April 2008 - Devel - libvirt List Archives

[Libvir] FYI: configure.in (ALL_LINGUAS): Fix typo: s/Latn/latin/
by Jim Meyering 08 Apr '08

08 Apr '08

FYI, I committed this: Mon Apr 8 17:32:07 CET 2008 Jim Meyering <meyering(a)redhat.com> + * configure.in (ALL_LINGUAS): Fix typo: s/Latn/latin/. + Don't fail to read a file because it's non-seekable (e.g., a pipe). * src/util.c (fread_file_lim): New function. (__virFileReadAll): Use fread_file_lim, rather than requiring diff --git a/configure.in b/configure.in index cc41185..bd6b744 100644 --- a/configure.in +++ b/configure.in @@ -888,7 +888,7 @@ if test -d po then ALL_LINGUAS=`(cd po > /dev/null && ls *.po) | sed 's+\.po$++'` else - ALL_LINGUAS="af am ar as be bg bn_IN bn ca cs cy da de el en_GB es et eu_ES fa fi fr gl gu he hi hr hu hy id is it ja ka kn ko ku lo lt lv mk ml mr ms my nb nl nn no nso or pa pl pt_BR pt ro ru si sk sl sq sr@Latn sr sv ta te th tr uk ur vi zh_CN zh_TW zu" + ALL_LINGUAS="af am ar as be bg bn_IN bn ca cs cy da de el en_GB es et eu_ES fa fi fr gl gu he hi hr hu hy id is it ja ka kn ko ku lo lt lv mk ml mr ms my nb nl nn no nso or pa pl pt_BR pt ro ru si sk sl sq sr@latin sr sv ta te th tr uk ur vi zh_CN zh_TW zu" fi dnl Extra link-time flags for Cygwin. -- 1.5.5.rc3.14.g78bf3

1 0

[Libvir] Zombie KVMs?
by Henri Cook 08 Apr '08

08 Apr '08

Hey all, Does anyone ever see: root 18628 3.2 0.0 0 0 ? Z 17:30 0:40 \_ [kvm] <defunct> Zombie copies of KVM under libvirtd? They're unkillable (without restarting libvirtd) - although libvirt all still functions as normal Henri

2 1

[Libvir] [PATCH] Catch qemu VM-start errors
by Richard W.M. Jones 08 Apr '08

08 Apr '08

Patch to fix the aforementioned problem when qemu subprocess fails to start. Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top

3 2

[Libvir] [PATCH] Add xen and hvm guest types to test drive caps
by Cole Robinson 08 Apr '08

08 Apr '08

The attached patch adds xen and hvm guest types to the test driver's capabilities. It was currently set to offer only a 'linux' type which doesn't seem to follow the conventions of the other drivers, so I removed that. Please yell if I'm wrong :) Thanks, Cole diff --git a/src/test.c b/src/test.c index f401d7d..9b2ca56 100644 --- a/src/test.c +++ b/src/test.c @@ -984,6 +984,8 @@ static char *testGetCapabilities (virConnectPtr conn) char *xml; int cell1[] = { 0, 2, 4, 6, 8, 10, 12, 14 }; int cell2[] = { 1, 3, 5, 7, 9, 11, 13, 15 }; + const char *guest_types[] = { "hvm", "xen" }; + int num_guest_types = 2, i; if ((caps = virCapabilitiesNew(TEST_MODEL, 0, 0)) == NULL) goto no_memory; @@ -998,29 +1000,33 @@ static char *testGetCapabilities (virConnectPtr conn) if (virCapabilitiesAddHostNUMACell(caps, 1, 8, cell2) < 0) goto no_memory; - if ((guest = virCapabilitiesAddGuest(caps, - "linux", - TEST_MODEL, - TEST_MODEL_WORDSIZE, - NULL, - NULL, - 0, - NULL)) == NULL) - goto no_memory; - - if (virCapabilitiesAddGuestDomain(guest, - "test", - NULL, - NULL, - 0, - NULL) == NULL) - goto no_memory; - - - if (virCapabilitiesAddGuestFeature(guest, "pae", 1, 1) == NULL) - goto no_memory; - if (virCapabilitiesAddGuestFeature(guest ,"nonpae", 1, 1) == NULL) - goto no_memory; + for (i = 0; i < num_guest_types; ++i) { + + if ((guest = virCapabilitiesAddGuest(caps, + guest_types[i], + TEST_MODEL, + TEST_MODEL_WORDSIZE, + NULL, + NULL, + 0, + NULL)) == NULL) + goto no_memory; + + if (virCapabilitiesAddGuestDomain(guest, + "test", + NULL, + NULL, + 0, + NULL) == NULL) + goto no_memory; + + if (strcmp(guest_types[i], "xen")) { + if (virCapabilitiesAddGuestFeature(guest, "pae", 1, 1) == NULL) + goto no_memory; + if (virCapabilitiesAddGuestFeature(guest ,"nonpae", 1, 1) == NULL) + goto no_memory; + } + } if ((xml = virCapabilitiesFormatXML(caps)) == NULL) goto no_memory;

