- Devel - libvirt List Archives

[libvirt] [PATCHv2 0/8]
by Ján Tomko 22 Jan '19

22 Jan '19

For: https://bugzilla.redhat.com/show_bug.cgi?id=1602418 v1: https://www.redhat.com/archives/libvir-list/2019-January/msg00490.html v2: * fixed memory leaks pointed out by John in v1 Patches without R-b: [4/8] cowardly refused to unref the private data in Secret.*Destroy [8/8] fixed the logic to include checking whether the domain actually has a VNC graphics and amended the commit message Ján Tomko (8): conf: introduce virDomainGraphicsNew conf: add privateData to virDomainGraphicsDef qemu: add qemuDomainGraphicsPrivate data with a tlsAlias qemu: prepare secret for the graphics upfront qemu_process: fix debug message qemu.conf: add vnc_tls_x509_secret_uuid qemu: add support for encrypted VNC TLS keys qemu: error out when vnc vncTLSx509secretUUID is unsupported src/conf/domain_conf.c | 30 ++++- src/conf/domain_conf.h | 5 + src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf | 6 + src/qemu/qemu_command.c | 19 +++- src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 107 ++++++++++++++++++ src/qemu/qemu_domain.h | 13 +++ src/qemu/qemu_process.c | 2 +- src/qemu/test_libvirtd_qemu.aug.in | 1 + ...graphics-vnc-tls-secret.x86_64-latest.args | 36 ++++++ .../graphics-vnc-tls-secret.xml | 30 +++++ tests/qemuxml2argvtest.c | 5 + 14 files changed, 250 insertions(+), 10 deletions(-) create mode 100644 tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/graphics-vnc-tls-secret.xml -- 2.20.1

2 10

[libvirt] [PATCH] docs: use JavaScript based PolicyKit .rules files
by Mark McLoughlin 21 Jan '19

21 Jan '19

PolicyKit authentication rules have switched to a JavaScript based format quite some time ago. See: http://davidz25.blogspot.com/2012/06/authorization-rules-in-polkit.html While backwards compat for the old .pkla format is still available, it makes sense to point people first at the new format. The SSHPolicyKitSetup wiki page seems pretty stale, so remove the reference to it. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> --- docs/auth.html.in | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/docs/auth.html.in b/docs/auth.html.in index afd6cd7f9b..33afe0a8ad 100644 --- a/docs/auth.html.in +++ b/docs/auth.html.in @@ -184,15 +184,29 @@ Default policy will still allow any application to connect to the RO socket. The default policy can be overridden by creating a new policy file in the -local override directory <code>/etc/polkit-1/localauthority/50-local.d/</code>. -Policy files should have a unique name ending with .pkla. Using reverse DNS -naming works well. Information on the options available can be found by -reading the pklocalauthority man page. The two libvirt daemon actions -available are named <code>org.libvirt.unix.manage</code> for full management -access, and <code>org.libvirt.unix.monitor</code> for read-only access. +<code>/etc/polkit-1/rules.d</code> directory. Information on the options +available can be found by reading the <code>polkit(8)</code> man page. The +two libvirt actions are named <code>org.libvirt.unix.manage</code> for full +management access, and <code>org.libvirt.unix.monitor</code> for read-only +access. + + +As an example, creating <code>/etc/polkit-1/rules.d/80-libvirt-manage.rules</code> +with the following gives the user <code>fred</code> full management access +when accessing from an active local session: +<pre>polkit.addRule(function(action, subject) { + if (action.id == "org.libvirt.unix.manage" && + subject.local && subject.active && subject.user == "fred") { + return polkit.Result.YES; + } +});</pre> -As an example, this gives the user <code>fred</code> full management access: +Older versions of PolicyKit used policy files ending with .pkla in the +local override directory <code>/etc/polkit-1/localauthority/50-local.d/</code>. +Compatibility with this older format is provided by <a +href="https://pagure.io/polkit-pkla-compat">polkit-pkla-compat</a>. As an +example, this gives the user <code>fred</code> full management access: <pre>[Allow fred libvirt management permissions] Identity=unix-user:fred @@ -200,10 +214,6 @@ Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes</pre> - -Further examples of PolicyKit setup can be found on the -<a href="http://wiki.libvirt.org/page/SSHPolicyKitSetup">wiki page</a>. - <h2><a id="ACL_server_sasl">SASL pluggable authentication</a></h2> -- 2.20.1

