Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts
by Felix Geyer
On 28.01.2014 15:04, Jamie Strandboge wrote:
> On 01/26/2014 03:47 PM, Felix Geyer wrote:
>> Make virt-aa-helper create rules to allow VMs access to filesystem
>> mounts from the host.
>
> Note that virt-aa-helper access to various parts of the filesystem is generally
> ok. However, can you be more specific about the problem you're trying to solve?
> Eg, is there a bug number?
virt-aa-helper doesn't create the appropriate rules to allow qemu access to
shared filesystem mounts:
http://libvirt.org/formatdomain.html#elementsFilesystems
This made it necessary to manually modify the libivrt-<UUID> profile.
There is a report about this on the Ubuntu bugtracker:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/943680
Regards,
Felix
>
>> ---
>> src/security/virt-aa-helper.c | 26 ++++++++++++++++++++------
>> 1 file changed, 20 insertions(+), 6 deletions(-)
>>
>> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
>> index b9282b4..e1f7848 100644
>> --- a/src/security/virt-aa-helper.c
>> +++ b/src/security/virt-aa-helper.c
>> @@ -578,9 +578,6 @@ valid_path(const char *path, const bool readonly)
>> return -1;
>>
>> switch (sb.st_mode & S_IFMT) {
>> - case S_IFDIR:
>> - return 1;
>> - break;
>> case S_IFSOCK:
>> return 1;
>> break;
>> @@ -747,7 +744,7 @@ get_definition(vahControl * ctl, const char *xmlStr)
>> }
>>
>> static int
>> -vah_add_file(virBufferPtr buf, const char *path, const char *perms)
>> +vah_add_path(virBufferPtr buf, const char *path, const char *perms, bool recursive)
>> {
>> char *tmp = NULL;
>> int rc = -1;
>> @@ -788,10 +785,14 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms)
>> goto cleanup;
>> }
>>
>> - virBufferAsprintf(buf, " \"%s\" %s,\n", tmp, perms);
>> + virBufferAsprintf(buf, " \"%s%s\" %s,\n", tmp, recursive ? "/**" : "", perms);
>> if (readonly) {
>> virBufferAddLit(buf, " # don't audit writes to readonly files\n");
>> - virBufferAsprintf(buf, " deny \"%s\" w,\n", tmp);
>> + virBufferAsprintf(buf, " deny \"%s%s\" w,\n", tmp, recursive ? "/**" : "");
>> + }
>> + if (recursive) {
>> + // allow reading (but not creating) the dir
>> + virBufferAsprintf(buf, " \"%s/\" r,\n", tmp);
>> }
>>
>> cleanup:
>> @@ -801,6 +802,12 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms)
>> }
>>
>> static int
>> +vah_add_file(virBufferPtr buf, const char *path, const char *perms)
>> +{
>> + return vah_add_path(buf, path, perms, false);
>> +}
>> +
>> +static int
>> vah_add_file_chardev(virBufferPtr buf,
>> const char *path,
>> const char *perms,
>> @@ -1049,6 +1056,13 @@ get_files(vahControl * ctl)
>> } /* switch */
>> }
>>
>> + for (i = 0; i < ctl->def->nfss; i++) {
>> + virDomainFSDefPtr fs = ctl->def->fss[i];
>> +
>> + if (vah_add_path(&buf, fs->src, fs->readonly ? "r" : "rw", true) != 0)
>> + goto cleanup;
>> + }
>> +
>> if (ctl->newfile)
>> if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
>> goto cleanup;
>>
10 years, 11 months
[libvirt] [PATCH 0/4] Fix virConnectBaselineCPU with expand-features flag
by Jiri Denemark
Jiri Denemark (4):
tests: Better support for VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES
cpu: Fix VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES
cpu: Try to use source CPU model in virConnectBaselineCPU
tests: Add more tests for virConnectBaselineCPU
src/cpu/cpu_x86.c | 101 +++++++++++++++++---------
tests/cputest.c | 27 ++++++-
tests/cputestdata/x86-baseline-3-expanded.xml | 35 +++++++++
tests/cputestdata/x86-baseline-3-result.xml | 34 +--------
tests/cputestdata/x86-baseline-4-expanded.xml | 46 ++++++++++++
tests/cputestdata/x86-baseline-4-result.xml | 14 ++++
tests/cputestdata/x86-baseline-4.xml | 18 +++++
tests/cputestdata/x86-baseline-5-expanded.xml | 47 ++++++++++++
tests/cputestdata/x86-baseline-5-result.xml | 10 +++
tests/cputestdata/x86-baseline-5.xml | 35 +++++++++
10 files changed, 296 insertions(+), 71 deletions(-)
create mode 100644 tests/cputestdata/x86-baseline-3-expanded.xml
create mode 100644 tests/cputestdata/x86-baseline-4-expanded.xml
create mode 100644 tests/cputestdata/x86-baseline-4-result.xml
create mode 100644 tests/cputestdata/x86-baseline-4.xml
create mode 100644 tests/cputestdata/x86-baseline-5-expanded.xml
create mode 100644 tests/cputestdata/x86-baseline-5-result.xml
create mode 100644 tests/cputestdata/x86-baseline-5.xml
--
1.8.5.3
10 years, 11 months
[libvirt] [PATCH v2 0/3] Enhance virnetdevbandwidthtest
by Michal Privoznik
Round two.
