- Devel - libvirt List Archives

[PATCH v2 0/3] bhyve: implement virDomainSetLifecycleAction() API
by Roman Bogorodskiy 04 Sep '26

04 Sep '26

Changes since v1: Main changes are in the patch 2/3. The original series added lifecycle action handling to bhyve_monitor.c, but bhyve_driver.c still had the code to e.g. issue a shutdown command on reboot right away when onReboot was set to destroy, bypassing monitor. It does not play well together, and also it's confusing. In v2 monitor is the only place to handle lifecycle settings. Roman Bogorodskiy (3): bhyve: add validation for lifecycle actions bhyve: monitor: respect on_poweroff / on_reboot settings bhyve: implement virDomainSetLifecycleAction() API src/bhyve/bhyve_domain.c | 36 +++++++++++ src/bhyve/bhyve_domain.h | 3 + src/bhyve/bhyve_driver.c | 122 ++++++++++++++++++++++++++++++++++---- src/bhyve/bhyve_monitor.c | 20 +++++-- 4 files changed, 165 insertions(+), 16 deletions(-) -- 2.55.0

2 4

[PULL 00/13] Misc fixes patches
by Daniel P. Berrangé 04 Sep '26

04 Sep '26

The following changes since commit 99e54ab5e7a6efc945af6d5661842155d1f3fc7a: Merge tag 'hw-misc-20260903' of https://github.com/philmd/qemu into staging (2026-09-03 16:43:24 +0100) are available in the Git repository at: https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request for you to fetch changes up to a61ee2ff816bc2804f773cbcff45a6cd8d83330d: docs/system/security: exclude uninitialized stack variables as bugs (2026-09-04 11:17:00 +0100) ---------------------------------------------------------------- Merge crypto, I/O and misc fixes * Deprecated the AF_ALG crypto backend * Improve checkpatch output in CI jobs * Fix --disable-containers arg handling in configure * Document security policy for uninitialized stack variables * Fix multiple denial of service flaws in websockets * Fix error handling in some x509 APIs ---------------------------------------------------------------- Daniel P. Berrangé (4): crypto: deprecate the AF_ALG crypto backend gitlab: use --emacs --quiet for checkpatch.pl instead of --terse configure: correctly honour --disable-containers docs/system/security: exclude uninitialized stack variables as bugs Denis V. Lunev (6): io/channel-socket: do not treat a zero length write as an error io/channel-websock: send an HTTP 400 when the greeting has no space io/channel-websock: handle a blocked write during the handshake tests/unit: add websock handshake test io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading tests/unit: cover blocked IO during the websock handshake Evgeny Kolmakov (1): crypto: Use g_autofree Marc-André Lureau (2): crypto/x509-utils: don't double set errp crypto/x509-utils: propagate the error .gitlab-ci.d/check-patch.py | 6 +- configure | 1 + crypto/block.c | 17 +- crypto/hmac-gcrypt.c | 12 +- crypto/hmac-glib.c | 10 +- crypto/ivgen-essiv.c | 15 +- crypto/ivgen.c | 6 +- crypto/secret_keyring.c | 5 +- crypto/x509-utils.c | 4 +- docs/about/deprecated.rst | 21 +++ docs/system/security.rst | 10 ++ io/channel-socket.c | 2 +- io/channel-websock.c | 10 +- meson.build | 6 + tests/unit/meson.build | 1 + tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++ 16 files changed, 327 insertions(+), 48 deletions(-) create mode 100644 tests/unit/test-io-channel-websock.c -- 2.55.0

1 14

[PATCH v9 0/4] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 03 Sep '26

03 Sep '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The third patch introduces unit testing of the new nftables driver. Finally the last patch introduces a new element to the nwfilterbinding XML which is used to detect and run a cleanup on the old firewall rules defined via the previous used nwfilter firewall backend. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM interface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in separate tables "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM interface is filtered in the -output chain(s). - Ethernet table has support for subchains where the inet table puts everything in one chain. This is for compatibility reasons with how nwfilter ebiptables behaved, so that users may switch to nftables and expect the same firewalling behavior. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v9: - Fix regression introduced in v8 where we recreate an already created firewall rule in the root sub chain and lower priority firewall rules on the root chain. Changes in v8: - Fix incompatibility issue with ebiptables driver for inet rules Inet rules in nftables are now placed on the root chains following iptables logic inside the ebiptables driver. Introducing subchains for inet caused sorting problems, subchains can accept or drop a packet which on the ebiptables driver inet rules would have been filtered out by rules that were sorted differently. Changes in v7: - Add backend XML element to virnwfilterbinding, to support switching from nwfilter firewall backend Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb's suggestion to separate arguments - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeas files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of separating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (4): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver nwfilter: add used firewall backend to nwfilterbinding libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/schemas/nwfilterbinding.rng | 7 + src/conf/virnwfilterbindingdef.c | 17 +- src/conf/virnwfilterbindingdef.h | 1 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 67 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 144 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2877 ++++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ .../filter-vars.xml | 1 + .../simple-backend.xml | 10 + tests/virnwfilterbindingxml2xmltest.c | 1 + 64 files changed, 18858 insertions(+), 119 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c create mode 100644 tests/virnwfilterbindingxml2xmldata/simple-backend.xml -- 2.53.0

