdevice.h" #include "qemu_vhost_user_gpu.h" +#include "qemu_dbus.h" #include "qemu_domain.h" #include "qemu_tpm.h" #include "qemu_slirp.h" @@ -276,6 +277,9 @@ qemuExtDevicesSetupCgroup(virQEMUDriverPtr driver, virDomainDefPtr def = vm->def; size_t i; + if (qemuDBusSetupCgroup(driver, vm) < 0) + return -1; + for (i = 0; i < def->nvideos; i++) { virDomainVideoDefPtr video = def->videos[i]; -- 2.26.0.rc2.42.g98cedd0233

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; Those functions talk to system bus and have a special handling of system bus missing. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/util/virdbus.c | 12 ++++++------ src/util/virdbus.h | 4 ++-- src/util/virfirewalld.c | 2 +- src/util/virsystemd.c | 8 ++++---- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/util/virdbus.c b/src/util/virdbus.c index 77691cd2b0..858291e2ba 100644 --- a/src/util/virdbus.c +++ b/src/util/virdbus.c @@ -1700,12 +1700,12 @@ static int virDBusIsServiceInList(const char *listMethod, const char *name) } /** - * virDBusIsServiceEnabled: + * virDBusSystemIsServiceEnabled: * @name: service name * * Returns 0 if service is available, -1 on fatal error, or -2 if service is not available */ -int virDBusIsServiceEnabled(const char *name) +int virDBusSystemIsServiceEnabled(const char *name) { int ret = virDBusIsServiceInList("ListActivatableNames", name); @@ -1715,12 +1715,12 @@ int virDBusIsServiceEnabled(const char *name) } /** - * virDBusIsServiceRegistered + * virDBusSystemIsServiceRegistered * @name: service name * * Returns 0 if service is registered, -1 on fatal error, or -2 if service is not registered */ -int virDBusIsServiceRegistered(const char *name) +int virDBusSystemIsServiceRegistered(const char *name) { int ret = virDBusIsServiceInList("ListNames", name); @@ -1843,13 +1843,13 @@ int virDBusMessageDecode(DBusMessage* msg G_GNUC_UNUSED, return -1; } -int virDBusIsServiceEnabled(const char *name G_GNUC_UNUSED) +int virDBusSystemIsServiceEnabled(const char *name G_GNUC_UNUSED) { VIR_DEBUG("DBus support not compiled into this binary"); return -2; } -int virDBusIsServiceRegistered(const char *name G_GNUC_UNUSED) +int virDBusSystemIsServiceRegistered(const char *name G_GNUC_UNUSED) { VIR_DEBUG("DBus support not compiled into this binary"); return -2; diff --git a/src/util/virdbus.h b/src/util/virdbus.h index 083c074d59..b3b0260a4e 100644 --- a/src/util/virdbus.h +++ b/src/util/virdbus.h @@ -70,7 +70,7 @@ int virDBusMessageDecode(DBusMessage *msg, const char *types, ...); void virDBusMessageUnref(DBusMessage *msg); -int virDBusIsServiceEnabled(const char *name); -int virDBusIsServiceRegistered(const char *name); +int virDBusSystemIsServiceEnabled(const char *name); +int virDBusSystemIsServiceRegistered(const char *name); bool virDBusErrorIsUnknownMethod(virErrorPtr err); diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c index c14a6b6e65..499f925b7e 100644 --- a/src/util/virfirewalld.c +++ b/src/util/virfirewalld.c @@ -66,7 +66,7 @@ VIR_ENUM_IMPL(virFirewallDBackend, int virFirewallDIsRegistered(void) { - return virDBusIsServiceRegistered(VIR_FIREWALL_FIREWALLD_SERVICE); + return virDBusSystemIsServiceRegistered(VIR_FIREWALL_FIREWALLD_SERVICE); } /** diff --git a/src/util/virsystemd.c b/src/util/virsystemd.c index 1d41ed34f7..9a659dad84 100644 --- a/src/util/virsystemd.c +++ b/src/util/virsystemd.c @@ -157,13 +157,13 @@ virSystemdHasMachined(void) if (val != -1) return val; - if ((ret = virDBusIsServiceEnabled("org.freedesktop.machine1")) < 0) { + if ((ret = virDBusSystemIsServiceEnabled("org.freedesktop.machine1")) < 0) { if (ret == -2) g_atomic_int_set(&virSystemdHasMachinedCachedValue, -2); return ret; } - if ((ret = virDBusIsServiceRegistered("org.freedesktop.systemd1")) == -1) + if ((ret = virDBusSystemIsServiceRegistered("org.freedesktop.systemd1")) == -1) return ret; g_atomic_int_set(&virSystemdHasMachinedCachedValue, ret); return ret; @@ -179,14 +179,14 @@ virSystemdHasLogind(void) if (val != -1) return val; - ret = virDBusIsServiceEnabled("org.freedesktop.login1"); + ret = virDBusSystemIsServiceEnabled("org.freedesktop.login1"); if (ret < 0) { if (ret == -2) g_atomic_int_set(&virSystemdHasLogindCachedValue, -2); return ret; } - if ((ret = virDBusIsServiceRegistered("org.freedesktop.login1")) == -1) + if ((ret = virDBusSystemIsServiceRegistered("org.freedesktop.login1")) == -1) return ret; g_atomic_int_set(&virSystemdHasLogindCachedValue, ret); -- 2.26.0.rc2.42.g98cedd0233