Michal Privoznik (3):
virfile: Introduce virFileAppendStr
virCommand: Introduce virCommandSetDryRun
virnetdevbandwidthtest: Introduce testVirNetDevBandwidthSet
src/libvirt_private.syms | 2 +
src/util/vircommand.c | 58 ++++++++++++++++++++++++-
src/util/vircommand.h | 2 +
src/util/virfile.c | 57 ++++++++++++++++++++----
src/util/virfile.h | 3 ++
tests/virnetdevbandwidthtest.c | 98 ++++++++++++++++++++++++++++++++++++++++++
6 files changed, 210 insertions(+), 10 deletions(-)
--
1.8.5.2
10 years, 11 months
[libvirt] [libvirt-designer][PATCH] virtxml: Adapt to latest libvirt-glib
by Michal Privoznik
With libvirt-glib update, I've noticed a deprecation warning:
libvirt-designer-domain.c: In function 'gvir_designer_domain_add_disk_full':
libvirt-designer-domain.c:1610:9: error: 'gvir_config_domain_disk_set_driver_type' is deprecated (declared at /usr/include/libvirt-gconfig-1.0/libvirt-gconfig/libvirt-gconfig-domain-disk.h:145): Use 'gvir_config_domain_disk_set_driver_format' instead [-Werror=deprecated-declarations]
gvir_config_domain_disk_set_driver_type(disk, format);
^
cc1: all warnings being treated as errors
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
configure.ac | 4 +++
libvirt-designer/libvirt-designer-domain.c | 41 ++++++++++++++++++++++++++--
libvirt-designer/libvirt-designer-internal.h | 18 ++++++++++++
3 files changed, 61 insertions(+), 2 deletions(-)
diff --git a/configure.ac b/configure.ac
index bad199b..f74e3f1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -75,6 +75,10 @@ AC_PROG_CC
AM_PROG_CC_C_O
AC_CHECK_FUNCS([strchr])
AC_CHECK_FUNCS([strrchr])
+AC_CHECK_FUNCS([strcmp])
+AC_CHECK_FUNCS([strcasecmp])
+AC_CHECK_FUNCS([strncmp])
+AC_CHECK_FUNCS([strncasecmp])
AC_CHECK_FUNCS([uname])
AC_PROG_CXX
AC_TYPE_SIZE_T
diff --git a/libvirt-designer/libvirt-designer-domain.c b/libvirt-designer/libvirt-designer-domain.c
index 848dfea..8a11894 100644
--- a/libvirt-designer/libvirt-designer-domain.c
+++ b/libvirt-designer/libvirt-designer-domain.c
@@ -1606,8 +1606,45 @@ gvir_designer_domain_add_disk_full(GVirDesignerDomain *design,
gvir_config_domain_disk_set_type(disk, type);
gvir_config_domain_disk_set_source(disk, path);
gvir_config_domain_disk_set_driver_name(disk, driver_name);
- if (format)
- gvir_config_domain_disk_set_driver_type(disk, format);
+ if (format) {
+ GVirConfigDomainDiskFormat fmt;
+
+ if (STRCASEEQ(format, "raw"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_RAW;
+ else if (STRCASEEQ(format, "dir"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_DIR;
+ else if (STRCASEEQ(format, "bochs"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_BOCHS;
+ else if (STRCASEEQ(format, "cloop"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_CLOOP;
