- Devel - libvirt List Archives

[libvirt] Error in virt-install
by Nuno Fernandes 10 Mar '09

10 Mar '09

Hi, I've just installed an centos 5.2 with all the updates 'till now. Next i've tried the following install script that worked fine: virt-install -n test -r 512 --vnc --file=/dev/VolGroup00/test-os -- location=ftp://mirrors/centos/5/os/i386 -x 'text' Next i've rebuild rpm of libvirt to libvirt-0.6.1 (using --with-rhel5-api). The rpm build fine and installed without any errors. Next i've retried the virt-install script but i get the following error: [root@localhost ~]# virt-install -n test -r 512 --vnc -- file=/dev/VolGroup00/test-os --location=ftp://mirrors/centos/5/os/i386 -x 'text' Starting install... *** glibc detected *** /usr/bin/python: free(): invalid next size (fast): 0x0936a1b8 *** ======= Backtrace: ========= /lib/i686/nosegneg/libc.so.6[0x1e0906] /lib/i686/nosegneg/libc.so.6(cfree+0x90)[0x1e3e30] /usr/lib/libvirt.so.0(virFree+0x24)[0x8eb4e4] /usr/lib/libvirt.so.0[0x94793c] /usr/lib/libvirt.so.0[0x93abf1] /usr/lib/libvirt.so.0(virDomainLookupByUUID+0xb7)[0x8fda77] /usr/lib/libvirt.so.0(virDomainLookupByUUIDString+0x17f)[0x8ffbaf] /usr/lib/python2.4/site- packages/libvirtmod.so(libvirt_virDomainLookupByUUIDString+0x6d)[0xfa349d] /usr/lib/libpython2.4.so.1.0(PyCFunction_Call+0x14d)[0x67249d] /usr/lib/libpython2.4.so.1.0(PyEval_EvalFrame+0x498d)[0x6ac9cd] /usr/lib/libpython2.4.so.1.0(PyEval_EvalFrame+0x44ff)[0x6ac53f] /usr/lib/libpython2.4.so.1.0(PyEval_EvalFrame+0x44ff)[0x6ac53f] /usr/lib/libpython2.4.so.1.0(PyEval_EvalCodeEx+0x896)[0x6adc76] /usr/lib/libpython2.4.so.1.0[0x65fcba] /usr/lib/libpython2.4.so.1.0(PyObject_Call+0x37)[0x647d87] /usr/lib/libpython2.4.so.1.0[0x64e388] /usr/lib/libpython2.4.so.1.0(PyObject_Call+0x37)[0x647d87] /usr/lib/libpython2.4.so.1.0(PyEval_EvalFrame+0x2518)[0x6aa558] /usr/lib/libpython2.4.so.1.0(PyEval_EvalFrame+0x44ff)[0x6ac53f] /usr/lib/libpython2.4.so.1.0(PyEval_EvalCodeEx+0x896)[0x6adc76] /usr/lib/libpython2.4.so.1.0(PyEval_EvalFrame+0x43f6)[0x6ac436] /usr/lib/libpython2.4.so.1.0(PyEval_EvalCodeEx+0x896)[0x6adc76] /usr/lib/libpython2.4.so.1.0(PyEval_EvalFrame+0x43f6)[0x6ac436] /usr/lib/libpython2.4.so.1.0(PyEval_EvalCodeEx+0x896)[0x6adc76] /usr/lib/libpython2.4.so.1.0(PyEval_EvalCode+0x63)[0x6add03] /usr/lib/libpython2.4.so.1.0[0x6caad8] /usr/lib/libpython2.4.so.1.0(PyRun_SimpleFileExFlags+0x198)[0x6cc1e8] /usr/lib/libpython2.4.so.1.0(PyRun_AnyFileExFlags+0x7a)[0x6cc8ca] /usr/lib/libpython2.4.so.1.0(Py_Main+0xb85)[0x6d32d5] /usr/bin/python(main+0x32)[0x80485b2] /lib/i686/nosegneg/libc.so.6(__libc_start_main+0xdc)[0x18cdec] /usr/bin/python[0x80484c1] ======= Memory map: ======== 00110000-00112000 r-xp 00000000 fd:00 393272 /lib/libutil-2.5.so 00112000-00113000 r-xp 00001000 fd:00 393272 /lib/libutil-2.5.so 00113000-00114000 rwxp 00002000 fd:00 393272 /lib/libutil-2.5.so 00114000-00117000 r-xp 00000000 fd:00 1835042 /usr/lib/python2.4/lib- dynload/fcntlmodule.so 00117000-00118000 rwxp 00003000 fd:00 1835042 /usr/lib/python2.4/lib- dynload/fcntlmodule.so 00118000-0011b000 r-xp 00000000 fd:00 1835035 /usr/lib/python2.4/lib- dynload/cStringIO.so 0011b000-0011c000 rwxp 00003000 fd:00 1835035 /usr/lib/python2.4/lib- dynload/cStringIO.so 0011c000-0011f000 r-xp 00000000 fd:00 1835067 /usr/lib/python2.4/lib- dynload/timemodule.so 0011f000-00121000 rwxp 00002000 fd:00 1835067 /usr/lib/python2.4/lib- dynload/timemodule.so 00121000-00125000 r-xp 00000000 fd:00 1835037 /usr/lib/python2.4/lib- dynload/collectionsmodule.so 00125000-00126000 rwxp 00003000 fd:00 1835037 /usr/lib/python2.4/lib- dynload/collectionsmodule.so 00126000-0016c000 r-xp 00000000 fd:00 1835465 /usr/lib/python2.4/site- packages/libxml2mod.so 0016c000-00171000 rwxp 00046000 fd:00 1835465 /usr/lib/python2.4/site- packages/libxml2mod.so 00172000-00175000 r-xp 00000000 fd:00 1835023 /usr/lib/python2.4/lib- dynload/_localemodule.so 00175000-00176000 rwxp 00003000 fd:00 1835023 /usr/lib/python2.4/lib- dynload/_localemodule.so 00176000-00177000 r-xp 00176000 00:00 0 [vdso] 00177000-002b7000 r-xp 00000000 fd:00 393297 /lib/i686/nosegneg/libc-2.5.so 002b7000-002b9000 r-xp 00140000 fd:00 393297 /lib/i686/nosegneg/libc-2.5.so 002b9000-002ba000 rwxp 00142000 fd:00 393297 /lib/i686/nosegneg/libc-2.5.so 002ba000-002bd000 rwxp 002ba000 00:00 0 002bd000-003e9000 r-xp 00000000 fd:00 1642546 /usr/lib/libxml2.so.2.6.26 003e9000-003ee000 rwxp 0012c000 fd:00 1642546 /usr/lib/libxml2.so.2.6.26 003ee000-003ef000 rwxp 003ee000 00:00 0 003ef000-00401000 r-xp 00000000 fd:00 1642814 /usr/lib/libz.so.1.2.3 00401000-00402000 rwxp 00011000 fd:00 1642814 /usr/lib/libz.so.1.2.3 00402000-00405000 r-xp 00000000 fd:00 1835027 /usr/lib/python2.4/lib- dynload/_ssl.so 00405000-00406000 rwxp 00003000 fd:00 1835027 /usr/lib/python2.4/lib- dynload/_ssl.so 00406000-00447000 r-xp 00000000 fd:00 393226 /lib/libssl.so.0.9.8b 00447000-0044b000 rwxp 00040000 fd:00 393226 /lib/libssl.so.0.9.8b 0044b000-00477000 r-xp 00000000 fd:00 1642465 /usr/lib/libgssapi_krb5.so.2.2 00477000-00478000 rwxp 0002c000 fd:00 1642465 /usr/lib/libgssapi_krb5.so.2.2 00478000-00480000 r-xp 00000000 fd:00 1644106 /usr/lib/libkrb5support.so.0.1 00480000-00481000 rwxp 00007000 fd:00 1644106 /usr/lib/libkrb5support.so.0.1 00481000-00483000 r-xp 00000000 fd:00 1835049 /usr/lib/python2.4/lib- dynload/md5module.so 00483000-00484000 rwxp 00002000 fd:00 1835049 /usr/lib/python2.4/lib- dynload/md5module.so 00484000-00487000 r-xp 00000000 fd:00 1835061 /usr/lib/python2.4/lib- dynload/shamodule.so 00487000-00488000 rwxp 00002000 fd:00 1835061 /usr/lib/python2.4/lib- dynload/shamodule.so 00488000-00489000 r-xp 00000000 fd:00 1835029 /usr/lib/python2.4/lib- dynload/_weakref.so 00489000-0048a000 rwxp 00000000 fd:00 1835029 /usr/lib/python2.4/lib- dynload/_weakref.so 0048a000-0048e000 r-xp 00000000 fd:00 1835052 /usr/lib/python2.4/lib- dynload/operator.so 0048e000-0048f000 rwxp 00004000 fd:00 1835052 /usr/lib/python2.4/lib- dynload/operator.so 0048f000-00492000 r-xp 00000000 fd:00 1649254 /usr/lib/libgpg- error.so.0.3.0 00492000-00493000 rwxp 00002000 fd:00 1649254 /usr/lib/libgpg- error.so.0.3.0 00493000-00495000 r-xp 00000000 fd:00 394821 /lib/libcom_err.so.2.1 00495000-00496000 rwxp 00001000 fd:00 394821 /lib/libcom_err.so.2.1 00496000-0049a000 r-xp 00000000 fd:00 1649345 /usr/lib/libnuma.so.1 0049a000-0049b000 rwxp 00004000 fd:00 1649345 /usr/lib/libnuma.so.1 0049d000-0049f000 r-xp 00000000 fd:00 393246 /lib/libdl-2.5.so 0049f000-004a0000 r-xp 00001000 fd:00 393246 /lib/libdl-2.5.so 004a0000-004a1000 rwxp 00002000 fd:00 393246 /lib/libdl-2.5.so 004a1000-005be000 r-xp 00000000 fd:00 393218 /lib/libcrypto.so.0.9.8b 005be000-005d1000 rwxp 0011c000 fd:00 393218 /lib/libcrypto.so.0.9.8b 005d1000-005d4000 rwxp 005d1000 00:00 0 005d4000-005ea000 r-xp 00000000 fd:00 394806 /lib/libselinux.so.1 005ea000-005ec000 rwxp 00015000 fd:00 394806 /lib/libselinux.so.1 005ec000-005fa000 r-xp 00000000 fd:00 1835039 /usr/lib/python2.4/lib- dynload/datetime.so 005fa000-005fd000 rwxp 0000d000 fd:00 1835039 /usr/lib/python2.4/lib- dynload/datetime.so 005fd000-0060d000 r-xp 00000000 fd:00 1835034 /usr/lib/python2.4/lib- dynload/cPickle.so 0060d000-0060e000 rwxp 00010000 fd:00 1835034 /usr/lib/python2.4/lib- dynload/cPickle.so 0060e000-00612000 r-xp 00000000 fd:00 1646395 /usr/lib/libxenstore.so.3.0.0 00612000-00613000 rwxp 00003000 fd:00 1646395 /usr/lib/libxenstore.so.3.0.0 00613000-00616000 rwxp 00613000 00:00 0 00616000-00619000 r-xp 00000000 fd:00 1835071 /usr/lib/python2.4/lib- dynload/zlibmodule.so 00619000-0061a000 rwxp 00003000 fd:00 1835071 /usr/lib/python2.4/lib- dynload/zlibmodule.so 0061a000-00625000 r-xp 00000000 fd:00 394812 /lib/libgcc_s-4.1.2-20080102.so.1 00625000-00626000 rwxp 0000a000 fd:00 394812 /lib/libgcc_s-4.1.2-20080102.so.1 00628000-0071b000 r-xp 00000000 fd:00 1644304 /usr/lib/libpython2.4.so.1.0 0071b000-0073d000 rwxp 000f3000 fd:00 1644304 /usr/lib/libpython2.4.so.1.0 0073d000-00740000 rwxp 0073d000 00:00 0 00740000-0077b000 r-xp 00000000 fd:00 394805 /lib/libsepol.so.1 0077b000-0077c000 rwxp 0003a000 fd:00 394805 /lib/libsepol.so.1 0077c000-00786000 rwxp 0077c000 00:00 0 00786000-007ac000 r-xp 00000000 fd:00 1835055 /usr/lib/python2.4/lib- dynload/pyexpat.so 007ac000-007af000 rwxp 00026000 fd:00 1835055 /usr/lib/python2.4/lib- dynload/pyexpat.so 007af000-007c2000 r-xp 00000000 fd:00 393250 /lib/libnsl-2.5.so 007c2000-007c3000 r-xp 00012000 fd:00 393250 /lib/libnsl-2.5.so 007c3000-007c4000 rwxp 00013000 fd:00 393250 /lib/libnsl-2.5.so 007c4000-007c6000 rwxp 007c4000 00:00 0 007c8000-007cc000 r-xp 00000000 fd:00 1835032 /usr/lib/python2.4/lib- dynload/binascii.so 007cc000-007cd000 rwxp 00003000 fd:00 1835032 /usr/lib/python2.4/lib- dynload/binascii.so 007cd000-00819000 r-xp 00000000 fd:00 1870995 /usr/lib/python2.4/site- packages/M2Crypto/__m2crypto.so 00819000-0081d000 rwxp 0004b000 fd:00 1870995 /usr/lib/python2.4/site- packages/M2Crypto/__m2crypto.so 0081d000-0081e000 rwxp 0081d000 00:00 0 0083a000-00843000 r-xp 00000000 fd:00 1835026 /usr/lib/python2.4/lib- dynload/_socketmodule.so 00843000-00846000 rwxp 00009000 fd:00 1835026 /usr/lib/python2.4/lib- dynload/_socketmodule.so 00846000-008d6000 r-xp 00000000 fd:00 1643455 /usr/lib/libkrb5.so.3.3 008d6000-008d9000 rwxp 0008f000 fd:00 1643455 /usr/lib/libkrb5.so.3.3 008d9000-0096c000 r-xp 00000000 fd:00 1647990 /usr/lib/libvirt.so.0.6.1 0096c000-0096e000 rwxp 00092000 fd:00 1647990 /usr/lib/libvirt.so.0.6.1 0096e000-0097e000 rwxp 0096e000 00:00 0 009bb000-009ce000 r-xp 00000000 fd:00 393227 /lib/i686/nosegneg/libpthread-2.5.so 009ce000-009cf000 r-xp 00012000 fd:00 393227 /lib/i686/nosegneg/libpthread-2.5.so 009cf000-009d0000 rwxp 00013000 fd:00 393227 /lib/i686/nosegneg/libpthread-2.5.so 009d0000-009d2000 rwxp 009d0000 00:00 0 009d2000-00a25000 r-xp 00000000 fd:00 1651434 /usr/lib/libgcrypt.so.11.2.2 00a25000-00a27000 rwxp 00053000 fd:00 1651434 /usr/lib/libgcrypt.so.11.2.2 00a56000-00a58000 r-xp 00000000 fd:00 394819 /lib/libkeyutils-1.2.so 00a58000-00a59000 rwxp 00001000 fd:00 394819 /lib/libkeyutils-1.2.so 00b36000-00b5b000 r-xp 00000000 fd:00 1642678 /usr/lib/libk5crypto.so.3.1 00b5b000-00b5c000 rwxp 00025000 fd:00 1642678 /usr/lib/libk5crypto.so.3.1 00bd2000-00bf7000 r-xp 00000000 fd:00 393225 /lib/i686/nosegneg/libm-2.5.so 00bf7000-00bf8000 r-xp 00024000 fd:00 393225 /lib/i686/nosegneg/libm-2.5.so 00bf8000-00bf9000 rwxp 00025000 fd:00 393225 /lib/i686/nosegneg/libm-2.5.so 00c02000-00c0b000 r-xp 00000000 fd:00 393244 /lib/libcrypt-2.5.so 00c0b000-00c0c000 r-xp 00008000 fd:00 393244 /lib/libcrypt-2.5.so 00c0c000-00c0d000 rwxp 00009000 fd:00 393244 /lib/libcrypt-2.5.so 00c0d000-00c34000 rwxp 00c0d000 00:00 0 00cef000-00cf2000 r-xp 00000000 fd:00 1835060 /usr/lib/python2.4/lib- dynload/selectmodule.so 00cf2000-00cf3000 rwxp 00002000 fd:00 1835060 /usr/lib/python2.4/lib- dynload/selectmodule.so 00d03000-00d12000 r-xp 00000000 fd:00 393266 /lib/libresolv-2.5.so 00d12000-00d13000 r-xp 0000e000 fd:00 393266 /lib/libresolv-2.5.so 00d13000-00d14000 rwxp 0000f000 fd:00 393266 /lib/libresolv-2.5.so 00d14000-00d16000 rwxp 00d14000 00:00 0 00d2c000-00d30000 r-xp 00000000 fd:00 1835064 /usr/lib/python2.4/lib- dynload/structmodule.so 00d30000-00d31000 rwxp 00004000 fd:00 1835064 /usr/lib/python2.4/lib- dynload/structmodule.so 00dad000-00dae000 r-xp 00000000 fd:00 1835010 /usr/lib/python2.4/lib- dynload/_bisect.so 00dae000-00daf000 rwxp 00001000 fd:00 1835010 /usr/lib/python2.4/lib- dynload/_bisect.so 00daf000-00e26000 r-xp 00000000 fd:00 1642695 /usr/lib/libgnutls.so.13.0.6 00e26000-00e2c000 rwxp 00076000 fd:00 1642695 /usr/lib/libgnutls.so.13.0.6 00e31000-00e33000 r-xp 00000000 fd:00 1835025 /usr/lib/python2.4/lib- dynload/_randommodule.so 00e33000-00e34000 rwxp 00002000 fd:00 1835025 /usr/lib/python2.4/lib- dynload/_randommodule.so 00e7d000-00e81000 r-xp 00000000 fd:00 1835063 /usr/lib/python2.4/lib- dynload/stropmodule.so 00e81000-00e83000 rwxp 00003000 fd:00 1835063 /usr/lib/python2.4/lib- dynload/stropmodule.so 00eb5000-00eb8000 r-xp 00000000 fd:00 1835048 /usr/lib/python2.4/lib- dynload/mathmodule.so 00eb8000-00eb9000 rwxp 00002000 fd:00 1835048 /usr/lib/python2.4/lib- dynload/mathmodule.so 00f01000-00f1b000 r-xp 00000000 fd:00 393233 /lib/ld-2.5.so 00f1b000-00f1c000 r-xp 00019000 fd:00 393233 /lib/ld-2.5.so 00f1c000-00f1d000 rwxp 0001a000 fd:00 393233 /lib/ld-2.5.so 00f95000-00fa5000 r-xp 00000000 fd:00 1836431 /usr/lib/python2.4/site- packages/libvirtmod.so 00fa5000-00fa6000 rwxp 00010000 fd:00 1836431 /usr/lib/python2.4/site- packages/libvirtmod.so 07fe5000-07ffd000 r-xp 00000000 fd:00 1644078 /usr/lib/libsasl2.so.2.0.22 07ffd000-07ffe000 rwxp 00017000 fd:00 1644078 /usr/lib/libsasl2.so.2.0.22 08048000-08049000 r-xp 00000000 fd:00 1651446 /usr/bin/python 08049000-0804a000 rw-p 00000000 fd:00 1651446 /usr/bin/python 091d3000-093cb000 rw-p 091d3000 00:00 0 b6e00000-b6e21000 rw-p b6e00000 00:00 0 b6e21000-b6f00000 ---p b6e21000 00:00 0 b6fb6000-b6fbd000 r--s 00000000 fd:00 1704837 /usr/lib/gconv/gconv- modules.cache b6fbd000-b6ffe000 rw-p b6fbd000 00:00 0 b6ffe000-b6fff000 ---p b6ffe000 00:00 0 b6fff000-b7ac2000 rw-p b6fff000 00:00 0 b7ac3000-b7ceb000 rw-p b7ac3000 00:00 0 b7cec000-b7eec000 r--p 00000000 fd:00 1651479 /usr/lib/locale/locale- archive b7eec000-b7f70000 rw-p b7eec000 00:00 0 b7f75000-b7f78000 rw-p b7f75000 00:00 0 bfaea000-bfaff000 rw-p bfaea000 00:00 0 [stack] Aborted I've memtested the memory and its fine. If i use a file as the target (instead of a block device) it also works: virt-install -n test -r 512 --vnc --file=/tmp/test-os --file-size=2 -- location=ftp://mirrors/centos/5/os/i386 Any ideas? Thanks, Nuno Fernandes