4 4

[Libvir] Web Interface Question
by Henri Cook 07 Apr '08

07 Apr '08

Hey guys, I'm designing a web interface for libvirt so that my customers can manage their DomUs - unless you know of a good one that already exists??? I'm thinking that the best way to run this is have the web server connected to libvirtd - but I can't find any documentation about the API it presents - can you help? I considered giving the web server access to virsh and parsing that, but that has obvious security implications as it would need root/sudo access Regards, Henri

5 10

Re: [Libvir] Web Interface Question
by Henri Cook 06 Apr '08

06 Apr '08

That sounds quite exciting; is it open source? I'm looking at build something that works with KVM/Xen but i'm sure many of the operations are the same; especially for status type, read only queries. Do you know if there's anything like an RFC document for libvirtd? What did you base all your queries off while making the product? Thanks for getting back to me, Henri Shuveb Hussain wrote: > Hello Henri, > > On Sun, Apr 6, 2008 at 2:05 AM, Henri Cook > <henri(a)theplayboymansion.net <mailto:henri@theplayboymansion.net>> wrote: > > Hey guys, > > I'm designing a web interface for libvirt so that my customers can > manage their DomUs - unless you know of a good one that already > exists??? > > > We, from BinaryKarma are the folks who contributed OpenVZ support for > Libvirt and are experts in the area. We already have a product FluidVM > that manages Xen and OpenVZ based virtual machines with support for > Linux Containers and VMWare ESX coming up. FluidVM also ships with a > browser based interface. > > Currently, there is also VPSCart, a free application built on top of > the FluidVM platform available where you can create plans and expose > them on a portal. customers can then choose and buy any of them. > Users with the right privileges are automatically provisioned. They > can login and manage their VPSs. Usage of VPSCart is completely optional. > > FluidVM ships with support for Local and SAN storage as well. You can > evaluate a fully capable copy of FluidVM for a period of 45 days by > downloading it from our web site. Here are the details: > > *FluidVM Screenshots:* > http://www.binarykarma.com/fluidvm_screenshots.php > > *FluidVM Demo Videos:* > http://www.binarykarma.com/demo.php > > *FluidVM Manuals, free License and User Manuals:* > http://www.binarykarma.com/download.php > > If you have any further questions, we'll be happy to clarify them. > > > Thanks & regards, > -- > Shuveb Hussain > B I N A R Y K A R M A > Chennai, India. > Phone : +91 44-64621656 > Mobile: +91 98403-80386 > http://www.binarykarma.com

1 0

[Libvir] [PATCH] add error message for the case of "vcpupin" fails
by S.Sakamoto 05 Apr '08

05 Apr '08

Hi, When I set a number that is bigger than virtual CPU's setting of guest_dom to <vcpu>, No error-messages are shown. I try follow, # virsh vcpupin guest_dom 100 0,1 [no error messages] # echo $? 1 I make the patch to solve this problem. Thanks, Shigeki Sakamoto. Index: virsh.c =================================================================== RCS file: /data/cvs/libvirt/src/virsh.c,v retrieving revision 1.140 diff -u -p -r1.140 virsh.c --- virsh.c 27 Mar 2008 13:43:01 -0000 1.140 +++ virsh.c 4 Apr 2008 05:21:47 -0000 @@ -1747,6 +1747,7 @@ cmdVcpupin(vshControl * ctl, vshCmd * cm } if (vcpu >= info.nrVirtCpu) { + vshError(ctl, FALSE, _("vcpupin: Invalid vCPU number.")); virDomainFree(dom); return FALSE; }

