September 2013 - Devel - libvirt List Archives

[libvirt] [PATCH] Add support for enabling SASL for SPICE guests
by Daniel P. Berrange 08 Sep '13

08 Sep '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> QEMU has support for SASL auth for SPICE guests, but libvirt has no way to enable it. Following the example from VNC where it is globally enabled via qemu.conf Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/qemu/libvirtd_qemu.aug | 2 ++ src/qemu/qemu.conf | 16 ++++++++++++++++ src/qemu/qemu_command.c | 10 ++++++++++ src/qemu/qemu_conf.c | 3 +++ src/qemu/qemu_conf.h | 2 ++ src/qemu/test_libvirtd_qemu.aug.in | 2 ++ 6 files changed, 35 insertions(+) diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index cd13d53..118d4c7 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -38,6 +38,8 @@ module Libvirtd_qemu = | bool_entry "spice_tls" | str_entry "spice_tls_x509_cert_dir" | str_entry "spice_password" + | bool_entry "spice_sasl" + | str_entry "spice_sasl_dir" let nogfx_entry = bool_entry "nographics_allow_host_audio" diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 5fd6263..6d4e99e 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -140,6 +140,22 @@ #spice_password = "XYZ12345" +# Enable use of SASL encryption on the SPICE server. This requires +# a SPICE client which supports the SASL protocol extension. +# +# It is necessary to configure /etc/sasl2/qemu.conf to choose +# the desired SASL plugin (eg, GSSPI for Kerberos) +# +#spice_sasl = 1 + +# The default SASL configuration file is located in /etc/sasl2/ +# When running libvirtd unprivileged, it may be desirable to +# override the configs in this location. Set this parameter to +# point to the directory, and create a qemu.conf in that location +# +#spice_sasl_dir = "/some/directory/sasl2" + + # By default, if no graphical front end is configured, libvirt will disable # QEMU audio output since directly talking to alsa/pulseaudio may not work # with various security settings. If you know what you're doing, enable diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 91ca86a..5e4ebc8 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7065,6 +7065,16 @@ qemuBuildGraphicsSPICECommandLine(virQEMUDriverConfigPtr cfg, virBufferAsprintf(&opt, "tls-port=%u", tlsPort); } + if (cfg->spiceSASL) { + virBufferAddLit(&opt, ",sasl"); + + if (cfg->spiceSASLdir) + virCommandAddEnvPair(cmd, "SASL_CONF_DIR", + cfg->spiceSASLdir); + + /* TODO: Support ACLs later */ + } + switch (virDomainGraphicsListenGetType(graphics, 0)) { case VIR_DOMAIN_GRAPHICS_LISTEN_TYPE_ADDRESS: listenAddr = virDomainGraphicsListenGetAddress(graphics, 0); diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 1f57f72..41ca7a3 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -266,6 +266,7 @@ static void virQEMUDriverConfigDispose(void *obj) VIR_FREE(cfg->spiceTLSx509certdir); VIR_FREE(cfg->spiceListen); VIR_FREE(cfg->spicePassword); + VIR_FREE(cfg->spiceSASLdir); VIR_FREE(cfg->hugetlbfsMount); VIR_FREE(cfg->hugepagePath); @@ -379,6 +380,8 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, GET_VALUE_BOOL("spice_tls", cfg->spiceTLS); GET_VALUE_STR("spice_tls_x509_cert_dir", cfg->spiceTLSx509certdir); + GET_VALUE_BOOL("spice_sasl", cfg->spiceSASL); + GET_VALUE_STR("spice_sasl_dir", cfg->spiceSASLdir); GET_VALUE_STR("spice_listen", cfg->spiceListen); GET_VALUE_STR("spice_password", cfg->spicePassword); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 206f2c6..cbd7053 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -111,6 +111,8 @@ struct _virQEMUDriverConfig { bool spiceTLS; char *spiceTLSx509certdir; + bool spiceSASL; + char *spiceSASLdir; char *spiceListen; char *spicePassword; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index ea770dc..1a9fb20 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -15,6 +15,8 @@ module Test_libvirtd_qemu = { "spice_tls" = "1" } { "spice_tls_x509_cert_dir" = "/etc/pki/libvirt-spice" } { "spice_password" = "XYZ12345" } +{ "spice_sasl" = "1" } +{ "spice_sasl_dir" = "/some/directory/sasl2" } { "nographics_allow_host_audio" = "1" } { "remote_display_port_min" = "5900" } { "remote_display_port_max" = "65535" } -- 1.8.3.1