2 7

[PATCH] ci: refresh with 'lcitool manifest'
by Daniel P. Berrangé 03 Sep '26

03 Sep '26

From: Daniel P. Berrangé <berrange(a)redhat.com> This fixes the selinux package name on Debian/Ubuntu distros Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- ci/buildenv/debian-13-cross-aarch64.sh | 2 +- ci/buildenv/debian-13-cross-armv6l.sh | 2 +- ci/buildenv/debian-13-cross-armv7l.sh | 2 +- ci/buildenv/debian-13-cross-i686.sh | 2 +- ci/buildenv/debian-13-cross-ppc64le.sh | 2 +- ci/buildenv/debian-13-cross-riscv64.sh | 2 +- ci/buildenv/debian-13-cross-s390x.sh | 2 +- ci/buildenv/debian-13.sh | 2 +- ci/buildenv/debian-sid-cross-aarch64.sh | 2 +- ci/buildenv/debian-sid-cross-armv6l.sh | 2 +- ci/buildenv/debian-sid-cross-armv7l.sh | 2 +- ci/buildenv/debian-sid-cross-i686.sh | 2 +- ci/buildenv/debian-sid-cross-ppc64le.sh | 2 +- ci/buildenv/debian-sid-cross-riscv64.sh | 2 +- ci/buildenv/debian-sid-cross-s390x.sh | 2 +- ci/buildenv/debian-sid.sh | 2 +- ci/buildenv/ubuntu-2404.sh | 2 +- ci/buildenv/ubuntu-2604.sh | 2 +- ci/containers/debian-13-cross-aarch64.Dockerfile | 2 +- ci/containers/debian-13-cross-armv6l.Dockerfile | 2 +- ci/containers/debian-13-cross-armv7l.Dockerfile | 2 +- ci/containers/debian-13-cross-i686.Dockerfile | 2 +- ci/containers/debian-13-cross-ppc64le.Dockerfile | 2 +- ci/containers/debian-13-cross-riscv64.Dockerfile | 2 +- ci/containers/debian-13-cross-s390x.Dockerfile | 2 +- ci/containers/debian-13.Dockerfile | 2 +- ci/containers/debian-sid-cross-aarch64.Dockerfile | 2 +- ci/containers/debian-sid-cross-armv6l.Dockerfile | 2 +- ci/containers/debian-sid-cross-armv7l.Dockerfile | 2 +- ci/containers/debian-sid-cross-i686.Dockerfile | 2 +- ci/containers/debian-sid-cross-ppc64le.Dockerfile | 2 +- ci/containers/debian-sid-cross-riscv64.Dockerfile | 2 +- ci/containers/debian-sid-cross-s390x.Dockerfile | 2 +- ci/containers/debian-sid.Dockerfile | 2 +- ci/containers/ubuntu-2404.Dockerfile | 2 +- ci/containers/ubuntu-2604.Dockerfile | 2 +- 36 files changed, 36 insertions(+), 36 deletions(-) diff --git a/ci/buildenv/debian-13-cross-aarch64.sh b/ci/buildenv/debian-13-cross-aarch64.sh index 31486c93fc..39cbe16569 100644 --- a/ci/buildenv/debian-13-cross-aarch64.sh +++ b/ci/buildenv/debian-13-cross-aarch64.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:arm64 \ libsanlock-dev:arm64 \ libsasl2-dev:arm64 \ - libselinux1-dev:arm64 \ + libselinux-dev:arm64 \ libssh-dev:arm64 \ libssh2-1-dev:arm64 \ libtirpc-dev:arm64 \ diff --git a/ci/buildenv/debian-13-cross-armv6l.sh b/ci/buildenv/debian-13-cross-armv6l.sh index cad3f59aca..f8325959c8 100644 --- a/ci/buildenv/debian-13-cross-armv6l.sh +++ b/ci/buildenv/debian-13-cross-armv6l.sh @@ -72,7 +72,7 @@ function install_buildenv() { libreadline-dev:armel \ libsanlock-dev:armel \ libsasl2-dev:armel \ - libselinux1-dev:armel \ + libselinux-dev:armel \ libssh-dev:armel \ libssh2-1-dev:armel \ libtirpc-dev:armel \ diff --git a/ci/buildenv/debian-13-cross-armv7l.sh b/ci/buildenv/debian-13-cross-armv7l.sh index 87a93b1866..cdc0dc8218 100644 --- a/ci/buildenv/debian-13-cross-armv7l.sh +++ b/ci/buildenv/debian-13-cross-armv7l.sh @@ -72,7 +72,7 @@ function install_buildenv() { libreadline-dev:armhf \ libsanlock-dev:armhf \ libsasl2-dev:armhf \ - libselinux1-dev:armhf \ + libselinux-dev:armhf \ libssh-dev:armhf \ libssh2-1-dev:armhf \ libtirpc-dev:armhf \ diff --git a/ci/buildenv/debian-13-cross-i686.sh b/ci/buildenv/debian-13-cross-i686.sh index 729f32540a..c46ac5ad45 100644 --- a/ci/buildenv/debian-13-cross-i686.sh +++ b/ci/buildenv/debian-13-cross-i686.sh @@ -72,7 +72,7 @@ function install_buildenv() { libreadline-dev:i386 \ libsanlock-dev:i386 \ libsasl2-dev:i386 \ - libselinux1-dev:i386 \ + libselinux-dev:i386 \ libssh-dev:i386 \ libssh2-1-dev:i386 \ libtirpc-dev:i386 \ diff --git a/ci/buildenv/debian-13-cross-ppc64le.sh b/ci/buildenv/debian-13-cross-ppc64le.sh index 40a0aa5e25..6c1948bb59 100644 --- a/ci/buildenv/debian-13-cross-ppc64le.sh +++ b/ci/buildenv/debian-13-cross-ppc64le.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:ppc64el \ libsanlock-dev:ppc64el \ libsasl2-dev:ppc64el \ - libselinux1-dev:ppc64el \ + libselinux-dev:ppc64el \ libssh-dev:ppc64el \ libssh2-1-dev:ppc64el \ libtirpc-dev:ppc64el \ diff --git a/ci/buildenv/debian-13-cross-riscv64.sh b/ci/buildenv/debian-13-cross-riscv64.sh index 7e1cc85ffe..46ed10097e 100644 --- a/ci/buildenv/debian-13-cross-riscv64.sh +++ b/ci/buildenv/debian-13-cross-riscv64.