3 2

[Libvir] virsh define appears to succeed, but doesn't add bridge
by Jim Meyering 04 Apr '08

04 Apr '08

While trying to test this tiny script on rawhide, http://hg.et.redhat.com/virt/websites/ovirt-web--devel?f=e4f3ee8de5a1;file=… I was surprised to see I couldn't provoke this failure: echo 1>&2 "$0: you seem to have already run this script"; exit 1; } The idea is to dump xml, insert 4 lines describing a bridge, and use virsh "define" to apply the new definition. However, that last step doesn't seem to work, even though virsh exits successfully. If the new XML is somehow insufficient, the least it could do is give a diagnostic. Otherwise it has to honor the request. # cat $tmpfile <domain type='kvm' id='1'> <name>developer</name> <uuid>f2af0696-77ea-dd8f-3f6c-cf3f38d5216e</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type>hvm</type> <boot dev='cdrom'/> </os> <features> <acpi/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>destroy</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu-kvm</emulator> <disk type='file' device='disk'> <source file='/var/lib/libvirt/images/developer.img'/> <target dev='hda'/> </disk> <disk type='file' device='cdrom'> <source file='/var/lib/libvirt/images/Fedora-8-x86_64-rescuecd.iso'/> <target dev='hdc'/> <readonly/> </disk> <interface type='network'> <mac address='00:16:3e:46:e2:8a'/> <source network='default'/> <target dev='vnet0'/> </interface> <interface type="bridge"> <mac address="00:16:3e:12:34:56"/> <source bridge="dummybridge"/> </interface> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5900' listen='127.0.0.1'/> </devices> </domain> # virsh -c qemu:///system define "$tmpfile" Domain developer defined from /t/jt2884.FGSiY6/tmp.JVPZ4LBMVf # virsh -c qemu:///system dumpxml developer <domain type='kvm' id='1'> <name>developer</name> <uuid>f2af0696-77ea-dd8f-3f6c-cf3f38d5216e</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type>hvm</type> <boot dev='cdrom'/> </os> <features> <acpi/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>destroy</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu-kvm</emulator> <disk type='file' device='disk'> <source file='/var/lib/libvirt/images/developer.img'/> <target dev='hda'/> </disk> <disk type='file' device='cdrom'> <source file='/var/lib/libvirt/images/Fedora-8-x86_64-rescuecd.iso'/> <target dev='hdc'/> <readonly/> </disk> <interface type='network'> <mac address='00:16:3e:46:e2:8a'/> <source network='default'/> <target dev='vnet0'/> </interface> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5900' listen='127.0.0.1'/> </devices> </domain>

1 0

[Libvir] FYI: Reporting 'upstream' bugs for libvirt & virt tools
by Daniel P. Berrange 04 Apr '08

04 Apr '08

This is a quick mail to let people know of a new bug reporting policy for virtualization related tools. 1. Only, if you are using binary RPMs from official Fedora repositories, bugs should be reported under the 'Fedora' product, with the component matching the RPM you're reporting against: https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora 2. For all other cases. ie If you are using self-built binaries, or checkouts from the source repos, or forwarding bugs from a non-Fedora distribution, then use the generic 'Virtualization Tools' product: https://bugzilla.redhat.com/enter_bug.cgi?product=Virtualization%20Tools This is our master 'upstream' bug tracking product now. This is important because Fedora recently instituted a number of bug house keeping policies against things under 'Fedora', which may result in your bugs being incorrectly closed. Using 'Virtualization Tools' product in bugzilla ensures we can distinguish upstream bugs from Fedora bugs. This applies to the following applications: libvirt virt-df virt-manager virt-p2v virt-top virt-viewer virtinst Regards, Daniel. -- |: Red Hat, Engineering, Boston -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

1 0

[Libvir] PATCH: Don't request polkit auth if client is root
by Daniel P. Berrange 04 Apr '08