+ else if (STRCASEEQ(format, "cow"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_COW;
+ else if (STRCASEEQ(format, "dmg"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_DMG;
+ else if (STRCASEEQ(format, "iso"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_ISO;
+ else if (STRCASEEQ(format, "qcow"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_QCOW;
+ else if (STRCASEEQ(format, "qcow2"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_QCOW2;
+ else if (STRCASEEQ(format, "qed"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_QED;
+ else if (STRCASEEQ(format, "vmdk"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_VMDK;
+ else if (STRCASEEQ(format, "vpc"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_VPC;
+ else if (STRCASEEQ(format, "fat"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_FAT;
+ else if (STRCASEEQ(format, "vhd"))
+ fmt = GVIR_CONFIG_DOMAIN_DISK_FORMAT_VHD;
+ else {
+ g_set_error(error, GVIR_DESIGNER_DOMAIN_ERROR, 0,
+ "unknown disk format %s", format);
+ goto error;
+ }
+
+ gvir_config_domain_disk_set_driver_format(disk, fmt);
+ }
controller = gvir_designer_domain_get_preferred_disk_controller(design, NULL);
if (controller == NULL)
diff --git a/libvirt-designer/libvirt-designer-internal.h b/libvirt-designer/libvirt-designer-internal.h
index e95edfc..05dcf1d 100644
--- a/libvirt-designer/libvirt-designer-internal.h
+++ b/libvirt-designer/libvirt-designer-internal.h
@@ -24,4 +24,22 @@
#ifndef __LIBVIRT_DESIGNER_INTERNAL_H__
#define __LIBVIRT_DESIGNER_INTERNAL_H__
+# include <strings.h>
+
+# define STREQ(a,b) (strcmp(a,b) == 0)
+# define STRCASEEQ(a,b) (strcasecmp(a,b) == 0)
+# define STRNEQ(a,b) (strcmp(a,b) != 0)
+# define STRCASENEQ(a,b) (strcasecmp(a,b) != 0)
+# define STREQLEN(a,b,n) (strncmp(a,b,n) == 0)
+# define STRCASEEQLEN(a,b,n) (strncasecmp(a,b,n) == 0)
+# define STRNEQLEN(a,b,n) (strncmp(a,b,n) != 0)
+# define STRCASENEQLEN(a,b,n) (strncasecmp(a,b,n) != 0)
+# define STRPREFIX(a,b) (strncmp(a,b,strlen(b)) == 0)
+# define STRSKIP(a,b) (STRPREFIX(a,b) ? (a) + strlen(b) : NULL)
+
+# define STREQ_NULLABLE(a, b) \
+ ((a) ? (b) && STREQ((a) ? (a) : "", (b) ? (b) : "") : !(b))
+# define STRNEQ_NULLABLE(a, b) \
+ ((a) ? !(b) || STRNEQ((a) ? (a) : "", (b) ? (b) : "") : !!(b))
+
#endif /* __LIBVIRT_DESIGNER_INTERNAL_H__ */
--
1.8.5.2
10 years, 11 months
[libvirt] [PATCH v2 0/2] BSD: implement nodeGetCPUStats
by Roman Bogorodskiy
Updated patch which includes virsh update to not output
unsupported CPU stat fields.
For example, Linux output:
user: 1.0%
system: 1.0%
idle: 98.0%
iowait: 0.0%
usage: 2.0%
Includes iowait, doesn't have intr.
FreeBSD output:
user: 0,8%
system: 0,9%
idle: 97,5%
intr: 0,8%
usage: 2,5%
Includes intr, doesn't have iowait.
