[libvirt] [PATCH] Remove capng_lock() call when spawning LXC container init process
by Daniel P. Berrange
The capng_lock() call sets the SECURE_NO_SETUID_FIXUP and SECURE_NOROOT
bits on the process. This prevents the kernel granting capabilities to
processes with an effective UID of 0, or with setuid programs. This is
not actually what we want in the container init process. It should be
allowed to run setuid processes & keep capabilities when root. All that
is required is masking a handful of dangerous capabilities from the
bounding set.
* src/lxc/lxc_container.c: Remove bogus capng_lock() call.
---
src/lxc/lxc_container.c | 11 +++++------
1 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index c77d099..023d553 100644
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -694,12 +694,11 @@ static int lxcContainerDropCapabilities(void)
return -1;
}
- /* Need to prevent them regaining any caps on exec */
- if ((ret = capng_lock()) < 0) {
- lxcError(NULL, NULL, VIR_ERR_INTERNAL_ERROR,
- _("Failed to lock capabilities: %d"), ret);
- return -1;
- }
+ /* We do not need to call capng_lock() in this case. The bounding
+ * set restriction will prevent them reacquiring sys_boot/module/time,
+ * etc which is all that matters for the container. Once inside the
+ * container it is fine for SECURE_NOROOT / SECURE_NO_SETUID_FIXUP to
+ * be unmasked - they can never escape the bounding set. */
#else
VIR_WARN0(_("libcap-ng support not compiled in, unable to clear capabilities"));
--
1.6.2.5
15 years, 5 months
[libvirt] Interface script for qemu/kvm determinately fails?
by Ryota Ozaki
Hi,
I have a question about interface script (e.g., qemu-ifup) for qemu/kvm.
qemu/kvm is dropped its all capabilities by libcap-ng before executed.
So the script that is executed by qemu/kvm will fail if it executes
privileged operations which are usual jobs of it.
It means we cannot use <script> anymore? or I'm missing something?
I think executing the script in libvirtd after creating a tap and before
dropping capabilities would be a solution for that issue. Am I wrong?
Thanks,
ozaki-r
15 years, 5 months
[libvirt] [PATCH] Add virConnectGetLibvirtVersion API
by Cole Robinson
Hi all,
The attached patch adds a new API call for retrieving the libvirt
version used by a connection: virConnectGetLibvirtVersion. Without this,
there is currently no way to determine the libvirt version of a remote
qemu connection for example. This info can be useful for feature
detection/enabling/disabling.
As an example, virt-install may want to use the AC97 sound device as
the default sound model for new VMs. However, this was only added to
libvirt's white list in 0.6.0, while the other models have been
available since 0.4.3. If installing a remote guest, virt-install will
want to ensure that the remote libvirtd is >= 0.6.0. Granted, the remote
version could have backported the AC97 patch and virt-install would be
incorrect, but better to be overly restrictive than to blindly specify
AC97 and have guest creation bomb out.
The 'correct' way to handle the above issue would be some combination of
dropping internal whitelists from libvirt and generating them from info
reported by the hypervisor, and advertising the available values in the
capabilities XML. However I think this API addition makes things more
manageable with little downside until a proper solution is implemented.
Thanks,
Cole
15 years, 5 months
[libvirt] libvirt strange behavior possibly bug with version 0.7.2
by Ricardo Mendes
>>>import libvirt
>>>con=libvirt.open('xen:///')
>> libvirt.getVersion()
7002
>>>dom=con.defineXML('<domain type="xen"><name>rtiago_test2</name><clock offset="utc"/><vcpu>8</vcpu><on_poweroff>restart</on_poweroff><devices><disk device="disk" type="file"><source file="/images/SLC-4-x86.img"/><driver name="file"/><target bus="xen" dev="xvda1"/></disk><console tty="/dev/pts/2" type="pty"><source path="/dev/pts/2"/><target port="0"/></console></devices><on_crash>restart</on_crash><currentMemory>300000</currentMemory><memory>300000</memory><on_reboot>restart</on_reboot><os><kernel>/root/vmlinuz</kernel><initrd>/root/initrd.img</initrd><type>linux</type><root>/dev/xvda1 ro</root><cmdline>rtiago</cmdline></os></domain>')
>>> dom.create()
>>>0
>>> dom.destroy()
>>> 0
>>> dom.create()
Traceback (most recent call last):
File "<stdin>", line 1, in ?