04 Apr '08

This patch makes two adjustments to the way policy kit authentication is done. - Currently the server unconditionally ask the client to do policykit authentication. This is unnecessary if the remote client is running as root, which we can check via UNIX socket credentials. Unconditionally asking plays havoc with SSH tunneling, so this patch makes it check the socket credentials &not ask for auth if the client is UID==0 - The virsh client will unconditionally call polkit-auth to request credentials. This is also unneccessary if the client is running as root, so this patch makes it skip that step as root. The patch is bigger than it seems because removing an if() conditional made a huge chunk be re-indented. Dan. Index: qemud/internal.h =================================================================== RCS file: /data/cvs/libvirt/qemud/internal.h,v retrieving revision 1.42 diff -u -p -r1.42 internal.h --- qemud/internal.h 23 Jan 2008 14:54:41 -0000 1.42 +++ qemud/internal.h 3 Apr 2008 20:04:53 -0000 @@ -179,6 +179,9 @@ void qemudLog(int priority, const char * void remoteDispatchClientRequest (struct qemud_server *server, struct qemud_client *client); +#if HAVE_POLKIT +int qemudGetSocketIdentity(int fd, uid_t *uid, pid_t *pid); +#endif #endif Index: qemud/qemud.c =================================================================== RCS file: /data/cvs/libvirt/qemud/qemud.c,v retrieving revision 1.91 diff -u -p -r1.91 qemud.c --- qemud/qemud.c 14 Mar 2008 15:21:15 -0000 1.91 +++ qemud/qemud.c 3 Apr 2008 20:04:54 -0000 @@ -1040,6 +1040,28 @@ remoteCheckAccess (struct qemud_client * return 0; } +#if HAVE_POLKIT +int qemudGetSocketIdentity(int fd, uid_t *uid, pid_t *pid) { +#ifdef SO_PEERCRED + struct ucred cr; + unsigned int cr_len = sizeof (cr); + + if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &cr, &cr_len) < 0) { + qemudLog(QEMUD_ERR, _("Failed to verify client credentials: %s"), + strerror(errno)); + return -1; + } + + *pid = cr.pid; + *uid = cr.uid; +#else + /* XXX Many more OS support UNIX socket credentials we could port to. See dbus ....*/ +#error "UNIX socket credentials not supported/implemented on this platform yet..." +#endif + return 0; +} +#endif + static int qemudDispatchServer(struct qemud_server *server, struct qemud_socket *sock) { int fd; struct sockaddr_storage addr; @@ -1075,6 +1097,26 @@ static int qemudDispatchServer(struct qe memcpy (&client->addr, &addr, sizeof addr); client->addrlen = addrlen; +#if HAVE_POLKIT + /* Only do policy checks for non-root - allow root user + through with no checks, as a fail-safe - root can easily + change policykit policy anyway, so its pointless trying + to restrict root */ + if (client->auth == REMOTE_AUTH_POLKIT) { + uid_t uid; + pid_t pid; + + if (qemudGetSocketIdentity(client->fd, &uid, &pid) < 0) + goto cleanup; + + /* Cient is running as root, so disable auth */ + if (uid == 0) { + qemudLog(QEMUD_INFO, _("Turn off polkit auth for privileged client %d"), pid); + client->auth = REMOTE_AUTH_NONE; + } + } +#endif + if (client->type != QEMUD_SOCK_TYPE_TLS) { client->mode = QEMUD_MODE_RX_HEADER; client->bufferLength = REMOTE_MESSAGE_HEADER_XDR_LEN; Index: qemud/remote.c =================================================================== RCS file: /data/cvs/libvirt/qemud/remote.c,v retrieving revision 1.27 diff -u -p -r1.27 remote.c --- qemud/remote.c 27 Mar 2008 13:43:01 -0000 1.27 +++ qemud/remote.c 3 Apr 2008 20:04:54 -0000 @@ -2570,27 +2570,6 @@ remoteDispatchAuthSaslStep (struct qemud #if HAVE_POLKIT -static int qemudGetSocketIdentity(int fd, uid_t *uid, pid_t *pid) { -#ifdef SO_PEERCRED - struct ucred cr; - unsigned int cr_len = sizeof (cr); - - if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &cr, &cr_len) < 0) { - qemudLog(QEMUD_ERR, _("Failed to verify client credentials: %s"), - strerror(errno)); - return -1; - } - - *pid = cr.pid; - *uid = cr.uid; -#else - /* XXX Many more OS support UNIX socket credentials we could port to. See dbus ....