I've noticed two problem with the automatically created NVRAM varstore file. The first, even though I run qemu as root:root for some reason I get Permission denied when trying to open the _VARS.fd file. The problem is, the upper directory misses execute permissions, which in combination with us dropping some capabilities result in EPERM. The next thing is, that if I switch SELinux to enforcing mode, I get another EPERM because the vars file is not labeled correctly. It is passed to qemu as disk and hence should be labelled as disk. QEMU may write to it eventually, so this is different to kernel or initrd. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; --- libvirt.spec.in | 2 +- src/security/security_selinux.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index a6a58cf..ecf160b 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1938,7 +1938,7 @@ exit 0 %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/channel/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/channel/target/ -%dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/nvram/ +%dir %attr(0711, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/nvram/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index bf67fb5..3db2b27 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -2300,8 +2300,11 @@ virSecuritySELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr, mgr) < 0) return -1; + /* This is different than kernel or initrd. The nvram store + * is really a disk, qemu can read and write to it. */ if (def->os.loader && def->os.loader->nvram && - virSecuritySELinuxSetFilecon(def->os.loader->nvram, data->content_context) < 0) + secdef && secdef->imagelabel && + virSecuritySELinuxSetFilecon(def->os.loader->nvram, secdef->imagelabel) < 0) return -1; if (def->os.kernel && -- 1.8.5.5

On 11.09.2014 16:07, Laszlo Ersek wrote: Indeed. Moreover, I was first surprised that even if was running qemu under root:root I got EACCES. Problem was, libvirt drops nearly all caps (even CAP_SYS_ADMIN) after fork and prior to executing qemu binary. Thanks, applied. Michal

On 09/11/14 16:25, Michal Privoznik wrote: ... Unfortunately the patch is insufficient. Commit 742b08e3 added directory %{_localstatedir}/lib/libvirt/qemu/nvram/ to two sub-packages: %files daemon %files daemon-driver-qemu I assume that was a correct thing to do (it is consistent with the rest of the directories being listed for both subpackages). However, this recent patch (commit 37d8c75f) changes the 0750 permission bits to 0711 only in the "daemon" subpackage, and the directory in the daemon-driver-qemu subpackage remains with 0750. In my testing, the daemon package's modification doesn't take effect at all. In fact the daemon RPM doesn't even seem to contain the nvram directory. Thanks, Laszlo

