September 2012 - Devel - libvirt List Archives

[libvirt] [PATCH] security: Don't ignore errors when parsing DAC security labels
by Peter Krempa 19 Sep '12

19 Sep '12

The DAC security driver silently ignored errors when parsing the DAC label and used default values instead. With a domain containing the following label definition: <seclabel type='static' model='dac' relabel='yes'> <label>sdfklsdjlfjklsdjkl</label> </seclabel> the domain would start normaly but the disk images would be still owned by root and no error was displayed. This patch changes the behavior if the parsing of the label fails (note that a not present label is not a failure and in this case the default label should be used) the error isn't masked but is raised that causes the domain start to fail with a descriptive error message: virsh # start tr error: Failed to start domain tr error: invalid argument: failed to parse uid and gid for DAC security driver: sdfklsdjlfjklsdjkl I also changed the error code to "invalid argument" from "internal error". --- src/security/security_dac.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 211fb37..c669496 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -140,6 +140,8 @@ int virSecurityDACGetIds(virDomainDefPtr def, virSecurityDACDataPtr priv, return -1; } + +/* returns 1 if label isn't found, 0 on success, -1 on error */ static int virSecurityDACParseImageIds(virDomainDefPtr def, uid_t *uidPtr, gid_t *gidPtr) @@ -149,19 +151,19 @@ int virSecurityDACParseImageIds(virDomainDefPtr def, virSecurityLabelDefPtr seclabel; if (def == NULL) - return -1; + return 1; seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME); if (seclabel == NULL || seclabel->imagelabel == NULL) { virReportError(VIR_ERR_INTERNAL_ERROR, _("security label for DAC not found in domain %s"), def->name); - return -1; + return 1; } if (seclabel->imagelabel && parseIds(seclabel->imagelabel, &uid, &gid)) { - virReportError(VIR_ERR_INTERNAL_ERROR, + virReportError(VIR_ERR_INVALID_ARG, _("failed to parse uid and gid for DAC " "security driver: %s"), seclabel->label); return -1; @@ -179,8 +181,10 @@ static int virSecurityDACGetImageIds(virDomainDefPtr def, virSecurityDACDataPtr priv, uid_t *uidPtr, gid_t *gidPtr) { - if (virSecurityDACParseImageIds(def, uidPtr, gidPtr) == 0) - return 0; + int ret; + + if ((ret = virSecurityDACParseImageIds(def, uidPtr, gidPtr)) <= 0) + return ret; if (priv) { if (uidPtr) -- 1.7.12

2 2

[libvirt] [PATCH 0/4] Add support for reboot-timeout
by Martin Kletzander 19 Sep '12

19 Sep '12

This series introduces simple reboot timeout support. That means what should be done in case all boot options fail, reboot or not. And if yes, then how long the machine should wait. Before adding the support for that into XML parser, builder, and qemu, I felt the need to cleanup the boot parsing and enums (I couldn't look at that), so that's the first patch. Most of it is mechanical, the rest should be pretty straight-forward. --- I'd *love* to have it in 0.10.2, but I understand if it's too late :( Martin Kletzander (4): qemu: Cleanup boot parameter building Add support for reboot-timeout qemu: Add support for reboot-timeout QEMU Tests for reboot-timeout docs/formatdomain.html.in | 9 ++ docs/schemas/domaincommon.rng | 20 ++++ src/conf/domain_conf.c | 56 ++++++++- src/conf/domain_conf.h | 78 ++++++++----- src/libvirt_private.syms | 2 + src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 129 +++++++++++++++++---- tests/qemuargv2xmltest.c | 4 + ...xml2argv-boot-menu-disable-drive-bootindex.args | 1 + .../qemuxml2argv-reboot-timeout-disabled.args | 3 + .../qemuxml2argv-reboot-timeout-disabled.xml | 21 ++++ .../qemuxml2argv-reboot-timeout-enabled.args | 3 + .../qemuxml2argv-reboot-timeout-enabled.xml | 21 ++++ tests/qemuxml2argvtest.c | 5 + tests/qemuxml2xmltest.c | 4 + 16 files changed, 304 insertions(+), 57 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-disabled.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-disabled.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-enabled.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-enabled.xml -- 1.7.12