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; Since commit f10bd740e178c89f24d0b0298d0b5413537d0699 ("Cache the presence of machine1 service"), the code checks for systemd1 registration. Not totally unreasonable, but that seems odd since we actually check machined presence in this function. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/util/virsystemd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virsystemd.c b/src/util/virsystemd.c index 9a659dad84..74d0d15ca7 100644 --- a/src/util/virsystemd.c +++ b/src/util/virsystemd.c @@ -163,7 +163,7 @@ virSystemdHasMachined(void) return ret; } - if ((ret = virDBusSystemIsServiceRegistered("org.freedesktop.systemd1")) == -1) + if ((ret = virDBusSystemIsServiceRegistered("org.freedesktop.machine1")) == -1) return ret; g_atomic_int_set(&virSystemdHasMachinedCachedValue, ret); return ret; -- 2.26.0.rc2.42.g98cedd0233

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; machined could quite easily support session management: https://github.com/systemd/systemd/pull/15312 Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/util/virsystemd.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/src/util/virsystemd.c b/src/util/virsystemd.c index 14d680532f..31f5498438 100644 --- a/src/util/virsystemd.c +++ b/src/util/virsystemd.c @@ -148,16 +148,18 @@ void virSystemdHasLogindResetCachedValue(void) * 0 = machine1 is available */ static int -virSystemdHasMachined(void) +virSystemdHasMachined(DBusConnection **conn) { int ret; int val; + *conn = geteuid() ? virDBusGetSessionBus() : virDBusGetSystemBus(); + val = g_atomic_int_get(&virSystemdHasMachinedCachedValue); if (val != -1) return val; - if ((ret = virDBusSystemIsServiceEnabled("org.freedesktop.machine1")) < 0) { + if ((ret = virDBusIsServiceEnabled(*conn, "org.freedesktop.machine1")) < 0) { if (ret == -2) g_atomic_int_set(&virSystemdHasMachinedCachedValue, -2); return ret; @@ -199,10 +201,7 @@ virSystemdGetMachineNameByPID(pid_t pid) DBusMessage *reply = NULL; char *name = NULL, *object = NULL; - if (virSystemdHasMachined() < 0) - goto cleanup; - - if (!(conn = virDBusGetSystemBus())) + if (virSystemdHasMachined(&conn) < 0) goto cleanup; if (virDBusCallMethod(conn, &reply, NULL, @@ -279,12 +278,9 @@ int virSystemdCreateMachine(const char *name, char *scopename = NULL; static int hasCreateWithNetwork = 1; - if ((ret = virSystemdHasMachined()) < 0) + if ((ret = virSystemdHasMachined(&conn)) < 0) return ret; - if (!(conn = virDBusGetSystemBus())) - return -1; - ret = -1; creatorname = g_strdup_printf("libvirt-%s", drivername); @@ -459,14 +455,11 @@ int virSystemdTerminateMachine(const char *name) memset(&error, 0, sizeof(error)); - if ((ret = virSystemdHasMachined()) < 0) + if ((ret = virSystemdHasMachined(&conn)) < 0) goto cleanup; ret = -1; - if (!(conn = virDBusGetSystemBus())) - goto cleanup; - /* * The systemd DBus API we're invoking has the * following signature -- 2.26.0.rc2.42.g98cedd0233

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; External devices registration can add processes to the process group, which allows basic process management or other tuning. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/qemu/qemu_cgroup.c | 9 --------- 1 file changed, 9 deletions(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index cec0a03889..c288519e62 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -1127,15 +1127,6 @@ qemuSetupCgroupForExtDevices(virDomainObjPtr vm, priv->cgroup == NULL) return 0; /* Not supported, so claim success */ - /* - * If CPU cgroup controller is not initialized here, then we need - * neither period nor quota settings. And if CPUSET controller is - * not initialized either, then there's nothing to do anyway. - */ - if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_CPU) && - !virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_CPUSET)) - return 0; - if (virCgroupNewThread(priv->cgroup, VIR_CGROUP_THREAD_EMULATOR, 0, false, &cgroup_temp) < 0) goto cleanup; -- 2.26.0.rc2.42.g98cedd0233

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; CGroup delegation can allow various processes or users to use cgroup. Further checks should be done by the various backends. With this series, a qemu:///session VM can have basic CGroupv2 support with machined --user help. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- src/qemu/qemu_cgroup.c | 3 --- src/util/vircgroup.c | 5 +++++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index c288519e62..0f80dd4214 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -914,9 +914,6 @@ qemuInitCgroup(virDomainObjPtr vm, qemuDomainObjPrivatePtr priv = vm->privateData; g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(priv->driver); - if (!virQEMUDriverIsPrivileged(priv->driver)) - return 0; - if (!virCgroupAvailable()) return 0; diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index 70d85200cb..4e71677994 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -1254,6 +1254,11 @@ virCgroupNewMachine(const char *name, if (rv == -1) return -1; + if (geteuid() != 0) { + errno = EPERM; + return 0; + } + return virCgroupNewMachineManual(name, drivername, pidleader, -- 2.26.0.rc2.42.g98cedd0233