October 2026 - Devel - libvirt List Archives

[RFC] logrotate: add policy for virtqemud.log
by partha.satapathy＠oracle.com 14 Oct '26

14 Oct '26

# Enable full debug logging for monolithic libvirtd # tail /etc/libvirt/libvirtd.conf log_level = 1 log_filters="1:*" log_outputs="1:file:/var/log/libvirt/libvirtd.log" # Enable full debug logging for modular QEMU daemon # tail /etc/libvirt/virtqemud.conf log_level = 1 log_filters="1:*" log_outputs="1:file:/var/log/libvirt/virtqemud.log" # Restart only the daemon architecture currently in use systemctl restart libvirtd.service # monolithic mode # OR systemctl restart virtqemud.service # modular mode In general, use either: libvirtd.service for monolithic mode, or virtqemud plus the appropriate modular supporting daemons for modular mode. /var/log/libvirt/ ├── libvirtd.log # host-wide monolithic daemon log ├── virtqemud.log # host-wide modular QEMU daemon log └── qemu/ ├── vm1.log # VM-specific QEMU process log ├── vm2.log └── ... /var/log/libvirt stores host-level libvirt daemon logs, such as libvirtd.log for monolithic mode or virtqemud.log for modular QEMU mode. The /var/log/libvirt/qemu directory stores VM-specific QEMU logs. Therefore, placing virtqemud.log under /var/log/libvirt is appropriate. The existing logrotate configuration includes /var/log/libvirt/libvirtd.log through /etc/logrotate.d/libvirtd, and all VM-specific log files matching /var/log/libvirt/qemu/*.log through /etc/logrotate.d/libvirtd.qemu. It does not currently include /var/log/libvirt/virtqemud.log; therefore, a separate logrotate rule must be added for virtqemud.log if that log is enabled. We should either place virtqemud.log under /var/log/libvirt/qemu/, which is not appropriate because that directory is intended for VM-specific logs. The virtqemud.log rotation rule can be added to /etc/logrotate.d/libvirtd.qemu, or or define a dedicated logrotate rule in a separate file such as /etc/logrotate.d/virtqemud. Example rule: /var/log/libvirt/virtqemud.log { weekly missingok rotate 4 compress delaycompress copytruncate minsize 100k } This would provide the same log-management behavior for modular virtqemud file logging, that is already available for monolithic libvirtd logging.

2 3

[PATCH 0/5] security: Check if R/O or shared disk is not directory
by Michal Privoznik 14 Oct '26

14 Oct '26

*** BLURB HERE *** Michal Prívozník (5): qemusecuritytest: Introduce new test case security: Check if R/O or shared disk is not directory qemusecuritytest: Add machinery for negative test cases qemusecuritymock: Allow pretending some paths are directories qemusecuritytest: Introduce a test case for cdrom with directory src/security/security_dac.c | 37 +++++++++++++++++++++++++++++++ src/security/security_selinux.c | 37 +++++++++++++++++++++++++++++++ tests/qemusecuritymock.c | 7 +++++- tests/qemusecuritytest.c | 39 +++++++++++++++++++++++++++++---- tests/qemusecuritytest.h | 3 +++ 5 files changed, 118 insertions(+), 5 deletions(-) -- 2.56.0

2 6

[PATCH v3] replace rbd option auth_supported with auth_*_required
by Janis Heims 14 Oct '26

