June 2021 - Devel - libvirt List Archives

[PATCH] qemu: Don't set NVRAM label when creating it
by Michal Privoznik 16 Jun '21

16 Jun '21

The NVRAM label is set in qemuSecuritySetAllLabel(). There's no need to set its label upfront. In fact, setting it twice creates an imbalance because it's unset only once which mangles seclabel remembering. However, plain removal of the qemuSecurityDomainSetPathLabel() undoes the fix for the original bug (when dynamic ownership is off then the NVRAM is not created with cfg->user and cfg->group but as root:root). Therefore, we have to switch to virFileOpenAs() and pass cfg->user and cfg->group and VIR_FILE_OPEN_FORCE_OWNER flag. There's no need to pass VIR_FILE_OPEN_FORCE_MODE because the file will be created with the proper mode. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1969347 Fixes: bcdaa91a27b5b2d103535270a6a287efe6cd8bfb Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_process.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index c37687f249..2b03b0ab98 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4538,16 +4538,19 @@ qemuPrepareNVRAM(virQEMUDriver *driver, goto cleanup; } - if ((dstFD = qemuDomainOpenFile(driver, vm, loader->nvram, - O_WRONLY | O_CREAT | O_EXCL, - NULL)) < 0) + if ((dstFD = virFileOpenAs(loader->nvram, + O_WRONLY | O_CREAT | O_EXCL, + S_IRUSR | S_IWUSR, + cfg->user, cfg->group, + VIR_FILE_OPEN_FORCE_OWNER)) < 0) { + virReportSystemError(-dstFD, + _("Failed to create file '%s'"), + loader->nvram); goto cleanup; + } created = true; - if (qemuSecurityDomainSetPathLabel(driver, vm, loader->nvram, false) < 0) - goto cleanup; - do { char buf[1024]; -- 2.31.1

2 1

[PATCH 0/3] Apparmor: Add profiles for hypervisor daemons
by Jim Fehlig 16 Jun '21

16 Jun '21

This series is a first attempt at creating apparmor profiles for the modular daemons. It introduces profiles for virt{lxc,qemu,xen}d, which AFAIK are the only hypervisors supported by apparmor. The profiles are copies of the libvirtd profile, with all the non hypervisor-specific rules removed. E.g. qemu related rules removed from the virtxend profile and vice versa. Likely more rules could be trimmed from the xen and lxc profiles. I'll need to investigate how the apparmor tools can help identify such rules. So far things look okay with apparmor and modular daemons. One issue I have yet to resolve is interaction between dnsmasq and libvirt_leaseshelper. Trying to start e.g. the default network results in the following apparmor denial type=AVC msg=audit(1623791662.885:655): apparmor="DENIED" operation="exec" profile="/usr/sbin/dnsmasq" name="/usr/lib/libvirt_leaseshelper" pid=8154 comm="sh" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 Perhaps some apparmor experts can make better sense of that error than me :-). It would be nice to avoid adjusting the dnsmasq profile, which is not in the libvirt project, if possible. I noticed a few more denial messages that I _think_ are unrelated to modular daemons, which also need further investigation type=AVC msg=audit(1623797296.856:593): apparmor="DENIED" operation="open" profile="virt-aa-helper" name="/etc/ssl/openssl.cnf" pid=6511 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1623797296.856:594): apparmor="DENIED" operation="open" profile="virt-aa-helper" name="/etc/libnl/classid" pid=6511 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 t type=AVC msg=audit(1623797297.732:623): apparmor="DENIED" operation="open" profile="libvirt-481c2d22-76d5-404b-a4b0-dc2069c7e19e" name="/etc/libnl/classid" pid=6539 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=107 ouid=0 Jim Fehlig (3): Apparmor: Add profile for virtqemud Apparmor: Add profile for virtlxcd Apparmor: Add profile for virtxend src/security/apparmor/libvirt-lxc | 4 +- src/security/apparmor/libvirt-qemu | 6 + src/security/apparmor/meson.build | 3 + src/security/apparmor/usr.sbin.virtlxcd.in | 89 +++++++++++++ src/security/apparmor/usr.sbin.virtqemud.in | 135 ++++++++++++++++++++ src/security/apparmor/usr.sbin.virtxend.in | 78 +++++++++++ 6 files changed, 314 insertions(+), 1 deletion(-) create mode 100644 src/security/apparmor/usr.sbin.virtlxcd.in create mode 100644 src/security/apparmor/usr.sbin.virtqemud.in create mode 100644 src/security/apparmor/usr.sbin.virtxend.in -- 2.31.1