3 11

[libvirt] [PATCH 0/3] more build fixes
by Eric Blake 19 Sep '12

19 Sep '12

Pushing all three under the build-breaker rules. Eric Blake (3): bitmap: fix problems in previous commit build: fix nodeinfo build on non-Linux platforms build: avoid unused symbol src/libvirt_private.syms | 1 - src/nodeinfo.c | 4 ++++ src/util/bitmap.c | 3 +-- tests/virbitmaptest.c | 12 +++++++----- 4 files changed, 12 insertions(+), 8 deletions(-) -- 1.7.11.4

2 6

[libvirt] [PATCH] Ensure existing selinux mount is removed before mounting new one in LXC
by Daniel P. Berrange 19 Sep '12

19 Sep '12

Some kernel versions (at least RHEL-6 2.6.32) do not let you over-mount an existing selinuxfs instance with a new one. Thus we must unmount the existing instance inside our namespace. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/lxc/lxc_container.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 9bc5610..f5b0bc6 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1533,6 +1533,14 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef, lxcContainerUnmountSubtree("/proc", false) < 0)) goto cleanup; +#if HAVE_SELINUX + /* Some versions of Linux kernel don't let you overmount + * the selinux filesystem, so make sure we kill it first + */ + if (lxcContainerUnmountSubtree(SELINUX_MOUNT, false) < 0) + goto cleanup; +#endif + /* Mounts the core /proc, /sys, etc filesystems */ if (lxcContainerMountBasicFS(true, sec_mount_options) < 0) goto cleanup; @@ -1615,6 +1623,14 @@ static int lxcContainerSetupExtraMounts(virDomainDefPtr vmDef, lxcContainerUnmountSubtree("/proc", false) < 0) goto cleanup; +#if HAVE_SELINUX + /* Some versions of Linux kernel don't let you overmount + * the selinux filesystem, so make sure we kill it first + */ + if (lxcContainerUnmountSubtree(SELINUX_MOUNT, false) < 0) + goto cleanup; +#endif + /* Mounts the core /proc, /sys, etc filesystems */ if (lxcContainerMountBasicFS(false, sec_mount_options) < 0) goto cleanup; -- 1.7.1

2 1

[libvirt] [PATCH] Improve some debugging log messages in LXC mount setup
by Daniel P. Berrange 19 Sep '12

19 Sep '12

Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/lxc/lxc_container.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index f5b0bc6..8fbbc0d 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -556,8 +556,9 @@ static int lxcContainerMountBasicFS(bool pivotRoot, srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts); if (mount(srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts) < 0) { virReportSystemError(errno, - _("Failed to mount %s on %s type %s"), - mnts[i].src, mnts[i].dst, NULLSTR(mnts[i].type)); + _("Failed to mount %s on %s type %s flags=%d opts=%s"), + srcpath, mnts[i].dst, NULLSTR(mnts[i].type), + mnts[i].mflags, NULLSTR(mnts[i].opts)); goto cleanup; } } @@ -579,8 +580,8 @@ static int lxcContainerMountBasicFS(bool pivotRoot, MS_NOSUID, opts); if (mount("devfs", "/dev", "tmpfs", MS_NOSUID, opts) < 0) { virReportSystemError(errno, - _("Failed to mount %s on %s type %s"), - "devfs", "/dev", "tmpfs"); + _("Failed to mount %s on %s type %s (%s)"), + "devfs", "/dev", "tmpfs", opts); goto cleanup; } } -- 1.7.1

2 1

[libvirt] [PATCH] build: avoid non-portable byte-swapping
by Eric Blake 19 Sep '12