14 Oct '26

As stated in Yusuke Fujimaki's patch, Ceph recently removed the deprecated auth_supported option that is still used by libvirt, causing errors when attempting to start a storage pool on a newer Ceph server: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/RELD… https://github.com/ceph/ceph/commit/350cc71d7d9e9cd6239d24080082de7ac9bf8b70 This patch addresses the issue by replacing the deprecated option with auth_client_required. While all three replacement options (auth_cluster_required, auth_service_required and auth_client_required) were previously set by Ceph, it really only makes sense to keep the last in libvirt as the other options are only relevant on the server side. See the discussion here: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3TVM… Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/918 Signed-off-by: Janis Heims <janis.heims(a)undertheprinter.com> --- Changes since v2: - Fixed corrupt patch Changes since v1: - Removed auth_cluster_required and auth_service_required src/libxl/libxl_conf.c | 7 +++---- src/libxl/xen_xl.c | 2 +- src/storage/storage_backend_rbd.c | 5 +++-- tests/xlconfigdata/test-rbd-multihost-noauth.cfg | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 3bb5c1e591..9050caf400 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1087,11 +1087,10 @@ libxlMakeNetworkDiskSrcStr(virStorageSource *src, if (username) { virBufferEscape(&buf, '\\', ":", ":id=%s", username); - virBufferEscape(&buf, '\\', ":", - ":key=%s:auth_supported=cephx\\;none", - secret); + virBufferEscape(&buf, '\\', ":", ":key=%s", secret); + virBufferAddLit(&buf, ":auth_client_required=cephx\\;none"); } else { - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); } if (src->nhosts > 0) { diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index d05972af5b..5a31fc6939 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -1478,7 +1478,7 @@ xenFormatXLDiskSrcNet(virStorageSource *src) virBufferStrcat(&buf, "rbd:", src->path, NULL); - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); if (src->nhosts > 0) { virBufferAddLit(&buf, ":mon_host="); diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index 25cad4a28d..9832a99264 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -241,7 +241,7 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, goto cleanup; if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "cephx") < 0) + "auth_client_required", "cephx") < 0) goto cleanup; } else { VIR_DEBUG("Not using cephx authorization"); @@ -250,8 +250,9 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, _("failed to create the RADOS cluster")); goto cleanup; } + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "none") < 0) + "auth_client_required", "none") < 0) goto cleanup; } diff --git a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg index 5906865047..8ff1878885 100644 --- a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg +++ b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg @@ -22,4 +22,4 @@ parallel = "none" serial = "none" builder = "hvm" boot = "d" -disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_supported=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] +disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_client_required=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] base-commit: 215fab8ab1d912f6b25e60ab4d2ad59000f2eaff -- 2.54.0

2 1

Restricting what an authenticated remote client can do - access control for TLS/SASL identities?
by Pierre-Samuel LE STANG 14 Oct '26

14 Oct '26

Hello, I am running libvirt on a fleet of hosts which live-migrate guests between each other in peer-to-peer mode, over TLS with client certificates. With peer-to-peer migration, each host must accept incoming libvirt connections from all its peers. Today, once a remote client is authenticated (trusted x509 certificate and/or SASL), it can use the full API. I would like to restrict what a given remote peer is allowed to do, ideally to "receive an incoming migration" only. If I understand correctly, the access control framework cannot be used for remote clients today: - the only shipped access drivers are "none" and "polkit"; - the polkit driver identifies the caller by its local process ID/UID, which is only available for clients connected to the UNIX domain socket, so checks cannot succeed for remote connections; - the documentation [1] still says that the SASL / Kerberos username and/or x509 distinguished name obtained from the authentication provider should be used "in future versions". This wording dates back to the original access control work in 2013, where support for remote identities was listed as future work, and it does not seem to have changed since. So I have a few simple questions: * Is this still on your roadmap, or is somebody working on it? * Was it discussed after 2013? If there is a reason it was not done, I would be happy to understand it. * We can spend time to write and test patches in this area. If you had to do it, which direction would you take? Is there a design you would prefer, or something you would not accept upstream? We would be happy to discuss and agree on a design before starting. [1] https://libvirt.org/aclpolkit.html - "User identity attributes" Thanks, -- Pierre-Samuel Le Stang

1 0

[PATCH v2] replace rbd option auth_supported with auth_*_required
by Janis Heims 13 Oct '26