3 7

[libvirt] PATCH: 0/25: Full thread support for libvirt public API
by Daniel P. Berrange 10 Mar '09

10 Mar '09

This patch series is (mostly) aimed at providing full support for threads in the libvirt API. Specifically we remove the restriction that a single virConnectPtr is tied to a thread. Multiple threads can safely use the same object (provided one doesn't free it behind another's back :-P ) This is tested to compile on Linux + Win32 (MinGW), hopefully doesn't break Solaris, but I'll be testing that soon too. I've tortured the patches in various nasty ways are they're now stable enough to let loose and probably merge for wider testing. It'll probably be easier to just fix future problems in tree, rather than maintain this patchset longer. The full patchset is also available here http://berrange.fedorapeople.org/libvirt-threads-2009-01-13/ Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

7 166

[libvirt] OCaml libvirt bindings 0.6.1.0 released
by Richard W.M. Jones 10 Mar '09

10 Mar '09

http://libvirt.org/ocaml/ Not a lot of change, since the bindings are pretty much stable now. The main change, and reason for this release, was that since CVE-2008-5086 the virDomainBlockPeek and virDomainMemoryPeek bindings now require a read/write libvirt connection. This broke mlvirsh and virt-df which were requesting a read-only connection. I have now changed this (thanks David Lutterkort for pointing out the problem). Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top

1 0

[libvirt] [Patch] Fix detach tap device on Xen3.3.1
by Takahashi Tomohiro 10 Mar '09

10 Mar '09

Hi, I made the patch that corrected the following problem. It is that when I executed the "virsh detach-disk" command on Xen3.3.1, Libvirt could not detach tap device and output the following error message. # virsh detach-disk Fedora xvdd libvir: Xen Daemon error : POST operation failed: xend_post: error from xen daemon: (xend.err 'Device 51760 not connected') The cause of this problem is incompatible of Xen3.3.0 and Xen3.3.1. I think Xen specific was changed by the following patch. http://xenbits.xensource.com/xen-3.3-testing.hg?rev/e0e17216ba70 If you have any comments, please suggest me. Signed-off-by: Tomohiro Takahashi <takatom(a)jp.fujitsu.com> Thanks, Tomohiro Takahashi diff -uNrp libvirt.orig/src/xend_internal.c libvirt/src/xend_internal.c --- libvirt.orig/src/xend_internal.c 2009-02-14 03:23:23.000000000 +0900 +++ libvirt/src/xend_internal.c 2009-03-09 12:28:48.000000000 +0900 @@ -5566,7 +5566,11 @@ virDomainXMLDevID(virDomainPtr domain, char *xref; if (dev->type == VIR_DOMAIN_DEVICE_DISK) { - strcpy(class, "vbd"); + if (!(strcmp(dev->data.disk->driverName, "tap"))) { + strcpy(class, "tap"); + } else { + strcpy(class, "vbd"); + } if (dev->data.disk->dst == NULL) return -1; xenUnifiedLock(priv);

2 3

[libvirt] [ANNOUNCE] New release virt-manager 0.7.0
by Cole Robinson 10 Mar '09

10 Mar '09

I'm happy to announce a new virt-manager release, version 0.7.0. The release can be downloaded from: http://virt-manager.org/download.html The direct download link is: http://virt-manager.org/download/sources/virt-manager/virt-manager-0.7.0.ta… This release includes: - Redesigned 'New Virtual Machine' wizard (Jeremy Perry, Tim Allen, Cole Robinson) - Option to remove storage when deleting a virtual machine. - File browser for libvirt storage pools and volumes, for use when attaching storage to a new or existing guest. - Physical device assignment (PCI, USB) for existing virtual machines. - Bug fixes and minor improvements. Thanks to everyone who has contributed to this release through testing, bug reporting, submitting patches, and otherwise sending in feedback! Thanks, Cole

1 0

[libvirt] Re: [et-mgmt-tools] latest virt-manager and virtinst on centos-5
by Cole Robinson 09 Mar '09

09 Mar '09

Farkas Levente wrote: > hi, > the these packages: > virt-manager-0.6.1-4 > python-virtinst-0.400.2-3 > libvirt-python-0.6.1-1 > libvirt-0.6.1-1 > on centos-5 gives this error when i try to install a new guest after > press finish in virt manager: > -------------------------------------------- > Unable to complete install 'libvirt.libvirtError internal error unable > to start guest: > Traceback (most recent call last): > File "/usr/share/virt-manager/virtManager/create.py", line 717, in > do_install > dom = guest.start_install(False, meter = meter) > File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 536, > in start_install > return self._do_install(consolecb, meter, removeOld, wait) > File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 628, > in _do_install > self.domain = self.conn.createLinux(install_xml, 0) > File "/usr/lib64/python2.4/site-packages/libvirt.py", line 973, in > createLinux > if ret is None:raise libvirtError('virDomainCreateLinux() failed', > conn=self) > libvirtError: internal error unable to start guest: > ' This was a libvirt bug that should have been fixed in the latest release. Could be some other variant of it since you are running centos. - Cole

1 0

[libvirt] libvirt 0.6.1 not playing well with RHEL5.2 lokkit
by Charles Duffy 09 Mar '09

09 Mar '09

Howdy. I'm running RHEL5.2, and libvirt 0.6.1. I don't use the distro-provided firewall (system-config-securitylevel-tui-1.6.29.1-2.1.el5) and have it completely disabled, but libvirt appears to be having some trouble ascertaining as much: > libvirtd: 14:05:42.807: warning : Failed to read /etc/sysconfig/system-config-firewall > last message repeated 2 times > kernel: fvtebr0: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature. > kernel: fvtebr0: starting userspace STP failed, starting kernel STP > libvirtd: 14:06:34.825: error : internal error '/usr/sbin/lokkit --nostart --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/INPUT.chain' exited with non-zero status 1 and signal 0: --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/INPUT.chain: unknown option > libvirtd: 14:06:34.825: warning : Failed to run '/usr/sbin/lokkit --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/INPUT.chain': Invalid argument > libvirtd: 14:06:34.828: error : internal error '/usr/sbin/lokkit --nostart --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/FORWARD.chain' exited with non-zero status 1 and signal 0: --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/FORWARD.chain: unknown option > libvirtd: 14:06:34.828: warning : Failed to run '/usr/sbin/lokkit --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/FORWARD.chain': Invalid argument > libvirtd: 14:06:34.831: error : internal error '/usr/sbin/lokkit --nostart --custom-rules=ipv4:nat:/var/lib/libvirt/iptables/nat/POSTROUTING.chain' exited with non-zero status 1 and signal 0: --custom-rules=ipv4:nat:/var/lib/libvirt/iptables/nat/POSTROUTING.chain: unknown option > libvirtd: 14:06:34.831: warning : Failed to run '/usr/sbin/lokkit --custom-rules=ipv4:nat:/var/lib/libvirt/iptables/nat/POSTROUTING.chain': Invalid argument

2 1

[Fwd: Re: [libvirt] Libvirt audio xml format]
by Simon Lambourn 09 Mar '09

09 Mar '09

1 0

[libvirt] FileSystem Creation for Logical Storage Volume
by Martin Gajdos 08 Mar '09

08 Mar '09

Hi there As I haven't found this information anywhere else, I'm trying this mailing list. I would like to know if it's possible to create a filesystem (ext3 for e.g.) along with a storage volume with libvirt. The volumes are located on a remote system. So is there function in libvirt for this? and if not, what would be the way to go? Thanks Martin Gajdos

1 0

[libvirt] Libvirt audio xml format
by Simon Lambourn 07 Mar '09

07 Mar '09

Hi, excuse the possible dumb question from a new KVM/Libvirt user - I'm very impressed overall but struggling to work out how to define an audio device in the libvirt xml. I have a virtualised windows XP up & running, now want to add an audio device. I can see how to do it in kvm and I believe audio devices are now supported in libvirt, but could not find documentation on how to write the xml. System is Ubuntu 8.10 on AMD64. Thanks in anticipation.