2 1

[libvirt] [PATCHv5 0/5] Introduce API to query IP addresses for given domain
by Nehal J Wani 08 Sep '13

08 Sep '13

This feature has been requested for a very long time. Since qemu guest agent gives us reliable results, now the wait is over. The RFC was first proposed by Michal Privoznik: http://www.redhat.com/archives/libvir-list/2012-February/msg00437.html A patch was submitted, using structs: https://www.redhat.com/archives/libvir-list/2012-June/msg00220.html Another patch was submitted, using XML: https://www.redhat.com/archives/libvir-list/2012-June/msg00904.html Neither of the patches were accepted, probably due to lack of extensibility and usability. Hence, we thought of using virTypedParameters for reporting list of interfaces along with their MAC address and IP addresses. The RFC can be found here: https://www.redhat.com/archives/libvir-list/2013-July/msg00084.html The idea of extensibility was rejected and rendered out of scope of libvirt. Hence, we were back to structs. This API is called virDomainInterfaceAddresses which returns a dynamically allocated array of virDomainInterface struct. The great disadvantage is once this gets released, it's written in stone and we cannot change or add an item into it. The API supports two methods: * Return information (list of all associated interfaces with MAC address and IP addresses) of all of the domain interfaces by default (if no interface name is provided) * Return information for the specified interface (if an interface name is provided) v5: * s/virDomainInterfacesAddresses/virDomainInterfaceAddresses. * Case for IP aliasing handled using virHashTable. * New test cases added, involving multiple and 0 IP addresse(s) per interface. * IP prefix changed from int to unsigned int. * Changes to practice libvirt habits. v4: * Various style nits, indentation errors, memory leaks fixed. * https://www.redhat.com/archives/libvir-list/2013-August/msg01265.html v3: * Upper bounds to number of interfaces and addresses per interface introduced. * Change from array of structs to array of pointers * ifaces_count moved from function argument to return value * Changes in variable names * Test cases added for qemuAgentGetInterfaces. * https://www.redhat.com/archives/libvir-list/2013-August/msg01215.html v2: * Logical errors, memory leaks and few other errors fixed. * https://www.redhat.com/archives/libvir-list/2013-August/msg00631.html v1: * http://www.redhat.com/archives/libvir-list/2013-July/msg01553.html Nehal J Wani (5): domifaddr: Implement the public APIs domifaddr: Implement the remote protocol domifaddr: Implement the API for qemu domifaddr: Add virsh support domifaddr: Expose python binding daemon/remote.c | 131 +++++++++++++++++++++++++++ examples/python/Makefile.am | 2 +- examples/python/README | 1 + examples/python/domipaddrs.py | 50 +++++++++++ include/libvirt/libvirt.h.in | 32 +++++++ python/generator.py | 3 + python/libvirt-override-api.xml | 8 +- python/libvirt-override.c | 111 +++++++++++++++++++++++ src/driver.h | 6 ++ src/libvirt.c | 115 ++++++++++++++++++++++++ src/libvirt_public.syms | 6 ++ src/qemu/qemu_agent.c | 193 ++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_agent.h | 3 + src/qemu/qemu_driver.c | 55 ++++++++++++ src/remote/remote_driver.c | 99 +++++++++++++++++++++ src/remote/remote_protocol.x | 40 ++++++++- src/remote_protocol-structs | 24 +++++ tests/qemuagenttest.c | 149 +++++++++++++++++++++++++++++++ tools/virsh-domain-monitor.c | 119 +++++++++++++++++++++++++ tools/virsh.pod | 11 +++ 20 files changed, 1155 insertions(+), 3 deletions(-) create mode 100755 examples/python/domipaddrs.py -- 1.7.11.7

4 33

[libvirt] [PATCH 0/n] improvements to native-to-xml parsing
by Eric Blake 06 Sep '13