13 Oct '26

As stated in Yusuke Fujimaki's patch, Ceph recently removed the deprecated auth_supported option that is still used by libvirt, causing errors when attempting to start a storage pool on a newer Ceph server: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/RELD… https://github.com/ceph/ceph/commit/350cc71d7d9e9cd6239d24080082de7ac9bf8b70 This patch addresses the issue by replacing the deprecated option with auth_client_required. While all three replacement options (auth_cluster_required, auth_service_required and auth_client_required) were previously set by Ceph, it really only makes sense to keep the last in libvirt as the other options are only relevant on the server side. See the discussion here: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3TVM… Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/918 Signed-off-by: Janis Heims <janis.heims(a)undertheprinter.com> --- Changes since v1: - Removed auth_cluster_required and auth_service_required src/libxl/libxl_conf.c | 7 +++---- src/libxl/xen_xl.c | 2 +- src/storage/storage_backend_rbd.c | 6 ++++-- tests/xlconfigdata/test-rbd-multihost-noauth.cfg | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 3bb5c1e591..9050caf400 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1087,11 +1087,10 @@ libxlMakeNetworkDiskSrcStr(virStorageSource *src, if (username) { virBufferEscape(&buf, '\\', ":", ":id=%s", username); - virBufferEscape(&buf, '\\', ":", - ":key=%s:auth_supported=cephx\\;none", - secret); + virBufferEscape(&buf, '\\', ":", ":key=%s", secret); + virBufferAddLit(&buf, ":auth_client_required=cephx\\;none"); } else { - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); } if (src->nhosts > 0) { diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index d05972af5b..5a31fc6939 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -1478,7 +1478,7 @@ xenFormatXLDiskSrcNet(virStorageSource *src) virBufferStrcat(&buf, "rbd:", src->path, NULL); - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); if (src->nhosts > 0) { virBufferAddLit(&buf, ":mon_host="); diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index 25cad4a28d..64ea11a7f5 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -241,17 +241,19 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, goto cleanup; if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "cephx") < 0) + "auth_client_required", "cephx") < 0) goto cleanup; } else { VIR_DEBUG("Not using cephx authorization"); if (rados_create(&ptr->cluster, NULL) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to create the RADOS cluster")); goto cleanup; } + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "none") < 0) + "auth_client_required", "none") < 0) goto cleanup; } diff --git a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg index 5906865047..8ff1878885 100644 --- a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg +++ b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg @@ -22,4 +22,4 @@ parallel = "none" serial = "none" builder = "hvm" boot = "d" -disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_supported=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] +disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_client_required=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] base-commit: 215fab8ab1d912f6b25e60ab4d2ad59000f2eaff -- 2.54.0

1 0

[PATCH] docs: be more specific about when <ip> can be used in <interface>
by Laine Stump 13 Oct '26

