October 2013 - Devel - libvirt List Archives

[libvirt] [PATCH] LXC: Improved check before mounting securityfs
by Bogdan Purcareata 08 Oct '13

08 Oct '13

Securityfs kernel support may not be available on all platforms running libvirt containers. Since securityfs receives special handling in the context of user namespaces, make an additional check to see if it is supported, by inspecting /proc/filesystems. Making this check for all lxcBasicMounts is a bit tedious, since the /proc filesystem is first unmounted from host, so the /proc/filesystems list should be saved before unmounting, to be available at all times. However, checks for the support for /proc or /sys are superfluous. In the long run, to support the addition of new filesystems in lxcBasicMounts, an additional "optional" flag should be introduced, to mark that for a specific filesystem, the code should first check for support in the kernel, before mounting it. For mandatory filesystems, if mounting them fails, creating the container fails. Right now, check for support only for securityfs, since right now it is the only special case. Signed-off-by: Bogdan Purcareata <bogdan.purcareata(a)freescale.com> --- src/lxc/lxc_container.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 68 insertions(+), 1 deletion(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index c60f5d8..cead026 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -509,6 +509,71 @@ static int lxcContainerChildMountSort(const void *a, const void *b) # define MS_SLAVE (1<<19) #endif +/* + * This function attempts to detect kernel support + * for a specific filesystem type. This is done by + * inspecting /proc/filesystems. + */ +static int lxcCheckFSSupport(const char *fs_type) +{ + FILE *fp = NULL; + int ret = -1; + const char *fslist = "/proc/filesystems"; + char *line = NULL; + char *type; + size_t n; + + /* there should be no problem mounting an entry + * with NULL fs type, hence NULL fs types are + * supported */ + if (!fs_type) { + ret = 1; + goto out; + } + + VIR_DEBUG("Checking kernel support for %s in %s", fs_type, fslist); + + if (!(fp = fopen(fslist, "r"))) { + virReportSystemError(errno, + _("Unable to read %s"), + fslist); + goto out; + } + + while(getline(&line, &n, fp) > 0) { + type = strstr(line, fs_type); + + if (!type) + continue; + + /* eliminate trailing newline */ + type[strlen(type) - 1] = '\0'; + + if (STREQ(type,fs_type)) { + VIR_DEBUG("Kernel support found for %s", fs_type); + ret = 1; + goto cleanup; + } + } + + if (ferror(fp)) { + virReportSystemError(errno, + _("Error reading line from %s"), + fslist); + goto cleanup; + } + + VIR_DEBUG("No kernel support for %s", fs_type); + + ret = 0; + +cleanup: + VIR_FREE(line); + VIR_FORCE_FCLOSE(fp); +out: + return ret; +} + static int lxcContainerGetSubtree(const char *prefix, char ***mountsret, size_t *nmountsret) @@ -872,7 +937,9 @@ static int lxcContainerMountBasicFS(bool userns_enabled) continue; #endif - if (STREQ(mnt->src, "securityfs") && userns_enabled) + if (STREQ(mnt->src, "securityfs") && + (lxcCheckFSSupport(mnt->type) < 1 || + userns_enabled)) continue; if (virFileMakePath(mnt->dst) < 0) { -- 1.7.11.7

3 5

[libvirt] [PATCH] Ensure securityfs is mounted readonly in container
by Daniel P. Berrange 08 Oct '13

08 Oct '13

From: Dan Walsh <dwalsh(a)redhat.com> If securityfs is available on the host, we should ensure to mount it read-only in the container. This will avoid systemd trying to mount it during startup causing SELinux AVCs. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/lxc/lxc_container.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index b910b10..a943b22 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -770,6 +770,8 @@ static int lxcContainerMountBasicFS(void) { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, { "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV }, { "sysfs", "/sys", "sysfs", NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, + { "securityfs", "/sys/kernel/security", "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV }, + { "securityfs", "/sys/kernel/security", "securityfs", NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, #if WITH_SELINUX { SELINUX_MOUNT, SELINUX_MOUNT, "selinuxfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV }, { SELINUX_MOUNT, SELINUX_MOUNT, NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, -- 1.8.3.1

3 2

[libvirt] [PATCHv2 0/5] Refactor feature handling and add support for pvticketlocks
by Peter Krempa 07 Oct '13

