December 2013 - Devel - libvirt List Archives

[libvirt] [PATCH] Add helper program to create custom leases
by Nehal J Wani 14 Jan '14

14 Jan '14

Introduce helper program to catch events from dnsmasq and maintain a custom lease file per network. It supports dhcpv4 and dhcpv6. The file is saved as "<interface-name>.status". The format of each lease is: <expiry-time (epoch time)> <mac> <iaid> <ip-address> <hostname> <clientid> Example of custom leases file content: 1385245780 52:54:00:2f:ba:76 * 192.168.150.153 * * 1385245781 52:54:00:2f:ba:76 3127926 2001:db8:ca2:2:1::6c * 00:04:76:00:cf:ae:b3:0b:fc:cd:0e:22:2e:97:76:65:74:ec 1385245964 52:54:00:44:7c:d7 * 192.168.150.219 iiit-ad885e4aa1 01:52:54:00:44:7c:d7 1385245964 52:54:00:44:7c:d7 * 192.168.150.219 * 01:52:54:00:44:7c:d7 1385246016 52:54:00:5d:99:92 * 192.168.150.212 iiit-ad885e4aa1 01:52:54:00:5d:99:92 1385246041 52:54:00:3b:16:e0 * 192.168.150.207 * * 1385246081 52:54:00:db:dd:98 * 192.168.150.234 * * 1385246088 52:54:00:db:dd:98 14409112 2001:db8:ca2:2:1::6d * 00:04:76:00:cf:ae:b3:0b:fc:cd:0e:22:2e:97:76:65:74:ec --- src/util/leaseshelper.c | 232 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 232 insertions(+) create mode 100644 src/util/leaseshelper.c diff --git a/src/util/leaseshelper.c b/src/util/leaseshelper.c new file mode 100644 index 0000000..9ed22a6 --- /dev/null +++ b/src/util/leaseshelper.c @@ -0,0 +1,232 @@ +/* + * leasehelper.c: Helper program to create custom leases file + * + * Copyright (C) 2013 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + * Author: Nehal J Wani <nehaljw.kkd1(a)gmail.com> + * + */ + +#include <config.h> + +#include <stdio.h> +#include <stdlib.h> + +#include "virutil.h" +#include "virthread.h" +#include "virfile.h" +#include "virbuffer.h" +#include "virstring.h" +#include "virerror.h" +#include "viralloc.h" +#include "configmake.h" + +#define VIR_FROM_THIS VIR_FROM_NETWORK + +/** + * VIR_NETWORK_DHCP_LEASE_FIELDS: + * + * Macro providing the maximum number of fields in an entry in + * the leases file + */ +#define VIR_NETWORK_DHCP_LEASE_FIELDS 6 +/** + * VIR_NETWORK_DHCP_LEASE_FILE_SIZE_MAX: + * + * Macro providing the upper limit on the size of leases file + */ +#define VIR_NETWORK_DHCP_LEASE_FILE_SIZE_MAX 2097152 + +/* + * Use this when passing possibly-NULL strings to printf-a-likes. + */ +# define EMPTY_STR(s) ((s) ? (s) : "*") + +int +main(int argc, char **argv) { + + FILE *g = fopen("/tmp/wtf", "a"); + int j; + for (j = 0; j < argc; j++) + fprintf(g, "called :: : %s, ", argv[j]); + fprintf(g, "\n"); + fclose(g); + + /* Doesn't hurt to check */ + if (argc < 4) { + /* Refer man page of dnsmasq --dhcp-script for more details */ + fprintf(stderr, "Usage: $program $action ${mac|clientid} $ip\n"); + return -1; + } + + const char *program_name = argv[0]; + const char *action = argv[1]; + const char *interface = EMPTY_STR(virGetEnvAllowSUID("DNSMASQ_INTERFACE")); + const char *expirytime = EMPTY_STR(virGetEnvAllowSUID("DNSMASQ_LEASE_EXPIRES")); + const char *mac = argv[2]; + const char *ip = argv[3]; + const char *iaid = EMPTY_STR(virGetEnvAllowSUID("DNSMASQ_IAID")); + const char *hostname = EMPTY_STR(virGetEnvAllowSUID("DNSMASQ_SUPPLIED_HOSTNAME")); + const char *clientid = EMPTY_STR(virGetEnvAllowSUID("DNSMASQ_CLIENT_ID")); + const char *leases_str = NULL; + char *lease_file = NULL; + char *lease_entries = NULL; + char *lease_entry = NULL; + char **lease_fields = NULL; + bool delete = false; + bool add = false; + int rv = -1; + int lease_file_len = 0; + FILE *fp = NULL; + long long expirytime_tmp = 0; + virBuffer buf_new_lease = VIR_BUFFER_INITIALIZER; + virBuffer buf_all_leases = VIR_BUFFER_INITIALIZER; + + if (setlocale(LC_ALL, "") == NULL || + bindtextdomain(PACKAGE, LOCALEDIR) == NULL || + textdomain(PACKAGE) == NULL) { + fprintf(stderr, _("%s: initialization failed\n"), program_name); + exit(EXIT_FAILURE); + } + + if (virThreadInitialize() < 0 || + virErrorInitialize() < 0) { + fprintf(stderr, _("%s: initialization failed\n"), program_name); + exit(EXIT_FAILURE); + } + + if (virAsprintf(&lease_file, "%s/%s.status", LOCALSTATEDIR + "/lib/libvirt/dnsmasq/", interface) < 0) + goto cleanup; + + if (virGetEnvAllowSUID("DNSMASQ_IAID")) { + mac = EMPTY_STR(virGetEnvAllowSUID("DNSMASQ_MAC")); + clientid = argv[2]; + } + + /* Make sure dnsmasq knows the interface, otherwise something is wrong */ + if (STREQ(interface, "*")) + goto cleanup; + + /* Make sure the file exists. If not, 'touch' it */ + if (virFileTouch(lease_file, 0644) < 0) + goto cleanup; + + /* Read entire contents */ + if ((lease_file_len = virFileReadAll(lease_file, + VIR_NETWORK_DHCP_LEASE_FILE_SIZE_MAX, + &lease_entries)) < 0) { + goto cleanup; + } + + if (STREQ(action, "add") || STREQ(action, "old") || STREQ(action, "del")) { + if (mac || STREQ(action, "del")) { + /* Delete the corresponding lease */ + delete = true; + if (STREQ(action, "add") || STREQ(action, "old")) { + fprintf(stderr, "add|old\n"); + add = true; + /* Enter new lease */ + virBufferAsprintf(&buf_new_lease, "%s %s %s %s %s %s\n", + expirytime, mac, iaid, ip, hostname, clientid); + + if (virBufferError(&buf_new_lease)) { + virBufferFreeAndReset(&buf_new_lease); + virReportOOMError(); + goto cleanup; + } + } + } + } + + lease_entry = lease_entries[0] == '\0' ? NULL : lease_entries; + + while (lease_entry) { + int nfields = 0; + + char *eol = strchr(lease_entry, '\n'); + *eol = '\0'; + + /* Split the lease line */ + if (!(lease_fields = virStringSplit(lease_entry, " ", + VIR_NETWORK_DHCP_LEASE_FIELDS))) + goto cleanup; + + nfields = virStringListLength(lease_fields); + + /* Forward lease_entry to the next lease */ + lease_entry = strchr(lease_entry, '\0'); + if (lease_entry - lease_entries + 1 < lease_file_len) + lease_entry++; + else + lease_entry = NULL; + + if (nfields != VIR_NETWORK_DHCP_LEASE_FIELDS) + goto cleanup; + + if (virStrToLong_ll(lease_fields[0], NULL, 10, &expirytime_tmp) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Unable to convert lease expiry time to integer: %s"), + lease_fields[0]); + goto cleanup; + } + + /* Check whether lease has expired or not */ + if (expirytime_tmp < (long long) time(NULL)) + continue; + else if (delete && STREQ(lease_fields[3], ip)) + continue; + else { + virBufferAsprintf(&buf_all_leases, "%s %s %s %s %s %s\n", + lease_fields[0], lease_fields[1], lease_fields[2], + lease_fields[3], lease_fields[4], lease_fields[5]); + + if (virBufferError(&buf_all_leases)) { + virBufferFreeAndReset(&buf_all_leases); + virReportOOMError(); + goto cleanup; + } + } + } + + if (add) { + virBufferAsprintf(&buf_all_leases, "%s", virBufferContentAndReset(&buf_new_lease)); + + if (virBufferError(&buf_all_leases)) { + virBufferFreeAndReset(&buf_all_leases); + virReportOOMError(); + goto cleanup; + } + } + + rv = 0; + + /* Write to file */ + leases_str = virBufferContentAndReset(&buf_all_leases); + if (!leases_str) + leases_str = ""; + + if (virFileWriteStr(lease_file, leases_str, 0) < 0) + rv = -1; + +cleanup: + VIR_FREE(lease_file); + VIR_FREE(lease_entries); + if (lease_fields) + virStringFreeList(lease_fields); + return rv; +} -- 1.8.1.4

