November 2007 - Devel - libvirt List Archives

[Libvir] netcat "-U" option
by Richard W.M. Jones 23 Nov '07

23 Nov '07

Debian ship a completely different version of netcat from Fedora. Not just a different version, but it appears to be a different codebase. Debian's netcat doesn't support the (very useful) -U option, so this code fails in src/remote_internal.c: cmd_argv[j++] = strdup (command); //..... cmd_argv[j++] = strdup (server); cmd_argv[j++] = strdup (netcat ? netcat : "nc"); cmd_argv[j++] = strdup ("-U"); cmd_argv[j++] = strdup (sockname ? sockname : LIBVIRTD_PRIV_UNIX_SOCKET); cmd_argv[j++] = 0; As a result of this remote-over-ssh fails on Debian. I'm not completely sure how to solve this at the moment. If anyone has any ideas ... Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

3 4

[Libvir] [PATCH] fixes when running as user or in tree tests
by Daniel Veillard 23 Nov '07

23 Nov '07

The following patches does 3 things which correct annoyances when running as an user or when running from a tree built with --prefix=/usr - avoid error message when non-root cannot open xenstore - avoid error message when non-root cannot directly access xend in those two cases the proxy (or remote code) should implement the access so there is no need to raise the error there. - when configuring with --prefix=/usr i.e. the same prefix as the installed libvirt, use the same localstatedir /var (instead of /usr/var) and sysconfdir /etc (instead of /usr/etc) to be able to connect to the system daemon, and use the system local options Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

1 0

[Libvir] (remoteInitializeGnuTLS): Fix a typo in a variable name.
by Jim Meyering 22 Nov '07

22 Nov '07

2007-11-21 Jim Meyering <meyering(a)redhat.com> Fix a typo in a variable name. * qemud/qemud.c: Check crl_file, not ca_file, for revocation list, in remoteInitializeGnuTLS. diff --git a/qemud/qemud.c b/qemud/qemud.c index 55bd805..f6cd026 100644 --- a/qemud/qemud.c +++ b/qemud/qemud.c @@ -165,7 +165,7 @@ remoteInitializeGnuTLS (void) } if (crl_file && crl_file[0] != '\0') { - if (remoteCheckCertFile("CA revocation list", ca_file) < 0) + if (remoteCheckCertFile("CA revocation list", crl_file) < 0) return -1; qemudDebug ("loading CRL from %s", crl_file); -- 1.5.3.6.736.gb7f30

2 2

[Libvir] <disk> <shareable/> has no effect
by Markus Armbruster 21 Nov '07

21 Nov '07

Looks like <shareable/> within <disk> has no effect. I ran virsh dumpxml, inserted the <shareable/>, redefined the domain, and ran virsh dumpxml again. No shareable. I even ran virsh undefine and virsh define again, same thing. XML and output of xm list --long for this guest attached.

3 4

[Libvir] brSetForwardDelay / brSetEnableSTP
by Richard W.M. Jones 21 Nov '07

21 Nov '07

This code in qemu_driver.c doesn't look right to me. I think the second should be a call to brSetEnableSTP? Rich. if (network->def->forwardDelay && (err = brSetForwardDelay(driver->brctl, network->bridge, network->def->forwardDelay))) { qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, "failed to set bridge forward delay to %d\n", network->def->forwardDelay); goto err_delbr; } if ((err = brSetForwardDelay(driver->brctl, network->bridge, network->def->disableSTP ? 0 : 1))) { qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, "failed to set bridge STP to %s\n", network->def->disableSTP ? "off" : "on"); goto err_delbr; } -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

2 3

[Libvir] [PATCH] virterror Cleanups
by Saori Fukuta 20 Nov '07

20 Nov '07

Hi, The virsh command sometimes says wrong message that indicating where the error is coming from. So I have some fixes for libvirt error. * Add two number for virErrorDomain (virterror.h) * Add six message indicating where it's coming from (virterror.c) * Fix virErrorDomain number specified with __virRaiseError (openvz_conf.c/openvz_driver.c/stats_linux.c/xm_internal.c) Regards, Saori Fukuta