06 Sep '13

I tried to use 'virsh qemu-attach', and hit different failures with both libvirt.git on Fedora 19, and with an older version of libvirt on RHEL 6. I'm posting patches that I have so far to start reviews, but need to write still more patches as I still haven't succeeded at attaching. I also need to add a patch to the testsuite to cover the command line that I'm trying to attach to. Eric Blake (3): qemu: only parse basename when determining emulator properties qemu: simplify list cleanup qemu: recognize -machine accel=kvm when parsing native src/conf/domain_conf.c | 6 ++++ src/qemu/qemu_command.c | 87 +++++++++++++++++++++++++------------------------ 2 files changed, 50 insertions(+), 43 deletions(-) -- 1.8.3.1

3 19

[libvirt] [PATCH] LXC:fix typo in lxc_container.c
by Chen Hanxiao 06 Sep '13

06 Sep '13

From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> fix typo in lxc_container.c Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8abaea0..cf096f3 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1145,7 +1145,7 @@ lxcContainerMountDetectFilesystem(const char *src ATTRIBUTE_UNUSED, #endif /* ! WITH_BLKID */ /* - * This functions attempts to do automatic detection of filesystem + * This function attempts to do automatic detection of filesystem * type following the same rules as the util-linux 'mount' binary. * * The main difference is that we don't (currently) try to use @@ -1600,7 +1600,7 @@ static int lxcContainerResolveSymlinks(virDomainDefPtr vmDef) } /* - * This is running as the 'init' process insid the container. + * This is running as the 'init' process inside the container. * It removes some capabilities that could be dangerous to * host system, since they are not currently "containerized" */ @@ -1750,7 +1750,7 @@ static int lxcContainerChild(void *data) if (lxcContainerSendContinue(argv->handshakefd) < 0) { virReportSystemError(errno, "%s", - _("failed to send continue signal to controller")); + _("Failed to send continue signal to controller")); goto cleanup; } -- 1.8.2.1

2 1

[libvirt] [PATCH 0/3] caps: expose the user and group owner of the HV
by Giuseppe Scrivano 06 Sep '13

06 Sep '13

virt-manager has no way to known the user/group that run the HV process without requiring the user to manually set it trough setup.py or assuming "root" as default value. This series extends the Guest capabilities with "hv_user" and "hv_group", to inform the libvirt user about the user/group (when qemu is used) that run the HV process. Giuseppe Scrivano (3): caps: new internal function "virCapabilitiesSetHvUserAndGroup" qemu: set hv_user/hv_group caps to the user/group which runs qemu caps: add tests and documentation for hv_user and hv_group docs/schemas/capability.rng | 10 +++++++ src/conf/capabilities.c | 46 +++++++++++++++++++++++++++++++ src/conf/capabilities.h | 7 +++++ src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 3 ++ tests/capabilityschemadata/caps-test2.xml | 4 +++ 6 files changed, 71 insertions(+) -- 1.8.3.1

2 12

[libvirt] [PATCH 0/3] Keep original file label
by Michal Privoznik 06 Sep '13

06 Sep '13

This is just a resurrection of my previous patchset. As of atomicity problem, I just realized there is none. The qemuProcessHook (which is responsible for locking the files) is called prior virSecurityManagerSetAllLabel (responsible for chown()-ing). Anyway, even if there's still one and it's pre-existing, it shouldn't block this set, should it? Michal Privoznik (3): virFile: Add APIs for extended attributes handling virfile: Introduce internal API for managing ACL security_dac: Favour ACLs over chown() configure.ac | 2 + libvirt.spec.in | 1 + m4/virt-acl.m4 | 9 ++ src/Makefile.am | 4 +- src/libvirt_private.syms | 6 + src/security/security_dac.c | 297 ++++++++++++++++++++++++++++++++++++++----- src/util/virfile.c | 301 ++++++++++++++++++++++++++++++++++++++++++++ src/util/virfile.h | 28 +++++ 8 files changed, 617 insertions(+), 31 deletions(-) create mode 100644 m4/virt-acl.m4 -- 1.8.1.5

2 7

[libvirt] [PATCH] qemu: Remove unnecessary variable assignment
by Hongwei Bi 06 Sep '13

06 Sep '13

Remove unnecessary 'addrs = NULL' in qemuDomainAssignS390Addresses() and qemuDomainAssignPCIAddresses() due to the related Free function in label cleanup. --- src/qemu/qemu_command.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 643532f..3cc9c1d 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1320,7 +1320,6 @@ qemuDomainAssignS390Addresses(virDomainDefPtr def, qemuDomainCCWAddressSetFree(priv->ccwaddrs); priv->persistentAddrs = 1; priv->ccwaddrs = addrs; - addrs = NULL; } else { priv->persistentAddrs = 0; } @@ -1901,7 +1900,6 @@ qemuDomainAssignPCIAddresses(virDomainDefPtr def, qemuDomainPCIAddressSetFree(priv->pciaddrs); priv->persistentAddrs = 1; priv->pciaddrs = addrs; - addrs = NULL; } else { priv->persistentAddrs = 0; } -- 1.7.1