19 Sep '12

Commit 0fc89098 used functions only available on glibc, completely botched 32-bit environments, and risked SIGBUS due to unaligned memory access on platforms that aren't as forgiving as x86_64. * bootstrap.conf (gnulib_modules): Import ffsl. * src/util/bitmap.c (includes): Use <strings.h> for ffsl. (virBitmapNewData, virBitmapToData): Avoid 64-bit assumptions and non-portable functions. --- I wish I could push this under the build-breaker rule, but it is not quite trivial enough. bootstrap.conf | 1 + src/util/bitmap.c | 38 +++++++++++++++++++++++++++----------- 2 files changed, 28 insertions(+), 11 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index 2847c0b..23000ac 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -44,6 +44,7 @@ fcntl fcntl-h fdatasync ffs +ffsl fnmatch fsync func diff --git a/src/util/bitmap.c b/src/util/bitmap.c index 51e567a..4bade6c 100644 --- a/src/util/bitmap.c +++ b/src/util/bitmap.c @@ -1,7 +1,7 @@ /* * bitmap.h: Simple bitmap operations * - * Copyright (C) 2010-2011 Red Hat, Inc. + * Copyright (C) 2010-2012 Red Hat, Inc. * Copyright (C) 2010 Novell, Inc. * * This library is free software; you can redistribute it and/or @@ -27,6 +27,7 @@ #include <stdint.h> #include <stdio.h> #include <string.h> +#include <strings.h> #include <stdlib.h> #include <sys/types.h> @@ -418,15 +419,23 @@ virBitmapPtr virBitmapNewCopy(virBitmapPtr src) virBitmapPtr virBitmapNewData(void *data, int len) { virBitmapPtr bitmap; - int i; + int i, j; + unsigned long *p; + unsigned char *bytes = data; bitmap = virBitmapNew(len * CHAR_BIT); if (!bitmap) return NULL; - memcpy(bitmap->map, data, len); - for (i = 0; i < bitmap->map_len; i++) - bitmap->map[i] = le64toh(bitmap->map[i]); + /* le64toh is not provided by gnulib, so we do the conversion by hand */ + p = bitmap->map; + for (i = j = 0; i < len; i++, j++) { + if (j == sizeof(*p)) { + j = 0; + p++; + } + *p |= bytes[i] << (j * CHAR_BIT); + } return bitmap; } @@ -446,19 +455,26 @@ int virBitmapToData(virBitmapPtr bitmap, unsigned char **data, int *dataLen) { int len; unsigned long *l; - int i; + int i, j; + unsigned char *bytes; - len = bitmap->map_len * (VIR_BITMAP_BITS_PER_UNIT / CHAR_BIT); + len = (bitmap->max_bit + CHAR_BIT - 1) / CHAR_BIT; if (VIR_ALLOC_N(*data, len) < 0) return -1; - memcpy(*data, bitmap->map, len); + bytes = *data; *dataLen = len; - l = (unsigned long *)*data; - for (i = 0; i < bitmap->map_len; i++, l++) - *l = htole64(*l); + /* htole64 is not provided by gnulib, so we do the conversion by hand */ + l = bitmap->map; + for (i = j = 0; i < len; i++, j++) { + if (j == sizeof(*l)) { + j = 0; + l++; + } + bytes[i] = *l >> (j * CHAR_BIT); + } return 0; } -- 1.7.11.4