Roman Bogorodskiy (2):
BSD: implement nodeGetCPUStats
virsh: report only filled values in 'nodecpustats'
include/libvirt/libvirt.h.in | 8 +++
src/nodeinfo.c | 104 +++++++++++++++++++++++++++++++++++++++
tools/virsh-host.c | 113 +++++++++++++++++++++++++++----------------
3 files changed, 184 insertions(+), 41 deletions(-)
--
1.8.4.3
10 years, 11 months
[libvirt] [RFC PATCHv2 0/2] Implement tiered driver loading
by Adam Walters
This patchset implements a tiered driver loading system. I split the hypervisor
drivers out into their own tier, which is loaded after the other drivers. This
has the net effect of ensuring that things like secrets, networks, etc., are
initialized and auto-started before any hypervisors, such as QEMU, LXC, etc.
This resolves the race condition currently present when starting libvirtd
while domains are running, which happens when restarting libvirtd after having
started at least one domain.
This patch will work without my config driver patchset, which is about to be
submitted, as well. Without the config driver patchset, however, RBD storage
pools using CephX authentication can not be auto-started due to a circular
dependency between the QEMU and storage drivers. This may also affect other
storage backends, but I currently only have the capacity to test with RBD and
file backed storage pools.
The reason this interferes with RBD storage pools is that currently, the
storage driver has a hard-coded connection to QEMU in order to look up secrets.
After this patchset, the QEMU driver will not be loaded until after the storage
driver has completed its initialization and auto-start routines, which causes
issues looking up secrets. Any pool type that does not use or need data from
outside of the base storage pool definition should continue to auto-start
along with no longer being affected by the current race condition. I have
verified that file-based storage pools definitely auto-start fine after this
patchset, and no longer have any issue with the current race condition.
For anyone who is not familiar with the race condition I mention above, the
basic description is that upon restarting libvirtd, any running QEMU domains
using storage volumes are killed randomly due to their associated storage pool
not yet being online. This is due to storage pool auto-start not having
completed prior to QEMU initialization. In my prior testing, I found that this
race condition affected at least one domain approximately 40% of the time. I
sent this information to the mailing list back on 06DEC2013, if anyone is
interested in going back and re-reading my description.
I would appreciate any comments and suggestions about this patchset. It works
for me on 4 machines running three different distros of Linux (Archlinux,
Gentoo, and CentOS), so I would imagine that it should work most anywhere.
Adam Walters (2):
driver: Implement new state driver field
libvirt: Implement tiered driver loading
src/check-driverimpls.pl | 1 +
src/driver.h | 7 +++++
src/interface/interface_backend_netcf.c | 1 +
src/libvirt.c | 45 ++++++++++++++++++++-------------
src/libxl/libxl_driver.c | 1 +
src/lxc/lxc_driver.c | 1 +
src/network/bridge_driver.c | 1 +
src/node_device/node_device_hal.c | 1 +
src/node_device/node_device_udev.c | 1 +
src/nwfilter/nwfilter_driver.c | 1 +
src/qemu/qemu_driver.c | 1 +
src/remote/remote_driver.c | 1 +
src/secret/secret_driver.c | 1 +
src/storage/storage_driver.c | 1 +
src/uml/uml_driver.c | 1 +
src/xen/xen_driver.c | 1 +
16 files changed, 48 insertions(+), 18 deletions(-)
--
1.8.5.2
10 years, 11 months
[libvirt] fix/re-do query-command-line-options
by Amos Kong
Hi QEMU/Libvirt list,
When I worked on query-command-line-options, I first used some marcos [1] to
generate two config & option tables. This will cover all the options,
but it returns a string, it's difficult for libvirt to parse and use
it.
Finally I got a suggestion to read info from new interface (QemuOpts),
We add opts info to vm_config_groups[], query-command-line-options
will visit the array. It doesn't conver all the options, but the
latest options are covered, so this implementation is acceptable.
Problem:
* QemuOpts was designed just for options with parameter, some new option
without parameters is lost in query output (eg: -enable-fips)
* block drive uses three QemuOpts, it's legacy issue.
* QemuOpts of some options aren't updated, it might be difficult to
updated when we add some new parameters
* other
We discussed to reimplement this command, but it seems DEF maroc is the
only point to cover all the options, all the options are described in
qemu-options.hx
I'm considering to reuse the DEF marocs to generate a table, try to
return the crude info if QemuOpts doesn't cover it.
Or maintain a split array (like vm_config_groups[]), it only contains
the option without parameter (option name & help info).