3 4

[Libvir] ANNOUNCE: Ruby bindings for libvirt
by David Lutterkort 20 Nov '07

20 Nov '07

I'm pleased to announce the availability of Ruby bindings for libvirt. The main site for them is http://libvirt.org/ruby API docs can be found at http://libvirt.org/ruby/api/index.html An initial release is at http://libvirt.org/ruby/download - the bindings are mostly complete, though there are a number of less frequently used functions that are not covered yet. Please send all your patches (and comments/questions) to this list. David

3 3

[Libvir] [PATCH]: Add virNodeGetInfo to ruby bindings
by Chris Lalancette 19 Nov '07

19 Nov '07

All, Attached is a patch to add the virNodeGetInfo() call to the Libvirt Ruby bindings. Although it is not technically a virConn* function, it acts like one since it uses the virConnectPtr structure, so I put it with those functions. Let me know if I am doing anything completely crazy in here; this is my first stab at Ruby binding code. It works like so: require 'libvirt' conn = Libvirt::open("qemu:///system") ni = c.nodeGetInfo print ni Signed-off-by: Chris Lalancette <clalance(a)redhat.com>

2 1

[Libvir] [Suggestion] The "ISP scenario"
by Richard W.M. Jones 19 Nov '07

19 Nov '07

This pattern has come up a few times now: ISP provides a Xen hosting service to customers. ISP wants to provide some basic statistics to their customers. The statistics could be provided to a customer through the libvirt remote protocol, eg: customer$ virsh -c xen://dom0/ dominfo mydom But the problem with this is that (as libvirt is currently architected) _any_ access to dom0, if it authenticates, gives access to information from all domains. We've previously discussed adding access control using something like SELinux (see for example: https://www.redhat.com/archives/libvir-list/2007-August/msg00030.html) but nothing much has come of it so far. But can we solve the single common case above directly, without thwarting our ability to solve the bigger picture later? My suggestion is that we add an option to /etc/libvirt/libvirtd.conf, something like: tls_restrict_dn: [ "DN1", "name:customer1", "DN2", "uuid:12345678", "DN3", "*" ] with the meaning that (presumably a customer) connecting with certificate DN1 could only find out information about the domain "customer1", DN2 similarly, DN3 is a privileged client, and any other DN would be rejected. (Compare and contrast to tls_allowed_dn_list: http://libvirt.org/remote.html#Remote_libvirtd_configuration) An implementation of this would modify the call to virConnectOpen to add an additional flag (or call?) allowing the access control to be passed, and this would have to be checked in the relevant virDomain* calls. This is not dissimilar to how read-only connections are implemented in libvirtd currently. I would also suggest as a matter of course that we modify all public API calls in src/libvirt.c to add a call to a generic permission checking routine, for example: int virDomainSuspend(virDomainPtr domain) { virConnectPtr conn; DEBUG("domain=%p", domain); if (!VIR_IS_CONNECTED_DOMAIN(domain)) { virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); return (-1); } - if (domain->conn->flags & VIR_CONNECT_RO) { - virLibDomainError(domain, VIR_ERR_OPERATION_DENIED, __FUNCTION__); - return (-1); - } + if (!check_permission (domain, OP_SUSPEND)) return -1; With the initial implementation of check_permission just doing the VIR_CONNECT_RO check to start with, but able to do other checks in future. Also relevant to this is SASL support, see: https://www.redhat.com/archives/libvir-list/2007-November/msg00005.html since AIUI this changes the possible formats for Distinguished Names, or could even make DNs irrelevant. Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

3 2

[Libvir] [Bug] keymap tag for vnc connections ignored for qemu and kvm
by C. Hemsing 19 Nov '07

19 Nov '07

The keymap entry in the respective xml file is being ignored when starting qemu. It should be honoured in src/qemu_conf.c when setting up argv in function qemudBuildCommandLine in case keymap is set and vnc has been chosen. Ignoring the keymap (not issuing -k ...) will make vnc impossible to use for many international keyboards. I've filed a bug report (https://bugzilla.redhat.com/show_bug.cgi?id=390461) Cheers, Chris

1 0