- Devel - libvirt List Archives

[libvirt PATCH] apparmor: Allow running /usr/libexec/qemu-kvm
by Andrea Bolognani 30 Nov '22

30 Nov '22

Distros that use AppArmor, such as Debian and Ubuntu, install QEMU under /usr/bin/qemu-system-*, and our AppArmor profile is written with that assumption in mind. If you try to run the RHEL or CentOS version of libvirt and QEMU inside a privileged container on such distros, however, that will result in an error, because the path /usr/libexec/qemu-kvm is used instead. In particular, this prevents upstream KubeVirt releases (which are based on CentOS) from running on Debian/Ubuntu nodes. See https://github.com/kubevirt/kubevirt/pull/8692 and the issues referenced therein for additional details. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- src/security/apparmor/usr.sbin.libvirtd.in | 4 ++++ src/security/apparmor/usr.sbin.virtqemud.in | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/security/apparmor/usr.sbin.libvirtd.in b/src/security/apparmor/usr.sbin.libvirtd.in index 886f1ad518..2994de5ec9 100644 --- a/src/security/apparmor/usr.sbin.libvirtd.in +++ b/src/security/apparmor/usr.sbin.libvirtd.in @@ -99,6 +99,10 @@ profile libvirtd @sbindir@/libvirtd flags=(attach_disconnected) { # read and run an ebtables script. /var/lib/libvirt/virtd* ixr, + # Needed when running the RHEL/CentOS version of libvirt and QEMU + # inside a privileged container on a Debian/Ubuntu host + /usr/libexec/qemu-kvm PUx, + # force the use of virt-aa-helper audit deny /{usr/,}sbin/apparmor_parser rwxl, audit deny /etc/apparmor.d/libvirt/** wxl, diff --git a/src/security/apparmor/usr.sbin.virtqemud.in b/src/security/apparmor/usr.sbin.virtqemud.in index 3de03d49fc..b3f33b9471 100644 --- a/src/security/apparmor/usr.sbin.virtqemud.in +++ b/src/security/apparmor/usr.sbin.virtqemud.in @@ -94,6 +94,10 @@ profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) { # read and run an ebtables script. /var/lib/libvirt/virtd* ixr, + # Needed when running the RHEL/CentOS version of libvirt and QEMU + # inside a privileged container on a Debian/Ubuntu host + /usr/libexec/qemu-kvm PUx, + # force the use of virt-aa-helper audit deny /{usr/,}sbin/apparmor_parser rwxl, audit deny /etc/apparmor.d/libvirt/** wxl, -- 2.38.1

4 12

[PATCH v4 0/7] qemu: tpm: Add support for migration across shared storage
by Stefan Berger 30 Nov '22

30 Nov '22

This series of patches adds support for migrating vTPMs across hosts whose storage has been set up to share the directory structure holding the state of the TPM (swtpm). The existence of share storage influences the management of the directory structure holding the TPM state, which for example is only removed when a domain is undefined and not when a VM is removed on the migration source host. Further, when shared storage is used then security labeling on the destination side is skipped assuming that the labeling was already done on the source side. I have tested this with an NFS setup where I had to turn SELinux off on the hosts since the SELinux MLS range labeling is not supported by NFS. For shared storage support to work properly both sides of the migration need to be clients of the shared storage setup, meaning that they both have to have /var/lib/libvirt/swtpm mounted as shared storage, because other- wise the virFileIsSharedFS() may not detect shared storage and in the worst case may cause the TPM emulator (swtpm) to malfunction if for example the source side removed the TPM state directory structure. Shared storage migration requires (upcoming) swtpm v0.8. Stefan v4: - Fixed long-standing bug regarding offline migration that now blocks if no shared storage is set up - Addressed Michal's concerns v3: - Relying entirely on virFileIsSharedFS() on migration source and destination sides to detect whether shared storage is set up between hosts; no more hint about shared storage from user via flag - Added support for virDomainTPMPrivate structure to store and persist TPM-related private data Stefan Berger (7): util: Add parsing support for swtpm's cmdarg-migration capability qemu: tpm: Allow offline migration with TPM_EMULATOR only with shared storage qemu: tpm: Conditionally create storage on incoming migration qemu: tpm: Add support for storing private TPM-related data qemu: tpm: Pass --migration option to swtpm if supported and needed qemu: tpm: Avoid security labels on incoming migration with shared storage qemu: tpm: Never remove state on outgoing migration and shared storage src/conf/domain_conf.c | 63 ++++++++++++++++++-- src/conf/domain_conf.h | 9 +++ src/qemu/qemu_domain.c | 85 ++++++++++++++++++++++++-- src/qemu/qemu_domain.h | 17 +++++- src/qemu/qemu_driver.c | 20 +++---- src/qemu/qemu_extdevice.c | 10 ++-- src/qemu/qemu_extdevice.h | 6 +- src/qemu/qemu_migration.c | 28 +++++++-- src/qemu/qemu_process.c | 9 ++- src/qemu/qemu_snapshot.c | 4 +- src/qemu/qemu_tpm.c | 122 ++++++++++++++++++++++++++++++++++---- src/qemu/qemu_tpm.h | 14 ++++- src/util/virtpm.c | 1 + src/util/virtpm.h | 1 + 14 files changed, 339 insertions(+), 50 deletions(-) -- 2.37.3