13 Oct '26

A user commented that the documentation was rather vague about when an <ip> address specified in a domain <interface> can be used and when it can't. This extra verbiage attempts to clarify that. Signed-off-by: Laine Stump <laine(a)redhat.com> --- I'm undecided if this is too verbose to be in formatdomain.html, but once I started typing (after reading this message https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/DZWK… ) I decided to finish it and send; if it seems inappropriate there then maybe it can be put somewhere else. Also, I *think* I have the information correct for non QEMU/LXC drivers, but it's based solely on a quick examination of the code (looking for references to "guestIP"). docs/formatdomain.rst | 59 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 48 insertions(+), 11 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index e4eb2d9ba3..2e314b159e 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -6747,17 +6747,54 @@ IP configuration </devices> ... -:since:`Since 1.2.12` network devices and hostdev devices with network -capabilities can optionally be provided one or more IP addresses to set on the -network device in the guest. Note that some hypervisors or network device types -will simply ignore them or only use the first one. The ``family`` attribute can -be set to either ``ipv4`` or ``ipv6``, and the ``address`` attribute contains -the IP address. The optional ``prefix`` is the number of 1 bits in the netmask, -and will be automatically set if not specified - for IPv4 the default prefix is -determined according to the network "class" (A, B, or C - see RFC870), and for -IPv6 the default prefix is 64. The optional ``peer`` attribute holds the IP -address of the other end of a point-to-point network device -:since:`(since 2.1.0)`. +:since:`Since 1.2.12` in some specific instances, network devices and +hostdev devices with network capabilities can optionally be provided +one or more IP addresses to set on the network device in the guest +using the <ip> subelement. Within <ip>, the ``family`` attribute can +be set to either ``ipv4`` or ``ipv6``, and the ``address`` attribute +contains the IP address. The optional ``prefix`` is the number of 1 +bits in the netmask, and will be automatically set if not specified - +for IPv4 the default prefix is determined according to the network +"class" (A, B, or C - see RFC870), and for IPv6 the default prefix +is 64. The optional ``peer`` attribute holds the IP address of the +other end of a point-to-point network device :since:`(since 2.1.0)`. + +As mentioned above, only certain types of interfaces on certain +hypervisors can use the <ip> element. In particular: + +* lxc driver - <interface> or <hostdev mode='capabilities' type='net'> + can have one or more IP addresses specified for each interface, and + this will be directly set on the interface inside the container by + libvirt. + +* QEMU driver - <interface type='user'> and <interface + type='vhostuser'> (the latter only when <backend type='passt'>) can + have a single IPv4 address specified (and for passt-backed + interfaces also a single IPv6 address). In these cases, libvirt will + setup the internal DHCP server of slirp or passt to provide the IP + addresses - the guest OS must have the interface config setup to use + DHCP or the settings in libvirt will be ignored. + +* VirtualBox driver - for <interface type='bridge'> a single IP + address can be set. + +* Cloud Hypervisor driver - for <interface type='ethernet'> a + single IP address can be set. + +* openvz driver - <interface type='ethernet'> can have multiple + IP addresses specified. + +* Xen driver - <interface type='bridge|ethernet'> can have multiple IP + addresses set. + +In all other cases, IP addresses in the libvirt domain interface +config will either be ignored, or generate an error. Aside from this, +for guests connected via libvirt's own bridge-based virtual networks, +it is also possible to set IP addresses with static <host> entries in +the `virtual network's config <formatnetwork.html#addressing>`__. If +none of the above applies to your guest, IP address configuration must +be done outside of libvirt, either by changing the relevant DHCP +server config, or changing the guest OS network config directly. :since:`Since 1.2.12` route elements can also be added to define IP routes to add in the guest. The attributes of this element are -- 2.56.0

2 1

[libvirt PATCH] util: bitmap: fix typo
by Ján Tomko 13 Oct '26

13 Oct '26

From: Ján Tomko <jtomko(a)redhat.com> Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as trivial. src/util/virbitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virbitmap.c b/src/util/virbitmap.c index b9b737a087..587b3d13fc 100644 --- a/src/util/virbitmap.c +++ b/src/util/virbitmap.c @@ -562,7 +562,7 @@ virBitmapParseUnlimited(const char *str) * empty (or contains just spaces) an empty bitmap is returned instead of an * error. * - * Returns @bitmap on success, or NULL in cas of error + * Returns @bitmap on success, or NULL in case of error */ virBitmap * virBitmapParseUnlimitedAllowEmpty(const char *str) -- 2.56.0

1 0

[PATCH] qemu_driver: fix potential null pointer dereference in qemuConnectCPUModelBaseline()
by Elizaveta Tereshkina 13 Oct '26

13 Oct '26

qemuMonitorGetCPUModelExpansion() may return 0 without assigning a value to model_info if QEMU returns a GenericError. Passing NULL to qemuConnectStealCPUModelFromInfo() can lead to the NULL pointer dereference. Check the result before stealing the CPU model to avoid this. Fixes: aa797c6625 (qemu_driver: expand cpu features after baseline) Signed-off-by: Elizaveta Tereshkina <teryoshkina.ea(a)gmail.com> --- src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ebf19d7c0f..5922065897 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -12382,7 +12382,7 @@ qemuConnectCPUModelBaseline(virQEMUCaps *qemuCaps, false, false, &result) < 0) return NULL; - if (qemuConnectStealCPUModelFromInfo(baseline, &result) < 0) + if (result && qemuConnectStealCPUModelFromInfo(baseline, &result) < 0) return NULL; } -- 2.43.0

3 4

[PATCH] replace rbd option auth_supported with auth_*_required
by Janis Heims 13 Oct '26