2 1

[libvirt] [PATCH 0/2] qemu: Don't format 'cache' for empty cdroms
by Peter Krempa 21 Jan '19

21 Jan '19

See patch 2/2 for explanation. Peter Krempa (2): tests: qemuxml2argv: Add test case for empty CDROM with cache mode qemu: command: Don't format image properties for empty -drive src/qemu/qemu_command.c | 47 ++++++++++--------- tests/qemuxml2argvdata/disk-cdrom.args | 6 ++- .../disk-cdrom.x86_64-2.12.0.args | 9 ++-- .../disk-cdrom.x86_64-latest.args | 9 ++-- tests/qemuxml2argvdata/disk-cdrom.xml | 6 +++ tests/qemuxml2xmloutdata/disk-cdrom.xml | 6 +++ 6 files changed, 52 insertions(+), 31 deletions(-) -- 2.20.1

3 9

[libvirt] [PATCH 0/4] qemu_conf: use VIR_AUTOFREE in the recently created
by Ján Tomko 21 Jan '19

21 Jan '19

Ján Tomko (4): virQEMUDriverConfigLoadProcessEntry: use VIR_AUTOFREE virQEMUDriverConfigLoadNVRAMEntry: use VIR_AUTOFREE virQEMUDriverConfigLoadSecurityEntry: use VIR_AUTOFREE virQEMUDriverConfigLoadSWTPMEntry: use VIR_AUTOFREE src/qemu/qemu_conf.c | 131 +++++++++++++++++++++------------------------------ 1 file changed, 55 insertions(+), 76 deletions(-) -- 2.16.4

2 8

[libvirt] [PATCH] rpm spec: don't assume %{fedora} exists as a macro
by Daniel P. Berrangé 21 Jan '19

21 Jan '19

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushed under the "fix the previous build breaker fix" rule :-( Sorry. libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 567721f424..823f0753ae 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -110,7 +110,7 @@ %endif # Ceph dropping support for 32-bit hosts -%if 0%{fedora} >= 30 +%if 0%{?fedora} >= 30 %ifarch %{arm} %{ix86} %define with_storage_rbd 0 %endif -- 2.20.1

2 1

[libvirt] [PATCH] config-post: Remove duplicated 'undef WITH_CAPNG'
by Radostin Stoyanov 21 Jan '19

21 Jan '19

Signed-off-by: Radostin Stoyanov <rstoyanov1(a)gmail.com> --- config-post.h | 1 - 1 file changed, 1 deletion(-) diff --git a/config-post.h b/config-post.h index dd4ef8fc0b..54731feff7 100644 --- a/config-post.h +++ b/config-post.h @@ -69,7 +69,6 @@ # undef WITH_VIRTUALPORT # undef WITH_SECDRIVER_SELINUX # undef WITH_SECDRIVER_APPARMOR -# undef WITH_CAPNG #endif /* LIBVIRT_NSS */ #ifndef __GNUC__ -- 2.20.1

2 1

[libvirt] [PATCH 0/8] qemu: VNC: support encrypted server TLS keys
by Ján Tomko 21 Jan '19

21 Jan '19

Applies on top of my qemu.conf cleanups: https://www.redhat.com/archives/libvir-list/2019-January/msg00401.html https://bugzilla.redhat.com/show_bug.cgi?id=1602418 Ján Tomko (8): conf: introduce virDomainGraphicsNew conf: add privateData to virDomainGraphicsDef qemu: add qemuDomainGraphicsPrivate data with a tlsAlias qemu: prepare secret for the graphics upfront qemu_process: fix debug message qemu.conf: add vnc_tls_x509_secret_uuid qemu: add support for encrypted VNC TLS keys qemu: error out when vnc vncTLSx509secretUUID is unsupported src/conf/domain_conf.c | 27 ++++- src/conf/domain_conf.h | 5 + src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf | 6 ++ src/qemu/qemu_command.c | 19 +++- src/qemu/qemu_conf.c | 3 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 102 ++++++++++++++++++ src/qemu/qemu_domain.h | 13 +++ src/qemu/qemu_process.c | 2 +- src/qemu/test_libvirtd_qemu.aug.in | 1 + ...graphics-vnc-tls-secret.x86_64-latest.args | 36 +++++++ .../graphics-vnc-tls-secret.xml | 30 ++++++ tests/qemuxml2argvtest.c | 5 + 14 files changed, 241 insertions(+), 10 deletions(-) create mode 100644 tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/graphics-vnc-tls-secret.xml -- 2.20.1

