- Devel - libvirt List Archives

[libvirt] [dbus PATCH] data: Allow system access to users in the libvirt group
by Andrea Bolognani 29 Jun '18

29 Jun '18

This is consistent with libvirt's own polkit configuration, which grants users in the libvirt group full administrative access to the system daemon. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- data/system/org.libvirt.conf.in | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/data/system/org.libvirt.conf.in b/data/system/org.libvirt.conf.in index fe61b70..45fd4de 100644 --- a/data/system/org.libvirt.conf.in +++ b/data/system/org.libvirt.conf.in @@ -12,4 +12,8 @@ <allow send_destination="org.libvirt"/> </policy> + <policy group="libvirt"> + <allow send_destination="org.libvirt"/> + </policy> + </busconfig> -- 2.17.1

2 1

[libvirt] [dbus PATCH 0/2] Fix polkit rules directory
by Andrea Bolognani 29 Jun '18

29 Jun '18

See patch 2/2 for the details. Andrea Bolognani (2): configure: Make polkit rules directory configurable configure: Fix default polkit rules directory configure.ac | 5 +++++ data/Makefile.am | 2 +- libvirt-dbus.spec.in | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) -- 2.17.1

2 3

[libvirt] [dbus PATCH] data: Fix indentation in Makefile.am
by Andrea Bolognani 29 Jun '18

29 Jun '18

Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- Pushed as trivial. data/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Makefile.am b/data/Makefile.am index b3fa614..b0e6b31 100644 --- a/data/Makefile.am +++ b/data/Makefile.am @@ -23,7 +23,7 @@ interfaces_files = \ org.libvirt.Domain.xml \ org.libvirt.Network.xml \ org.libvirt.NodeDevice.xml \ - org.libvirt.NWFilter.xml \ + org.libvirt.NWFilter.xml \ org.libvirt.Secret.xml \ org.libvirt.StoragePool.xml \ org.libvirt.StorageVol.xml \ -- 2.17.1

1 0

[libvirt] [PATCH] qemu: Report error on unexpected job stats type
by Jiri Denemark 28 Jun '18

28 Jun '18

If we ever fail to properly set jobinfo->statsType, qemuDomainJobInfoToParams would return -1 without setting an error. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_domain.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index fee44812c1..9afe705929 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -730,6 +730,12 @@ qemuDomainJobInfoToParams(qemuDomainJobInfoPtr jobInfo, return qemuDomainDumpJobInfoToParams(jobInfo, type, params, nparams); case QEMU_DOMAIN_JOB_STATS_TYPE_NONE: + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("invalid job statistics type")); + break; + + default: + virReportEnumRangeError(qemuDomainJobStatsType, jobInfo->statsType); break; } -- 2.18.0

2 3

[libvirt] [PATCH python] Fix bugs in nwfilter binding APIs
by Daniel P. Berrangé 28 Jun '18

28 Jun '18

We did not correctly mangle the API names in two cases, and we also forgot to specialize the lookup method name in the sanity test. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- generator.py | 5 ++++- sanitytest.py | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/generator.py b/generator.py index ae0e45c..bd7ff11 100755 --- a/generator.py +++ b/generator.py @@ -1127,7 +1127,10 @@ def nameFixup(name, classe, type, file): func = func[0:1].lower() + func[1:] elif name[0:27] == "virNWFilterBindingCreateXML": func = name[3:] - func = func[0:1].lower() + func[1:] + func = func[0:3].lower() + func[3:] + elif name[0:24] == "virNWFilterBindingLookup": + func = name[3:] + func = func[0:3].lower() + func[3:] elif name[0:24] == "virNWFilterBindingDefine": func = name[3:] func = func[0:3].lower() + func[3:] diff --git a/sanitytest.py b/sanitytest.py index d5c23dc..68dde6b 100644 --- a/sanitytest.py +++ b/sanitytest.py @@ -260,7 +260,7 @@ for name in sorted(basicklassmap): "LookupByUUIDString", "LookupByVolume" "LookupByName", "LookupByID", "LookupByName", "LookupByKey", "LookupByPath", "LookupByMACString", "LookupByUsage", "LookupByVolume", - "LookupByTargetPath","LookupSCSIHostByWWN", + "LookupByTargetPath","LookupSCSIHostByWWN", "LookupByPortDev", "Restore", "RestoreFlags", "SaveImageDefineXML", "SaveImageGetXMLDesc", "DefineXMLFlags"]: if klass != "virDomain": -- 2.17.1

2 1

[libvirt] [PATCH] qemu: Allow cachetune only for KVM domains
by Michal Privoznik 28 Jun '18

28 Jun '18

https://bugzilla.redhat.com/show_bug.cgi?id=1541921 In TCG mode, there are no vCPU threads and thus there's nothing to be placed into resctrl CGroup. Forbid such configuration. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_domain.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index fee44812c1..a39d9a46a0 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -3980,6 +3980,13 @@ qemuDomainDefValidate(const virDomainDef *def, } } + if (def->ncachetunes && + def->virtType != VIR_DOMAIN_VIRT_KVM) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("cachetune is only supported for KVM domains")); + goto cleanup; + } + if (qemuDomainDefValidateFeatures(def, qemuCaps) < 0) goto cleanup; -- 2.16.4

3 2

[libvirt] [PATCH] security: Add swtpm paths to the domain's AppArmor profile
by Stefan Berger 28 Jun '18