07 Oct '13

Version 2 incorporates changes based on review feedback from Jan and Doug. Peter Krempa (5): schema: Rename option to make it reusable conf: Refactor storing and usage of feature flags qemu: Add support for paravirtual spinlocks in the guest conf: Clean up few error messages qemu: command: Fix macro indentation docs/formatdomain.html.in | 7 + docs/schemas/domaincommon.rng | 18 +- src/conf/domain_conf.c | 200 +++++++++++++++------ src/conf/domain_conf.h | 3 +- src/libxl/libxl_conf.c | 9 +- src/lxc/lxc_container.c | 6 +- src/qemu/qemu_command.c | 31 +++- src/vbox/vbox_tmpl.c | 45 +++-- src/xenapi/xenapi_driver.c | 10 +- src/xenapi/xenapi_utils.c | 22 ++- src/xenxs/xen_sxpr.c | 20 +-- src/xenxs/xen_xm.c | 30 ++-- .../qemuxml2argv-pv-spinlock-disabled.args | 5 + .../qemuxml2argv-pv-spinlock-disabled.xml | 26 +++ .../qemuxml2argv-pv-spinlock-enabled.args | 5 + .../qemuxml2argv-pv-spinlock-enabled.xml | 26 +++ tests/qemuxml2argvtest.c | 2 + tests/qemuxml2xmltest.c | 2 + 18 files changed, 326 insertions(+), 141 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pv-spinlock-disabled.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pv-spinlock-disabled.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pv-spinlock-enabled.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pv-spinlock-enabled.xml -- 1.8.3.2

1 7

[libvirt] [PATCH] virerror: s/VIR_ERR_STORAGE_VOL_EXISTS/VIR_ERR_STORAGE_VOL_EXISTS/
by Michal Privoznik 07 Oct '13

07 Oct '13

We currently have other error codes in singular form, e.g. VIR_ERR_NETWORK_EXIST. Cleanup the previous patch to match the form. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- include/libvirt/virterror.h | 2 +- src/storage/storage_driver.c | 2 +- src/util/virerror.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/libvirt/virterror.h b/include/libvirt/virterror.h index fd14237..e31e9c4 100644 --- a/include/libvirt/virterror.h +++ b/include/libvirt/virterror.h @@ -296,7 +296,7 @@ typedef enum { VIR_ERR_ACCESS_DENIED = 88, /* operation on the object/resource was denied */ VIR_ERR_DBUS_SERVICE = 89, /* error from a dbus service */ - VIR_ERR_STORAGE_VOL_EXISTS = 90, /* the storage vol already exists */ + VIR_ERR_STORAGE_VOL_EXIST = 90, /* the storage vol already exists */ } virErrorNumber; /** diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index d419a36..b3f0871 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -1538,7 +1538,7 @@ storageVolCreateXML(virStoragePoolPtr obj, goto cleanup; if (virStorageVolDefFindByName(pool, voldef->name)) { - virReportError(VIR_ERR_STORAGE_VOL_EXISTS, + virReportError(VIR_ERR_STORAGE_VOL_EXIST, _("'%s'"), voldef->name); goto cleanup; } diff --git a/src/util/virerror.c b/src/util/virerror.c index 3f55cec..d9a9fc4 100644 --- a/src/util/virerror.c +++ b/src/util/virerror.c @@ -1004,7 +1004,7 @@ virErrorMsg(virErrorNumber error, const char *info) else errmsg = _("Storage volume not found: %s"); break; - case VIR_ERR_STORAGE_VOL_EXISTS: + case VIR_ERR_STORAGE_VOL_EXIST: if (info == NULL) errmsg = _("this storage volume exists already"); else -- 1.8.1.5

2 2

[libvirt] [PATCH 0/2] Fixes for Mac OS X
by Ryota Ozaki 07 Oct '13

07 Oct '13

These patches enable libvirtd to work on Mac OS X. We still cannot build libvirtd from git repository due to a rpcgen problem(*) though, we can build it with a libvirt tarball, that means that we can use libvirtd installed by HomeBrew. (*) https://www.redhat.com/archives/libvirt-users/2013-February/msg00033.html ozaki-r Ryota Ozaki (2): rpc: fix getsockopt for LOCAL_PEERCRED on Mac OS X nodeinfo: make freebsdNodeGetCPUCount work on Mac OS X src/nodeinfo.c | 15 ++++++++++++--- src/rpc/virnetsocket.c | 4 ++++ 2 files changed, 16 insertions(+), 3 deletions(-) -- 1.8.3.4

4 8

[libvirt] [PATCH] Be more clever and verbose about localization-initialization.
by Fuchs, Andreas 07 Oct '13

07 Oct '13

Currently libvirt fails with an uninformative error message if no translations are found. Fixes: * If bindtextdomain fails due to missing language files, fall back to locale C. * If textdomain still fails, report the exact error without translation attempt. https://bugzilla.redhat.com/show_bug.cgi?id=1016158 Signed-off-by: Andreas Fuchs <andreas.fuchs(a)sit.fraunhofer.de> --- daemon/libvirtd.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 99c0342..490acbf 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -1132,9 +1132,17 @@ int main(int argc, char **argv) { }; if (setlocale(LC_ALL, "") == NULL || - bindtextdomain(PACKAGE, LOCALEDIR) == NULL || - textdomain(PACKAGE) == NULL || - virInitialize() < 0) { + bindtextdomain(PACKAGE, LOCALEDIR) == NULL || + textdomain(PACKAGE) == NULL) { + VIR_WARN("Cannot find localization information. Falling back to non-localized messages."); + if (setlocale(LC_ALL, "C") == NULL || + textdomain(PACKAGE) == NULL) { + fprintf(stderr, "%s: localization initialization failed\n", argv[0]); + exit(EXIT_FAILURE); + } + } + + if (virInitialize() < 0) { fprintf(stderr, _("%s: initialization failed\n"), argv[0]); exit(EXIT_FAILURE); } -- 1.7.10.4