2 18

[libvirt PATCH 0/3] qemu: A few qemuMigrationCookieParse cleanups
by Jiri Denemark 30 Nov '22

30 Nov '22

Jiri Denemark (3): qemu: Reorder qemuMigrationCookieParse arguments qemu: Replace priv with qemuCaps in qemuMigrationCookieParse qemu: Reindent qemuMigrationCookieParse prototype arguments src/qemu/qemu_migration.c | 35 ++++++++++++++++-------------- src/qemu/qemu_migration_cookie.c | 12 ++++------ src/qemu/qemu_migration_cookie.h | 14 ++++++------ tests/qemumigrationcookiexmltest.c | 6 ++--- 4 files changed, 33 insertions(+), 34 deletions(-) -- 2.38.1

2 4

[PATCH] node_device_conf: Avoid memleak in virNodeDeviceGetPCIVPDDynamicCap()
by Michal Privoznik 30 Nov '22

30 Nov '22

The virNodeDeviceGetPCIVPDDynamicCap() function is called from virNodeDeviceGetPCIDynamicCaps() and therefore has to be a wee bit more clever about adding VPD capability. Namely, it has to remove the old one before adding a new one. This is how other functions called from virNodeDeviceGetPCIDynamicCaps() behave as well. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2143235 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/conf/node_device_conf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c index 83e66b85e3..af331baaf3 100644 --- a/src/conf/node_device_conf.c +++ b/src/conf/node_device_conf.c @@ -3068,6 +3068,9 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev) virPCIDeviceAddress devAddr = { 0 }; g_autoptr(virPCIVPDResource) res = NULL; + g_clear_pointer(&devCapPCIDev->vpd, virPCIVPDResourceFree); + devCapPCIDev->flags &= ~VIR_NODE_DEV_CAP_FLAG_PCI_VPD; + devAddr.domain = devCapPCIDev->domain; devAddr.bus = devCapPCIDev->bus; devAddr.slot = devCapPCIDev->slot; @@ -3081,8 +3084,6 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev) if ((res = virPCIDeviceGetVPD(pciDev))) { devCapPCIDev->flags |= VIR_NODE_DEV_CAP_FLAG_PCI_VPD; devCapPCIDev->vpd = g_steal_pointer(&res); - } else { - virPCIVPDResourceFree(g_steal_pointer(&devCapPCIDev->vpd)); } } return 0; -- 2.37.4

2 1

[libvirt PATCH] qemu: Pass vm to qemuMigrationCookieParse if it exists
by Jiri Denemark 30 Nov '22

30 Nov '22

The vm object is used inside qemuMigrationCookieParse based on the flags passed to qemuMigrationCookieParse and the content of the cookie. The callers should not just blindly guess and pass NULL if they (incorrectly) think the vm object is not needed. We should always pass the vm object unless it does not exist yet. This fixes a bug when statistics of a completed migration reported "Unknown" operation instead of "Incoming migration" on the destination host. https://bugzilla.redhat.com/show_bug.cgi?id=2137298 Fixes: v8.7.0-79-g0150f7a8c1 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_migration.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index bef06f4caf..6d3810c79c 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -4775,7 +4775,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_GRAPHICS | QEMU_MIGRATION_COOKIE_CAPS | QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS, - NULL); + vm); if (!mig) goto error; @@ -6459,7 +6459,7 @@ qemuMigrationDstFinishOffline(virQEMUDriver *driver, g_autoptr(qemuMigrationCookie) mig = NULL; if (!(mig = qemuMigrationCookieParse(driver, vm->def, priv->origname, priv, - cookiein, cookieinlen, cookie_flags, NULL))) + cookiein, cookieinlen, cookie_flags, vm))) return NULL; if (qemuMigrationDstPersist(driver, vm, mig, false) < 0) @@ -6655,7 +6655,7 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, vm, flags, retcode); if (!(mig = qemuMigrationCookieParse(driver, vm->def, priv->origname, priv, - cookiein, cookieinlen, cookie_flags, NULL))) + cookiein, cookieinlen, cookie_flags, vm))) goto error; if (retcode != 0) { -- 2.38.1