1 1

[libvirt] [PATCH] vbox: add support for v4.2.20+ and v4.3.4+
by Jean-Baptiste Rouault 14 Jan '14

14 Jan '14

While working on adding virDomain*Stats support to the vbox driver, we found bugs in the VirtualBox API C bindings. These bugs have been fixed in versions 4.2.20 and 4.3.4. However, the changes in the C bindings are incompatible with the vbox_CAPI_v4_2.h and vbox_CAPI_v4_3.h files which are bundled in libvirt source code. This is why the following patch adds vbox_CAPI_v4_2_20.h and vbox_CAPI_v4_3_4.h. We tried to keep compatibility with older VirtualBox 4.2.x and 4.3.x releases so we added a "SPECIAL_VERSION" identifier to conditionnaly include the right header. I'm not really pleased with this "SPECIAL_VERSION" identifier, maybe we could instead increase the precision of "VBOX_API_VERSION", for example 4002 would become 4002000. This would permit us to select the right header based on the VBOX_API_VERSION only, what do you think ? Jean-Baptiste Rouault (1): vbox: add support for v4.2.20+ and v4.3.4+ src/Makefile.am | 4 +- src/vbox/vbox_CAPI_v4_2_20.h | 9001 +++++++++++++++++++++++++++++++++++ src/vbox/vbox_CAPI_v4_3_4.h | 10321 +++++++++++++++++++++++++++++++++++++++++ src/vbox/vbox_V2_2.c | 1 + src/vbox/vbox_V3_0.c | 1 + src/vbox/vbox_V3_1.c | 1 + src/vbox/vbox_V3_2.c | 1 + src/vbox/vbox_V4_0.c | 1 + src/vbox/vbox_V4_1.c | 1 + src/vbox/vbox_V4_2.c | 1 + src/vbox/vbox_V4_2_20.c | 14 + src/vbox/vbox_V4_3.c | 1 + src/vbox/vbox_V4_3_4.c | 14 + src/vbox/vbox_driver.c | 20 +- src/vbox/vbox_tmpl.c | 12 +- 15 files changed, 19389 insertions(+), 5 deletions(-) create mode 100644 src/vbox/vbox_CAPI_v4_2_20.h create mode 100644 src/vbox/vbox_CAPI_v4_3_4.h create mode 100644 src/vbox/vbox_V4_2_20.c create mode 100644 src/vbox/vbox_V4_3_4.c -- 1.8.5.1