28 Jun '18

This patch extends the AppArmor domain profile with file paths the swtpm accesses for state, log, pid, and socket files. Both, QEMU and swtpm, use this AppArmor profile. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Cc: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- examples/apparmor/libvirt-qemu | 5 +++++ src/security/virt-aa-helper.c | 45 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index 874aca2092..df5f512487 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -158,6 +158,11 @@ /usr/{lib,lib64}/qemu/*.so mr, /usr/lib/(a){multiarch}/qemu/*.so mr, + # swtpm + /{usr/,}bin/swtpm rmix, + /usr/{lib,lib64}/libswtpm_libtpms.so mr, + /usr/lib/(a){multiarch}/libswtpm_libtpms.so mr, + # for save and resume /{usr/,}bin/dash rmix, /{usr/,}bin/dd rmix, diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 971ee6733c..952b496f21 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1181,6 +1181,51 @@ get_files(vahControl * ctl) } } + if (ctl->def->tpm) { + char *shortName = NULL; + const char *tpmpath = NULL; + + switch (ctl->def->tpm->type) { + case VIR_DOMAIN_TPM_TYPE_EMULATOR: + shortName = virDomainDefGetShortName(ctl->def); + + switch (ctl->def->tpm->version) { + case VIR_DOMAIN_TPM_VERSION_1_2: + tpmpath = "tpm1.2"; + break; + case VIR_DOMAIN_TPM_VERSION_2_0: + tpmpath = "tpm2"; + break; + case VIR_DOMAIN_TPM_VERSION_DEFAULT: + case VIR_DOMAIN_TPM_VERSION_LAST: + break; + } + + /* Unix socket for QEMU and swtpm to use */ + virBufferAsprintf(&buf, + " \"/run/libvirt/qemu/swtpm/%s-swtpm.sock\" rw,\n", + shortName); + /* Paths for swtpm to use: give it access to its state + * directory, log, and PID files. + */ + virBufferAsprintf(&buf, + " \"%s/lib/libvirt/swtpm/%s/%s/**\" rw,\n", + LOCALSTATEDIR, uuidstr, tpmpath); + virBufferAsprintf(&buf, + " \"%s/log/swtpm/libvirt/qemu/%s-swtpm.log\" a,\n", + LOCALSTATEDIR, ctl->def->name); + virBufferAsprintf(&buf, + " \"/run/libvirt/qemu/swtpm/%s-swtpm.pid\" rw,\n", + shortName); + + VIR_FREE(shortName); + break; + case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: + case VIR_DOMAIN_TPM_TYPE_LAST: + break; + } + } + if (ctl->def->virtType == VIR_DOMAIN_VIRT_KVM) { for (i = 0; i < ctl->def->nnets; i++) { virDomainNetDefPtr net = ctl->def->nets[i]; -- 2.14.4

2 3

[libvirt] [PATCH] lxc: Rearrange order in lxcDomainUpdateDeviceFlags
by John Ferlan 28 Jun '18

28 Jun '18

Although commit e3497f3f noted that the LIVE option doesn't matter and removed the call to virDomainDefCompatibleDevice, it didn't go quite far enough and change the order of the checks. Since we don't have the possibility of LIVE succeeding and thus the need for a delayed update in order to write the CONFIG change let's just merge the saving of the config into one if statement. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- src/lxc/lxc_driver.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index bde0ff6ad4..6afb36765a 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -4862,6 +4862,12 @@ static int lxcDomainUpdateDeviceFlags(virDomainPtr dom, goto endjob; } + if (flags & VIR_DOMAIN_AFFECT_LIVE) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("Unable to modify live devices")); + goto endjob; + } + if (flags & VIR_DOMAIN_AFFECT_CONFIG) { /* Make a copy for updated domain. */ vmdef = virDomainObjCopyPersistentDef(vm, caps, driver->xmlopt); @@ -4872,17 +4878,7 @@ static int lxcDomainUpdateDeviceFlags(virDomainPtr dom, * device we're going to update. */ if ((ret = lxcDomainUpdateDeviceConfig(vmdef, dev)) < 0) goto endjob; - } - - if (flags & VIR_DOMAIN_AFFECT_LIVE) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("Unable to modify live devices")); - - goto endjob; - } - /* Finally, if no error until here, we can save config. */ - if (flags & VIR_DOMAIN_AFFECT_CONFIG) { ret = virDomainSaveConfig(cfg->configDir, driver->caps, vmdef); if (!ret) { virDomainObjAssignDef(vm, vmdef, false, NULL); -- 2.14.4

2 1

[libvirt] [PATCH 0/2] tests: qemumonitorjson: Fix blockstats test case
by Peter Krempa 28 Jun '18

28 Jun '18

Peter Krempa (2): tests: qemumonitorjson: Add only required replies for blockstats test tests: qemumonitorjson: Fix name and call apropriate API tests/qemumonitorjsontest.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) -- 2.16.2

2 3

[libvirt] [PATCH] qemu: domain: update only newly detected images in qemuDomainDetermineDiskChain
by Peter Krempa 28 Jun '18

28 Jun '18

The processing code which prepares images should be executed really only for the images which were detected. The code actually tried to update the last user-specified layer as well. Thankfully we don't do anything that would be a problem at this point. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index f8a662f747..0fe9bc4b2a 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8377,7 +8377,7 @@ qemuDomainDetermineDiskChain(virQEMUDriverPtr driver, if (virStorageFileGetMetadata(src, uid, gid, report_broken) < 0) goto cleanup; - for (n = src; virStorageSourceIsBacking(n); n = n->backingStore) { + for (n = src->backingStore; virStorageSourceIsBacking(n); n = n->backingStore) { if (qemuDomainValidateStorageSource(n, priv->qemuCaps) < 0) goto cleanup; -- 2.16.2

2 1