2 1

[libvirt] lxc: dominfo.cpuTime support using cgroups.cpuacct
by Ryota Ozaki 06 Mar '09

06 Mar '09

Hi, This patch enables to get CPU usage of a lxc using cpuacct subsystem of cgroups. Thanks, ozaki-r

3 7

[libvirt] PATCH: Fix crash after deleting storage vol fails
by Daniel P. Berrange 06 Mar '09

06 Mar '09

After a little debugging on IRC we discovered a problem in the deletion of storage volumes. We were mistakenly calling virStorageVolFree(vol) even if the delete call failed. So the pool got left with a NULL storage volume, and later use of that pool could crash on this. Daniel Index: src/storage_driver.c =================================================================== RCS file: /data/cvs/libvirt/src/storage_driver.c,v retrieving revision 1.32 diff -u -p -r1.32 storage_driver.c --- src/storage_driver.c 5 Feb 2009 16:28:30 -0000 1.32 +++ src/storage_driver.c 6 Mar 2009 12:56:20 -0000 @@ -1296,7 +1296,6 @@ storageVolumeDelete(virStorageVolPtr obj ret = 0; cleanup: - virStorageVolDefFree(vol); if (pool) virStoragePoolObjUnlock(pool); return ret; -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

3 2

[libvirt] Questions on "Xen XM error : internal error unable to store config file handle"
by Taeho Kang 06 Mar '09

06 Mar '09

Dear all, I am trying to add defined domains to a hypervisor with virDomainDefineXML function. But I keep getting the following error. libvir: Xen XM error : internal error unable to store config file handle I tried using virsh, but it gave the same error. Does anybody know the cause of this error? Thank you in advance, /Taeho

2 1

[libvirt] [RFC]: Secure migration
by Chris Lalancette 05 Mar '09

05 Mar '09

All, I've been looking at implementing secure migration for libvirt. I've taken a look at two approaches; I'll outline them, and then tell you which one I think we should do, and why. Note that in the discussion below, I'm talking mostly about the qemu migration protocol; I believe both of the approaches will lend themselves to, say, Xen, but the details will be different. For the sake of the outlines, I'm using three specific terms: "src" is used to refer to the source of the migration, that is, where the VM is running *before* migration begins; "dst" is used to refer to the destination of the migration, that is, where we want the VM to be at the end; and "controller" refers to the controlling program (usually virsh), which can be run on an entirely separate machine. -------------------------------------------------------------------------------- 1) virsh on the controller connects to the src, and initiates the migration command. In turn, this causes the controller to also connect to the dst. Now, during the "Prepare" step on the dst, we setup a qemu container to listen to some port on localhost. Next, the "Perform" step is called on the src machine. This causes an external program to be forked on the src; this external program connects to the dst (using virConnectOpen), then waits for migration data from the qemu instance. As the migration data comes in, it uses a new RPC call (something like "writeMigrationData") to pass the data to the dst. The dst then takes that data, and writes it out to the waiting qemu container. Pros: Uses existing RPC mechanism, so you don't have to open a new port on the destination Cons: There is a "hidden" dependency between the src and dst, which may be difficult for users to get right (more on this below). 2) virsh on the controller connects to the src, and initiates the migration command. In turn, this causes the controller to also connect to the dst. Now, during the "Prepare" step on the dst, we setup a qemu container to listen to some port (call it 1234) on localhost. It also forks an external program (or a thread) to listen for an incoming gnutls connection. Next, the "Perform" step is call on the src machine. This forks an external program (or thread) to listen for incoming data from a localhost migration, do the gnutls handshake with the dst, and dump the data over the gnutls connection to the dst. Pros: Works mostly transparently; the user doesn't have to set anything up different than they do today for "unsecure" migration Cons: Requires opening a new (but still well-known) port in the firewall on the dst side. -------------------------------------------------------------------------------- More about the "hidden" dependencies for 1). There are quite a few examples of where the controller might have access to both machines, but the src libvirtd does not. A few examples below: a) libvirtd is using TLS + the "tls_allowed_dn_list" in /etc/libvirt/libvirtd.conf on the dst machine. They have it configured so that they can access the machine via TLS on the controller machine, but not from the src machine. b) libvirtd is using SASL digest-md5 on the dst machine. When the src machine tries to connect, it needs a name and password to do so, which it doesn't have. (technically, I guess we could proxy that response back to the controller, and have the user fill it there, and then return back to the src, and then the dst, but it seems roundabout) c) libvirtd is using SASL gssapi on the dst machine. When the src machine tries to connect to the dst, it needs to have the right configuration (i.e. /etc/krb5.conf and /etc/sasl2/libvirt.conf need to work), and it also has to get some kind of principal from the kerberos server (but which principal?). Because of the hidden dependency problem, I think solution 2) is actually more viable; yes, it also has a dependency (opening a hole in the firewall), but that can be documented and will work no matter what other authentication you are doing between the controller and src and dst machines. However, I am open to being convinced otherwise. Thoughts? -- Chris Lalancette

4 8

[libvirt] Release of libvirt-0.6.1
by Daniel Veillard 04 Mar '09

04 Mar '09

I originaly though that this release would just include a set of bug fixes from 0.6.0, but a couple feature are includd as well as a number of local improvement. Available as usual from ftp://libvirt.org/libvirt/ + New features: - new APIs for Node device detach reattach and reset (Mark McLoughlin) - sVirt mandatory access control support (James Morris and Dan Walsh) + Portability: - non gcc toolchain (John Levon) - gcc-4.4 warnings fixes (Mark McLoughlin) - fix build without LXC and QEmu (Jim Meyering) + Documentation: - man page bugzilla URL (Mark McLoughlin) - typo in domain format (Jesse Farinacci) - clock offset fix (Mark McLoughlin) - hostdev description typo (Mark McLoughlin) - static host IP (Charles Duffy) - new example program (David Allan) + Bug fixes: - NULL dereference in LXC (Jim Meyering) - fix domain error reporting (John Levon) - fix loop of libvirtd --timeout (Daniel Berrange) - limit history to 500 to restrict virsh memory (Daniel Berrange) - wrong lvm volume format check (Cole Robinson) - I/O error in daemon and associated remote acces crash (Daniel Berrange) - fix autostart of session daemon (Daniel Berrange) - restart guest on qemu migration failures (Chris Lalancette) - config parsing leaks (Ryota Ozaki) - DBus multithreading activation to avoid crashes (Daniel Berrange) - mark defined network descriptions as persistent (Cole Robinson) - qemu+tls handshake negotiation hang (Chris Lalancette) + Improvements: - don't hardcode ssh port (Guido Gunther) - new test cases and testing infrastructure (Jim Meyering) - improve the SExpr parser (John Levon) - proper error reporting on xend shutdown command (John Levon) - proper handling of errors when saving QEmu domains state (Guido Gunther) - revamp of the internal error memory APIs (John Levon) - better virsh error reporting (John Levon) - more daemon options to allow running multiple daemons (Jim Meyering) - error handling when creating a QEmu domain (Guido Gunther) - fix timeouts in QEmu log reading (Guido Gunther) - migration with xend 3.3 fixes (John Levon) - virsh XML dump flags cleanup (Cole Robinson) - fix build with loadable drivers (Maximilian Wilhelm) - internal XML APIs to read long long and hexa values (Mark McLoughlin) - function to parse node device XML descriptions and associated test (Mark McLoughlin) - generate network bridge names if not provided (Cole Robinson) - recognize ejectable media in hostdev hal driver (Cole Robinson) - integration of sVirt (Daniel Berrange) + Cleanups: - printf NULL string checks (John Levon) - remove uses of strerror and use virStrerror (Jim Meyering) - remove redundant NULL assignments (Jim Meyering) - QEmu driver logging and exec cleanups (Jim Meyering) - many error handling cleanups (Jim Meyering) - XML module cleanups (Mark McLoughlin) - compiler warning (Maximilian Wilhelm) - daemon TCP listen cleanup (Cole Robinson) - size_t type cleanup (Guido Gunther) - parallel make fix (Michael Marineau) - storage error diagnostic fix (Ryota Ozaki) - remove redundant monitor watch variable (Cole Robinson) - qemu AttachDevice error report improvement (Cole Robinson) - virsh output cleanup (Jim Meyering) - various tests cleanups and improvements (Jim Meyering) - fix the internal export list with new APIs (Daniel Berrange) - cleanups on new APIs for Node device (Daniel Berrange) So quite a bit of changes happened in one month of development, so it's getting clear we aren't really slowing down and keeping a relatively fast release cycle is needed. So expect 0.6.2 in a month or so. Thanks to everybody who contributed to the release ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH 0/1] Merge DanPB's SCSI HBA pool code
by David Allan 04 Mar '09

04 Mar '09

This patch contains the implementation Daniel Berrange did of storage pools using SCSI HBAs. I have updated it for the current tree in preparation for implementing NPIV support. Let me know what you think. I would also like feedback on the integration into the build system, particularly where POLKIT_CFLAGS should go. Dave

6 18

[libvirt] [PATCH] Use posix_fallocate() to allocate disk space
by Amit Shah 04 Mar '09

04 Mar '09

Hi, This is an untested patch to make disk allocations faster and non-fragmented. I'm using posix_fallocate() now but relying on glibc really calling fallocate() if it exists for the file system to be the fastest. - This fails build because libutil needs to be added as a dependency? ../src/.libs/libvirt_driver_storage.a(storage_backend_fs.o): In function `virStorageBackendFileSystemVolCreate': /home/amit/src/libvirt/src/storage_backend_fs.c:1023: undefined reference to `safezero' - What's vol->capacity? Why is ftruncate() needed after the call to (current) safewrite()? My assumption is that the user can specify some max. capacity and wish to allocate only a chunk off it at create-time. Is that correct? The best case to get a non-fragmented VM image is to have it allocated completely at create-time with fallocate(). Currently xfs and ext4 support the fallocate() syscall (btrfs will, too, when it's ready). Comments? Amit >From dfe4780f5990571f026e02e6187cb64505c982c1 Mon Sep 17 00:00:00 2001 From: Amit Shah <amit.shah(a)redhat.com> Date: Tue, 24 Feb 2009 16:55:58 +0530 Subject: [PATCH] Use posix_fallocate() to allocate disk space Using posix_fallocate() to allocate disk space and fill it with zeros is faster than writing the zeros block-by-block. Also, for backing file systems that support the fallocate() syscall, this operation will give us a big speed boost. The biggest advantage of using this is the file will not be fragmented for the allocated chunks. Signed-off-by: Amit Shah <amit.shah(a)redhat.com> --- src/storage_backend_fs.c | 23 ++++++++--------------- src/util.c | 5 +++++ src/util.h | 1 + 3 files changed, 14 insertions(+), 15 deletions(-) diff --git a/src/storage_backend_fs.c b/src/storage_backend_fs.c index 240de96..74b0fda 100644 --- a/src/storage_backend_fs.c +++ b/src/storage_backend_fs.c @@ -1019,21 +1019,14 @@ virStorageBackendFileSystemVolCreate(virConnectPtr conn, /* XXX slooooooooooooooooow. * Need to add in progress bars & bg thread somehow */ if (vol->allocation) { - unsigned long long remain = vol->allocation; - static char const zeros[4096]; - while (remain) { - int bytes = sizeof(zeros); - if (bytes > remain) - bytes = remain; - if ((bytes = safewrite(fd, zeros, bytes)) < 0) { - virReportSystemError(conn, errno, - _("cannot fill file '%s'"), - vol->target.path); - unlink(vol->target.path); - close(fd); - return -1; - } - remain -= bytes; + int r; + if ((r = safezero(fd, 0, 0, vol->allocation)) < 0) { + virReportSystemError(conn, r, + _("cannot fill file '%s'"), + vol->target.path); + unlink(vol->target.path); + close(fd); + return -1; } } diff --git a/src/util.c b/src/util.c index 990433a..1bee7f0 100644 --- a/src/util.c +++ b/src/util.c @@ -117,6 +117,11 @@ ssize_t safewrite(int fd, const void *buf, size_t count) return nwritten; } +int safezero(int fd, int flags, off_t offset, off_t len) +{ + return posix_fallocate(fd, offset, len); +} + #ifndef PROXY int virFileStripSuffix(char *str, diff --git a/src/util.h b/src/util.h index a79cfa7..acaabb1 100644 --- a/src/util.h +++ b/src/util.h @@ -31,6 +31,7 @@ int saferead(int fd, void *buf, size_t count); ssize_t safewrite(int fd, const void *buf, size_t count); +int safezero(int fd, int flags, off_t offset, off_t len); enum { VIR_EXEC_NONE = 0, -- 1.6.0.6

3 6

[libvirt] selinux
by Michael Kress 04 Mar '09

04 Mar '09

Hi! What do I have to do to get qemu-kvm to run with selinux running with enforcing policy? I get these messages when I enable this policy: Mar 3 20:56:23 matrix kernel: [ 8972.482746] device vnet0 entered promiscuous mode Mar 3 20:56:23 matrix kernel: [ 8972.898943] br0: port 2(vnet0) entering learning state Mar 3 20:56:23 matrix kernel: [ 8972.901957] type=1400 audit(1236110183.820:20): avc: denied { execmem } for pid=6376 comm="kvm" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process Mar 3 20:56:23 matrix kernel: [ 8973.161318] type=1400 audit(1236110183.832:21): avc: denied { append } for pid=6379 comm="ifup" name="ifstate" dev=sda1 ino=1376380 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file Mar 3 20:56:23 matrix kernel: [ 8973.188371] br0: port 2(vnet0) entering disabled state Mar 3 20:56:23 matrix kernel: [ 8973.203666] device vnet0 left promiscuous mode Mar 3 20:56:23 matrix kernel: [ 8973.203675] br0: port 2(vnet0) entering disabled state Mar 3 20:56:23 matrix libvirtd: Received signal 17, dispatching to drivers Mar 3 20:56:23 matrix libvirtd: Received signal 17, dispatching to drivers Mar 3 20:56:23 matrix kernel: [ 8973.216362] type=1400 audit(1236110183.880:22): avc: denied { append } for pid=6387 comm="ifdown" name="ifstate" dev=sda1 ino=1376380 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file I've tried to set the type: chcon -t virt_image_t a01.img but all I got was: chcon: failed to change context of `a01.img' to `system_u:object_r:virt_image_t:s0': Invalid argument The host is a debian 5.0 machine. TIA Regards Michael