2 1

Re: [libvirt] [libvirt-users] (Xen + libvirt) Installing and workin with xen -4.2.1 and libvirt 1.1.2
by Eric Blake 07 Oct '13

07 Oct '13

On 10/07/2013 02:28 AM, cooldharma06 wrote: > hi, > > i removed all libvirt things form my system and i installed libvirt-0.9.12 > frm my repository. > > then i installed libvirt-1.1.2 from the source with following commands. > > ./configure --prefix=/usr --localstatedir=/var --sysconfdir=/etc > --with-xen=yes --with-libxl=yes > > make > > make install > > now its works with XM. > but with xl its not working... > > i attached the corresponding screenshots also. kindly refer the attachment. Sending 271k of attachments to multiple mailing lists is considered poor netiquette - the effort to send that much from the mail server to the large number of recipients of each list, as well as the fact that not all list recipients have broadband access and have to pay for every byte downloaded, means that it is much nicer to copy-and-paste the text contents of error messages, and/or host your screenshots on an external site and merely post the URL to your screenshots rather than attaching them to the mail. Also, we ask that you avoid top-posting on technical lists. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] [PATCH 0/2] Make it easier to disable readline
by Eric Blake 07 Oct '13

07 Oct '13

Previously, disabling readline involved uninstalling the development library, or else configuring with: ac_cv_lib_readline_readline=no ac_cv_search_tgetent=no ac_cv_lib_readline_rl_initialize=no With this series, it is much easier to test that virsh still works without readline support, merely using ./configuire --without-readline. Eric Blake (2): build: move readline check into its own macro build: add configure --without-readline configure.ac | 43 +++---------------------------------------- m4/virt-readline.m4 | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ tools/virsh.c | 12 ++++++------ 3 files changed, 59 insertions(+), 46 deletions(-) create mode 100644 m4/virt-readline.m4 -- 1.8.3.1

2 4

[libvirt] [PATCH] tests: avoid compile failure on linux kernels older than 2.6.19
by Giuseppe Scrivano 07 Oct '13

07 Oct '13

Signed-off-by: Giuseppe Scrivano <gscrivan(a)redhat.com> --- tests/securityselinuxhelper.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/securityselinuxhelper.c b/tests/securityselinuxhelper.c index 89cba3a..d996825 100644 --- a/tests/securityselinuxhelper.c +++ b/tests/securityselinuxhelper.c @@ -24,7 +24,9 @@ #include <dlfcn.h> #include <errno.h> -#include <linux/magic.h> +#if HAVE_LINUX_MAGIC_H +# include <linux/magic.h> +#endif #include <selinux/selinux.h> #include <stdio.h> #include <stdlib.h> @@ -33,6 +35,10 @@ #include <unistd.h> #include <attr/xattr.h> +#ifndef NFS_SUPER_MAGIC +# define NFS_SUPER_MAGIC 0x6969 +#endif + #include "virstring.h" static int (*realstatfs)(const char *path, struct statfs *buf); -- 1.8.3.1

3 2

[libvirt] [PATCH] build: kill maintainer mode, always rebuild by default
by Eric Blake 07 Oct '13

07 Oct '13

The automake manual recommends against the use of disabling maintainer mode by default: https://www.gnu.org/software/automake/manual/automake.html#maintainer_002dm… because when it is disabled, the user gets no indication if they touch a file that would normally require a rebuild. Automake 1.11 changed things so that AM_MAINTAINER_MODE([enable]) will set the mode to enabled by default; but RHEL 5 still uses automake 1.9, where AM_MAINTAINER_MODE did not recognize an argument, and therefore disables maintainer mode by default. Having the default be different according to which version of automake built the project is annoying, and I _have_ been bitten on RHEL 5 rebuilds where the default disabled mode led to silently incorrect builds. The automake manual admits that being able to disable maintainer mode still makes sense for projects that still store generated files from the autotools in version control; but we have dropped that for several years now. As such, it's finally time to just ditch the whole idea of maintainer mode, and unconditionally rebuild autotools files if a dependency changes, without offering a configure option to disable that mode. * configure.ac (AM_MAINTAINER_MODE): Drop. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- configure.ac | 1 - 1 file changed, 1 deletion(-) diff --git a/configure.ac b/configure.ac index 7e357c4..024b0c8 100644 --- a/configure.ac +++ b/configure.ac @@ -24,7 +24,6 @@ AC_CONFIG_MACRO_DIR([m4]) dnl Make automake keep quiet about wildcards & other GNUmake-isms; also keep dnl quiet about the fact that we intentionally cater to automake 1.9 AM_INIT_AUTOMAKE([-Wno-portability -Wno-obsolete tar-ustar subdir-objects]) -AM_MAINTAINER_MODE([enable]) # Maintainer note - comment this line out if you plan to rerun # GNULIB_POSIXCHECK testing to see if libvirt should be using more modules. -- 1.8.3.1

2 2