File "/usr/lib64/python2.4/site-packages/libvirt.py", line 287, in create
if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self)
libvirt.libvirtError: Unknown failure
Every call to create will raise the same exception, It only works if I do a new connection to the
hypervisor. Is there an workaround??
15 years, 5 months
[libvirt] [PATCH] Finer grained migration control
by Chris Lalancette
Normally, when you migrate a domain from host A to host B,
the domain on host A remains defined but shutoff and the domain
on host B remains running but is a "transient". Add a new
flag to virDomainMigrate() to allow the original domain to be
undefined on source host A, and a new flag to virDomainMigrate() to
allow the new domain to be persisted on the destination host B.
Signed-off-by: Chris Lalancette <clalance(a)redhat.com>
---
include/libvirt/libvirt.h.in | 2 ++
src/libvirt.c | 4 ++++
src/qemu/qemu_driver.c | 34 ++++++++++++++++++++++++++++++++--
tools/virsh.c | 8 ++++++++
4 files changed, 46 insertions(+), 2 deletions(-)
diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in
index f51a565..6186d4e 100644
--- a/include/libvirt/libvirt.h.in
+++ b/include/libvirt/libvirt.h.in
@@ -339,6 +339,8 @@ typedef enum {
VIR_MIGRATE_LIVE = (1 << 0), /* live migration */
VIR_MIGRATE_PEER2PEER = (1 << 1), /* direct source -> dest host control channel */
VIR_MIGRATE_TUNNELLED = (1 << 2), /* tunnel migration data over libvirtd connection */
+ VIR_MIGRATE_PERSIST_DEST = (1 << 3), /* persist the VM on the destination */
+ VIR_MIGRATE_UNDEFINE_SOURCE = (1 << 4), /* undefine the VM on the source */
} virDomainMigrateFlags;
/* Domain migration. */
diff --git a/src/libvirt.c b/src/libvirt.c
index b14942d..92a1eaa 100644
--- a/src/libvirt.c
+++ b/src/libvirt.c
@@ -3128,6 +3128,10 @@ virDomainMigrateDirect (virDomainPtr domain,
* VIR_MIGRATE_LIVE Do not pause the VM during migration
* VIR_MIGRATE_PEER2PEER Direct connection between source & destination hosts
* VIR_MIGRATE_TUNNELLED Tunnel migration data over the libvirt RPC channel
+ * VIR_MIGRATE_PERSIST_DEST If the migration is successful, persist the domain
+ * on the destination host.
+ * VIR_MIGRATE_UNDEFINE_SOURCE If the migration is successful, undefine the
+ * domain on the source host.
*
* VIR_MIGRATE_TUNNELLED requires that VIR_MIGRATE_PEER2PEER be set.
* Applications using the VIR_MIGRATE_PEER2PEER flag will probably
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 3812f91..ba5694e 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -6848,7 +6848,8 @@ qemudDomainMigratePerform (virDomainPtr dom,
event = virDomainEventNewFromObj(vm,
VIR_DOMAIN_EVENT_STOPPED,
VIR_DOMAIN_EVENT_STOPPED_MIGRATED);
- if (!vm->persistent) {
+ if (!vm->persistent || (flags & VIR_MIGRATE_UNDEFINE_SOURCE)) {
+ virDomainDeleteConfig(dom->conn, driver->configDir, driver->autostartDir, vm);
virDomainRemoveInactive(&driver->domains, vm);
vm = NULL;
}
@@ -6886,13 +6887,14 @@ qemudDomainMigrateFinish2 (virConnectPtr dconn,
const char *cookie ATTRIBUTE_UNUSED,
int cookielen ATTRIBUTE_UNUSED,
const char *uri ATTRIBUTE_UNUSED,
- unsigned long flags ATTRIBUTE_UNUSED,
+ unsigned long flags,
int retcode)
{
struct qemud_driver *driver = dconn->privateData;
virDomainObjPtr vm;
virDomainPtr dom = NULL;
virDomainEventPtr event = NULL;
+ int newVM = 1;
qemuDriverLock(driver);
vm = virDomainFindByName(&driver->domains, dname);
@@ -6906,6 +6908,34 @@ qemudDomainMigrateFinish2 (virConnectPtr dconn,
* object, but if no, clean up the empty qemu process.