3 3

[libvirt] PATCH: Fix libvirtd test cases
by Daniel P. Berrange 04 Mar '09

04 Mar '09

The libvirtd tests have a number of bugs causing them to fail & generally do bad things. They all currently fail on RHEL5 hosts. - daemon-conf - the abs_topbuild_dir env var was not being set correctly so it failed to find config.h. It also broken by changes in stderr debug output from libvirtd. This patch fixes the env var, and changes it to it just looks for the desired error message, not doing a diff across entire of stdout/err. - libvirtd-fail - again fails because it is diffing the whole of stdout/err and coming across warning messages its not expecting. Change it to look for daemon error exit status because that reliably indicates whether it quit as expected on bogus configs - libvirtd-pool - running the QEMU driver which does not exist, just to test virsh's XML generation capabilities. This adds a --print-xml arg to virsh and uses the test:///default driver for testing, so we avoid the QEMU driver & daemon during tests - libvirt-net-persist - again trying to rnu the QEMU driver which does not exist, and its writing config files into the user's home directory. There's no easy fix for this, so I'm killing it off. It can be tested in the separate integration test suite where you can be sure to arrange for correct pre-requisites and safe working environment src/virsh.c | 51 ++++++++++++++++++++++++--------------- tests/Makefile.am | 3 -- tests/daemon-conf | 13 +++------- tests/libvirtd-fail | 9 ++---- tests/libvirtd-net-persist | 58 --------------------------------------------- tests/libvirtd-pool | 41 ++++++------------------------- 6 files changed, 48 insertions(+), 127 deletions(-) Daniel Index: src/virsh.c =================================================================== RCS file: /data/cvs/libvirt/src/virsh.c,v retrieving revision 1.195 diff -u -p -u -p -r1.195 virsh.c --- src/virsh.c 3 Mar 2009 09:59:02 -0000 1.195 +++ src/virsh.c 3 Mar 2009 19:23:01 -0000 @@ -2923,6 +2923,7 @@ cmdPoolCreate(vshControl *ctl, const vsh */ static const vshCmdOptDef opts_pool_X_as[] = { {"name", VSH_OT_DATA, VSH_OFLAG_REQ, gettext_noop("name of the pool")}, + {"print-xml", VSH_OT_BOOL, 0, gettext_noop("print XML document, but don't define/create")}, {"type", VSH_OT_DATA, VSH_OFLAG_REQ, gettext_noop("type of the pool")}, {"source-host", VSH_OT_DATA, 0, gettext_noop("source-host for underlying storage")}, {"source-path", VSH_OT_DATA, 0, gettext_noop("source path for underlying storage")}, @@ -3002,6 +3003,7 @@ cmdPoolCreateAs(vshControl *ctl, const v { virStoragePoolPtr pool; char *xml, *name; + int printXML = vshCommandOptBool(cmd, "print-xml"); if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) return FALSE; @@ -3009,18 +3011,22 @@ cmdPoolCreateAs(vshControl *ctl, const v if (!buildPoolXML(cmd, &name, &xml)) return FALSE; - pool = virStoragePoolCreateXML(ctl->conn, xml, 0); - free (xml); - - if (pool != NULL) { - vshPrint(ctl, _("Pool %s created\n"), name); - virStoragePoolFree(pool); - return TRUE; + if (printXML) { + printf("%s", xml); + free (xml); } else { - vshError(ctl, FALSE, _("Failed to create pool %s"), name); - } + pool = virStoragePoolCreateXML(ctl->conn, xml, 0); + free (xml); - return FALSE; + if (pool != NULL) { + vshPrint(ctl, _("Pool %s created\n"), name); + virStoragePoolFree(pool); + } else { + vshError(ctl, FALSE, _("Failed to create pool %s"), name); + return FALSE; + } + } + return TRUE; } @@ -3085,6 +3091,7 @@ cmdPoolDefineAs(vshControl *ctl, const v { virStoragePoolPtr pool; char *xml, *name; + int printXML = vshCommandOptBool(cmd, "print-xml"); if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) return FALSE; @@ -3092,18 +3099,22 @@ cmdPoolDefineAs(vshControl *ctl, const v if (!buildPoolXML(cmd, &name, &xml)) return FALSE; - pool = virStoragePoolDefineXML(ctl->conn, xml, 0); - free (xml); - - if (pool != NULL) { - vshPrint(ctl, _("Pool %s defined\n"), name); - virStoragePoolFree(pool); - return TRUE; + if (printXML) { + printf("%s", xml); + free (xml); } else { - vshError(ctl, FALSE, _("Failed to define pool %s"), name); - } + pool = virStoragePoolDefineXML(ctl->conn, xml, 0); + free (xml); - return FALSE; + if (pool != NULL) { + vshPrint(ctl, _("Pool %s defined\n"), name); + virStoragePoolFree(pool); + } else { + vshError(ctl, FALSE, _("Failed to define pool %s"), name); + return FALSE; + } + } + return TRUE; } Index: tests/Makefile.am =================================================================== RCS file: /data/cvs/libvirt/tests/Makefile.am,v retrieving revision 1.76 diff -u -p -u -p -r1.76 Makefile.am --- tests/Makefile.am 3 Mar 2009 17:00:18 -0000 1.76 +++ tests/Makefile.am 3 Mar 2009 19:23:01 -0000 @@ -82,7 +82,6 @@ test_scripts += \ define-dev-segfault \ int-overflow \ libvirtd-fail \ - libvirtd-net-persist \ libvirtd-pool \ read-bufsiz \ read-non-seekable \ @@ -127,7 +126,7 @@ TESTS_ENVIRONMENT = \ abs_top_srcdir=`cd '$(top_srcdir)'; pwd` \ abs_builddir=`cd '$(builddir)'; pwd` \ abs_srcdir=`cd '$(srcdir)'; pwd` \ - CONFIG_HEADER='$(abs_top_builddir)/config.h' \ + CONFIG_HEADER="`cd '$(top_builddir)'; pwd`/config.h" \ PATH="$(path_add)$(PATH_SEPARATOR)$$PATH" \ SHELL="$(SHELL)" \ LIBVIRT_DRIVER_DIR="$(abs_top_builddir)/src/.libs" \ Index: tests/daemon-conf =================================================================== RCS file: /data/cvs/libvirt/tests/daemon-conf,v retrieving revision 1.6 diff -u -p -u -p -r1.6 daemon-conf --- tests/daemon-conf 2 Mar 2009 20:01:26 -0000 1.6 +++ tests/daemon-conf 3 Mar 2009 19:23:01 -0000 @@ -52,15 +52,10 @@ while :; do test $i = $n && break - # Filter out some ignorable diagnostics and drop timestamps - sed \ - -e 's/.*: error : //' \ - -e '/^Cannot set group when not running as root$/d' \ - -e '/^libnuma: Warning: .sys not mounted or no numa system/d' \ - err > k && mv k err - - printf '%s\n\n' "remoteReadConfigFile: $f: $param_name: $msg" > expected-err - diff -u expected-err err || fail=1 + # Check that the diagnostic we want appears + grep "$msg" err 1>/dev/null 2>&1 + RET=$? + test "$RET" = "0" || fail=1 i=$(expr $i + 1) done Index: tests/libvirtd-fail =================================================================== RCS file: /data/cvs/libvirt/tests/libvirtd-fail,v retrieving revision 1.1 diff -u -p -u -p -r1.1 libvirtd-fail --- tests/libvirtd-fail 2 Mar 2009 20:01:05 -0000 1.1 +++ tests/libvirtd-fail 3 Mar 2009 19:23:01 -0000 @@ -12,10 +12,7 @@ test -z "$abs_top_srcdir" && abs_top_src fail=0 -libvirtd --config=no-such-file > log 2>&1 && fail=1 -cat <<\EOF > exp -Failed to open file 'no-such-file': No such file or directory -EOF +libvirtd --config=no-such-conf --timeout=5 2> log +RET=$? -compare exp log || fail=1 -exit $fail +test "$RET" != "0" && exit 0 || exit 1 Index: tests/libvirtd-net-persist =================================================================== RCS file: tests/libvirtd-net-persist diff -N tests/libvirtd-net-persist --- tests/libvirtd-net-persist 2 Mar 2009 18:41:00 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,58 +0,0 @@ -#!/bin/sh -# ensure that net-destroy doesn't make network disappear (persistence-related) - -if test "$VERBOSE" = yes; then - set -x - libvirtd --version - virsh --version -fi - -test -z "$srcdir" && srcdir=$(pwd) -test -z "$abs_top_srcdir" && abs_top_srcdir=$(pwd)/.. -. "$srcdir/test-lib.sh" - -fail=0 - -pwd=$(pwd) || fail=1 -sock_dir="$pwd" -cat > conf <<EOF || fail=1 -unix_sock_dir = "$sock_dir" -log_outputs = "3:file:$pwd/log" -EOF - -cat > net.xml <<EOF || fail=1 -<network> - <name>N</name> - <ip address="192.168.199.1" netmask="255.255.255.0"></ip> -</network> -EOF - -cat > exp <<EOF || fail=1 -Network N defined from net.xml - -Network N destroyed - -Name State Autostart ------------------------------------------ -N inactive no - -EOF - -libvirtd --config=conf > libvirtd-log 2>&1 & pid=$! -sleep 1 - -url="qemu:///session?socket=@$sock_dir/libvirt-sock" -virsh -c "$url" \ - 'net-define net.xml; net-destroy N; net-list --all' > out 2>&1 \ - || fail=1 - -# if libvird's log is empty, sleep for a second before killing it -test -s libvirtd-log || sleep 1 -kill $pid - -compare exp out || fail=1 - -printf "Shutting down network 'N'\n" > log-exp -compare log-exp libvirtd-log || fail=1 - -exit $fail Index: tests/libvirtd-pool =================================================================== RCS file: /data/cvs/libvirt/tests/libvirtd-pool,v retrieving revision 1.1 diff -u -p -u -p -r1.1 libvirtd-pool --- tests/libvirtd-pool 2 Mar 2009 20:01:05 -0000 1.1 +++ tests/libvirtd-pool 3 Mar 2009 19:23:01 -0000 @@ -1,9 +1,8 @@ #!/bin/sh -# Get coverage of libvirtd's config-parsing code. +# Get coverage of virsh pool-define-as XML formatting if test "$VERBOSE" = yes; then set -x - libvirtd --version virsh --version fi @@ -14,50 +13,28 @@ test -z "$abs_top_srcdir" && abs_top_src fail=0 pwd=$(pwd) || fail=1 -sock_dir="$pwd" -cat > conf <<EOF || fail=1 -unix_sock_dir = "$sock_dir" -log_outputs = "3:file:$pwd/log" -EOF - -libvirtd --config=conf > libvirtd-log 2>&1 & pid=$! -sleep 1 - -url="qemu:///session?socket=@$sock_dir/libvirt-sock" -virsh --connect "$url" \ - pool-define-as P dir src-host /src/path /src/dev S /target-path > out 2>&1 \ - || fail=1 -virsh --connect "$url" pool-dumpxml P >> out 2>&1 || fail=1 -# remove random uuid -sed 's/<uuid>.*/-/' out > k && mv k out || fail=1 - -kill $pid +virsh --connect test:///default \ + pool-define-as --print-xml \ + P dir src-host /src/path /src/dev S /target-path \ + 1>out 2>&1 cat <<EOF > pool-list-exp -Pool P defined - <pool type='dir'> <name>P</name> - - - <capacity>0</capacity> - <allocation>0</allocation> - <available>0</available> <source> + <host name='src-host'/> + <dir path='/src/path'/> + <device path='/src/dev'/> + <name>S</name> </source> <target> <path>/target-path</path> - <permissions> - <mode>0700</mode> - <owner>500</owner> - <group>500</group> - </permissions> </target> </pool> EOF compare pool-list-exp out || fail=1 -compare /dev/null libvirtd-log || fail=1 exit $fail -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

3 4

[libvirt] [ANNOUNCE] New release virtinst 0.400.2
by Cole Robinson 04 Mar '09

04 Mar '09

I'm happy to announce a new virtinst release, version 0.400.2. The release can be downloaded from: http://virt-manager.org/download.html The direct download link is: http://virt-manager.org/download/sources/virtinst/virtinst-0.400.2.tar.gz This release includes: - New virt-clone option --original-xml, allows cloning a guest from an xml file, rather than require an existing, defined guest. - New virt-install option --import, allows creating a guest from an existing disk image, bypassing any OS install phase. - New virt-install option --host-device, for connecting a physical host device to the guest. - Allow specifying 'cache' value via virt-install's --disk options (Ben Kochie) - New virt-install option --nonetworks (John Levon) - Lots of backend cleanups and documentation improvements. Thanks to everyone who has contributed to this release through testing, bug reporting, submitting patches, and otherwise sending in feedback! Thanks, Cole

1 0

[libvirt] [PATCH] * qemud/libvirtd_qemu.aug: Add "security_driver".
by Jim Meyering 03 Mar '09

03 Mar '09

>From 0e79e00614e8c6cd2b7fe7bcad1d52b2de1a3a58 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 3 Mar 2009 17:42:53 +0100 Subject: [PATCH] * qemud/libvirtd_qemu.aug: Add "security_driver". --- qemud/libvirtd.conf | 4 ++-- qemud/libvirtd_qemu.aug | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/qemud/libvirtd.conf b/qemud/libvirtd.conf index 1fd5918..0e0b40c 100644 --- a/qemud/libvirtd.conf +++ b/qemud/libvirtd.conf @@ -289,7 +289,7 @@ # separated by spaces. # # e.g: -# log_filters="3:remote 4:event" +#log_filters = "3:remote 4:event" # to only get warning or errors from the remote layer and only errors from # the event layer. @@ -311,5 +311,5 @@ # # Multiple output can be defined , they just need to be separated by spaces. # e.g.: -# log_outputs="3:syslog:libvirtd" +#log_outputs = "3:syslog:libvirtd" # to log all warnings and errors to syslog under the libvirtd ident diff --git a/qemud/libvirtd_qemu.aug b/qemud/libvirtd_qemu.aug index b2e4318..e297a5f 100644 --- a/qemud/libvirtd_qemu.aug +++ b/qemud/libvirtd_qemu.aug @@ -27,6 +27,7 @@ module Libvirtd_qemu = | str_entry "vnc_tls_x509_cert_dir" | bool_entry "vnc_tls_x509_verify" | str_entry "vnc_password" + | str_entry "security_driver" (* Each enty in the config is one of the following three ... *) let entry = vnc_entry @@ -41,4 +42,3 @@ module Libvirtd_qemu = . Util.stdexcl let xfm = transform lns filter - -- 1.6.2.rc1.285.gc5f54