2 1

[PATCH 0/2] logging: add log cleanup for obsolete domains
by Oleg Vasilev 30 Nov '22

30 Nov '22

Motivation comes from the case when libguestfs has repeatedly created transient VMs, which in turn created lots of logs without any mechanism to delete it afterwards. More motivation in [1]. Previous attempt in [2]. [1]: https://listman.redhat.com/archives/libvir-list/2022-February/msg00425.html [2]: https://listman.redhat.com/archives/libvir-list/2022-February/msg00865.html Oleg Vasilev (2): logging: refactor to store config inside log handler logging: add log cleanup for obsolete domains src/logging/log_daemon.c | 6 +- src/logging/log_daemon_config.c | 9 ++ src/logging/log_daemon_config.h | 3 + src/logging/log_handler.c | 137 +++++++++++++++++++++++++++---- src/logging/log_handler.h | 17 ++-- src/logging/test_virtlogd.aug.in | 2 + src/logging/virtlogd.aug | 2 + src/logging/virtlogd.conf | 7 ++ 8 files changed, 153 insertions(+), 30 deletions(-) -- 2.38.1

2 5

[PATCH] Fix couple of comment typos
by Martin Kletzander 30 Nov '22

30 Nov '22

Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Pushed as trivial. examples/c/admin/list_clients.c | 2 +- examples/c/admin/logging.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/c/admin/list_clients.c b/examples/c/admin/list_clients.c index 70907b4fba2f..169c9a7ec814 100644 --- a/examples/c/admin/list_clients.c +++ b/examples/c/admin/list_clients.c @@ -53,7 +53,7 @@ int main(int argc, char **argv) { int ret = -1; virAdmConnectPtr conn = NULL; - virAdmServerPtr srv = NULL; /* which server list the clients from */ + virAdmServerPtr srv = NULL; /* which server to list the clients from */ virAdmClientPtr *clients = NULL; /* where to store the servers */ ssize_t i = 0; int count = 0; diff --git a/examples/c/admin/logging.c b/examples/c/admin/logging.c index 730ae40d9d53..575d15a3a67c 100644 --- a/examples/c/admin/logging.c +++ b/examples/c/admin/logging.c @@ -77,7 +77,7 @@ int main(int argc, char **argv) goto cleanup; } - /* now, try to change the redefine the current log output and filters */ + /* now, try to change the current log output and filters */ if (virAdmConnectSetLoggingOutputs(conn, set_outputs, 0) < 0) goto cleanup; -- 2.38.1

1 0

[PATCH] selinux: Reflect context_str() type change
by Michal Privoznik 29 Nov '22

29 Nov '22

As of [1]. libselinux changed the type of context_str() - it now returns a const string. Follow this change in our code base. 1: https://github.com/SELinuxProject/selinux/commit/dd98fa322766760c4e1f029cf1… Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/security/security_selinux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 1f72f61cac..92e85c92e0 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -526,7 +526,7 @@ static char * virSecuritySELinuxContextAddRange(char *src, char *dst) { - char *str = NULL; + const char *str = NULL; char *ret = NULL; context_t srccon = NULL; context_t dstcon = NULL; @@ -567,7 +567,7 @@ virSecuritySELinuxGenNewContext(const char *basecontext, { context_t context = NULL; char *ret = NULL; - char *str; + const char *str; char *ourSecContext = NULL; context_t ourContext = NULL; -- 2.37.4

2 1

Entering freeze for libvirt-8.10.0
by Jiri Denemark 29 Nov '22

29 Nov '22

I have just tagged v8.10.0-rc1 in the repository and pushed signed tarballs and source RPMs to https://libvirt.org/sources/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Thanks, Jirka

1 1

[PATCH 0/2] qemu: refresh state after reset
by Kristina Hanicova 29 Nov '22

29 Nov '22

This series implements domain state refreshing after reset from libvirt API and reboot from the guest OS. Kristina Hanicova (2): qemu: refresh state after reset qemu: refresh state after reboot initiated from the guest src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 22 +++++++++++++++++++++- src/qemu/qemu_process.c | 2 ++ 4 files changed, 25 insertions(+), 1 deletion(-) -- 2.38.1

2 3