*/ -#error "UNIX socket credentials not supported/implemented on this platform yet..." -#endif - return 0; -} - - static int remoteDispatchAuthPolkit (struct qemud_server *server ATTRIBUTE_UNUSED, struct qemud_client *client, @@ -2600,6 +2579,15 @@ remoteDispatchAuthPolkit (struct qemud_s { pid_t callerPid; uid_t callerUid; + PolKitCaller *pkcaller = NULL; + PolKitAction *pkaction = NULL; + PolKitContext *pkcontext = NULL; + PolKitError *pkerr = NULL; + PolKitResult pkresult; + DBusError err; + const char *action = client->readonly ? + "org.libvirt.unix.monitor" : + "org.libvirt.unix.manage"; REMOTE_DEBUG("Start PolicyKit auth %d", client->fd); if (client->auth != REMOTE_AUTH_POLKIT) { @@ -2615,98 +2603,78 @@ remoteDispatchAuthPolkit (struct qemud_s return -2; } - /* Only do policy checks for non-root - allow root user - through with no checks, as a fail-safe - root can easily - change policykit policy anyway, so its pointless trying - to restrict root */ - if (callerUid == 0) { - qemudLog(QEMUD_INFO, _("Allowing PID %d running as root"), callerPid); - ret->complete = 1; - client->auth = REMOTE_AUTH_NONE; - } else { - PolKitCaller *pkcaller = NULL; - PolKitAction *pkaction = NULL; - PolKitContext *pkcontext = NULL; - PolKitError *pkerr = NULL; - PolKitResult pkresult; - DBusError err; - const char *action = client->readonly ? - "org.libvirt.unix.monitor" : - "org.libvirt.unix.manage"; - - qemudLog(QEMUD_INFO, _("Checking PID %d running as %d"), - callerPid, callerUid); - dbus_error_init(&err); - if (!(pkcaller = polkit_caller_new_from_pid(server->sysbus, - callerPid, &err))) { - qemudLog(QEMUD_ERR, _("Failed to lookup policy kit caller: %s"), - err.message); - dbus_error_free(&err); - remoteDispatchFailAuth(client, req); - return -2; - } - - if (!(pkaction = polkit_action_new())) { - qemudLog(QEMUD_ERR, _("Failed to create polkit action %s\n"), - strerror(errno)); - polkit_caller_unref(pkcaller); - remoteDispatchFailAuth(client, req); - return -2; - } - polkit_action_set_action_id(pkaction, action); - - if (!(pkcontext = polkit_context_new()) || - !polkit_context_init(pkcontext, &pkerr)) { - qemudLog(QEMUD_ERR, _("Failed to create polkit context %s\n"), - (pkerr ? polkit_error_get_error_message(pkerr) - : strerror(errno))); - if (pkerr) - polkit_error_free(pkerr); - polkit_caller_unref(pkcaller); - polkit_action_unref(pkaction); - dbus_error_free(&err); - remoteDispatchFailAuth(client, req); - return -2; - } + qemudLog(QEMUD_INFO, _("Checking PID %d running as %d"), + callerPid, callerUid); + dbus_error_init(&err); + if (!(pkcaller = polkit_caller_new_from_pid(server->sysbus, + callerPid, &err))) { + qemudLog(QEMUD_ERR, _("Failed to lookup policy kit caller: %s"), + err.message); + dbus_error_free(&err); + remoteDispatchFailAuth(client, req); + return -2; + } + + if (!(pkaction = polkit_action_new())) { + qemudLog(QEMUD_ERR, _("Failed to create polkit action %s\n"), + strerror(errno)); + polkit_caller_unref(pkcaller); + remoteDispatchFailAuth(client, req); + return -2; + } + polkit_action_set_action_id(pkaction, action); + + if (!