4 7

[libvirt] PATCH: Fix missing thread locking for new remote APIs
by Daniel P. Berrange 03 Mar '09

03 Mar '09

The remote driver additions for the sVirt APIs pre-date the time when we added thread support, and I didn't notice they were mising the lock calls. This patch adds the missing lock calls, so 'virsh dominfo' doesn't hang anymore due to an unlock without initial lock. It also fixes two return values to be -1 rather than -2 Daniel Index: src/libvirt.c =================================================================== RCS file: /data/cvs/libvirt/src/libvirt.c,v retrieving revision 1.198 diff -u -p -r1.198 libvirt.c --- src/libvirt.c 3 Mar 2009 09:14:28 -0000 1.198 +++ src/libvirt.c 3 Mar 2009 18:32:25 -0000 @@ -4206,7 +4206,7 @@ virDomainGetSecurityLabel(virDomainPtr d return conn->driver->domainGetSecurityLabel(domain, seclabel); virLibConnWarning(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); - return -2; + return -1; } /** @@ -4236,7 +4236,7 @@ virNodeGetSecurityModel(virConnectPtr co return conn->driver->nodeGetSecurityModel(conn, secmodel); virLibConnWarning(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); - return -2; + return -1; } /** Index: src/remote_internal.c =================================================================== RCS file: /data/cvs/libvirt/src/remote_internal.c,v retrieving revision 1.140 diff -u -p -r1.140 remote_internal.c --- src/remote_internal.c 3 Mar 2009 09:27:03 -0000 1.140 +++ src/remote_internal.c 3 Mar 2009 18:32:25 -0000 @@ -2302,26 +2302,33 @@ remoteDomainGetSecurityLabel (virDomainP remote_domain_get_security_label_args args; remote_domain_get_security_label_ret ret; struct private_data *priv = domain->conn->privateData; + int rv = -1; + + remoteDriverLock(priv); make_nonnull_domain (&args.dom, domain); memset (&ret, 0, sizeof ret); if (call (domain->conn, priv, 0, REMOTE_PROC_DOMAIN_GET_SECURITY_LABEL, (xdrproc_t) xdr_remote_domain_get_security_label_args, (char *)&args, (xdrproc_t) xdr_remote_domain_get_security_label_ret, (char *)&ret) == -1) { - return -1; + goto done; } if (ret.label.label_val != NULL) { if (strlen (ret.label.label_val) >= sizeof seclabel->label) { errorf (domain->conn, VIR_ERR_RPC, _("security label exceeds maximum: %zd"), sizeof seclabel->label - 1); - return -1; + goto done; } strcpy (seclabel->label, ret.label.label_val); seclabel->enforcing = ret.enforcing; } - return 0; + rv = 0; + +done: + remoteDriverUnlock(priv); + return rv; } static int @@ -2329,19 +2336,22 @@ remoteNodeGetSecurityModel (virConnectPt { remote_node_get_security_model_ret ret; struct private_data *priv = conn->privateData; + int rv = -1; + + remoteDriverLock(priv); memset (&ret, 0, sizeof ret); if (call (conn, priv, 0, REMOTE_PROC_NODE_GET_SECURITY_MODEL, (xdrproc_t) xdr_void, NULL, (xdrproc_t) xdr_remote_node_get_security_model_ret, (char *)&ret) == -1) { - return -1; + goto done; } if (ret.model.model_val != NULL) { if (strlen (ret.model.model_val) >= sizeof secmodel->model) { errorf (conn, VIR_ERR_RPC, _("security model exceeds maximum: %zd"), sizeof secmodel->model - 1); - return -1; + goto done; } strcpy (secmodel->model, ret.model.model_val); } @@ -2350,11 +2360,16 @@ remoteNodeGetSecurityModel (virConnectPt if (strlen (ret.doi.doi_val) >= sizeof secmodel->doi) { errorf (conn, VIR_ERR_RPC, _("security doi exceeds maximum: %zd"), sizeof secmodel->doi - 1); - return -1; + goto done; } strcpy (secmodel->doi, ret.doi.doi_val); } - return 0; + + rv = 0; + +done: + remoteDriverUnlock(priv); + return rv; } static char * -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 1

[libvirt] some questions about libvirt features and limitations
by Florian Vichot 03 Mar '09

03 Mar '09

Hello everyone, I'm working on a open source project (http://www.hynesim.org) in which we needed libvirt-like functionalities. As at the time, libvirt did not support OpenVZ, and it did not support VirtualBox, we went and implemented our own wrappers around Kvm/Qemu, VirtualBox and OpenVz (Honeyd too, but our wrapper is such an ugly hack that it doesn't really deserve mention). Now that time has passed, we'd would like to stop duplicating efforts, and use libvirt instead, and concentrate on more innovating functionalities for Hynesim. Also our wrappers are terrible hacks, and do a lot less error checking than libvirt :) But before I can replace our wrappers with libvirt, we're missing some functionalities (that I will propose a patch for if required), and there are a few questions concerning libvirt I've not managed to find an answer for, so I'd be very grateful if I could get some advice on them. Here goes: ------- Is it possible to add a device for any type of domain that would correspond to a TAP device on the host, and would be seen as a regular ethernet interface with a specific MAC address in the virtualized domain ? The "raw" commands to achieve that in OpenVZ and Qemu, for example, are: # kvm ... -net nic,macaddr=00:11:22:33:44:55 -net tap,ifname=tap0,script=no # vzctl set 100 --netif_add eth0,00:11:22:33:44:55,tap0 Is that doable in every driver supported by libvirt ? ------- Is the libvirtd daemon necessary for drivers other than Qemu ? I've been using the openvz driver alone for some tests (by connecting to "openvz:///system"), and yet I get warning messages: # sudo ./hellolibvirt openvz:///system Attempting to connect to hypervisor libvir: Remote error : unable to connect to '/var/run/libvirt/libvirt-sock': No such file or directory libvir: warning : Failed to find the network: Is the daemon running ? libvir: Remote error : unable to connect to '/var/run/libvirt/libvirt-sock': No such file or directory libvir: Remote error : unable to connect to '/var/run/libvirt/libvirt-sock': No such file or directory libvir: warning : Failed to find a node driver: Is the libvirtd daemon running ? Connected to hypervisor at "openvz:///system" Hypervisor: "OpenVZ" version: 3.0.22 There are 0 active and 1 inactive domains Inactive domains: 897 Disconnected from hypervisor The libvirtd daemon is indeed not running, as I don't see why it should be: I thought it was only useful for qemu guests. Am I right ? What is the role of the daemon exactly ? ------- Apparently the only way to start an OpenVZ domain is by specifying a template. Only problem is, when the VE is stopped, and undefined, all modifications are lost in the "private" file system of the VE (as it is deleted). The way we circumvented this in Hynesim is by specifying the --private option to "vzctl create" instead of the --ostemplate one. That way one can specify a dir that will be used directly as the filesystem for the VE. I was thinking maybe adding something along the lines of: <filesystem type='directory'> <source name='/path/to/ve/filesystem' /> <target dir='/'/> </filesystem> would do the trick. It looks simple enough to implement, so should I ? ------- Is there support in libvirt of "cloning" (duplicating a VM disk /filesystem) ? ------- Someone mentioned a VirtualBox driver. I'm highly interested in this. How is it going ? I'd be more than happy to beta test if required. Will it work with both PUEL and OSE versions ? When will it be ready for inclusion in libvirt ? How will you handle RDP access, as from what I saw only VNC is supported in libvirt currently ? ------- And last but not least, what are "node devices" ? The two pages about it are blank in the documentation. Are they the host machine, or a device of the host machine ? ------- I think that's all. Thank you for reading all this, Florian

1 0

[libvirt] PATCH: Fix build on Mingw32
by Daniel P. Berrange 03 Mar '09

03 Mar '09

pread() and pwrite() do not exist on mingw, and the nodedevxml2xmltest was adding libvirt_driver_qemu.la for some unknown reason - probably a cut & paste error. This broke the test compile when qemu was turned off as it is on mingw32. Daniel diff --git a/src/pci.c b/src/pci.c --- a/src/pci.c +++ b/src/pci.c @@ -156,7 +156,8 @@ pciRead(pciDevice *dev, unsigned pos, ui if (pciOpenConfig(dev) < 0) return -1; - if (pread(dev->fd, buf, buflen, pos) < 0) { + if (lseek(dev->fd, pos, SEEK_SET) != pos || + read(dev->fd, buf, buflen) < 0) { char ebuf[1024]; VIR_WARN(_("Failed to read from '%s' : %s"), dev->path, virStrerror(errno, ebuf, sizeof(ebuf))); @@ -195,7 +196,8 @@ pciWrite(pciDevice *dev, unsigned pos, u if (pciOpenConfig(dev) < 0) return -1; - if (pwrite(dev->fd, buf, buflen, pos) < 0) { + if (lseek(dev->fd, pos, SEEK_SET) != pos || + write(dev->fd, buf, buflen) < 0) { char ebuf[1024]; VIR_WARN(_("Failed to write to '%s' : %s"), dev->path, virStrerror(errno, ebuf, sizeof(ebuf))); diff --git a/tests/Makefile.am b/tests/Makefile.am --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -185,7 +185,7 @@ endif nodedevxml2xmltest_SOURCES = \ nodedevxml2xmltest.c \ testutils.c testutils.h -nodedevxml2xmltest_LDADD = ../src/libvirt_driver_qemu.la $(LDADDS) +nodedevxml2xmltest_LDADD = $(LDADDS) virshtest_SOURCES = \ virshtest.c \ -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

3 4

[libvirt] PATCH: Mark <seclabel> as dynamic generated, or statically pre-defined
by Daniel P. Berrange 03 Mar '09

03 Mar '09

This patch implements the behaviour I was refering to earlier, whereby the domain XML explicitly says whether the security label is a statically pre-defined one, or dynamically generated on VM boot by libvirtd So when creating a new guest, apps like virt-install have 2 options: - Leave out the <seclabel> tag completely -> If no security driver is active, just works as normal unconfined VM -> If a security driver is active, a dynamic seclabel is generated <seclabel type='dynamic' model='selinux'> <label>system_u:system_r:qemu_t:s0:c424,c719</label> <imagelabel>system_u:object_r:virt_image_t:s0:c424,c719</imagelabel> </seclabel> - Add an explicit <seclabel> tag with type='static' attribute -> Security driver uses the defined label & imagelabel <seclabel type='static' model='selinux'> <label>system_u:system_r:qemu_t:s0:c25,c100</label> <imagelabel>system_u:system_r:virt_image_t:s0:c25,c100</imagelabel> </seclabel> A static seclabel is visible in the XML, at all times, whether the VM is active or inactive. A dynamic seclabel is only visible when the VM is running, since it is auto-generated at VM boot. If you migrate the VM, or save/restore it, the dynamic seclabel will change on each boot. The seclabel isn't visible when not running, or if asking for the inactive XML dump This patch implements parsing of the 'type' attribute, and makes the seclabel generation key off this attribute. It also adds the 'imagelabel' XML element, since that was being used internally, but was not including in the XML output, or parsing routines, making it impossible to specify a pre-defined image label or see the dyanmic one domain_conf.c | 65 +++++++++++++++++++++++++++++++++++++++++++---------- domain_conf.h | 9 +++++++ qemu_driver.c | 13 ++++++++-- security_selinux.c | 1 4 files changed, 73 insertions(+), 15 deletions(-) Daniel Index: src/domain_conf.c =================================================================== RCS file: /data/cvs/libvirt/src/domain_conf.c,v retrieving revision 1.70 diff -u -p -r1.70 domain_conf.c --- src/domain_conf.c 3 Mar 2009 09:44:42 -0000 1.70 +++ src/domain_conf.c 3 Mar 2009 15:36:02 -0000 @@ -168,6 +168,10 @@ VIR_ENUM_IMPL(virDomainState, VIR_DOMAIN "shutoff", "crashed") +VIR_ENUM_IMPL(virDomainSeclabel, VIR_DOMAIN_SECLABEL_LAST, + "dynamic", + "static") + #define virDomainReportError(conn, code, fmt...) \ virReportErrorHelper(conn, VIR_FROM_DOMAIN, code, __FILE__, \ __FUNCTION__, __LINE__, fmt) @@ -1847,24 +1851,46 @@ static int virDomainLifecycleParseXML(vi static int virSecurityLabelDefParseXML(virConnectPtr conn, const virDomainDefPtr def, - xmlXPathContextPtr ctxt) + xmlXPathContextPtr ctxt, + int flags) { char *p; if (virXPathNode(conn, "./seclabel", ctxt) == NULL) return 0; - p = virXPathStringLimit(conn, "string(./seclabel/label[1])", + p = virXPathStringLimit(conn, "string(./seclabel/@type)", VIR_SECURITY_LABEL_BUFLEN-1, ctxt); if (p == NULL) goto error; - def->seclabel.label = p; - - p = virXPathStringLimit(conn, "string(./seclabel/@model)", - VIR_SECURITY_MODEL_BUFLEN-1, ctxt); - if (p == NULL) + if ((def->seclabel.type = virDomainSeclabelTypeFromString(p)) < 0) goto error; - def->seclabel.model = p; + VIR_FREE(p); + + /* Only parse details, if using static labels, or + * if the 'live' VM XML is requested + */ + if (def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC || + !(flags & VIR_DOMAIN_XML_INACTIVE)) { + p = virXPathStringLimit(conn, "string(./seclabel/@model)", + VIR_SECURITY_MODEL_BUFLEN-1, ctxt); + if (p == NULL) + goto error; + def->seclabel.model = p; + + p = virXPathStringLimit(conn, "string(./seclabel/label[1])", + VIR_SECURITY_LABEL_BUFLEN-1, ctxt); + if (p == NULL) + goto error; + def->seclabel.label = p; + + p = virXPathStringLimit(conn, "string(./seclabel/imagelabel[1])", + VIR_SECURITY_LABEL_BUFLEN-1, ctxt); + if (p == NULL) + goto error; + def->seclabel.imagelabel = p; + + } return 0; @@ -2458,7 +2484,7 @@ static virDomainDefPtr virDomainDefParse VIR_FREE(nodes); /* analysis of security label */ - if (virSecurityLabelDefParseXML(conn, def, ctxt) == -1) + if (virSecurityLabelDefParseXML(conn, def, ctxt, flags) == -1) goto error; return def; @@ -3480,9 +3506,24 @@ char *virDomainDefFormat(virConnectPtr c virBufferAddLit(&buf, " </devices>\n"); if (def->seclabel.model) { - virBufferEscapeString(&buf, " <seclabel model='%s'>\n", def->seclabel.model); - virBufferEscapeString(&buf, " <label>%s</label>\n", def->seclabel.label); - virBufferAddLit(&buf, " </seclabel>\n"); + const char *sectype = virDomainSeclabelTypeToString(def->seclabel.type); + if (!sectype) + goto cleanup; + if (!def->seclabel.label || + (def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC && + (flags & VIR_DOMAIN_XML_INACTIVE))) { + virBufferVSprintf(&buf, " <seclabel type='%s' model='%s'/>\n", + sectype, def->seclabel.model); + } else { + virBufferVSprintf(&buf, " <seclabel type='%s' model='%s'>\n", + sectype, def->seclabel.model); + virBufferEscapeString(&buf, " <label>%s</label>\n", + def->seclabel.label); + if (def->seclabel.imagelabel) + virBufferEscapeString(&buf, " <imagelabel>%s</imagelabel>\n", + def->seclabel.imagelabel); + virBufferAddLit(&buf, " </seclabel>\n"); + } } virBufferAddLit(&buf, "</domain>\n"); Index: src/domain_conf.h =================================================================== RCS file: /data/cvs/libvirt/src/domain_conf.h,v retrieving revision 1.39 diff -u -p -r1.39 domain_conf.h --- src/domain_conf.h 3 Mar 2009 09:44:42 -0000 1.39 +++ src/domain_conf.h 3 Mar 2009 15:36:02 -0000 @@ -410,6 +410,13 @@ struct _virDomainOSDef { char *bootloaderArgs; }; +enum virDomainSeclabelType { + VIR_DOMAIN_SECLABEL_DYNAMIC, + VIR_DOMAIN_SECLABEL_STATIC, + + VIR_DOMAIN_SECLABEL_LAST, +}; + /* Security configuration for domain */ typedef struct _virSecurityLabelDef virSecurityLabelDef; typedef virSecurityLabelDef *virSecurityLabelDefPtr; @@ -417,6 +424,7 @@ struct _virSecurityLabelDef { char *model; /* name of security model */ char *label; /* security label string */ char *imagelabel; /* security image label string */ + int type; }; #define VIR_DOMAIN_CPUMASK_LEN 1024 @@ -650,5 +658,6 @@ VIR_ENUM_DECL(virDomainInputBus) VIR_ENUM_DECL(virDomainGraphics) /* from libvirt.h */ VIR_ENUM_DECL(virDomainState) +VIR_ENUM_DECL(virDomainSeclabel) #endif /* __DOMAIN_CONF_H */ Index: src/qemu_driver.c =================================================================== RCS file: /data/cvs/libvirt/src/qemu_driver.c,v retrieving revision 1.213 diff -u -p -r1.213 qemu_driver.c --- src/qemu_driver.c 3 Mar 2009 15:18:24 -0000 1.213 +++ src/qemu_driver.c 3 Mar 2009 15:36:02 -0000 @@ -1314,9 +1314,9 @@ static int qemudStartVMDaemon(virConnect hookData.vm = vm; hookData.driver = driver; - /* If you are using a SecurityDriver and there was no security label in - database, then generate a security label for isolation */ - if (vm->def->seclabel.label == NULL && + /* If you are using a SecurityDriver with dynamic labelling, + then generate a security label for isolation */ + if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC && driver->securityDriver && driver->securityDriver->domainGenSecurityLabel && driver->securityDriver->domainGenSecurityLabel(conn, vm) < 0) @@ -1525,6 +1525,13 @@ static void qemudShutdownVMDaemon(virCon if (driver->securityDriver) driver->securityDriver->domainRestoreSecurityLabel(conn, vm); + /* Clear out dynamically assigned labels */ + if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) { + VIR_FREE(vm->def->seclabel.model); + VIR_FREE(vm->def->seclabel.label); + VIR_FREE(vm->def->seclabel.imagelabel); + } + if (qemudRemoveDomainStatus(conn, driver, vm) < 0) { VIR_WARN(_("Failed to remove domain status for %s"), vm->def->name); Index: src/security_selinux.c =================================================================== RCS file: /data/cvs/libvirt/src/security_selinux.c,v retrieving revision 1.2 diff -u -p -r1.2 security_selinux.c --- src/security_selinux.c 3 Mar 2009 15:18:24 -0000 1.2 +++ src/security_selinux.c 3 Mar 2009 15:36:02 -0000 @@ -161,6 +161,7 @@ SELinuxGenSecurityLabel(virConnectPtr co char *scontext = NULL; int c1 = 0; int c2 = 0; + if ( ( vm->def->seclabel.label ) || ( vm->def->seclabel.model ) || ( vm->def->seclabel.imagelabel )) { -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