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:riscv64 \ libsanlock-dev:riscv64 \ libsasl2-dev:riscv64 \ - libselinux1-dev:riscv64 \ + libselinux-dev:riscv64 \ libssh-dev:riscv64 \ libssh2-1-dev:riscv64 \ libtirpc-dev:riscv64 \ diff --git a/ci/buildenv/debian-13-cross-s390x.sh b/ci/buildenv/debian-13-cross-s390x.sh index 38ebd83560..0f35644285 100644 --- a/ci/buildenv/debian-13-cross-s390x.sh +++ b/ci/buildenv/debian-13-cross-s390x.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:s390x \ libsanlock-dev:s390x \ libsasl2-dev:s390x \ - libselinux1-dev:s390x \ + libselinux-dev:s390x \ libssh-dev:s390x \ libssh2-1-dev:s390x \ libtirpc-dev:s390x \ diff --git a/ci/buildenv/debian-13.sh b/ci/buildenv/debian-13.sh index b9bbabfc94..8b02411105 100644 --- a/ci/buildenv/debian-13.sh +++ b/ci/buildenv/debian-13.sh @@ -53,7 +53,7 @@ function install_buildenv() { libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ diff --git a/ci/buildenv/debian-sid-cross-aarch64.sh b/ci/buildenv/debian-sid-cross-aarch64.sh index 31486c93fc..39cbe16569 100644 --- a/ci/buildenv/debian-sid-cross-aarch64.sh +++ b/ci/buildenv/debian-sid-cross-aarch64.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:arm64 \ libsanlock-dev:arm64 \ libsasl2-dev:arm64 \ - libselinux1-dev:arm64 \ + libselinux-dev:arm64 \ libssh-dev:arm64 \ libssh2-1-dev:arm64 \ libtirpc-dev:arm64 \ diff --git a/ci/buildenv/debian-sid-cross-armv6l.sh b/ci/buildenv/debian-sid-cross-armv6l.sh index cad3f59aca..f8325959c8 100644 --- a/ci/buildenv/debian-sid-cross-armv6l.sh +++ b/ci/buildenv/debian-sid-cross-armv6l.sh @@ -72,7 +72,7 @@ function install_buildenv() { libreadline-dev:armel \ libsanlock-dev:armel \ libsasl2-dev:armel \ - libselinux1-dev:armel \ + libselinux-dev:armel \ libssh-dev:armel \ libssh2-1-dev:armel \ libtirpc-dev:armel \ diff --git a/ci/buildenv/debian-sid-cross-armv7l.sh b/ci/buildenv/debian-sid-cross-armv7l.sh index 87a93b1866..cdc0dc8218 100644 --- a/ci/buildenv/debian-sid-cross-armv7l.sh +++ b/ci/buildenv/debian-sid-cross-armv7l.sh @@ -72,7 +72,7 @@ function install_buildenv() { libreadline-dev:armhf \ libsanlock-dev:armhf \ libsasl2-dev:armhf \ - libselinux1-dev:armhf \ + libselinux-dev:armhf \ libssh-dev:armhf \ libssh2-1-dev:armhf \ libtirpc-dev:armhf \ diff --git a/ci/buildenv/debian-sid-cross-i686.sh b/ci/buildenv/debian-sid-cross-i686.sh index 729f32540a..c46ac5ad45 100644 --- a/ci/buildenv/debian-sid-cross-i686.sh +++ b/ci/buildenv/debian-sid-cross-i686.sh @@ -72,7 +72,7 @@ function install_buildenv() { libreadline-dev:i386 \ libsanlock-dev:i386 \ libsasl2-dev:i386 \ - libselinux1-dev:i386 \ + libselinux-dev:i386 \ libssh-dev:i386 \ libssh2-1-dev:i386 \ libtirpc-dev:i386 \ diff --git a/ci/buildenv/debian-sid-cross-ppc64le.sh b/ci/buildenv/debian-sid-cross-ppc64le.sh index 40a0aa5e25..6c1948bb59 100644 --- a/ci/buildenv/debian-sid-cross-ppc64le.sh +++ b/ci/buildenv/debian-sid-cross-ppc64le.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:ppc64el \ libsanlock-dev:ppc64el \ libsasl2-dev:ppc64el \ - libselinux1-dev:ppc64el \ + libselinux-dev:ppc64el \ libssh-dev:ppc64el \ libssh2-1-dev:ppc64el \ libtirpc-dev:ppc64el \ diff --git a/ci/buildenv/debian-sid-cross-riscv64.sh b/ci/buildenv/debian-sid-cross-riscv64.sh index 7e1cc85ffe..46ed10097e 100644 --- a/ci/buildenv/debian-sid-cross-riscv64.sh +++ b/ci/buildenv/debian-sid-cross-riscv64.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:riscv64 \ libsanlock-dev:riscv64 \ libsasl2-dev:riscv64 \ - libselinux1-dev:riscv64 \ + libselinux-dev:riscv64 \ libssh-dev:riscv64 \ libssh2-1-dev:riscv64 \ libtirpc-dev:riscv64 \ diff --git a/ci/buildenv/debian-sid-cross-s390x.sh b/ci/buildenv/debian-sid-cross-s390x.sh index 38ebd83560..0f35644285 100644 --- a/ci/buildenv/debian-sid-cross-s390x.sh +++ b/ci/buildenv/debian-sid-cross-s390x.sh @@ -74,7 +74,7 @@ function install_buildenv() { libreadline-dev:s390x \ libsanlock-dev:s390x \ libsasl2-dev:s390x \ - libselinux1-dev:s390x \ + libselinux-dev:s390x \ libssh-dev:s390x \ libssh2-1-dev:s390x \ libtirpc-dev:s390x \ diff --git a/ci/buildenv/debian-sid.sh b/ci/buildenv/debian-sid.sh index b9bbabfc94..8b02411105 100644 --- a/ci/buildenv/debian-sid.sh +++ b/ci/buildenv/debian-sid.sh @@ -53,7 +53,7 @@ function install_buildenv() { libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ diff --git a/ci/buildenv/ubuntu-2404.sh b/ci/buildenv/ubuntu-2404.sh index 459a306061..41ec137294 100644 --- a/ci/buildenv/ubuntu-2404.sh +++ b/ci/buildenv/ubuntu-2404.sh @@ -54,7 +54,7 @@ function install_buildenv() { libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ diff --git a/ci/buildenv/ubuntu-2604.sh b/ci/buildenv/ubuntu-2604.sh index 459a306061..41ec137294 100644 --- a/ci/buildenv/ubuntu-2604.sh +++ b/ci/buildenv/ubuntu-2604.sh @@ -54,7 +54,7 @@ function install_buildenv() { libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ diff --git a/ci/containers/debian-13-cross-aarch64.Dockerfile b/ci/containers/debian-13-cross-aarch64.Dockerfile index 6293715d29..70051eb352 100644 --- a/ci/containers/debian-13-cross-aarch64.Dockerfile +++ b/ci/containers/debian-13-cross-aarch64.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:arm64 \ libsanlock-dev:arm64 \ libsasl2-dev:arm64 \ - libselinux1-dev:arm64 \ + libselinux-dev:arm64 \ libssh-dev:arm64 \ libssh2-1-dev:arm64 \ libtirpc-dev:arm64 \ diff --git a/ci/containers/debian-13-cross-armv6l.Dockerfile b/ci/containers/debian-13-cross-armv6l.Dockerfile index 8c54391915..ed88c25835 100644 --- a/ci/containers/debian-13-cross-armv6l.Dockerfile +++ b/ci/containers/debian-13-cross-armv6l.Dockerfile @@ -83,7 +83,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:armel \ libsanlock-dev:armel \ libsasl2-dev:armel \ - libselinux1-dev:armel \ + libselinux-dev:armel \ libssh-dev:armel \ libssh2-1-dev:armel \ libtirpc-dev:armel \ diff --git a/ci/containers/debian-13-cross-armv7l.Dockerfile b/ci/containers/debian-13-cross-armv7l.Dockerfile index fd54af8649..359023cbb6 100644 --- a/ci/containers/debian-13-cross-armv7l.Dockerfile +++ b/ci/containers/debian-13-cross-armv7l.Dockerfile @@ -83,7 +83,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:armhf \ libsanlock-dev:armhf \ libsasl2-dev:armhf \ - libselinux1-dev:armhf \ + libselinux-dev:armhf \ libssh-dev:armhf \ libssh2-1-dev:armhf \ libtirpc-dev:armhf \ diff --git a/ci/containers/debian-13-cross-i686.Dockerfile b/ci/containers/debian-13-cross-i686.Dockerfile index 3cb098e30f..41585a4687 100644 --- a/ci/containers/debian-13-cross-i686.Dockerfile +++ b/ci/containers/debian-13-cross-i686.Dockerfile @@ -83,7 +83,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:i386 \ libsanlock-dev:i386 \ libsasl2-dev:i386 \ - libselinux1-dev:i386 \ + libselinux-dev:i386 \ libssh-dev:i386 \ libssh2-1-dev:i386 \ libtirpc-dev:i386 \ diff --git a/ci/containers/debian-13-cross-ppc64le.Dockerfile b/ci/containers/debian-13-cross-ppc64le.Dockerfile index e18dcc9356..155acd8062 100644 --- a/ci/containers/debian-13-cross-ppc64le.Dockerfile +++ b/ci/containers/debian-13-cross-ppc64le.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:ppc64el \ libsanlock-dev:ppc64el \ libsasl2-dev:ppc64el \ - libselinux1-dev:ppc64el \ + libselinux-dev:ppc64el \ libssh-dev:ppc64el \ libssh2-1-dev:ppc64el \ libtirpc-dev:ppc64el \ diff --git a/ci/containers/debian-13-cross-riscv64.Dockerfile b/ci/containers/debian-13-cross-riscv64.Dockerfile index 1901c8996c..6007be0a81 100644 --- a/ci/containers/debian-13-cross-riscv64.Dockerfile +++ b/ci/containers/debian-13-cross-riscv64.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:riscv64 \ libsanlock-dev:riscv64 \ libsasl2-dev:riscv64 \ - libselinux1-dev:riscv64 \ + libselinux-dev:riscv64 \ libssh-dev:riscv64 \ libssh2-1-dev:riscv64 \ libtirpc-dev:riscv64 \ diff --git a/ci/containers/debian-13-cross-s390x.Dockerfile b/ci/containers/debian-13-cross-s390x.Dockerfile index 99f55321b6..c450f4a938 100644 --- a/ci/containers/debian-13-cross-s390x.Dockerfile +++ b/ci/containers/debian-13-cross-s390x.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:s390x \ libsanlock-dev:s390x \ libsasl2-dev:s390x \ - libselinux1-dev:s390x \ + libselinux-dev:s390x \ libssh-dev:s390x \ libssh2-1-dev:s390x \ libtirpc-dev:s390x \ diff --git a/ci/containers/debian-13.Dockerfile b/ci/containers/debian-13.Dockerfile index c07fd4fac1..bb0f2f2d13 100644 --- a/ci/containers/debian-13.Dockerfile +++ b/ci/containers/debian-13.Dockerfile @@ -55,7 +55,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ diff --git a/ci/containers/debian-sid-cross-aarch64.Dockerfile b/ci/containers/debian-sid-cross-aarch64.Dockerfile index ceaafbc41d..e7b66bc34d 100644 --- a/ci/containers/debian-sid-cross-aarch64.Dockerfile +++ b/ci/containers/debian-sid-cross-aarch64.