*/
if (retcode == 0) {
+ if (flags & VIR_MIGRATE_PERSIST_DEST) {
+ if (vm->persistent)
+ newVM = 0;
+ vm->persistent = 1;
+
+ if (virDomainSaveConfig(dconn, driver->configDir, vm->def) < 0) {
+ /* Hmpf. Migration was successful, but making it persistent
+ * was not. If we report successful, then when this domain
+ * shuts down, management tools are in for a surprise. On the
+ * other hand, if we report failure, then the management tools
+ * might try to restart the domain on the source side, even
+ * though the domain is actually running on the destination.
+ * Return a NULL dom pointer, and hope that this is a rare
+ * situation and management tools are smart.
+ */
+ vm = NULL;
+ goto cleanup;
+ }
+
+ event = virDomainEventNewFromObj(vm,
+ VIR_DOMAIN_EVENT_DEFINED,
+ newVM ?
+ VIR_DOMAIN_EVENT_DEFINED_ADDED :
+ VIR_DOMAIN_EVENT_DEFINED_UPDATED);
+ if (event)
+ qemuDomainEventQueue(driver, event);
+
+ }
dom = virGetDomain (dconn, vm->def->name, vm->def->uuid);
/* run 'cont' on the destination, which allows migration on qemu
diff --git a/tools/virsh.c b/tools/virsh.c
index 46c5454..47122d5 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -2465,6 +2465,8 @@ static const vshCmdOptDef opts_migrate[] = {
{"p2p", VSH_OT_BOOL, 0, gettext_noop("peer-2-peer migration")},
{"direct", VSH_OT_BOOL, 0, gettext_noop("direct migration")},
{"tunnelled", VSH_OT_BOOL, 0, gettext_noop("tunnelled migration")},
+ {"persistent", VSH_OT_BOOL, 0, gettext_noop("persist VM on destination")},
+ {"undefinesource", VSH_OT_BOOL, 0, gettext_noop("undefine VM on source")},
{"domain", VSH_OT_DATA, VSH_OFLAG_REQ, gettext_noop("domain name, id or uuid")},
{"desturi", VSH_OT_DATA, VSH_OFLAG_REQ, gettext_noop("connection URI of the destination host")},
{"migrateuri", VSH_OT_DATA, 0, gettext_noop("migration URI, usually can be omitted")},
@@ -2504,6 +2506,12 @@ cmdMigrate (vshControl *ctl, const vshCmd *cmd)
if (vshCommandOptBool (cmd, "tunnelled"))
flags |= VIR_MIGRATE_TUNNELLED;
+ if (vshCommandOptBool (cmd, "persistent"))
+ flags |= VIR_MIGRATE_PERSIST_DEST;
+
+ if (vshCommandOptBool (cmd, "undefinesource"))
+ flags |= VIR_MIGRATE_UNDEFINE_SOURCE;
+
if ((flags & VIR_MIGRATE_PEER2PEER) ||
vshCommandOptBool (cmd, "direct")) {
/* For peer2peer migration or direct migration we only expect one URI
--
1.6.0.6
15 years, 5 months
[libvirt] [PATCH] LXC implement missing lxcDomainInterfaceStats (domifstat)
by Ryota Ozaki
Most part of code is just copied from qemu_driver.c.