3 3

[libvirt] [PATCH] config: fix a typo
by Jim Meyering 03 Mar '09

03 Mar '09

>From 5cdfbefc15f81b3be7e2d60b3d173fdb2352a83c Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 3 Mar 2009 15:58:49 +0100 Subject: [PATCH] config: fix a typo * src/qemu_conf.c (CHECK_TYPE): Fix typo: s/security_river/security_driver/ --- src/qemu_conf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu_conf.c b/src/qemu_conf.c index 71fed5a..03f710f 100644 --- a/src/qemu_conf.c +++ b/src/qemu_conf.c @@ -152,7 +152,7 @@ int qemudLoadDriverConfig(struct qemud_driver *driver, } p = virConfGetValue (conf, "security_driver"); - CHECK_TYPE ("security_river", VIR_CONF_STRING); + CHECK_TYPE ("security_driver", VIR_CONF_STRING); if (p && p->str) { if (!(driver->securityDriverName = strdup(p->str))) { virReportOOMError(NULL); -- 1.6.2.rc1.285.gc5f54

2 1

[libvirt] Updated James Morris patch to apply to libvirt-0.6.0 version
by Daniel J Walsh 03 Mar '09

03 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is this acceptable to upstream? Dan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkma48EACgkQrlYvE4MpobMSBwCfXJnrlgoM0CuwdxF8BzcoQVvr 5pIAoNcKSrh+YsxNMjk8RgM4E7feUc4R =iLJG -----END PGP SIGNATURE----- diff -up libvirt-0.6.0/include/libvirt/libvirt.h.in.svirt libvirt-0.6.0/include/libvirt/libvirt.h.in --- libvirt-0.6.0/include/libvirt/libvirt.h.in.svirt 2009-01-20 08:48:27.000000000 -0500 +++ libvirt-0.6.0/include/libvirt/libvirt.h.in 2009-02-17 10:07:06.215686000 -0500 @@ -111,6 +111,68 @@ typedef enum { } virDomainCreateFlags; /** + * VIR_SECURITY_LABEL_BUFLEN: + * + * Macro providing the maximum length of the virSecurityLabel label string. + * Note that this value is based on that used by Labeled NFS. + */ +#define VIR_SECURITY_LABEL_BUFLEN (4096 + 1) + +/** + * virSecurityLabel: + * + * a virSecurityLabel is a structure filled by virDomainGetSecurityLabel(), + * providing the security label and associated attributes for the specified + * domain. + * + */ +typedef struct _virSecurityLabel { + char label[VIR_SECURITY_LABEL_BUFLEN]; /* security label string */ + int enforcing; /* 1 if security policy is being enforced for domain */ +} virSecurityLabel; + +/** + * virSecurityLabelPtr: + * + * a virSecurityLabelPtr is a pointer to a virSecurityLabel. + */ +typedef virSecurityLabel *virSecurityLabelPtr; + +/** + * VIR_SECURITY_MODEL_BUFLEN: + * + * Macro providing the maximum length of the virSecurityModel model string. + */ +#define VIR_SECURITY_MODEL_BUFLEN (256 + 1) + +/** + * VIR_SECURITY_DOI_BUFLEN: + * + * Macro providing the maximum length of the virSecurityModel doi string. + */ +#define VIR_SECURITY_DOI_BUFLEN (256 + 1) + +/** + * virSecurityModel: + * + * a virSecurityModel is a structure filled by virNodeGetSecurityModel(), + * providing the per-hypervisor security model and DOI attributes for the + * specified domain. + * + */ +typedef struct _virSecurityModel { + char model[VIR_SECURITY_MODEL_BUFLEN]; /* security model string */ + char doi[VIR_SECURITY_DOI_BUFLEN]; /* domain of interpetation */ +} virSecurityModel; + +/** + * virSecurityModelPtr: + * + * a virSecurityModelPtr is a pointer to a virSecurityModel. + */ +typedef virSecurityModel *virSecurityModelPtr; + +/** * virNodeInfoPtr: * * a virNodeInfo is a structure filled by virNodeGetInfo() and providing @@ -417,6 +479,9 @@ char * virConnectGetCap unsigned long long virNodeGetFreeMemory (virConnectPtr conn); +int virNodeGetSecurityModel (virConnectPtr conn, + virSecurityModelPtr secmodel); + /* * Gather list of running domains */ @@ -506,6 +571,8 @@ int virDomainSetMaxM int virDomainSetMemory (virDomainPtr domain, unsigned long memory); int virDomainGetMaxVcpus (virDomainPtr domain); +int virDomainGetSecurityLabel (virDomainPtr domain, + virSecurityLabelPtr seclabel); /* * XML domain description diff -up libvirt-0.6.0/include/libvirt/libvirt.h.svirt libvirt-0.6.0/include/libvirt/libvirt.h --- libvirt-0.6.0/include/libvirt/libvirt.h.svirt 2009-01-31 04:20:10.000000000 -0500 +++ libvirt-0.6.0/include/libvirt/libvirt.h 2009-02-17 10:07:32.421570000 -0500 @@ -111,6 +111,68 @@ typedef enum { } virDomainCreateFlags; /** + * VIR_SECURITY_LABEL_BUFLEN: + * + * Macro providing the maximum length of the virSecurityLabel label string. + * Note that this value is based on that used by Labeled NFS. + */ +#define VIR_SECURITY_LABEL_BUFLEN (4096 + 1) + +/** + * virSecurityLabel: + * + * a virSecurityLabel is a structure filled by virDomainGetSecurityLabel(), + * providing the security label and associated attributes for the specified + * domain. + * + */ +typedef struct _virSecurityLabel { + char label[VIR_SECURITY_LABEL_BUFLEN]; /* security label string */ + int enforcing; /* 1 if security policy is being enforced for domain */ +} virSecurityLabel; + +/** + * virSecurityLabelPtr: + * + * a virSecurityLabelPtr is a pointer to a virSecurityLabel. + */ +typedef virSecurityLabel *virSecurityLabelPtr; + +/** + * VIR_SECURITY_MODEL_BUFLEN: + * + * Macro providing the maximum length of the virSecurityModel model string. + */ +#define VIR_SECURITY_MODEL_BUFLEN (256 + 1) + +/** + * VIR_SECURITY_DOI_BUFLEN: + * + * Macro providing the maximum length of the virSecurityModel doi string. + */ +#define VIR_SECURITY_DOI_BUFLEN (256 + 1) + +/** + * virSecurityModel: + * + * a virSecurityModel is a structure filled by virNodeGetSecurityModel(), + * providing the per-hypervisor security model and DOI attributes for the + * specified domain. + * + */ +typedef struct _virSecurityModel { + char model[VIR_SECURITY_MODEL_BUFLEN]; /* security model string */ + char doi[VIR_SECURITY_DOI_BUFLEN]; /* domain of interpetation */ +} virSecurityModel; + +/** + * virSecurityModelPtr: + * + * a virSecurityModelPtr is a pointer to a virSecurityModel. + */ +typedef virSecurityModel *virSecurityModelPtr; + +/** * virNodeInfoPtr: * * a virNodeInfo is a structure filled by virNodeGetInfo() and providing @@ -417,6 +479,9 @@ char * virConnectGetCap unsigned long long virNodeGetFreeMemory (virConnectPtr conn); +int virNodeGetSecurityModel (virConnectPtr conn, + virSecurityModelPtr secmodel); + /* * Gather list of running domains */ @@ -506,6 +571,8 @@ int virDomainSetMaxM int virDomainSetMemory (virDomainPtr domain, unsigned long memory); int virDomainGetMaxVcpus (virDomainPtr domain); +int virDomainGetSecurityLabel (virDomainPtr domain, + virSecurityLabelPtr seclabel); /* * XML domain description diff -up libvirt-0.6.0/include/libvirt/virterror.h.svirt libvirt-0.6.0/include/libvirt/virterror.h --- libvirt-0.6.0/include/libvirt/virterror.h.svirt 2008-11-25 08:42:33.000000000 -0500 +++ libvirt-0.6.0/include/libvirt/virterror.h 2009-02-17 10:07:06.223677000 -0500 @@ -61,6 +61,7 @@ typedef enum { VIR_FROM_UML, /* Error at the UML driver */ VIR_FROM_NODEDEV, /* Error from node device monitor */ VIR_FROM_XEN_INOTIFY, /* Error from xen inotify layer */ + VIR_FROM_SECURITY, /* Error from security framework */ } virErrorDomain; @@ -154,6 +155,7 @@ typedef enum { VIR_WAR_NO_NODE, /* failed to start node driver */ VIR_ERR_INVALID_NODE_DEVICE,/* invalid node device object */ VIR_ERR_NO_NODE_DEVICE,/* node device not found */ + VIR_ERR_NO_SECURITY_MODEL, /* security model not found */ } virErrorNumber; /** diff -up libvirt-0.6.0/po/POTFILES.in.svirt libvirt-0.6.0/po/POTFILES.in --- libvirt-0.6.0/po/POTFILES.in.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/po/POTFILES.in 2009-02-17 10:07:06.226679000 -0500 @@ -22,6 +22,8 @@ src/proxy_internal.c src/qemu_conf.c src/qemu_driver.c src/remote_internal.c +src/security.c +src/security_selinux.c src/storage_backend.c src/storage_backend_disk.c src/storage_backend_fs.c diff -up libvirt-0.6.0/python/generator.py.svirt libvirt-0.6.0/python/generator.py --- libvirt-0.6.0/python/generator.py.svirt 2008-11-21 07:47:32.000000000 -0500 +++ libvirt-0.6.0/python/generator.py 2009-02-17 10:07:06.230676000 -0500 @@ -342,6 +342,8 @@ skip_function = ( 'virCopyLastError', # Python API is called virGetLastError instead 'virConnectOpenAuth', # Python C code is manually written 'virDefaultErrorFunc', # Python virErrorFuncHandler impl calls this from C + 'virDomainGetSecurityLabel', # Needs investigation... + 'virNodeGetSecurityModel', # Needs investigation... 'virConnectDomainEventRegister', # overridden in virConnect.py 'virConnectDomainEventDeregister', # overridden in virConnect.py ) diff -up libvirt-0.6.0/qemud/Makefile.am.svirt libvirt-0.6.0/qemud/Makefile.am --- libvirt-0.6.0/qemud/Makefile.am.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/qemud/Makefile.am 2009-02-17 10:07:06.237678000 -0500 @@ -130,6 +130,7 @@ libvirtd_LDADD += ../src/libvirt_driver_ endif endif +libvirtd_LDADD += ../src/libvirt_driver_security.la libvirtd_LDADD += ../src/libvirt.la if HAVE_POLKIT diff -up libvirt-0.6.0/qemud/remote.c.svirt libvirt-0.6.0/qemud/remote.c --- libvirt-0.6.0/qemud/remote.c.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/qemud/remote.c 2009-02-17 10:07:06.246680000 -0500 @@ -1340,6 +1340,76 @@ remoteDispatchDomainGetMaxVcpus (struct } static int +remoteDispatchDomainGetSecurityLabel(struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client ATTRIBUTE_UNUSED, + virConnectPtr conn, + remote_error *rerr, + remote_domain_get_security_label_args *args, + remote_domain_get_security_label_ret *ret) +{ + virDomainPtr dom; + virSecurityLabel seclabel; + + dom = get_nonnull_domain(conn, args->dom); + if (dom == NULL) { + remoteDispatchConnError(rerr, conn); + return -1; + } + + memset(&seclabel, 0, sizeof seclabel); + if (virDomainGetSecurityLabel(dom, &seclabel) == -1) { + virDomainFree(dom); + remoteDispatchFormatError(rerr, "%s", _("unable to get security label")); + return -1; + } + + ret->label.label_len = strlen(seclabel.label) + 1; + if (VIR_ALLOC_N(ret->label.label_val, ret->label.label_len) < 0) { + virDomainFree(dom); + remoteDispatchOOMError(rerr); + return -1; + } + strcpy(ret->label.label_val, seclabel.label); + ret->enforcing = seclabel.enforcing; + virDomainFree(dom); + + return 0; +} + +static int +remoteDispatchNodeGetSecurityModel(struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client ATTRIBUTE_UNUSED, + virConnectPtr conn, + remote_error *rerr, + void *args ATTRIBUTE_UNUSED, + remote_node_get_security_model_ret *ret) +{ + virSecurityModel secmodel; + + memset(&secmodel, 0, sizeof secmodel); + if (virNodeGetSecurityModel(conn, &secmodel) == -1) { + remoteDispatchFormatError(rerr, "%s", _("unable