If you touched some problem of the query-command-line-options, welcome
to reply it, I will try to satisfy your requests.
Thanks, Amos
[1] http://www.redhat.com/archives/libvir-list/2013-January/msg01656.html
|#elif defined(QEMU_OPTIONS_GENERATE_CONFIG)
|
|#define DEF(option, opt_arg, opt_enum, opt_help, arch_mask) \
| opt_help,
|
|#define DEFHEADING(text)
|#define ARCHHEADING(text, arch_mask)
|
|#elif defined(QEMU_OPTIONS_GENERATE_NAME)
|
|#define DEF(option, opt_arg, opt_enum, opt_help, arch_mask) \
| option,
|
|#define DEFHEADING(text)
|#define ARCHHEADING(text, arch_mask)
char const *optionstr[] = {
#define QEMU_OPTIONS_GENERATE_NAME
#include "qemu-options-wrapper.h"
};
char const *configstr[] = {
#define QEMU_OPTIONS_GENERATE_CONFIG
#include "qemu-options-wrapper.h"
};
--
Amos.
10 years, 11 months
[libvirt] [PATCHv3 0/4] Add a test for linuxNodeGetCPUStats
by Ján Tomko
v1: https://www.redhat.com/archives/libvir-list/2014-January/msg00951.html
v2: https://www.redhat.com/archives/libvir-list/2014-January/msg00992.html
use ticks instead of nsecs in test data
v3:
use nodeinfopriv.h instead of disgusting extern declarations
touch up the impossible error message
Ján Tomko (4):
Move test-local declarations to nodeinfopriv.h
Add test for linuxNodeGetCPUStats
Simplify linuxNodeGetCPUStats
Reword error message for oversized cpu time fields
src/Makefile.am | 2 +-
src/libvirt_linux.syms | 1 +
src/nodeinfo.c | 87 ++++++----------
src/nodeinfopriv.h | 38 +++++++
tests/nodeinfodata/linux-cpustat-24cpu.out | 150 ++++++++++++++++++++++++++++
tests/nodeinfodata/linux-cpustat-24cpu.stat | 25 +++++
tests/nodeinfotest.c | 130 +++++++++++++++++++++++-
7 files changed, 373 insertions(+), 60 deletions(-)
create mode 100644 src/nodeinfopriv.h
create mode 100644 tests/nodeinfodata/linux-cpustat-24cpu.out
create mode 100644 tests/nodeinfodata/linux-cpustat-24cpu.stat
--
1.8.3.2
10 years, 11 months
Re: [libvirt] [PATCH 0/2] support compression with dumping guest memory
by Qiao Nuohan
Hello,
Do you have some comments on this?
On 01/21/2014 05:43 PM, qiaonuohan wrote:
> --memory-only option is introduced without compression supported. Therefore,
> this is a freature regression of virsh dump. This patchset is used to add
> compression support in libvirt side and please refer the following address to
> see the qemu side, the lastest version of qemu side v7(ready for comment now).
>
> http://lists.gnu.org/archive/html/qemu-devel/2014-01/msg02139.html
>
> qiaonuohan (2):
> support compression when --memory-only option is specified
> support configuring the format of dumping memory in qemu.conf
>
> include/libvirt/libvirt.h.in | 18 +++++++++----
> src/libvirt.c | 15 +++++++++++
> src/qemu/libvirtd_qemu.aug | 1 +
> src/qemu/qemu.conf | 6 +++++
> src/qemu/qemu_conf.c | 2 ++
> src/qemu/qemu_conf.h | 1 +
> src/qemu/qemu_driver.c | 52 +++++++++++++++++++++++++++++++++++---
> src/qemu/qemu_monitor.c | 6 ++---
> src/qemu/qemu_monitor.h | 3 ++-
> src/qemu/qemu_monitor_json.c | 4 ++-
> src/qemu/qemu_monitor_json.h | 3 ++-
> src/qemu/test_libvirtd_qemu.aug.in | 1 +
> tests/qemumonitorjsontest.c | 2 +-
> tools/virsh-domain.c | 29 +++++++++++++++++++++
> 14 files changed, 127 insertions(+), 16 deletions(-)
>
--
Regards
Qiao Nuohan
10 years, 11 months