2 7

Migration capabilities is not reset after the libvirtd service restart
by Huangzhichao 16 Jun '21

16 Jun '21

Hi Everyone, We find migration capabilities is not reset after restarting libvirtd, it would cause problem in the following scene: Version: libvirt release 7.4.0 Step 1. create a VM and query migration capabilities, mark the return content as "Cap A". Step 2. stop the source libvirtd service when executing live migration, then migration failed. Step 3. restart the source libvirtd service, then query migration capabilities, mark the return content as "Cap B". "Cap A" is different from "Cap B", because the source libvirtd service would set migration capabilities when executing live migration. We find that there is a patch may cause this problem. Link: https://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=a1dec315c9ad87a198245… When we roll back this patch, "CAP A" would be the same as "CAP B". Do you have any suggestion ? Thanks.

2 1

[libvirt PATCH 0/3] Small virtiofs fixes (virtio-fs epopee)
by Ján Tomko 16 Jun '21

16 Jun '21

Today we fix a bug: https://bugzilla.redhat.com/show_bug.cgi?id=1969232 and an issue: https://gitlab.com/libvirt/libvirt/-/issues/178 Ján Tomko (3): conf: require target for external virtiofsd docs: fix filesystem schema indentation conf: reject duplicate virtiofs tags docs/formatdomain.rst | 1 + docs/kbase/virtiofs.rst | 1 + docs/schemas/domaincommon.rng | 32 +++++++++---------- src/conf/domain_conf.c | 2 +- src/conf/domain_validate.c | 30 +++++++++++++++++ tests/qemuxml2argvdata/vhost-user-fs-sock.xml | 1 + 6 files changed, 50 insertions(+), 17 deletions(-) -- 2.31.1

2 6

[libvirt PATCH] qemu_hotplug: Report VIR_ERR_DEVICE_MISSING when device is not found
by Lee Yarwood 16 Jun '21

16 Jun '21

126db34a81bc9f9f9710408f88cceaa1e34bbbd7 had previously switched various flows over to this from VIR_ERR_OPERATION_FAILED. This change simply does the same for qemuDomainDetachPrepDisk, qemuDomainDetachPrepInput and qemuDomainDetachPrepVsock to allow management apps to centralise their error handling on just VIR_ERR_DEVICE_MISSING for missing devices during a detach. --- src/qemu/qemu_hotplug.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 0640cdd9f7..68bd92cf13 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -5322,7 +5322,7 @@ qemuDomainDetachPrepDisk(virDomainObj *vm, int idx; if ((idx = qemuFindDisk(vm->def, match->dst)) < 0) { - virReportError(VIR_ERR_OPERATION_FAILED, + virReportError(VIR_ERR_DEVICE_MISSING, _("disk %s not found"), match->dst); return -1; } @@ -5819,7 +5819,7 @@ qemuDomainDetachPrepInput(virDomainObj *vm, int idx; if ((idx = virDomainInputDefFind(vm->def, match)) < 0) { - virReportError(VIR_ERR_OPERATION_FAILED, "%s", + virReportError(VIR_ERR_DEVICE_MISSING, "%s", _("matching input device not found")); return -1; } @@ -5855,7 +5855,7 @@ qemuDomainDetachPrepVsock(virDomainObj *vm, *detach = vsock = vm->def->vsock; if (!vsock || !virDomainVsockDefEquals(match, vsock)) { - virReportError(VIR_ERR_OPERATION_FAILED, "%s", + virReportError(VIR_ERR_DEVICE_MISSING, "%s", _("matching vsock device not found")); return -1; } -- 2.31.1