4 7

[libvirt] [PATCH] qemu: Add support for changing timeout value to open unix monitor socket
by Pavel Fux 10 Jan '14

10 Jan '14

Hi, I am talking about *Bug 987088*<https://bugzilla.redhat.com/show_bug.cgi?id=987088>, I have added a patch and a description of the fix, this is a copy of my comment on the bug: the default code behavior is wait for 3 seconds and if the socket is not opened yet, print this error and terminate. the code is in src/qemu/qemu_monitor.c in function qemuMonitorOpenUnix. In 2009 there was a patch that added the original 3 seconds retry, the patch can be found here: http://www.redhat.com/archives/libvir-list/2009-July/msg00335.html I have added a patch with this solution: the default behavior stays the same, but a user can add a configuration variable to qemu.conf and change the timeout value. every system needs a different value according to their system configuration but anyway 3 seconds is not suitable for all cases. I am attaching my patch. Pavel Fux.

3 2

[libvirt] [PATCH v4 0/7] Network events API
by Cédric Bosdonnat 10 Jan '14

10 Jan '14

This patch serie include changes to respond to Eric and Daniel's comments. The event namespace part of the ID is only handled at the object event's level, though we need to strip it out of virObjectEventStateEventID to get the remote driver properly deregister. Cédric Bosdonnat (7): Added Network events API and virNetworkEventLifecycle. test driver: implemented network events Add network events unit tests Add network events to the remote driver Added network events to the bridged network driver Fixed indentation in src/conf/*_event* Added default case with error for object event dispatching daemon/libvirtd.h | 1 + daemon/remote.c | 139 +++++++++++++++++ include/libvirt/libvirt.h.in | 80 ++++++++++ src/Makefile.am | 5 + src/conf/domain_event.c | 286 ++++++++++++++++++++--------------- src/conf/domain_event.h | 271 +++++++++++++++++++-------------- src/conf/network_event.c | 154 +++++++++++++++++++ src/conf/network_event.h | 51 +++++++ src/conf/object_event.c | 50 +++--- src/conf/object_event.h | 1 + src/conf/object_event_private.h | 20 ++- src/driver.h | 14 ++ src/libvirt.c | 125 +++++++++++++++ src/libvirt_private.syms | 2 + src/libvirt_public.syms | 7 + src/network/bridge_driver.c | 90 +++++++++++ src/network/bridge_driver_platform.h | 3 + src/remote/remote_driver.c | 127 ++++++++++++++++ src/remote/remote_protocol.x | 46 +++++- src/test/test_driver.c | 62 ++++++++ tests/objecteventtest.c | 167 ++++++++++++++++++++ 21 files changed, 1444 insertions(+), 257 deletions(-) create mode 100644 src/conf/network_event.c create mode 100644 src/conf/network_event.h -- 1.8.4.4