to get security model")); + return -1; + } + + ret->model.model_len = strlen(secmodel.model) + 1; + if (VIR_ALLOC_N(ret->model.model_val, ret->model.model_len) < 0) { + remoteDispatchOOMError(rerr); + return -1; + } + strcpy(ret->model.model_val, secmodel.model); + + ret->doi.doi_len = strlen(secmodel.doi) + 1; + if (VIR_ALLOC_N(ret->doi.doi_val, ret->doi.doi_len) < 0) { + remoteDispatchOOMError(rerr); + return -1; + } + strcpy(ret->doi.doi_val, secmodel.doi); + + return 0; +} + +static int remoteDispatchDomainGetOsType (struct qemud_server *server ATTRIBUTE_UNUSED, struct qemud_client *client ATTRIBUTE_UNUSED, virConnectPtr conn, diff -up libvirt-0.6.0/qemud/remote_dispatch_args.h.svirt libvirt-0.6.0/qemud/remote_dispatch_args.h --- libvirt-0.6.0/qemud/remote_dispatch_args.h.svirt 2008-12-19 09:00:02.000000000 -0500 +++ libvirt-0.6.0/qemud/remote_dispatch_args.h 2009-02-17 10:07:06.250678000 -0500 @@ -99,3 +99,4 @@ remote_node_device_get_parent_args val_remote_node_device_get_parent_args; remote_node_device_num_of_caps_args val_remote_node_device_num_of_caps_args; remote_node_device_list_caps_args val_remote_node_device_list_caps_args; + remote_domain_get_security_label_args val_remote_domain_get_security_label_args; diff -up libvirt-0.6.0/qemud/remote_dispatch_prototypes.h.svirt libvirt-0.6.0/qemud/remote_dispatch_prototypes.h --- libvirt-0.6.0/qemud/remote_dispatch_prototypes.h.svirt 2008-12-19 09:00:02.000000000 -0500 +++ libvirt-0.6.0/qemud/remote_dispatch_prototypes.h 2009-02-17 10:07:06.255676000 -0500 @@ -184,6 +184,13 @@ static int remoteDispatchDomainGetSchedu remote_error *err, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret); +static int remoteDispatchDomainGetSecurityLabel( + struct qemud_server *server, + struct qemud_client *client, + virConnectPtr conn, + remote_error *err, + remote_domain_get_security_label_args *args, + remote_domain_get_security_label_ret *ret); static int remoteDispatchDomainGetVcpus( struct qemud_server *server, struct qemud_client *client, @@ -576,6 +583,13 @@ static int remoteDispatchNodeGetInfo( remote_error *err, void *args, remote_node_get_info_ret *ret); +static int remoteDispatchNodeGetSecurityModel( + struct qemud_server *server, + struct qemud_client *client, + virConnectPtr conn, + remote_error *err, + void *args, + remote_node_get_security_model_ret *ret); static int remoteDispatchNodeListDevices( struct qemud_server *server, struct qemud_client *client, diff -up libvirt-0.6.0/qemud/remote_dispatch_ret.h.svirt libvirt-0.6.0/qemud/remote_dispatch_ret.h --- libvirt-0.6.0/qemud/remote_dispatch_ret.h.svirt 2008-12-19 09:00:02.000000000 -0500 +++ libvirt-0.6.0/qemud/remote_dispatch_ret.h 2009-02-17 10:07:06.259676000 -0500 @@ -86,3 +86,5 @@ remote_node_device_get_parent_ret val_remote_node_device_get_parent_ret; remote_node_device_num_of_caps_ret val_remote_node_device_num_of_caps_ret; remote_node_device_list_caps_ret val_remote_node_device_list_caps_ret; + remote_domain_get_security_label_ret val_remote_domain_get_security_label_ret; + remote_node_get_security_model_ret val_remote_node_get_security_model_ret; diff -up libvirt-0.6.0/qemud/remote_dispatch_table.h.svirt libvirt-0.6.0/qemud/remote_dispatch_table.h --- libvirt-0.6.0/qemud/remote_dispatch_table.h.svirt 2008-12-19 09:00:02.000000000 -0500 +++ libvirt-0.6.0/qemud/remote_dispatch_table.h 2009-02-17 10:07:06.263676000 -0500 @@ -592,3 +592,13 @@ .args_filter = (xdrproc_t) xdr_remote_node_device_list_caps_args, .ret_filter = (xdrproc_t) xdr_remote_node_device_list_caps_ret, }, +{ /* DomainGetSecurityLabel => 118 */ + .fn = (dispatch_fn) remoteDispatchDomainGetSecurityLabel, + .args_filter = (xdrproc_t) xdr_remote_domain_get_security_label_args, + .ret_filter = (xdrproc_t) xdr_remote_domain_get_security_label_ret, +}, +{ /* NodeGetSecurityModel => 119 */ + .fn = (dispatch_fn) remoteDispatchNodeGetSecurityModel, + .args_filter = (xdrproc_t) xdr_void, + .ret_filter = (xdrproc_t) xdr_remote_node_get_security_model_ret, +}, diff -up libvirt-0.6.0/qemud/remote_protocol.c.svirt libvirt-0.6.0/qemud/remote_protocol.c --- libvirt-0.6.0/qemud/remote_protocol.c.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/qemud/remote_protocol.c 2009-02-17 10:07:06.268676000 -0500 @@ -1166,6 +1166,43 @@ xdr_remote_domain_get_max_vcpus_ret (XDR } bool_t +xdr_remote_domain_get_security_label_args (XDR *xdrs, remote_domain_get_security_label_args *objp) +{ + + if (!xdr_remote_nonnull_domain (xdrs, &objp->dom)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_domain_get_security_label_ret (XDR *xdrs, remote_domain_get_security_label_ret *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->label.label_val; + + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->label.label_len, REMOTE_SECURITY_LABEL_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + if (!xdr_int (xdrs, &objp->enforcing)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_node_get_security_model_ret (XDR *xdrs, remote_node_get_security_model_ret *objp) +{ + char **objp_cpp1 = (char **) (void *) &objp->doi.doi_val; + char **objp_cpp0 = (char **) (void *) &objp->model.model_val; + + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->model.model_len, REMOTE_SECURITY_MODEL_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp1, (u_int *) &objp->doi.doi_len, REMOTE_SECURITY_DOI_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t xdr_remote_domain_attach_device_args (XDR *xdrs, remote_domain_attach_device_args *objp) { diff -up libvirt-0.6.0/qemud/remote_protocol.h.svirt libvirt-0.6.0/qemud/remote_protocol.h --- libvirt-0.6.0/qemud/remote_protocol.h.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/qemud/remote_protocol.h 2009-02-17 10:07:06.274679000 -0500 @@ -38,6 +38,9 @@ typedef remote_nonnull_string *remote_st #define REMOTE_AUTH_TYPE_LIST_MAX 20 #define REMOTE_DOMAIN_BLOCK_PEEK_BUFFER_MAX 65536 #define REMOTE_DOMAIN_MEMORY_PEEK_BUFFER_MAX 65536 +#define REMOTE_SECURITY_MODEL_MAX VIR_SECURITY_MODEL_BUFLEN +#define REMOTE_SECURITY_LABEL_MAX VIR_SECURITY_LABEL_BUFLEN +#define REMOTE_SECURITY_DOI_MAX VIR_SECURITY_DOI_BUFLEN typedef char remote_uuid[VIR_UUID_BUFLEN]; @@ -637,6 +640,32 @@ struct remote_domain_get_max_vcpus_ret { }; typedef struct remote_domain_get_max_vcpus_ret remote_domain_get_max_vcpus_ret; +struct remote_domain_get_security_label_args { + remote_nonnull_domain dom; +}; +typedef struct remote_domain_get_security_label_args remote_domain_get_security_label_args; + +struct remote_domain_get_security_label_ret { + struct { + u_int label_len; + char *label_val; + } label; + int enforcing; +}; +typedef struct remote_domain_get_security_label_ret remote_domain_get_security_label_ret; + +struct remote_node_get_security_model_ret { + struct { + u_int model_len; + char *model_val; + } model; + struct { + u_int doi_len; + char *doi_val; + } doi; +}; +typedef struct remote_node_get_security_model_ret remote_node_get_security_model_ret; + struct remote_domain_attach_device_args { remote_nonnull_domain dom; remote_nonnull_string xml; @@ -1348,6 +1377,8 @@ enum remote_procedure { REMOTE_PROC_NODE_DEVICE_GET_PARENT = 115, REMOTE_PROC_NODE_DEVICE_NUM_OF_CAPS = 116, REMOTE_PROC_NODE_DEVICE_LIST_CAPS = 117, + REMOTE_PROC_DOMAIN_GET_SECURITY_LABEL = 118, + REMOTE_PROC_NODE_GET_SECURITY_MODEL = 119, }; typedef enum remote_procedure remote_procedure; @@ -1474,6 +1505,9 @@ extern bool_t xdr_remote_domain_get_vcp extern bool_t xdr_remote_domain_get_vcpus_ret (XDR *, remote_domain_get_vcpus_ret*); extern bool_t xdr_remote_domain_get_max_vcpus_args (XDR *, remote_domain_get_max_vcpus_args*); extern bool_t xdr_remote_domain_get_max_vcpus_ret (XDR *, remote_domain_get_max_vcpus_ret*); +extern bool_t xdr_remote_domain_get_security_label_args (XDR *, remote_domain_get_security_label_args*); +extern bool_t xdr_remote_domain_get_security_label_ret (XDR *, remote_domain_get_security_label_ret*); +extern bool_t xdr_remote_node_get_security_model_ret (XDR *, remote_node_get_security_model_ret*); extern bool_t xdr_remote_domain_attach_device_args (XDR *, remote_domain_attach_device_args*); extern bool_t xdr_remote_domain_detach_device_args (XDR *, remote_domain_detach_device_args*); extern bool_t xdr_remote_domain_get_autostart_args (XDR *, remote_domain_get_autostart_args*); @@ -1679,6 +1713,9 @@ extern bool_t xdr_remote_domain_get_vcpu extern bool_t xdr_remote_domain_get_vcpus_ret (); extern bool_t xdr_remote_domain_get_max_vcpus_args (); extern bool_t xdr_remote_domain_get_max_vcpus_ret (); +extern bool_t xdr_remote_domain_get_security_label_args (); +extern bool_t xdr_remote_domain_get_security_label_ret (); +extern bool_t xdr_remote_node_get_security_model_ret (); extern bool_t xdr_remote_domain_attach_device_args (); extern bool_t xdr_remote_domain_detach_device_args (); extern bool_t xdr_remote_domain_get_autostart_args (); diff -up libvirt-0.6.0/qemud/remote_protocol.x.svirt libvirt-0.6.0/qemud/remote_protocol.x --- libvirt-0.6.0/qemud/remote_protocol.x.svirt 2008-12-19 07:51:11.000000000 -0500 +++ libvirt-0.6.0/qemud/remote_protocol.x 2009-02-17 10:07:06.279676000 -0500 @@ -115,6 +115,21 @@ const REMOTE_DOMAIN_BLOCK_PEEK_BUFFER_MA */ const REMOTE_DOMAIN_MEMORY_PEEK_BUFFER_MAX = 65536; +/* + * Maximum length of a security model field. + */ +const REMOTE_SECURITY_MODEL_MAX = VIR_SECURITY_MODEL_BUFLEN; + +/* + * Maximum length of a security label field. + */ +const REMOTE_SECURITY_LABEL_MAX = VIR_SECURITY_LABEL_BUFLEN; + +/* + * Maximum length of a security DOI field. + */ +const REMOTE_SECURITY_DOI_MAX = VIR_SECURITY_DOI_BUFLEN; + /* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */ typedef opaque remote_uuid[VIR_UUID_BUFLEN]; @@ -617,6 +632,20 @@ struct remote_domain_get_max_vcpus_ret { int num; }; +struct remote_domain_get_security_label_args { + remote_nonnull_domain dom; +}; + +struct remote_domain_get_security_label_ret { + char label<REMOTE_SECURITY_LABEL_MAX>; + int enforcing; +}; + +struct remote_node_get_security_model_ret { + char model<REMOTE_SECURITY_MODEL_MAX>; + char doi<REMOTE_SECURITY_DOI_MAX>; +}; + struct remote_domain_attach_device_args { remote_nonnull_domain dom; remote_nonnull_string xml; @@ -1223,7 +1252,10 @@ enum remote_procedure { REMOTE_PROC_NODE_DEVICE_DUMP_XML = 114, REMOTE_PROC_NODE_DEVICE_GET_PARENT = 115, REMOTE_PROC_NODE_DEVICE_NUM_OF_CAPS = 116, - REMOTE_PROC_NODE_DEVICE_LIST_CAPS = 117 + REMOTE_PROC_NODE_DEVICE_LIST_CAPS = 117, + + REMOTE_PROC_DOMAIN_GET_SECURITY_LABEL = 118, + REMOTE_PROC_NODE_GET_SECURITY_MODEL = 119 }; /* Custom RPC structure. */ diff -up libvirt-0.6.0/src/capabilities.c.svirt libvirt-0.6.0/src/capabilities.c --- libvirt-0.6.0/src/capabilities.c.