2 3

[libvirt] [PATCH v2 0/5] virsh bash completion improvement
by Lin Ma 16 Jun '21

16 Jun '21

v1 -> v2: * 01-08 were merged, So remove them. * Reworked virshStorageVolKeyCompleter to avoid leaking objects. Thanks to Michal Privoznik for helping reviewing these patches. Lin Ma (5): virsh-pool: Remove static from virshStoragePoolList{Free,Collect} virsh-volume: Introduce virshStorageVolKeyCompleter virsh-volume: Add macros VIRSH_COMMON_OPT_VOL_* virsh-volume: Apply virshStorageVolKeyCompleter to vol-{name,pool} commands virsh-volume: Apply virshStorageVolNameCompleter to vol-{key,path} commands tools/virsh-completer-volume.c | 47 ++++++++++++++++++++++++++ tools/virsh-completer-volume.h | 5 +++ tools/virsh-pool.c | 10 ++---- tools/virsh-pool.h | 11 +++++++ tools/virsh-volume.c | 60 ++++++++++++++++------------------ 5 files changed, 94 insertions(+), 39 deletions(-) -- 2.26.2

2 7

[PATCH 0/3] qemu: Handle the egl-headless capability properly
by Peter Krempa 16 Jun '21

16 Jun '21

Similarly to my previous series dealing with SDL graphics, 'egl-headless' should be getting exactly the same treatment. Peter Krempa (3): qemu: capabilities: Un-retire QEMU_CAPS_EGL_HEADLESS tests: qemuxml2*: Add QEMU_CAPS_EGL_HEADLESS to fake-caps tests using egl-headless graphics qemu: capabilities: Fill SDL graphics support only when it's really supported src/qemu/qemu_capabilities.c | 8 ++++++-- src/qemu/qemu_capabilities.h | 2 +- tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.riscv32.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_3.1.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.1.0.sparc.xml | 1 + tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml | 1 + tests/qemuxml2argvtest.c | 9 ++++++--- tests/qemuxml2xmltest.c | 8 +++++--- 42 files changed, 56 insertions(+), 9 deletions(-) -- 2.31.1

2 7

[PATCH] gitlab-ci: Don't build docs in 'sanitizer' jobs
by Peter Krempa 16 Jun '21

16 Jun '21

Docs are not sanitized, thus there's no point in building them. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index b5930a0a46..3fa616261e 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -86,7 +86,7 @@ stages: before_script: - *script_variables script: - - meson build --werror -Db_lundef=false -Db_sanitize="$SANITIZER" + - meson build --werror -Ddocs=disabled -Db_lundef=false -Db_sanitize="$SANITIZER" - ninja -C build; - ninja -C build test; -- 2.31.1

2 1

[PATCH 00/22] Fix hotplug of disks with iothreads and s390 cruft cleanup
by Peter Krempa 15 Jun '21