13 Oct '26

As stated in Yusuke Fujimaki's patch, Ceph recently removed the deprecated auth_supported option that is still used by libvirt, causing errors when attempting to start a storage pool on a newer Ceph server: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/RELD… https://github.com/ceph/ceph/commit/350cc71d7d9e9cd6239d24080082de7ac9bf8b70 This patch addresses the issue by replacing the deprecated option with all three new options (auth_cluster_required, auth_service_required and auth_client_required), as was previously done in Ceph. Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/918 Signed-off-by: Janis Heims <janis.heims(a)undertheprinter.com> --- src/libxl/libxl_conf.c | 11 ++++++---- src/libxl/xen_xl.c | 4 +++- src/storage/storage_backend_rbd.c | 22 +++++++++++++++++-- .../test-rbd-multihost-noauth.cfg | 2 +- 4 files changed, 31 insertions(+), 8 deletions(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 3bb5c1e591..49f968a857 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1087,11 +1087,14 @@ libxlMakeNetworkDiskSrcStr(virStorageSource *src, if (username) { virBufferEscape(&buf, '\\', ":", ":id=%s", username); - virBufferEscape(&buf, '\\', ":", - ":key=%s:auth_supported=cephx\\;none", - secret); + virBufferEscape(&buf, '\\', ":", ":key=%s", secret); + virBufferAddLit(&buf, ":auth_cluster_required=cephx"); + virBufferAddLit(&buf, ":auth_service_required=cephx"); + virBufferAddLit(&buf, ":auth_client_required=cephx\\;none"); } else { - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_cluster_required=none"); + virBufferAddLit(&buf, ":auth_service_required=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); } if (src->nhosts > 0) { diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index d05972af5b..c1ddc7c071 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -1478,7 +1478,9 @@ xenFormatXLDiskSrcNet(virStorageSource *src) virBufferStrcat(&buf, "rbd:", src->path, NULL); - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_cluster_required=none"); + virBufferAddLit(&buf, ":auth_service_required=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); if (src->nhosts > 0) { virBufferAddLit(&buf, ":mon_host="); diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index 25cad4a28d..33e644d981 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -241,17 +241,35 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, goto cleanup; if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "cephx") < 0) + "auth_cluster_required", "cephx") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_service_required", "cephx") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_client_required", "cephx") < 0) goto cleanup; } else { VIR_DEBUG("Not using cephx authorization"); + if (rados_create(&ptr->cluster, NULL) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to create the RADOS cluster")); goto cleanup; } + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "none") < 0) + "auth_cluster_required", "none") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_service_required", "none") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_client_required", "none") < 0) goto cleanup; } diff --git a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg index 5906865047..b149be077c 100644 --- a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg +++ b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg @@ -22,4 +22,4 @@ parallel = "none" serial = "none" builder = "hvm" boot = "d" -disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_supported=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] +disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_cluster_required=none:auth_service_required=none:auth_client_required=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] base-commit: 215fab8ab1d912f6b25e60ab4d2ad59000f2eaff -- 2.54.0

2 3

Why can MAC and VLAN be set on <interface type='hostdev'>, but not an IP address?
by sst11336677＠gmail.com 12 Oct '26

12 Oct '26

Hi, I am using <interface type='hostdev'> to assign SR-IOV VFs to QEMU/KVM guests. libvirt lets me set the MAC address and the VLAN tag on that element, but there is no way to set an IP address. I would like to know which of these is the case: (a) libvirt cannot set it. The guest's IP address lives in the guest's own network stack, and with VFIO the host is not in the data path, so there is nothing host-side that could apply it. (b) libvirt could set it, but it has simply never been implemented. I believe the answer is (a), because the <ip> element was added to <hostdev mode='capabilities' type='net'> only for the LXC case, where the host owns the container's network namespace: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/6OH… But I would like that confirmed rather than inferred. If it is (a), would you consider saying so in the documentation? The hostdev interface section of formatdomain does not mention IP addresses at all, so there is nothing telling a reader that this is out of scope by design, or pointing them at the alternatives (a DHCP reservation keyed to the MAC that libvirt already sets, cloud-init, or the guest agent). Thanks,

2 1