5 19

[libvirt] [PATCHv2 0/7] lxc: honor mount namespaces
by Eric Blake 10 Jan '14

10 Jan '14

We are still awaiting a CVE number to be assigned, but Reco reported in Debian bug #732394 that a malicious guest could cause virDomainShutdown and virDomainReboot to cause the host to misbehave, if the host blindly follows symlinks in its own mount namespace instead of the guest's namespace. I have not yet tried to patch the bugs in virDomainDeviceAttach dereferencing /dev from the wrong namespace, which also suffers from the same vulnerability, but virProcessRunInMountNamespace should also be usable in that situation. While working on this series, I found several issues with virFork and virt-login-shell; since those are also related to correct namespace usage, I've bundled everything into one series; but the CVE is not fixed until patch 7/7 plus the future patch to /dev. I've done some pretty decent testing on the new virt-login-shell, but did not get as much testing on virDomainReboot. Since this series does address a CVE, and also regressions caused by our previous CVE fix in the same area of code (CVE-2013-4400 is unfortunately a poor example of shipping "fixes" without testing that the code still worked), I'd definitely appreciate a close review. Patch 6/7 is interesting: it uses virFork to use the mount namespace without impacting the parent process. However, since setns() is thread-safe, I wonder if it would be simpler to instead use pthread_create to do the callback within the same process instead of having to create a separate process, as that would make for easier coordination for passing the results back to the remaining threads that have not changed namespace. Thankfully, I think we came up with a good abstraction - I'm fairly confident that 6/7 could be rewritten to use pthread_create without changing the function signatures, in which case patch 7/7 would not need any changes to pick up the changed backend. Eric Blake (7): virt-login-shell: fix regressions in behavior virFork: simplify semantics virt-login-shell: use single instead of double fork virt-login-shell: saner exit value virsh: report exit status of failed lxc-enter-namespace lxc: add virProcessRunInMountNamespace lxc: security fix for virInitctlSetRunLevel src/internal.h | 7 +++ src/libvirt.c | 2 +- src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 38 ++++++------ src/util/vircommand.c | 128 +++++++++++++++----------------------- src/util/vircommand.h | 2 +- src/util/virfile.c | 25 ++------ src/util/virinitctl.c | 28 ++++----- src/util/virinitctl.h | 5 +- src/util/virprocess.c | 81 ++++++++++++++++++++++-- src/util/virprocess.h | 11 ++++ tools/virsh-domain.c | 34 ++++++---- tools/virsh.pod | 3 +- tools/virt-login-shell.c | 151 ++++++++++++++++++++------------------------- tools/virt-login-shell.pod | 23 ++++++- 15 files changed, 299 insertions(+), 240 deletions(-) -- 1.8.4.2

4 18

[libvirt] [PATCH 00/24] libvirt.c error handling audit
by Eric Blake 09 Jan '14

09 Jan '14

This series is in response to: https://www.redhat.com/archives/libvir-list/2013-December/msg01101.html It turned into a much bigger cleanup project, where I ended up with a lot of changes; hopefully the division into multiple patches makes review easier, and the end result diffstat shows that the code base is more compact when all is said and done. Eric Blake (24): maint: consistent formatting in libvirt.c maint: improve debug of libvirt-{qemu,lxc} apis maint: move debug statements first in public API maint: improve error condition style in public API maint: don't leave garbage on early API exit maint: reset error on entrance to public API maint: avoid nested public calls maint: improve VIR_ERR_NO_SUPPORT usage maint: improve VIR_ERR_OPERATION_DENIED usage maint: improve VIR_ERR_INVALID_CONN usage maint: inline VIR_IS_CONNECT macro maint: improve VIR_ERR_INVALID_DOMAIN usage maint: inline VIR_IS*_DOMAIN macro maint: improve VIR_ERR_INVALID_NETWORK usage maint: improve VIR_ERR_INVALID_INTERFACE usage maint: improve VIR_ERR_INVALID_STORAGE_POOL usage maint: improve VIR_ERR_INVALID_STORAGE_VOL usage maint: improve VIR_ERR_INVALID_NODE_DEVICE usage maint: improve VIR_ERR_INVALID_SECRET usage maint: improve VIR_ERR_INVALID_STREAM usage maint: improve VIR_ERR_INVALID_NWFILTER usage maint: improve VIR_ERR_INVALID_DOMAIN_SNAPSHOT usage maint: clean up error reporting in migration maint: replace remaining virLib*Error with better names cfg.mk | 10 - docs/api_extension.html.in | 7 +- po/POTFILES.in | 1 - src/datatypes.c | 104 +- src/datatypes.h | 318 ++- src/internal.h | 9 + src/libvirt-lxc.c | 38 +- src/libvirt-qemu.c | 65 +- src/libvirt.c | 5342 +++++++++++++-------------------------- src/locking/lock_daemon.c | 16 +- src/lxc/lxc_driver.c | 2 +- src/qemu/qemu_migration.c | 10 +- src/security/security_manager.c | 46 +- src/util/virerror.c | 2 +- src/util/virerror.h | 8 + src/util/virinitctl.c | 4 +- src/util/virtypedparam.c | 14 +- src/util/viruuid.h | 20 +- src/xen/xen_driver.c | 11 +- 19 files changed, 2250 insertions(+), 3777 deletions(-) -- 1.8.4.2