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:arm64 \ libsanlock-dev:arm64 \ libsasl2-dev:arm64 \ - libselinux1-dev:arm64 \ + libselinux-dev:arm64 \ libssh-dev:arm64 \ libssh2-1-dev:arm64 \ libtirpc-dev:arm64 \ diff --git a/ci/containers/debian-sid-cross-armv6l.Dockerfile b/ci/containers/debian-sid-cross-armv6l.Dockerfile index 3112f69a61..caaaf0b4d7 100644 --- a/ci/containers/debian-sid-cross-armv6l.Dockerfile +++ b/ci/containers/debian-sid-cross-armv6l.Dockerfile @@ -83,7 +83,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:armel \ libsanlock-dev:armel \ libsasl2-dev:armel \ - libselinux1-dev:armel \ + libselinux-dev:armel \ libssh-dev:armel \ libssh2-1-dev:armel \ libtirpc-dev:armel \ diff --git a/ci/containers/debian-sid-cross-armv7l.Dockerfile b/ci/containers/debian-sid-cross-armv7l.Dockerfile index 9aa194be53..77b88522d4 100644 --- a/ci/containers/debian-sid-cross-armv7l.Dockerfile +++ b/ci/containers/debian-sid-cross-armv7l.Dockerfile @@ -83,7 +83,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:armhf \ libsanlock-dev:armhf \ libsasl2-dev:armhf \ - libselinux1-dev:armhf \ + libselinux-dev:armhf \ libssh-dev:armhf \ libssh2-1-dev:armhf \ libtirpc-dev:armhf \ diff --git a/ci/containers/debian-sid-cross-i686.Dockerfile b/ci/containers/debian-sid-cross-i686.Dockerfile index 0dc2dbba6e..3722be26bf 100644 --- a/ci/containers/debian-sid-cross-i686.Dockerfile +++ b/ci/containers/debian-sid-cross-i686.Dockerfile @@ -83,7 +83,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:i386 \ libsanlock-dev:i386 \ libsasl2-dev:i386 \ - libselinux1-dev:i386 \ + libselinux-dev:i386 \ libssh-dev:i386 \ libssh2-1-dev:i386 \ libtirpc-dev:i386 \ diff --git a/ci/containers/debian-sid-cross-ppc64le.Dockerfile b/ci/containers/debian-sid-cross-ppc64le.Dockerfile index 0f5c2e749a..b22957790f 100644 --- a/ci/containers/debian-sid-cross-ppc64le.Dockerfile +++ b/ci/containers/debian-sid-cross-ppc64le.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:ppc64el \ libsanlock-dev:ppc64el \ libsasl2-dev:ppc64el \ - libselinux1-dev:ppc64el \ + libselinux-dev:ppc64el \ libssh-dev:ppc64el \ libssh2-1-dev:ppc64el \ libtirpc-dev:ppc64el \ diff --git a/ci/containers/debian-sid-cross-riscv64.Dockerfile b/ci/containers/debian-sid-cross-riscv64.Dockerfile index 77ca513dfd..85d4a2a411 100644 --- a/ci/containers/debian-sid-cross-riscv64.Dockerfile +++ b/ci/containers/debian-sid-cross-riscv64.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:riscv64 \ libsanlock-dev:riscv64 \ libsasl2-dev:riscv64 \ - libselinux1-dev:riscv64 \ + libselinux-dev:riscv64 \ libssh-dev:riscv64 \ libssh2-1-dev:riscv64 \ libtirpc-dev:riscv64 \ diff --git a/ci/containers/debian-sid-cross-s390x.Dockerfile b/ci/containers/debian-sid-cross-s390x.Dockerfile index 71588cd829..4801ad4931 100644 --- a/ci/containers/debian-sid-cross-s390x.Dockerfile +++ b/ci/containers/debian-sid-cross-s390x.Dockerfile @@ -85,7 +85,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev:s390x \ libsanlock-dev:s390x \ libsasl2-dev:s390x \ - libselinux1-dev:s390x \ + libselinux-dev:s390x \ libssh-dev:s390x \ libssh2-1-dev:s390x \ libtirpc-dev:s390x \ diff --git a/ci/containers/debian-sid.Dockerfile b/ci/containers/debian-sid.Dockerfile index fd23cb16ac..fdc89fc3c5 100644 --- a/ci/containers/debian-sid.Dockerfile +++ b/ci/containers/debian-sid.Dockerfile @@ -55,7 +55,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ diff --git a/ci/containers/ubuntu-2404.Dockerfile b/ci/containers/ubuntu-2404.Dockerfile index bb487d7a64..135cc21550 100644 --- a/ci/containers/ubuntu-2404.Dockerfile +++ b/ci/containers/ubuntu-2404.Dockerfile @@ -56,7 +56,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ diff --git a/ci/containers/ubuntu-2604.Dockerfile b/ci/containers/ubuntu-2604.Dockerfile index a631af360f..c0c296f20d 100644 --- a/ci/containers/ubuntu-2604.Dockerfile +++ b/ci/containers/ubuntu-2604.Dockerfile @@ -56,7 +56,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libreadline-dev \ libsanlock-dev \ libsasl2-dev \ - libselinux1-dev \ + libselinux-dev \ libssh-dev \ libssh2-1-dev \ libtirpc-dev \ -- 2.55.0