* src/lxc/lxc_driver.c: add lxcDomainInterfaceStats
---
src/lxc/lxc_driver.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++-
1 files changed, 61 insertions(+), 1 deletions(-)
diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index a917a46..542b382 100644
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -48,6 +48,7 @@
#include "event.h"
#include "nodeinfo.h"
#include "uuid.h"
+#include "stats_linux.h"
#define VIR_FROM_THIS VIR_FROM_LXC
@@ -1939,6 +1940,65 @@ cleanup:
return ret;
}
+#ifdef __linux__
+static int
+lxcDomainInterfaceStats(virDomainPtr dom,
+ const char *path,
+ struct _virDomainInterfaceStats *stats)
+{
+ lxc_driver_t *driver = dom->conn->privateData;
+ virDomainObjPtr vm;
+ int i;
+ int ret = -1;
+
+ lxcDriverLock(driver);
+ vm = virDomainFindByUUID(&driver->domains, dom->uuid);
+ lxcDriverUnlock(driver);
+
+ if (!vm) {
+ char uuidstr[VIR_UUID_STRING_BUFLEN];
+ virUUIDFormat(dom->uuid, uuidstr);
+ lxcError(dom->conn, dom, VIR_ERR_NO_DOMAIN,
+ _("No domain with matching uuid '%s'"), uuidstr);
+ goto cleanup;
+ }
+
+ if (!virDomainObjIsActive(vm)) {
+ lxcError(dom->conn, dom, VIR_ERR_OPERATION_INVALID,
+ "%s", _("Domain is not running"));
+ goto cleanup;
+ }
+
+ /* Check the path is one of the domain's network interfaces. */
+ for (i = 0 ; i < vm->def->nnets ; i++) {
+ if (vm->def->nets[i]->ifname &&
+ STREQ(vm->def->nets[i]->ifname, path)) {
+ ret = 0;
+ break;
+ }
+ }
+
+ if (ret == 0)
+ ret = linuxDomainInterfaceStats(dom->conn, path, stats);
+ else
+ lxcError(dom->conn, dom, VIR_ERR_INVALID_ARG,
+ _("Invalid path, '%s' is not a known interface"), path);
+
+cleanup:
+ if (vm)
+ virDomainObjUnlock(vm);
+ return ret;
+}
+#else
+static int
+lxcDomainInterfaceStats(virDomainPtr dom,
+ const char *path ATTRIBUTE_UNUSED,
+ struct _virDomainInterfaceStats *stats ATTRIBUTE_UNUSED)
+ lxcError(dom->conn, dom, VIR_ERR_NO_SUPPORT, "%s", __FUNCTION__);
+ return -1;
+}
+#endif
+
static int lxcDomainGetAutostart(virDomainPtr dom,
int *autostart) {
lxc_driver_t *driver = dom->conn->privateData;
@@ -2308,7 +2368,7 @@ static virDriver lxcDriver = {
NULL, /* domainMigratePerform */
NULL, /* domainMigrateFinish */
NULL, /* domainBlockStats */
- NULL, /* domainInterfaceStats */
+ lxcDomainInterfaceStats, /* domainInterfaceStats */
NULL, /* domainBlockPeek */
NULL, /* domainMemoryPeek */
nodeGetCellsFreeMemory, /* nodeGetCellsFreeMemory */
--
1.6.2.5
15 years, 5 months
[libvirt] Windows VM doesn't start as Linux one does
by Daniel Huhardeaux
Hi,
everything is in the subject. I'm running Debian SID with libvirt-bin
0.7.2-3 and virt-manager 0.8.0-2.
I had 4 VMs created manually some times ago (Lenny, Ubuntu 9.04, W2k and
XPHome) which I migrate to libvirt. Both Linux are booting well, both
Windows not: they start but suddenly reboot.
On W2K I see the white starting bannier increasing on the bottom off the
screen, and when done, reboot.
On XPh at the time where the booting Windows screen should appear, VM
restart. The I get the famous "Windows hasn't shutdown clearly, do you
want to start in safe mode ... aso)
On both systems, after first fail reboot, I can try and try again,
always the same. If I stared VMs manually, no problem!