When a domain is undefined, there are options to remove it's managed save state or snapshots. However, there's another file that libvirt creates per domain: the NVRAM variable store file. Make sure that the file is not left behind if the domain is undefined. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; --- include/libvirt/libvirt.h.in | 2 ++ src/qemu/qemu_driver.c | 19 ++++++++++++++++++- tools/virsh-domain.c | 15 ++++++++++++--- tools/virsh.pod | 6 +++++- 4 files changed, 37 insertions(+), 5 deletions(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index 94b942c..3c2a51a 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -2257,6 +2257,8 @@ typedef enum { VIR_DOMAIN_UNDEFINE_SNAPSHOTS_METADATA = (1 << 1), /* If last use of domain, then also remove any snapshot metadata */ + VIR_DOMAIN_UNDEFINE_NVRAM = (1 << 2), /* Also remove any + nvram file */ /* Future undefine control flags should come here. */ } virDomainUndefineFlagsValues; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index a8cda43..7f17fee 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6403,7 +6403,8 @@ qemuDomainUndefineFlags(virDomainPtr dom, virQEMUDriverConfigPtr cfg = NULL; virCheckFlags(VIR_DOMAIN_UNDEFINE_MANAGED_SAVE | - VIR_DOMAIN_UNDEFINE_SNAPSHOTS_METADATA, -1); + VIR_DOMAIN_UNDEFINE_SNAPSHOTS_METADATA | + VIR_DOMAIN_UNDEFINE_NVRAM, -1); if (!(vm = qemuDomObjFromDomain(dom))) return -1; @@ -6452,6 +6453,22 @@ qemuDomainUndefineFlags(virDomainPtr dom, } } + if (!virDomainObjIsActive(vm) && + vm->def->os.loader && vm->def->os.loader->nvram) { + if (!(flags & VIR_DOMAIN_UNDEFINE_NVRAM)) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("cannot delete inactive domain with nvram")); + goto cleanup; + } + + if (unlink(vm->def->os.loader->nvram) < 0) { + virReportSystemError(errno, + _("failed to remove nvram: %s"), + vm->def->os.loader->nvram); + goto cleanup; + } + } + if (virDomainDeleteConfig(cfg->configDir, cfg->autostartDir, vm) < 0) goto cleanup; diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 6aa8631..db52271 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -3248,6 +3248,10 @@ static const vshCmdOptDef opts_undefine[] = { .type = VSH_OT_BOOL, .help = N_("remove all domain snapshot metadata, if inactive") }, + {.name = "nvram", + .type = VSH_OT_BOOL, + .help = N_("remove nvram file, if inactive") + }, {.name = NULL} }; @@ -3270,6 +3274,7 @@ cmdUndefine(vshControl *ctl, const vshCmd *cmd) bool snapshots_metadata = vshCommandOptBool(cmd, "snapshots-metadata"); bool wipe_storage = vshCommandOptBool(cmd, "wipe-storage"); bool remove_all_storage = vshCommandOptBool(cmd, "remove-all-storage"); + bool nvram = vshCommandOptBool(cmd, "nvram"); /* Positive if these items exist. */ int has_managed_save = 0; int has_snapshots_metadata = 0; @@ -3313,6 +3318,9 @@ cmdUndefine(vshControl *ctl, const vshCmd *cmd) flags |= VIR_DOMAIN_UNDEFINE_SNAPSHOTS_METADATA; snapshots_safe = true; } + if (nvram) { + flags |= VIR_DOMAIN_UNDEFINE_NVRAM; + } if (!(dom = vshCommandOptDomain(ctl, cmd, &name))) return false; @@ -3504,10 +3512,11 @@ cmdUndefine(vshControl *ctl, const vshCmd *cmd) * VIR_DOMAIN_UNDEFINE_SNAPSHOTS_METADATA flag was not present * until 0.9.5; skip to piecewise emulation if we couldn't prove * above that the new API is safe. */ - if (managed_save_safe && snapshots_safe) { + if ((managed_save_safe && snapshots_safe) || nvram) { rc = virDomainUndefineFlags(dom, flags); - if (rc == 0 || (last_error->code != VIR_ERR_NO_SUPPORT && - last_error->code != VIR_ERR_INVALID_ARG)) + if (rc == 0 || nvram || + (last_error->code != VIR_ERR_NO_SUPPORT && + last_error->code != VIR_ERR_INVALID_ARG)) goto out; vshResetLibvirtError(); } diff --git a/tools/virsh.pod b/tools/virsh.pod index 60ee515..ae396d2 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -2083,7 +2083,7 @@ Output the device used for the TTY console of the domain. If the information is not available the processes will provide an exit code of 1. =item B<undefine> I<domain> [I<--managed-save>] [I<--snapshots-metadata>] -[ {I<--storage> B<volumes> | I<--remove-all-storage>} I<--wipe-storage>] +[I<--nvram>} [ {I<--storage> B<volumes> | I<--remove-all-storage>} I<--wipe-storage>] Undefine a domain. If the domain is running, this converts it to a transient domain, without stopping it. If the domain is inactive, @@ -2099,6 +2099,10 @@ domain. Without the flag, attempts to undefine an inactive domain with snapshot metadata will fail. If the domain is active, this flag is ignored. +The I<--nvram> flag ensures no nvram (/domain/os/nvram/) file is +left behind. If the domain has a nvram file and the flag is +omitted the undefine will fail. + The I<--storage> flag takes a parameter B<volumes>, which is a comma separated list of volume target names or source paths of storage volumes to be removed along with the undefined domain. Volumes can be undefined and thus removed only -- 1.8.5.5