2 1

[PATCH] gitlab-ci: cve_tags: Remove duplicate tags from exported list
by Peter Krempa 03 Sep '26

03 Sep '26

From: Peter Krempa <pkrempa(a)redhat.com> The 'cve-tags' file is exported as an artifact, but contained duplicate entries. Remove the duplicates. The artifact will be used by the 'libvirt-security-notice' repo to check for missing entries. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 7121248f7b..744c6472a3 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -193,7 +193,7 @@ cve_tags: - when: never script: # fetch list of git tags and exceptions - - git tag | grep -o 'CVE-[0-9]\+-[0-9]\+' > cve-tags + - git tag | grep -o 'CVE-[0-9]\+-[0-9]\+' | sort -u > cve-tags - grep -o 'CVE-[0-9]\+-[0-9]\+' .cve_exceptions > cve-allowed-exceptions - sort -u cve-tags cve-allowed-exceptions > cve-allowed # lookup CVE ids in 'git-log' -- 2.55.0

2 1

[PATCH v3 0/5] qemu: auto-select win-dmp for Windows guest crash dumps
by Denis V. Lunev 02 Sep '26

02 Sep '26

Auto-triggered dumps (on_crash, watchdog) always use QEMU's elf default, which is not WinDbg-loadable for a Windows guest and cannot be reliably converted after the fact. This was proposed before as a per-domain XML knob (https://www.mail-archive.com/devel@lists.libvirt.org/msg09638.html) Daniel P. Berrange objected: QEMU's query-dump-guest-memory-capability reported win-dmp as available on any x86-64 guest regardless of whether it had actually published a Windows dump header, so trusting it was not safe. QEMU's win_dump_available() has since been fixed to check the guest's vmcoreinfo note (https://lore.kernel.org/qemu-devel/20260619101834.228432-1-den@openvz.org/, commit b4bdad7dce). Validated against real guests: a Windows Server 2022 guest crashed via Sysinternals NotMyFault produces a PAGEDU64 (win-dmp) dump; an AlmaLinux 9 guest crashed via sysrq produces an ELF one. A 1GiB quota across two Linux crashes pruned the older dump and kept the newer, over-quota one. syntax-check and virstringtest pass. Changes since v2: * count a dump as the space it allocates, not its apparent size, so a sparse dump is not over-charged against the quota (Daniel). * rebased onto master. Changes since v1: * detect the 'allowed-by-guest' feature QEMU 11.1 puts on the win-dmp member of DumpGuestMemoryFormat (thanks Daniel for idea) * skip the probe unless that capability is present, so QEMU that offers win-dmp to every x86 guest keeps the elf default (Daniel). * fix the sort position of both new symbols in libvirt_private.syms, which v1 got wrong; picked up Daniel's Reviewed-by. * update virtlogd.aug and test_virtlogd.aug.in for the quoted form (Daniel). * update libvirtd_qemu.aug and test_libvirtd_qemu.aug.in for the new setting, and VIR_INFO -> VIR_DEBUG (both Daniel); count and remove only the dumps libvirt itself wrote, and skip pruning after a failed dump. * renamed test helpers for virStrToBytes * NEWS.rst entries added. Denis V. Lunev (5): qemu: add capability for guest-aware win-dmp availability qemu: auto-select win-dmp for crash- and watchdog-triggered dumps util: add virStrToBytes() and virConfGetValueBytes() for scaled sizes logging: accept a unit suffix in virtlogd's max_size qemu: cap total size of auto-triggered dumps under auto_dump_path NEWS.rst | 19 ++ src/libvirt_private.syms | 2 + src/logging/log_daemon_config.c | 2 +- src/logging/log_daemon_config.h | 2 +- src/logging/test_virtlogd.aug.in | 2 +- src/logging/virtlogd.aug | 5 +- src/logging/virtlogd.conf | 7 +- src/qemu/libvirtd_qemu.aug | 4 + src/qemu/qemu.conf.in | 17 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 165 +++++++++++++++++- src/qemu/test_libvirtd_qemu.aug.in | 1 + src/util/virconf.c | 47 +++++ src/util/virconf.h | 3 + src/util/virutil.c | 23 +++ src/util/virutil.h | 5 + .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_s390x.xml | 1 + .../caps_11.1.0_x86_64.xml | 1 + tests/qemumonitorjsontest.c | 3 + tests/virstringtest.c | 76 ++++++++ 24 files changed, 385 insertions(+), 7 deletions(-) -- 2.53.0

2 6

[PATCH v2 0/5] qemu: auto-select win-dmp for Windows guest crash dumps
by Denis V. Lunev 01 Sep '26