2 75

[libvirt] [PATCH 1/1] virsh nodecpustats erroneously returns stats for offline cpus on Linux
by Pradipta Kr. Banerjee 08 Jan '14

08 Jan '14

From: "Pradipta Kr. Banerjee" <bpradip(a)in.ibm.com> virsh nodecpustats erroneously returns stats for offline cpus on Linux To retrieve node cpu statistics on Linux system, the linuxNodeGetCPUstats function performs a minimal match of the input cpuid with the cpuid read from /proc/cpustat. On systems with larger cpus this can result in erroneous data. For eg if /proc/stat has similar data cpu 3645648 485 361475 3691194868 176595 40645 69850 0 1526172 0 cpu0 494045 62 42763 138516619 16107 2339 2431 0 248345 0 cpu4 402646 59 34745 138617562 17738 1413 1196 0 193948 0 cpu8 318662 32 32119 138715131 7903 927 982 0 115429 0 cpu12 247004 33 30465 138791438 5251 759 913 0 51938 0 and cpu 1,2 are offline, then 'virsh nodecpustats 1' displays data for cpu12 whereas virsh nodecpustats 2 correctly throws the following error "error: Unable to get node cpu stats error: Invalid cpuNum in linuxNodeGetCPUStats" This patch fixes the above mentioned problem Signed-off-by: Pradipta Kr. Banerjee <bpradip(a)in.ibm.com> --- src/nodeinfo.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 1838547..c9e5ff1 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -614,6 +614,8 @@ linuxNodeGetCPUStats(FILE *procstat, unsigned long long usr, ni, sys, idle, iowait; unsigned long long irq, softirq, steal, guest, guest_nice; char cpu_header[3 + INT_BUFSIZE_BOUND(cpuNum)]; + char cpu_header_read[3 + INT_BUFSIZE_BOUND(cpuNum)]; + char cpu_header_fmt[8]; if ((*nparams) == 0) { /* Current number of cpu stats supported by linux */ @@ -631,8 +633,11 @@ linuxNodeGetCPUStats(FILE *procstat, if (cpuNum == VIR_NODE_CPU_STATS_ALL_CPUS) { strcpy(cpu_header, "cpu"); + snprintf(cpu_header_fmt, sizeof(cpu_header_fmt), "%%%ds", 3); } else { snprintf(cpu_header, sizeof(cpu_header), "cpu%d", cpuNum); + snprintf(cpu_header_fmt, sizeof(cpu_header_fmt), "%%%ds", + (int)(3 + INT_BUFSIZE_BOUND(cpuNum))); } while (fgets(line, sizeof(line), procstat) != NULL) { @@ -649,6 +654,14 @@ linuxNodeGetCPUStats(FILE *procstat, continue; } + /* + * Process with stats gathering only if the cpuid from /proc/stat + * matches exactly with the input cpuid + */ + sscanf(buf, cpu_header_fmt, cpu_header_read); + if (STRNEQ(cpu_header, cpu_header_read)) + continue; + for (i = 0; i < *nparams; i++) { virNodeCPUStatsPtr param = &params[i]; -- 1.8.3.1

5 6

[libvirt] [PATCH] LXC: don't set socket create selinux context in virLXCProcessConnectMonitor
by Gao feng 08 Jan '14