15 Jun '21

This series consists of 3 parts: Part 1, patches 1-3: These are fixes to the virCommand->string conversion, namely two bugs: - VIR_TEST_REGENERATE_OUTPUT would produce new files with missing end newline - memleak in bhyves xml->native conversion Part 2, patches 4 - 21: Removal of 's390-virtio' machine and the corresponding addressing type. This was removed in qemu 2.6. The exploration started because the last patch was for a strange reason checking the address type and I needed to know if indeed 'virtio-s390' addresses don't support iothreads. Turns out the whole thing can be deleted. Part 3, patch 22: Hotplug of disks with iothreads is broken because the code was moved prior to address asignment and didn't account for missing address. Let's remove the whole check as it turned out to be pointless. Peter Krempa (22): util: command: Introduce virCommandToStringBuf qemuxml2arvtest: Ensure newline at the end of generated .args files bhyveConnectDomainXMLToNative: Fix memory leak in incorrect virCommandToString usage tests: qemuxml2argv: Modernize 'watchdog-diag288' test tests: qemuxml2argv: Modernize 'console-sclp' test tests: qemuxml2argv: Remove redundant tests for the obsolete 'virtio-390' machine tests: qemuxml2argv: Modernize 's390-allow-bogus-usb-none' test tests: qemuxml2xml: Modernize 's390-defaultconsole' case tests: qemuxml2argv: Modernize 's390-allow-bogus-usb-controller' test qemu: domain: Remove hack for 's390-virtio' machine tests: Remove 's390-virtio' machine caps faking qemu: capabilities: Remove probing of 'virtio-*-s390' devices qemu: capabilities: Don't probe device properties for 'virtio-*-s390' devices qemuxml2argvtest: Use other bus capability for 'non-x86_64-timer-error' case qemu: Always reject 'virtio-s390' addresses qemu: Remove last uses of QEMU_CAPS_VIRTIO_S390 qemuxml2*test: Remove QEMU_CAPS_VIRTIO_S390 flag qemu: capabilities: Retire QEMU_CAPS_VIRTIO_S390 qemu: Drop handling of devices with VIR_DOMAIN_DEVICE_ADDRESS_TYPE_VIRTIO_S390 qemuValidateDomainDeviceDefAddress: Add validation of CCW address qemuDomainCheckCCWS390AddressSupport: Remove duplicated checker qemu: validate: Don't check bus type in qemuValidateDomainDeviceDefDiskIOThreads src/bhyve/bhyve_driver.c | 4 +- src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 10 -- src/qemu/qemu_capabilities.h | 2 +- src/qemu/qemu_command.c | 10 +- src/qemu/qemu_domain.c | 44 ----- src/qemu/qemu_domain.h | 6 - src/qemu/qemu_domain_address.c | 17 +- src/qemu/qemu_domain_address.h | 3 +- src/qemu/qemu_hotplug.c | 17 +- src/qemu/qemu_validate.c | 48 ++--- src/util/vircommand.c | 50 ++++-- src/util/vircommand.h | 4 + .../caps_2.11.0.s390x.replies | 108 +++++------ .../caps_2.11.0.x86_64.replies | 152 +++++++--------- .../caps_2.12.0.aarch64.replies | 132 ++++++-------- .../caps_2.12.0.ppc64.replies | 124 ++++++------- .../caps_2.12.0.s390x.replies | 116 ++++++------ .../caps_2.12.0.x86_64.replies | 168 ++++++++---------- .../caps_3.0.0.ppc64.replies | 124 ++++++------- .../caps_3.0.0.riscv32.replies | 100 +++++------ .../caps_3.0.0.riscv64.replies | 100 +++++------ .../caps_3.0.0.s390x.replies | 120 ++++++------- .../caps_3.0.0.x86_64.replies | 168 ++++++++---------- .../caps_3.1.0.ppc64.replies | 124 ++++++------- .../caps_3.1.0.x86_64.replies | 168 ++++++++---------- .../caps_4.0.0.aarch64.replies | 136 +++++++------- .../caps_4.0.0.ppc64.replies | 132 ++++++-------- .../caps_4.0.0.riscv32.replies | 128 ++++++------- .../caps_4.0.0.riscv64.replies | 128 ++++++------- .../caps_4.0.0.s390x.replies | 120 ++++++------- .../caps_4.0.0.x86_64.replies | 168 ++++++++---------- .../caps_4.1.0.x86_64.replies | 160 ++++++++--------- .../caps_4.2.0.aarch64.replies | 144 +++++++-------- .../caps_4.2.0.ppc64.replies | 132 ++++++-------- .../caps_4.2.0.s390x.replies | 124 ++++++------- .../caps_4.2.0.x86_64.replies | 164 ++++++++--------- .../caps_5.0.0.aarch64.replies | 144 +++++++-------- .../caps_5.0.0.ppc64.replies | 140 +++++++-------- .../caps_5.0.0.riscv64.replies | 132 ++++++-------- .../caps_5.0.0.x86_64.replies | 164 ++++++++--------- .../caps_5.1.0.x86_64.replies | 164 ++++++++--------- .../caps_5.2.0.aarch64.replies | 148 +++++++-------- .../caps_5.2.0.ppc64.replies | 140 +++++++-------- .../caps_5.2.0.riscv64.replies | 132 ++++++-------- .../caps_5.2.0.s390x.replies | 124 ++++++------- .../caps_5.2.0.x86_64.replies | 164 ++++++++--------- .../caps_6.0.0.s390x.replies | 124 ++++++------- .../caps_6.0.0.x86_64.replies | 164 ++++++++--------- .../caps_6.1.0.x86_64.replies | 164 ++++++++--------- tests/qemuxml2argvdata/console-sclp.args | 28 --- .../console-sclp.s390x-latest.args | 36 ++++ tests/qemuxml2argvdata/console-sclp.xml | 2 +- .../qemuxml2argvdata/console-virtio-s390.args | 29 --- .../qemuxml2argvdata/console-virtio-s390.xml | 24 --- tests/qemuxml2argvdata/disk-virtio-s390.args | 26 --- tests/qemuxml2argvdata/disk-virtio-s390.xml | 22 --- tests/qemuxml2argvdata/net-virtio-s390.args | 26 --- tests/qemuxml2argvdata/net-virtio-s390.xml | 22 --- .../s390-allow-bogus-usb-controller.args | 31 ---- ...low-bogus-usb-controller.s390x-latest.args | 39 ++++ .../s390-allow-bogus-usb-controller.xml | 2 +- .../s390-allow-bogus-usb-none.args | 31 ---- ...390-allow-bogus-usb-none.s390x-latest.args | 39 ++++ .../s390-allow-bogus-usb-none.xml | 2 +- .../qemuxml2argvdata/s390-defaultconsole.xml | 2 +- tests/qemuxml2argvdata/watchdog-diag288.args | 28 --- .../watchdog-diag288.s390x-latest.args | 36 ++++ tests/qemuxml2argvdata/watchdog-diag288.xml | 2 +- tests/qemuxml2argvtest.c | 125 +++++-------- ...l => s390-defaultconsole.s390x-latest.xml} | 4 +- tests/qemuxml2xmltest.c | 27 +-- tests/testutilsqemu.c | 2 +- tests/vircapstest.c | 4 - 74 files changed, 2562 insertions(+), 3387 deletions(-) delete mode 100644 tests/qemuxml2argvdata/console-sclp.args create mode 100644 tests/qemuxml2argvdata/console-sclp.s390x-latest.args delete mode 100644 tests/qemuxml2argvdata/console-virtio-s390.args delete mode 100644 tests/qemuxml2argvdata/console-virtio-s390.xml delete mode 100644 tests/qemuxml2argvdata/disk-virtio-s390.args delete mode 100644 tests/qemuxml2argvdata/disk-virtio-s390.xml delete mode 100644 tests/qemuxml2argvdata/net-virtio-s390.args delete mode 100644 tests/qemuxml2argvdata/net-virtio-s390.xml delete mode 100644 tests/qemuxml2argvdata/s390-allow-bogus-usb-controller.args create mode 100644 tests/qemuxml2argvdata/s390-allow-bogus-usb-controller.s390x-latest.args delete mode 100644 tests/qemuxml2argvdata/s390-allow-bogus-usb-none.args create mode 100644 tests/qemuxml2argvdata/s390-allow-bogus-usb-none.s390x-latest.args delete mode 100644 tests/qemuxml2argvdata/watchdog-diag288.args create mode 100644 tests/qemuxml2argvdata/watchdog-diag288.s390x-latest.args rename tests/qemuxml2xmloutdata/{s390-defaultconsole.xml => s390-defaultconsole.s390x-latest.xml} (82%) -- 2.31.1

4 26

[libvirt PATCH 0/3] mdev tweaks
by Jonathon Jongsma 15 Jun '21

15 Jun '21

A few minor fixes to mdev support in the nodedev driver Jonathon Jongsma (3): nodedev: Remove useless device name from error message nodedev: Handle NULL command variable nodedev: handle mdevctl errors consistently src/node_device/node_device_driver.c | 45 ++++++++++++++-------------- 1 file changed, 23 insertions(+), 22 deletions(-) -- 2.31.1

2 6