01 Sep '26

Auto-triggered dumps (on_crash, watchdog) always use QEMU's elf default, which is not WinDbg-loadable for a Windows guest and cannot be reliably converted after the fact. This was proposed before as a per-domain XML knob (https://www.mail-archive.com/devel@lists.libvirt.org/msg09638.html) Daniel P. Berrange objected: QEMU's query-dump-guest-memory-capability reported win-dmp as available on any x86-64 guest regardless of whether it had actually published a Windows dump header, so trusting it was not safe. QEMU's win_dump_available() has since been fixed to check the guest's vmcoreinfo note (https://lore.kernel.org/qemu-devel/20260619101834.228432-1-den@openvz.org/, commit b4bdad7dce). Validated against real guests: a Windows Server 2022 guest crashed via Sysinternals NotMyFault produces a PAGEDU64 (win-dmp) dump; an AlmaLinux 9 guest crashed via sysrq produces an ELF one. A 1GiB quota across two Linux crashes pruned the older dump and kept the newer, over-quota one. syntax-check and virstringtest pass. Changes since v1: * detect the 'allowed-by-guest' feature QEMU 11.1 puts on the win-dmp member of DumpGuestMemoryFormat (thanks Daniel for idea) * skip the probe unless that capability is present, so QEMU that offers win-dmp to every x86 guest keeps the elf default (Daniel). * fix the sort position of both new symbols in libvirt_private.syms, which v1 got wrong; picked up Daniel's Reviewed-by. * update virtlogd.aug and test_virtlogd.aug.in for the quoted form (Daniel). * update libvirtd_qemu.aug and test_libvirtd_qemu.aug.in for the new setting, and VIR_INFO -> VIR_DEBUG (both Daniel); count and remove only the dumps libvirt itself wrote, and skip pruning after a failed dump. * renamed test helpers for virStrToBytes * NEWS.rst entries added. Denis V. Lunev (5): qemu: add capability for guest-aware win-dmp availability qemu: auto-select win-dmp for crash- and watchdog-triggered dumps util: add virStrToBytes() and virConfGetValueBytes() for scaled sizes logging: accept a unit suffix in virtlogd's max_size qemu: cap total size of auto-triggered dumps under auto_dump_path NEWS.rst | 19 ++ src/libvirt_private.syms | 2 + src/logging/log_daemon_config.c | 2 +- src/logging/log_daemon_config.h | 2 +- src/logging/test_virtlogd.aug.in | 2 +- src/logging/virtlogd.aug | 5 +- src/logging/virtlogd.conf | 7 +- src/qemu/libvirtd_qemu.aug | 4 + src/qemu/qemu.conf.in | 17 ++ src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 163 +++++++++++++++++- src/qemu/test_libvirtd_qemu.aug.in | 1 + src/util/virconf.c | 47 +++++ src/util/virconf.h | 3 + src/util/virutil.c | 23 +++ src/util/virutil.h | 5 + .../caps_11.1.0_aarch64.replies | 5 +- .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_x86_64.replies | 5 +- .../caps_11.1.0_x86_64.xml | 1 + tests/qemumonitorjsontest.c | 3 + tests/virstringtest.c | 76 ++++++++ 25 files changed, 394 insertions(+), 9 deletions(-) -- 2.53.0

3 12

[libvirt PATCH v2] storage: logical: don't write past buffer bounds
by Ján Tomko 01 Sep '26

01 Sep '26

From: Ján Tomko <jtomko(a)redhat.com> If parsed number of extents is 0, the calculated buffer size won't hold the first regex_unit. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/storage/storage_backend_logical.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 51e9337820..6138c6fb81 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -127,6 +127,7 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol, unsigned long long offset; unsigned long long size; unsigned long long length; + g_auto(GStrv) regex_array = NULL; g_autofree char *regex = NULL; /* Assume 1 extent (the regex for 'devices' is "(\\S+)") and only @@ -160,13 +161,10 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol, } /* Allocate space for 'nextents' regex_unit strings plus a comma for each */ - regex = g_new0(char, nextents * (strlen(regex_unit) + 1) + 1); - strcat(regex, regex_unit); - for (i = 1; i < nextents; i++) { - /* "," is the separator of "devices" field */ - strcat(regex, ","); - strcat(regex, regex_unit); - } + regex_array = g_new0(char *, nextents + 1); + for (i = 0; i < nextents; i++) + regex_array[i] = g_strdup(regex_unit); + regex = g_strjoinv(",", regex_array); re = g_regex_new(regex, 0, 0, &err); if (!re) { -- 2.55.0

2 1

[PATCH 0/6] resctrl: support whole-process allocations and monitoring
by Jedrzej Wasiukiewicz 01 Sep '26