08 Jan '14

the unix socket /var/run/libvirt/lxc/domain.sock is not created under the selinux context which configured by <seclabel>. If we try to connect the domain.sock under the selinux context of domain in virtLXCProcessConnectMonitor,selinux will deny this connect operation. type=AVC msg=audit(1387953696.067:662): avc: denied { connectto } for pid=21206 comm="libvirtd" path="/usr/local/var/run/libvirt/lxc/systemd.sock" scontext=unconfined_u:system_r:svirt_lxc_net_t:s0:c770,c848 tcontext=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket Since there is no harm to access doamin.sock outof domain's context, this patch removes the setsockcreatecon in virLXCProcessConnectMonitor. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_process.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index cc9c1a2..b336ade 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -640,9 +640,6 @@ static virLXCMonitorPtr virLXCProcessConnectMonitor(virLXCDriverPtr driver, virLXCMonitorPtr monitor = NULL; virLXCDriverConfigPtr cfg = virLXCDriverGetConfig(driver); - if (virSecurityManagerSetSocketLabel(driver->securityManager, vm->def) < 0) - goto cleanup; - /* Hold an extra reference because we can't allow 'vm' to be * deleted while the monitor is active */ virObjectRef(vm); @@ -652,15 +649,6 @@ static virLXCMonitorPtr virLXCProcessConnectMonitor(virLXCDriverPtr driver, if (monitor == NULL) virObjectUnref(vm); - if (virSecurityManagerClearSocketLabel(driver->securityManager, vm->def) < 0) { - if (monitor) { - virObjectUnref(monitor); - monitor = NULL; - } - goto cleanup; - } - -cleanup: virObjectUnref(cfg); return monitor; } -- 1.8.4.2

2 2

[libvirt] [PATCH V2 1/1] Add hw random number generator (/dev/hwrng) to cgroup ACL
by Pradipta Kr. Banerjee 07 Jan '14

07 Jan '14

From: "Pradipta Kr. Banerjee" <bpradip(a)in.ibm.com> Creating a qemu VM with /dev/hwrng as backend RNG device throws the following error - "Could not open '/dev/hwrng': Permission denied" This patch fixes the issue Signed-off-by: Pradipta Kr. Banerjee <bpradip(a)in.ibm.com> --- src/qemu/qemu_cgroup.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index f0cacd0..8e2076e 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -533,6 +533,18 @@ qemuSetupDevicesCgroup(virQEMUDriverPtr driver, goto cleanup; } + if (vm->def->rng && + (vm->def->rng->backend == VIR_DOMAIN_RNG_BACKEND_RANDOM)) { + VIR_DEBUG("Setting Cgroup ACL for RNG device"); + rv = virCgroupAllowDevicePath(priv->cgroup, vm->def->rng->source.file, + VIR_CGROUP_DEVICE_RW); + virDomainAuditCgroupPath(vm, priv->cgroup, "allow", + vm->def->rng->source.file, "rw", rv == 0); + if (rv < 0 && + !virLastErrorIsSystemErrno(ENOENT)) + goto cleanup; + } + ret = 0; cleanup: virObjectUnref(cfg); -- 1.8.3.1

2 2

[libvirt] [PATCH 0/5] qemu: Fix job usage in several APIs
by Jiri Denemark 07 Jan '14

07 Jan '14

When fixing https://bugzilla.redhat.com/show_bug.cgi?id=1043069 I realized qemuDomainBlockStats is not the only API that does not acquire a job early enough. Generally, every API that is going to begin a job should do that before fetching data from vm->def. The following 5 APIs failed to do so and moreover used the data fetched early from vm->def after starting a job. In some circumstances this can lead to a crash. Jiri Denemark (5): qemu: Do not access stale data in virDomainBlockStats qemu: Avoid using stale data in virDomainGetBlockInfo qemu: Fix job usage in qemuDomainBlockJobImpl qemu: Fix job usage in qemuDomainBlockCopy qemu: Fix job usage in virDomainGetBlockIoTune src/qemu/qemu_driver.c | 92 ++++++++++++++++++++++++-------------------------- 1 file changed, 44 insertions(+), 48 deletions(-) -- 1.8.5.2

3 15