(pkcontext = polkit_context_new()) || + !polkit_context_init(pkcontext, &pkerr)) { + qemudLog(QEMUD_ERR, _("Failed to create polkit context %s\n"), + (pkerr ? polkit_error_get_error_message(pkerr) + : strerror(errno))); + if (pkerr) + polkit_error_free(pkerr); + polkit_caller_unref(pkcaller); + polkit_action_unref(pkaction); + dbus_error_free(&err); + remoteDispatchFailAuth(client, req); + return -2; + } #if HAVE_POLKIT_CONTEXT_IS_CALLER_AUTHORIZED - pkresult = polkit_context_is_caller_authorized(pkcontext, - pkaction, - pkcaller, - 0, - &pkerr); - if (pkerr && polkit_error_is_set(pkerr)) { - qemudLog(QEMUD_ERR, - _("Policy kit failed to check authorization %d %s"), - polkit_error_get_error_code(pkerr), - polkit_error_get_error_message(pkerr)); - remoteDispatchFailAuth(client, req); - return -2; - } + pkresult = polkit_context_is_caller_authorized(pkcontext, + pkaction, + pkcaller, + 0, + &pkerr); + if (pkerr && polkit_error_is_set(pkerr)) { + qemudLog(QEMUD_ERR, + _("Policy kit failed to check authorization %d %s"), + polkit_error_get_error_code(pkerr), + polkit_error_get_error_message(pkerr)); + remoteDispatchFailAuth(client, req); + return -2; + } #else - pkresult = polkit_context_can_caller_do_action(pkcontext, - pkaction, - pkcaller); + pkresult = polkit_context_can_caller_do_action(pkcontext, + pkaction, + pkcaller); #endif - polkit_context_unref(pkcontext); - polkit_caller_unref(pkcaller); - polkit_action_unref(pkaction); - if (pkresult != POLKIT_RESULT_YES) { - qemudLog(QEMUD_ERR, - _("Policy kit denied action %s from pid %d, uid %d," - " result: %s\n"), - action, callerPid, callerUid, - polkit_result_to_string_representation(pkresult)); - remoteDispatchFailAuth(client, req); - return -2; - } - qemudLog(QEMUD_INFO, - _("Policy allowed action %s from pid %d, uid %d, result %s"), + polkit_context_unref(pkcontext); + polkit_caller_unref(pkcaller); + polkit_action_unref(pkaction); + if (pkresult != POLKIT_RESULT_YES) { + qemudLog(QEMUD_ERR, + _("Policy kit denied action %s from pid %d, uid %d," + " result: %s\n"), action, callerPid, callerUid, polkit_result_to_string_representation(pkresult)); - ret->complete = 1; - client->auth = REMOTE_AUTH_NONE; + remoteDispatchFailAuth(client, req); + return -2; } + qemudLog(QEMUD_INFO, + _("Policy allowed action %s from pid %d, uid %d, result %s"), + action, callerPid, callerUid, + polkit_result_to_string_representation(pkresult)); + ret->complete = 1; + client->auth = REMOTE_AUTH_NONE; return 0; } Index: src/libvirt.c =================================================================== RCS file: /data/cvs/libvirt/src/libvirt.c,v retrieving revision 1.132 diff -u -p -r1.132 libvirt.c --- src/libvirt.c 21 Mar 2008 15:03:37 -0000 1.132 +++ src/libvirt.c 3 Apr 2008 20:04:54 -0000 @@ -116,17 +116,23 @@ static int virConnectAuthCallbackDefault size_t len; switch (cred[i].type) { -#if defined(POLKIT_AUTH) case VIR_CRED_EXTERNAL: { if (STRNEQ(cred[i].challenge, "PolicyKit")) return -1; +#if defined(POLKIT_AUTH) if (virConnectAuthGainPolkit(cred[i].prompt) < 0) return -1; - +#else + /* + * Ignore & carry on. Although we can't auth + * directly, the user may have authenticated + * themselves already outside context of libvirt + */ +#endif break; } -#endif + case VIR_CRED_USERNAME: case VIR_CRED_AUTHNAME: case VIR_CRED_ECHOPROMPT: @@ -186,9 +192,7 @@ static int virConnectCredTypeDefault[] = VIR_CRED_REALM, VIR_CRED_PASSPHRASE, VIR_CRED_NOECHOPROMPT, -#if defined(POLKIT_AUTH) VIR_CRED_EXTERNAL, -#endif }; static virConnectAuth virConnectAuthDefault = { -- |: Red Hat, Engineering, Boston -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

4 5