My start script -which started without any problem my XPHome VM- is:
#!/bin/bash
AUDIO="es1370"
VGA="std"
sudo /usr/bin/kvm -localtime -cdrom /dev/scd0 -boot c -hda
/media/XP/vdisk.img -hdb /media/XP/vdisk1.img -m 512 -soundhw $AUDIO
-vga $VGA\
-net nic,vlan=0 -net vde,vlan=0,sock=/var/run/vde.ctl -usb -smb
public -monitor tcp:127.0.0.1:32011,server,nowait &
The XML file for the same VM which fail on boot is:
<domain type='kvm'>
<name>XPHome</name>
<uuid>26e5de74-0841-c4b3-4cc1-e0df0f93cb31</uuid>
<memory>524288</memory>
<currentMemory>524288</currentMemory>
<vcpu>1</vcpu>
<os>
<type arch='x86_64' machine='pc'>hvm</type>
<boot dev='hd'/>
</os>
<features>
<pae/>
</features>
<clock offset='localtime'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/bin/kvm</emulator>
<disk type='file' device='disk'>
<source file='/media/XP/vdisk.img'/>
<target dev='hda' bus='ide'/>
</disk>
<disk type='file' device='disk'>
<source file='/media/XP/vdisk1.img'/>
<target dev='hdb' bus='ide'/>
</disk>
<disk type='block' device='cdrom'>
<source dev='/dev/cdrom'/>
<target dev='hdc' bus='ide'/>
<readonly/>
</disk>
<interface type='bridge'>
<mac address='54:52:00:7a:ee:01'/>
<source bridge='virbr2'/>
</interface>
<serial type='pty'>
<source path='/dev/pts/6'/>
<target port='0'/>
</serial>
<console type='pty' tty='/dev/pts/6'>
<source path='/dev/pts/6'/>
<target port='0'/>
</console>
<input type='tablet' bus='usb'/>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='-1' autoport='yes' keymap='en-us'/>
<sound model='es1370'/>
<video>
<model type='cirrus' vram='9216' heads='1'/>
</video>
</devices>
</domain>
~>qemu-img info /media/XP/vdisk.img
image: /media/XP/vdisk.img
file format: raw
virtual size: 6.0G (6442450944 bytes)
disk size: 5.8G
~>qemu-img info /media/XP/vdisk1.img
image: /media/XP/vdisk1.img
file format: raw
virtual size: 2.0G (2147483648 bytes)
disk size: 268M
The disk image from all Linux VMs are also raw.
On another server I installed from scratch on LVM partition an XPPro
Windows VM without any problem.
Thanks for any hint.
Regards
--
Daniel
15 years, 5 months
[libvirt] [PATCH] Fix save and restore with non-privileged guests and SELinux
by Daniel P. Berrange
When running qemu:///system instance, libvirtd runs as root,
but QEMU may optionally be configured to run non-root. When
then saving a guest to a state file, the file is initially
created as root, and thus QEMU cannot write to it. It is also
missing labelling required to allow access via SELinux.
* src/qemu/qemu_driver.c: Set ownership on save image before
running migrate command in virDomainSave impl. Call out to
security driver to set save image labelling
* src/security/security_driver.h: Add driver APIs for setting
and restoring saved state file labelling
* src/security/security_selinux.c: Implement saved state file
labelling for SELinux
---
src/qemu/qemu_driver.c | 35 ++++++++++++++++++++++++++++++++---
src/security/security_driver.h | 7 +++++++
src/security/security_selinux.c | 23 +++++++++++++++++++++++
3 files changed, 62 insertions(+), 3 deletions(-)
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 30003e6..b023902 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -3347,6 +3347,7 @@ static int qemudDomainSave(virDomainPtr dom,
char *xml = NULL;
struct qemud_save_header header;
int ret = -1;
+ int rc;
virDomainEventPtr event = NULL;
memset(&header, 0, sizeof(header));
@@ -3435,11 +3436,24 @@ static int qemudDomainSave(virDomainPtr dom,
}
fd = -1;
+ if (driver->privileged &&
+ chown(path, driver->user, driver->group) < 0) {
+ virReportSystemError(NULL, errno,
+ _("unable to set ownership of '%s' to user %d:%d"),
+ path, driver->user, driver->group);
+ goto endjob;
+ }
+
+ if (driver->securityDriver &&
+ driver->securityDriver->domainSetSavedStateLabel &&
+ driver->securityDriver->domainSetSavedStateLabel(dom->conn, vm, path) == -1)
+ goto endjob;
+
if (header.compressed == QEMUD_SAVE_FORMAT_RAW) {
const char *args[] = { "cat", NULL };
qemuDomainObjPrivatePtr priv = vm->privateData;