2 3

[libvirt] [PATCH v4 0/9] improve virBitmap
by Hu Tao 18 Sep '12

18 Sep '12

In many places we store bitmap info in a chunk of data (pointed to by a char *), and have redundant codes to set/unset bits. This series extends virBitmap, and convert those codes to use virBitmap. changes: v4: - rename virBitmapAlloc to virBitmapNew - rename virBitmapAllocFromData to virBitmapNewData v3: - renaming member variables of virBitmap - rewrite virBitmapFormat using virBitmapNextSetBit - store bits in machine native endian format - more tests of virBitmap v2: - fix bug in qemuSetupCgroupForEmulator - new function virBitmapNextSetBit - virBitmapcmp -> virBitmapEqual - virBitmap: store bits in little endian format - some improvements of virBitmap - fix some memory leaks Hu Tao (9): bitmap: new member variable and function renaming New functions for virBitmap use virBitmap to store cpupin info use virBitmap to store cpu affinity info use virBitmap to store numa nodemask info. use virBitmap to store cpumask info. use virBitmap to store cells' cpumask info. use virBitmap to store nodeinfo. remove virDomainCpuSetFormat and virDomainCpuSetParse .gitignore | 1 + src/conf/cpu_conf.c | 17 +- src/conf/cpu_conf.h | 3 +- src/conf/domain_conf.c | 394 ++++++---------------------------- src/conf/domain_conf.h | 18 +- src/conf/snapshot_conf.c | 2 +- src/libvirt_private.syms | 16 +- src/lxc/lxc_controller.c | 56 +++-- src/nodeinfo.c | 26 +-- src/nodeinfo.h | 6 +- src/parallels/parallels_driver.c | 5 +- src/qemu/qemu_capabilities.c | 2 +- src/qemu/qemu_cgroup.c | 10 +- src/qemu/qemu_cgroup.h | 2 +- src/qemu/qemu_command.c | 43 +--- src/qemu/qemu_driver.c | 170 +++++++-------- src/qemu/qemu_process.c | 141 ++++-------- src/test/test_driver.c | 5 +- src/util/bitmap.c | 435 ++++++++++++++++++++++++++++++++++++-- src/util/bitmap.h | 36 +++- src/util/processinfo.c | 36 ++-- src/util/processinfo.h | 9 +- src/vmx/vmx.c | 36 ++-- tests/Makefile.am | 7 +- tests/cpuset | 2 +- tests/virbitmaptest.c | 362 +++++++++++++++++++++++++++++++ tools/virsh-domain.c | 2 +- 27 files changed, 1136 insertions(+), 706 deletions(-) create mode 100644 tests/virbitmaptest.c -- 1.7.10.2

5 36

[libvirt] update: dnsmasq and dynamic dns for IPv6
by Gene Czarcinski 18 Sep '12

18 Sep '12

I have done a bunch of testing and NetworkManager does not send the client-host's name to the server so that an IPv6 dns entry can occur. I have dupicated the problem with dnsmasq and bind/dhcp. This has been reported: https://bugzilla.redhat.com/show_bug.cgi?id=858327 Now back to figuring out how to get IPv6 dhcp support into libvirt. Gene

1 0

Re: [libvirt] [libvirt-users] virNodeGetCPUStats and virDomainGetCPUStats have same name in pyton binding as getCPUStats
by Daniel Veillard 18 Sep '12

18 Sep '12

On Tue, Sep 18, 2012 at 10:56:55AM +0000, Buggi, Harsha wrote: > Hi, > > virNodeGetCPUStats and virDomainGetCPUStats have same name in pyton binding as getCPUStats > > virDomainGetCPUStats gets called internally when we use the method getCPUStats. How do we access virNodeGetCPUStats? Ouch we need to fix the generator to have domainGetCPUStats !! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 3

[libvirt] [PATCH 0/5] Support ephemeral passthrough hostdevs
by Shradha Shah 18 Sep '12

18 Sep '12

The ephemeral flag helps support migration with PCI-passthrough. An ephemeral hostdev is automatically unplugged before migration and replugged (if one is available on the destination) after migration. Shradha Shah (5): Added ephemeral flag for hostdev in domain conf. Adding ephemeral flag for hostdev in network conf. Ephemeral flag mofication within the network driver. Ephemeral flag modification within the qemu driver. Migration support for ephemeral hostdevs. docs/schemas/domaincommon.rng | 16 +++ docs/schemas/network.rng | 8 ++ src/conf/domain_conf.c | 23 ++++- src/conf/domain_conf.h | 1 + src/conf/network_conf.c | 11 ++ src/conf/network_conf.h | 1 + src/network/bridge_driver.c | 1 + src/qemu/qemu_command.c | 49 +++++----- src/qemu/qemu_migration.c | 98 +++++++++++++++++++- tests/networkxml2xmlin/hostdev-pf.xml | 2 +- tests/networkxml2xmlin/hostdev.xml | 2 +- tests/networkxml2xmlout/hostdev-pf.xml | 2 +- tests/networkxml2xmlout/hostdev.xml | 2 +- .../qemuxml2argv-hostdev-pci-address.xml | 2 +- .../qemuxml2argv-hostdev-usb-address.xml | 2 +- .../qemuxml2argvdata/qemuxml2argv-net-hostdev.xml | 2 +- tests/qemuxml2argvdata/qemuxml2argv-pci-rom.xml | 4 +- 17 files changed, 188 insertions(+), 38 deletions(-) -- 1.7.4.4

1 5