2 19

[libvirt] [PATCH] rpm spec: disable ceph on 32-bit architectures
by Daniel P. Berrangé 21 Jan '19

21 Jan '19

Ceph in upstream and Fedora has dropped support for building on host architectures which are 32-bit. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushed as a build fix for RPM builds libvirt.spec.in | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index b04cf53eb8..567721f424 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -109,6 +109,12 @@ %define with_storage_zfs 0 %endif +# Ceph dropping support for 32-bit hosts +%if 0%{fedora} >= 30 + %ifarch %{arm} %{ix86} + %define with_storage_rbd 0 + %endif +%endif # RHEL doesn't ship OpenVZ, VBox, PowerHypervisor, # VMware, libxenserver (xenapi), libxenlight (Xen 4.1 and newer), -- 2.20.1

1 0

[libvirt] [PATCH] qemu: fix i6300esb watchdog hotplug on Q35
by Laine Stump 18 Jan '19

18 Jan '19

When commit 361c8dc17 added support for hotplugging the i6300esb watchdog device (first in libvirt-3.9.0), it accidentally contstructed the commandline for the device_add command before allocating a PCI address for the device. With no PCI address specified in the command, the watchdog would simply be placed at the lowest unused PCI slot. On a 440fx guest, this doesn't cause a problem, because libvirt's PCI address allocation algorithm would most likely give the same address anyway (usually a slot on pci-root), so nobody noticed the omission of address from the command. But on a Q35 guest, the lowest unused PCI slot is on pcie-root, which doesn't support hotplug; libvirt knows enough to assign a PCI address that is on a pcie-to-pci-bridge (because its slots *do* support hotplug), but qemu doesn't, so if there is no PCI address in the command, qemu just tries to plug the new device into pcie-root, and fails because it doesn't support hotplug, e.g.: error: Failed to attach device from watchdog.xml error: internal error: unable to execute QEMU command 'device_add': Bus 'pcie.0' does not support hotplugging The solution is simply to build the command string after assigning a PCI address, not before. Resolves: https://bugzilla.redhat.com/1666559 Signed-off-by: Laine Stump <laine(a)laine.org> --- src/qemu/qemu_hotplug.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index a1c3ca999b..40c693483e 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -3280,9 +3280,6 @@ qemuDomainAttachWatchdog(virQEMUDriverPtr driver, if (qemuAssignDeviceWatchdogAlias(watchdog) < 0) return -1; - if (!(watchdogstr = qemuBuildWatchdogDevStr(vm->def, watchdog, priv->qemuCaps))) - return -1; - if (watchdog->model == VIR_DOMAIN_WATCHDOG_MODEL_I6300ESB) { if (qemuDomainEnsurePCIAddress(vm, &dev, driver) < 0) goto cleanup; @@ -3294,6 +3291,9 @@ qemuDomainAttachWatchdog(virQEMUDriverPtr driver, goto cleanup; } + if (!(watchdogstr = qemuBuildWatchdogDevStr(vm->def, watchdog, priv->qemuCaps))) + goto cleanup; + /* QEMU doesn't have a 'dump' action; we tell qemu to 'pause', then libvirt listens for the watchdog event, and we perform the dump ourselves. so convert 'dump' to 'pause' for the qemu cli */ -- 2.20.1

2 1

[libvirt] ANNOUNCE: libvirt-dbus 1.3.0 released
by Pavel Hrdina 18 Jan '19

18 Jan '19

I'm happy to announce the release of libvirt-dbus 1.3.0. libvirt-dbus wraps libvirt API to provide high-level object-oriented API better suited for dbus-based applications. You can download it here: https://libvirt.org/sources/dbus/libvirt-dbus-1.3.0.tar.xz * New features - Support for all relevant interface APIs up to libvirt 3.0.0 * Bug fixes - Storage volumes and with special characters in the name are now correctly listed * Build-system improvements - Detect flake8 automatically - Install daemon under @sbindir@ - Fix version check for dependencies Thanks everybody who contributed! Pavel

1 0