qemuDomainObjEnterMonitor(vm);
- ret = qemuMonitorMigrateToCommand(priv->mon, 0, args, path);
+ rc = qemuMonitorMigrateToCommand(priv->mon, 0, args, path);
qemuDomainObjExitMonitor(vm);
} else {
const char *prog = qemudSaveCompressionTypeToString(header.compressed);
@@ -3450,13 +3464,28 @@ static int qemudDomainSave(virDomainPtr dom,
NULL
};
qemuDomainObjEnterMonitor(vm);
- ret = qemuMonitorMigrateToCommand(priv->mon, 0, args, path);
+ rc = qemuMonitorMigrateToCommand(priv->mon, 0, args, path);
qemuDomainObjExitMonitor(vm);
}
- if (ret < 0)
+ if (rc < 0)
goto endjob;
+ if (driver->privileged &&
+ chown(path, 0, 0) < 0) {
+ virReportSystemError(NULL, errno,
+ _("unable to set ownership of '%s' to user %d:%d"),
+ path, 0, 0);
+ goto endjob;
+ }
+
+ if (driver->securityDriver &&
+ driver->securityDriver->domainRestoreSavedStateLabel &&
+ driver->securityDriver->domainRestoreSavedStateLabel(dom->conn, path) == -1)
+ goto endjob;
+
+ ret = 0;
+
/* Shut it down */
qemudShutdownVMDaemon(dom->conn, driver, vm);
event = virDomainEventNewFromObj(vm,
diff --git a/src/security/security_driver.h b/src/security/security_driver.h
index fde2978..5514962 100644
--- a/src/security/security_driver.h
+++ b/src/security/security_driver.h
@@ -42,6 +42,11 @@ typedef int (*virSecurityDomainRestoreHostdevLabel) (virConnectPtr conn,
typedef int (*virSecurityDomainSetHostdevLabel) (virConnectPtr conn,
virDomainObjPtr vm,
virDomainHostdevDefPtr dev);
+typedef int (*virSecurityDomainSetSavedStateLabel) (virConnectPtr conn,
+ virDomainObjPtr vm,
+ const char *savefile);
+typedef int (*virSecurityDomainRestoreSavedStateLabel) (virConnectPtr conn,
+ const char *savefile);
typedef int (*virSecurityDomainGenLabel) (virConnectPtr conn,
virDomainObjPtr sec);
typedef int (*virSecurityDomainReserveLabel) (virConnectPtr conn,
@@ -71,6 +76,8 @@ struct _virSecurityDriver {
virSecurityDomainRestoreLabel domainRestoreSecurityLabel;
virSecurityDomainRestoreHostdevLabel domainRestoreSecurityHostdevLabel;
virSecurityDomainSetHostdevLabel domainSetSecurityHostdevLabel;
+ virSecurityDomainSetSavedStateLabel domainSetSavedStateLabel;
+ virSecurityDomainRestoreSavedStateLabel domainRestoreSavedStateLabel;
/*
* This is internally managed driver state and should only be accessed
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 0e31077..bd838e6 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -523,6 +523,7 @@ done:
return ret;
}
+
static int
SELinuxRestoreSecurityPCILabel(virConnectPtr conn,
pciDevice *dev ATTRIBUTE_UNUSED,
@@ -623,6 +624,26 @@ SELinuxRestoreSecurityLabel(virConnectPtr conn,
return rc;
}
+
+static int
+SELinuxSetSavedStateLabel(virConnectPtr conn,
+ virDomainObjPtr vm,
+ const char *savefile)
+{
+ const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
+
+ return SELinuxSetFilecon(conn, savefile, secdef->imagelabel);
+}
+
+
+static int
+SELinuxRestoreSavedStateLabel(virConnectPtr conn,
+ const char *savefile)
+{
+ return SELinuxRestoreSecurityFileLabel(conn, savefile);
+}
+
+
static int
SELinuxSecurityVerify(virConnectPtr conn, virDomainDefPtr def)
{
@@ -692,4 +713,6 @@ virSecurityDriver virSELinuxSecurityDriver = {
.domainSetSecurityLabel = SELinuxSetSecurityLabel,
.domainSetSecurityHostdevLabel = SELinuxSetSecurityHostdevLabel,
.domainRestoreSecurityHostdevLabel = SELinuxRestoreSecurityHostdevLabel,
+ .domainSetSavedStateLabel = SELinuxSetSavedStateLabel,
+ .domainRestoreSavedStateLabel = SELinuxRestoreSavedStateLabel,
};
--
1.6.2.5
15 years, 5 months
[libvirt] [PATCH 0/2] Fix xen domain listing
by Daniel P. Berrange
These patches are a re-post of Jonas Eriksson's work from a couple of months
ago, that we mistakenly forgot to commit.
The first patch is unchanged, apart from being adjusted for new source code
layout. The second patch is changed so that it checks against the hypervisor,
not Xend, since using Xend has a very serious performance impact (as much as
1 second per domain queried has been seen)
Daniel
15 years, 5 months