01 Sep '26

Resctrl support in libvirt currently requires allocations and monitors to be associated with a set of vCPUs. This does not accurately model QEMU resource consumption, as IOThreads, worker threads and emulator threads also consume cache, memory bandwidth and energy. This series introduces a whole-process resctrl scope, allowing ``cachetune``, ``memorytune``, ``energytune`` and ``monitor`` elements to omit the ``vcpus`` attribute and apply to the entire QEMU emulator process. By placing the emulator process into the resctrl group before thread creation, all subsequently created threads inherit the same resctrl configuration. Major design choices: * A resctrl allocation or monitor without a ``vcpus`` attribute is treated as a whole-process group. * Whole-process allocations and per-vCPU allocations are mutually exclusive within a domain to avoid ambiguous resource assignment. * Whole-process monitors require a whole-process allocation of the same resource type and are unique per resource. * Monitors without ``vcpus`` inherit the scope of their parent allocation. Under a whole-process allocation they monitor the whole process; under a per-vCPU allocation they monitor the allocation's vCPU set. This reflects the dependency between resctrl monitoring and allocation groups. * Whole-process resctrl groups are created by placing the QEMU process into the target group before thread creation, allowing all subsequently created threads to inherit the same resctrl configuration. The series also updates XML validation, fixes resctrl monitor statistics reporting, and cleans up monitor domstats output. Jedrzej Wasiukiewicz (6): conf: allow omitting vcpus in cachetune/memorytune/energytune conf: implement whole-process resctrl scope qemu: assign whole-process resctrl groups at domain start qemu: fix resctrl monitor stats reporting the wrong group name qemu: clean up resctrl monitor domstats NEWS: Document whole-process resctrl support NEWS.rst | 11 + docs/formatdomain.rst | 57 +++-- src/conf/domain_conf.c | 231 ++++++++++++------ src/conf/domain_conf.h | 2 + src/conf/schemas/domaincommon.rng | 48 ++-- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 29 ++- src/qemu/qemu_process.c | 40 ++- src/util/virresctrl.c | 20 +- src/util/virresctrl.h | 3 + .../cachetune-monitor-empty-vcpus.xml | 30 +++ .../cachetune-monitor-inherit-alloc.xml | 30 +++ .../cachetune-wholeprocess-duplicate.xml | 32 +++ ...chetune-wholeprocess-monitor-duplicate.xml | 31 +++ .../cachetune-wholeprocess-monitors.xml | 31 +++ .../energytune-colliding-monitor.xml | 30 +++ .../energytune-wholeprocess.xml | 29 +++ .../memorytune-wholeprocess.xml | 29 +++ .../resctrl-wholeprocess-alloc-monitor.xml | 32 +++ .../resctrl-wholeprocess-layering.xml | 32 +++ .../resctrl-wholeprocess-monitors.xml | 33 +++ .../cachetune-monitor-inherit-alloc.xml | 30 +++ tests/genericxml2xmltest.c | 11 + 23 files changed, 694 insertions(+), 128 deletions(-) create mode 100644 tests/genericxml2xmlindata/cachetune-monitor-empty-vcpus.xml create mode 100644 tests/genericxml2xmlindata/cachetune-monitor-inherit-alloc.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-duplicate.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-monitor-duplicate.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-monitors.xml create mode 100644 tests/genericxml2xmlindata/energytune-colliding-monitor.xml create mode 100644 tests/genericxml2xmlindata/energytune-wholeprocess.xml create mode 100644 tests/genericxml2xmlindata/memorytune-wholeprocess.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-alloc-monitor.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-layering.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-monitors.xml create mode 100644 tests/genericxml2xmloutdata/cachetune-monitor-inherit-alloc.xml -- 2.43.0 --------------------------------------------------------------------- Intel Technology Poland sp. z o.o. ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN. Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych. Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione. This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

1 8

Release of libvirt-12.7.0
by Jiri Denemark 01 Sep '26

01 Sep '26

The 12.7.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Security * CVE-2026-18917: Integer overflow in RPC handler for ``virNodeGetFreePages`` The RPC handler for ``virNodeGetFreePages`` didn't properly check for overflows in multiplication of integers when calculating the amount of returned data for validation and allocation of the return buffer. Specific values could thus pass validation and cause an undersized buffer to be allocated. The hypervisor driver would then fill the undersized buffer based on the values prior to multiplication and thus cause a write beyond the end of the allocated buffer. This bug can be triggered via a read-only connection. * CVE-2026-77158: Double free of disks array in ``qemuAgentGetDisks`` The qemu hypervisor driver would double-free the array of parsed disks, on error code paths leading to crash of the daemon. The error code path could be reached when the qemu guest agent provided malformed data as response to the ``guest-get-disks`` command. * CVE-2026-77159: ``chown()`` of swtpm log file follows symlinks When starting up a VM with a ``swtpm`` device configured, libvirt ``chown()``-s the log file of swtpm to the (unprivileged) user/group running the swtpm process. The problem is that the directory containing the log files is also owned by the same user/group, thus users with access to that directory could install a symlink to a privileged file that the libvirt daemon would follow and chown the file pointed to. * New features * bhyve: implement ``virDomainGetGuestInfo()`` and ``virDomainAgentSetResponseTimeout()`` APIs The bhyve driver now implements ``virDomainGetGuestInfo()`` which returns information about the guest, and ``virDomainAgentSetResponseTimeout()`` which sets the guest agent response timeout. * bhyve: allow setting disk serial numbers The bhyve driver now allows specifying ``<serial>`` for SATA disks and NVMe controllers:: <disk type='file'> <serial>BHYVE-SER01-0001</serial> <driver name='file' type='raw'/> <source file='/tmp/freebsd1.img'/> <target dev='hda' bus='sata' rotation_rate='7200'/> </disk> <controller type='nvme' index='0'> <serial>BHYVE-NVME0-01234</serial> </controller> It also supports specifying ``<wwn>`` for NVMe disks:: <disk type='file'> <driver name='file' type='raw'/> <source file='/path/to/some.img'/> <target dev='nvme0n1' bus='nvme'/> <wwn>01000000efbeadde</wwn> </disk> * qemu: Add poll-weight support for iothreads The qemu driver now supports the iothread poll-weight property, which controls the weight of the most recent event interval in the adaptive polling duration calculation. * Add guest device info to ``virDomainGetGuestInfo()`` QEMU guest agent has 'guest-get-devices` command, which returns information on guest devices (driver name, version, release date, and so on). This is now exposed via ``virDomainGetGuestInfo()`` API (accessible via ``guestinfo --devices`` virsh command). * Bug fixes * bhyve: fix domain API calls hanging after domain shutdown * remote: Fix stale virStream status In a few cases it might happen that daemon held incorrect state of a virStream leading to an infinite loop. This is now fixed. * esx: Don't crash when parsing unmounted datastore When libvirt constructs domain XML for an ESX domain it traverses through all datastores to find which one stores disks for the domain. But if a datastore wasn't mounted, then a crash would occur. This is now fixed. * virsh: Don't crash when certain error messages are printed A bug in the error printing function could cause ``virsh`` to crash when certain errors (e.g. disk not found in ``virsh detach-disk``) were being reported. Enjoy. Jirka

1 0