3 2

[libvirt] [PATCH 1/1] qemu: avoid users specifying CPU features for non-x86 plaftorm.
by Li Zhang 06 Sep '13

06 Sep '13

From: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> Currently, only X86 provides users CPU features with CPUID instruction. If users specify the features for non-x86, it should tell users to remove them. This patch is to report one error if features are specified by users for non-x86 platform. Signed-off-by: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> --- src/qemu/qemu_command.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 91ca86a..1a158e4 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -10644,6 +10644,14 @@ qemuParseCommandLineCPU(virDomainDefPtr dom, if (*feature == '\0') goto syntax; + if (dom->os.arch != VIR_ARCH_X86_64 && + dom->os.arch != VIR_ARCH_I686) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("%s platform doesn't support CPU features'"), + virArchToString(dom->os.arch)); + goto cleanup; + } + if (STREQ(feature, "kvmclock")) { bool present = (policy == VIR_CPU_FEATURE_REQUIRE); size_t j; -- 1.8.1.4

1 0

[libvirt] [PATCH] Docs: fix a typo in virt-login-shell.pod
by Alex Jia 06 Sep '13

06 Sep '13

Signed-off-by: Alex Jia <ajia(a)redhat.com> --- tools/virt-login-shell.pod | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virt-login-shell.pod b/tools/virt-login-shell.pod index e27d500..bcd7855 100644 --- a/tools/virt-login-shell.pod +++ b/tools/virt-login-shell.pod @@ -11,7 +11,7 @@ B<virt-login-shell> The B<virt-login-shell> program is a setuid shell that is used to join an LXC container that matches the user's name. If the container is not running, virt-login-shell will attempt to start the container. -virt-sandbox-shell is not allowed to be run by root. Normal users will get +virt-login-shell is not allowed to be run by root. Normal users will get added to a container that matches their username, if it exists, and they are configured in /etc/libvirt/virt-login-shell.conf. -- 1.7.1

2 2

[libvirt] [PATCH] domain_conf: Delete the USB controller check from the USB Device checklist on virDomainDeviceIsUSB
by Liuji (Jeremy) 06 Sep '13

06 Sep '13

When using "virsh attach-device" to attach a device, the virDomainDefCompatibleDevice function will check the compatibility. If the device is a USB device, but the VM don't have any USB controller, the execution of "virsh attach-device" will fails. It considers the USB controller as a USB device on virDomainDeviceIsUSB, so we can't use "virsh attach-device" to attach a USB controller for a VM which don't have any other USB controller. >From ec3257407a9c4aadcd4554dcaad00d40387cf488 Mon Sep 17 00:00:00 2001 From: Liu Ji <jeremy.liu(a)huawei.com> Date: Thu, 5 Sep 2013 09:56:42 +0800 Subject: [PATCH] domain_conf: Delete the USB controller check from the USB Device checklist on virDomainDeviceIsUSB Delete the USB controller check from the USB Device checklist on virDomainDeviceIsUSB, otherwise we can't use "virsh attach-device" to attach a USB controller for a VM which don't have any other USB controller. Signed-off-by: Liu Ji <jeremy.liu(a)huawei.com> --- src/conf/domain_conf.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e3aec69..ffb3254 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -16899,8 +16899,6 @@ virDomainDeviceIsUSB(virDomainDeviceDefPtr dev) int t = dev->type; if ((t == VIR_DOMAIN_DEVICE_DISK && dev->data.disk->bus == VIR_DOMAIN_DISK_BUS_USB) || - (t == VIR_DOMAIN_DEVICE_CONTROLLER && - dev->data.controller->type == VIR_DOMAIN_CONTROLLER_TYPE_USB) || (t == VIR_DOMAIN_DEVICE_INPUT && dev->data.input->type == VIR_DOMAIN_INPUT_BUS_USB) || (t == VIR_DOMAIN_DEVICE_HOSTDEV && -- 1.7.11.7

3 3