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/src/capabilities.c 2009-02-17 10:07:06.285678000 -0500 @@ -150,6 +150,8 @@ virCapabilitiesFree(virCapsPtr caps) { VIR_FREE(caps->host.migrateTrans); VIR_FREE(caps->host.arch); + VIR_FREE(caps->host.secModel.model); + VIR_FREE(caps->host.secModel.doi); VIR_FREE(caps); } @@ -599,6 +601,14 @@ virCapabilitiesFormatXML(virCapsPtr caps virBufferAddLit(&xml, " </cells>\n"); virBufferAddLit(&xml, " </topology>\n"); } + + if (caps->host.secModel.model) { + virBufferAddLit(&xml, " <secmodel>\n"); + virBufferVSprintf(&xml, " <model>%s</model>\n", caps->host.secModel.model); + virBufferVSprintf(&xml, " <doi>%s</doi>\n", caps->host.secModel.doi); + virBufferAddLit(&xml, " </secmodel>\n"); + } + virBufferAddLit(&xml, " </host>\n\n"); diff -up libvirt-0.6.0/src/capabilities.h.svirt libvirt-0.6.0/src/capabilities.h --- libvirt-0.6.0/src/capabilities.h.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/src/capabilities.h 2009-02-17 10:07:06.292677000 -0500 @@ -78,6 +78,12 @@ struct _virCapsHostNUMACell { int *cpus; }; +typedef struct _virCapsHostSecModel virCapsHostSecModel; +struct _virCapsHostSecModel { + char *model; + char *doi; +}; + typedef struct _virCapsHost virCapsHost; typedef virCapsHost *virCapsHostPtr; struct _virCapsHost { @@ -90,6 +96,7 @@ struct _virCapsHost { char **migrateTrans; int nnumaCell; virCapsHostNUMACellPtr *numaCell; + virCapsHostSecModel secModel; }; typedef struct _virCaps virCaps; diff -up libvirt-0.6.0/src/domain_conf.c.svirt libvirt-0.6.0/src/domain_conf.c --- libvirt-0.6.0/src/domain_conf.c.svirt 2009-02-17 10:07:06.195708000 -0500 +++ libvirt-0.6.0/src/domain_conf.c 2009-02-17 10:07:06.300677000 -0500 @@ -379,6 +379,16 @@ void virDomainDeviceDefFree(virDomainDev VIR_FREE(def); } +void virSecurityLabelDefFree(virDomainDefPtr def); + +void virSecurityLabelDefFree(virDomainDefPtr def) +{ + if (def->seclabel.model) + VIR_FREE(def->seclabel.model); + if (def->seclabel.label) + VIR_FREE(def->seclabel.label); +} + void virDomainDefFree(virDomainDefPtr def) { unsigned int i; @@ -437,6 +447,8 @@ void virDomainDefFree(virDomainDefPtr de VIR_FREE(def->cpumask); VIR_FREE(def->emulator); + virSecurityLabelDefFree(def); + VIR_FREE(def); } @@ -1818,6 +1830,34 @@ static int virDomainLifecycleParseXML(vi return 0; } +static int +virSecurityLabelDefParseXML(virConnectPtr conn, + const virDomainDefPtr def, + xmlXPathContextPtr ctxt) +{ + char *p; + + if (virXPathNode(conn, "./seclabel", ctxt) == NULL) + return 0; + + p = virXPathStringLimit(conn, "string(./seclabel/label[1])", + VIR_SECURITY_LABEL_BUFLEN-1, ctxt); + if (p == NULL) + goto error; + def->seclabel.label = p; + + p = virXPathStringLimit(conn, "string(./seclabel/@model)", + VIR_SECURITY_MODEL_BUFLEN-1, ctxt); + if (p == NULL) + goto error; + def->seclabel.model = p; + + return 0; + +error: + virSecurityLabelDefFree(def); + return -1; +} virDomainDeviceDefPtr virDomainDeviceDefParse(virConnectPtr conn, virCapsPtr caps, @@ -2403,6 +2443,10 @@ static virDomainDefPtr virDomainDefParse } VIR_FREE(nodes); + /* analysis of security label */ + if (virSecurityLabelDefParseXML(conn, def, ctxt) == -1) + goto error; + return def; no_memory: @@ -3420,6 +3464,13 @@ char *virDomainDefFormat(virConnectPtr c goto cleanup; virBufferAddLit(&buf, " </devices>\n"); + + if (def->seclabel.model) { + virBufferEscapeString(&buf, " <seclabel model='%s'>\n", def->seclabel.model); + virBufferEscapeString(&buf, " <label>%s</label>\n", def->seclabel.label); + virBufferAddLit(&buf, " </seclabel>\n"); + } + virBufferAddLit(&buf, "</domain>\n"); if (virBufferError(&buf)) diff -up libvirt-0.6.0/src/domain_conf.h.svirt libvirt-0.6.0/src/domain_conf.h --- libvirt-0.6.0/src/domain_conf.h.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/src/domain_conf.h 2009-02-17 10:07:06.307676000 -0500 @@ -407,6 +407,14 @@ struct _virDomainOSDef { char *bootloaderArgs; }; +/* Security configuration for domain */ +typedef struct _virSecurityLabelDef virSecurityLabelDef; +typedef virSecurityLabelDef *virSecurityLabelDefPtr; +struct _virSecurityLabelDef { + char *model; /* name of security model */ + char *label; /* security label string */ +}; + #define VIR_DOMAIN_CPUMASK_LEN 1024 /* Guest VM main configuration */ @@ -464,6 +472,7 @@ struct _virDomainDef { /* Only 1 */ virDomainChrDefPtr console; + virSecurityLabelDef seclabel; }; /* Guest VM runtime state */ diff -up libvirt-0.6.0/src/driver.h.svirt libvirt-0.6.0/src/driver.h --- libvirt-0.6.0/src/driver.h.svirt 2008-12-19 07:51:11.000000000 -0500 +++ libvirt-0.6.0/src/driver.h 2009-02-17 10:07:06.313676000 -0500 @@ -181,6 +181,12 @@ typedef int typedef int (*virDrvDomainGetMaxVcpus) (virDomainPtr domain); typedef int + (*virDrvDomainGetSecurityLabel) (virDomainPtr domain, + virSecurityLabelPtr seclabel); +typedef int + (*virDrvNodeGetSecurityModel) (virConnectPtr conn, + virSecurityModelPtr secmodel); +typedef int (*virDrvDomainAttachDevice) (virDomainPtr domain, const char *xml); typedef int @@ -361,6 +367,8 @@ struct _virDriver { virDrvDomainPinVcpu domainPinVcpu; virDrvDomainGetVcpus domainGetVcpus; virDrvDomainGetMaxVcpus domainGetMaxVcpus; + virDrvDomainGetSecurityLabel domainGetSecurityLabel; + virDrvNodeGetSecurityModel nodeGetSecurityModel; virDrvDomainDumpXML domainDumpXML; virDrvListDefinedDomains listDefinedDomains; virDrvNumOfDefinedDomains numOfDefinedDomains; diff -up libvirt-0.6.0/src/libvirt.c.svirt libvirt-0.6.0/src/libvirt.c --- libvirt-0.6.0/src/libvirt.c.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/src/libvirt.c 2009-02-17 10:07:06.332683000 -0500 @@ -4156,6 +4156,70 @@ error: return -1; } +/** + * virDomainGetSecurityLabel: + * @domain: a domain object + * @seclabel: pointer to a virSecurityLabel structure + * + * Extract security label of an active domain. + * + * Returns 0 in case of success, -1 in case of failure, and -2 + * if the operation is not supported (caller decides if that's + * an error). + */ +int +virDomainGetSecurityLabel(virDomainPtr domain, virSecurityLabelPtr seclabel) +{ + virConnectPtr conn; + + if (!VIR_IS_CONNECTED_DOMAIN(domain)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + return -1; + } + + if (seclabel == NULL) { + virLibDomainError(domain, VIR_ERR_INVALID_ARG, __FUNCTION__); + return -1; + } + + conn = domain->conn; + + if (conn->driver->domainGetSecurityLabel) + return conn->driver->domainGetSecurityLabel(domain, seclabel); + + virLibConnWarning(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -2; +} + +/** + * virNodeGetSecurityModel: + * @conn: a connection object + * @secmodel: pointer to a virSecurityModel structure + * + * Extract the security model of a hypervisor. + * + * Returns 0 in case of success, -1 in case of failure, and -2 if the + * operation is not supported (caller decides if that's an error). + */ +int +virNodeGetSecurityModel(virConnectPtr conn, virSecurityModelPtr secmodel) +{ + if (!VIR_IS_CONNECT(conn)) { + virLibConnError(conn, VIR_ERR_INVALID_CONN, __FUNCTION__); + return -1; + } + + if (secmodel == NULL) { + virLibConnError(conn, VIR_ERR_INVALID_ARG, __FUNCTION__); + return -1; + } + + if (conn->driver->nodeGetSecurityModel) + return conn->driver->nodeGetSecurityModel(conn, secmodel); + + virLibConnWarning(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -2; +} /** * virDomainAttachDevice: diff -up libvirt-0.6.0/src/libvirt_private.syms.svirt libvirt-0.6.0/src/libvirt_private.syms --- libvirt-0.6.0/src/libvirt_private.syms.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/src/libvirt_private.syms 2009-02-17 10:36:52.867582000 -0500 @@ -334,3 +334,4 @@ virXPathNode; virXPathNodeSet; virXPathString; virXMLPropString; +virXPathStringLimit; diff -up libvirt-0.6.0/src/libvirt_public.syms.svirt libvirt-0.6.0/src/libvirt_public.syms --- libvirt-0.6.0/src/libvirt_public.syms.svirt 2009-01-20 08:48:28.000000000 -0500 +++ libvirt-0.6.0/src/libvirt_public.syms 2009-02-17 10:37:09.630287000 -0500 @@ -244,7 +244,8 @@ LIBVIRT_0.6.0 { virStoragePoolRef; virStorageVolRef; virNodeDeviceRef; - + virDomainGetSecurityLabel; + virNodeGetSecurityModel; } LIBVIRT_0.5.0; # .... define new API here using predicted next version number .... diff -up libvirt-0.6.0/src/lxc_driver.c.svirt libvirt-0.6.0/src/lxc_driver.c --- libvirt-0.6.0/src/lxc_driver.c.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/src/lxc_driver.c 2009-02-17 10:07:06.339677000 -0500 @@ -1430,6 +1430,8 @@ static virDriver lxcDriver = { NULL, /* domainPinVcpu */ NULL, /* domainGetVcpus */ NULL, /* domainGetMaxVcpus */ + NULL, /* domainGetSecurityLabel */ + NULL, /* nodeGetSecurityModel */ lxcDomainDumpXML, /* domainDumpXML */ lxcListDefinedDomains, /* listDefinedDomains */ lxcNumDefinedDomains, /* numOfDefinedDomains */ diff -up libvirt-0.6.0/src/Makefile.am.svirt libvirt-0.6.0/src/Makefile.am --- libvirt-0.6.0/src/Makefile.am.svirt 2009-01-31 04:04:17.000000000 -0500 +++ libvirt-0.6.0/src/Makefile.am 2009-02-17 10:07:06.346676000 -0500 @@ -139,7 +139,7 @@ UML_DRIVER_SOURCES = \ NETWORK_DRIVER_SOURCES = \ network_driver.h network_driver.c -# And finally storage backend specific impls +# Storage backend specific impls STORAGE_DRIVER_SOURCES = \ storage_driver.h storage_driver.c \ storage_backend.h storage_backend.c @@ -164,6 +164,12 @@ STORAGE_DRIVER_DISK_SOURCES = \ STORAGE_HELPER_DISK_SOURCES = \ parthelper.c +# Security framework and drivers for various models +SECURITY_DRIVER_SOURCES = \ + security.h security.c + +SECURITY_DRIVER_SELINUX_SOURCES = \ + security_selinux.h security_selinux.c NODE_DEVICE_DRIVER_SOURCES = \ node_device.c node_device.h @@ -377,6 +383,19 @@ libvirt_driver_nodedev_la_LDFLAGS += -mo endif endif +libvirt_driver_security_la_SOURCES = $(SECURITY_DRIVER_SOURCES) +if WITH_DRIVER_MODULES +mod_LTLIBRARIES += libvirt_driver_security.la +else +noinst_LTLIBRARIES += libvirt_driver_security.la +endif +if WITH_DRIVER_MODULES +libvirt_driver_security_la_LDFLAGS = -module -avoid-version +endif + +if HAVE_SELINUX +libvirt_driver_security_la_SOURCES += $(SECURITY_DRIVER_SELINUX_SOURCES) +endif # Add all conditional sources just in case... EXTRA_DIST += \ @@ -395,7 +414,9 @@ EXTRA_DIST += \ $(STORAGE_DRIVER_DISK_SOURCES) \ $(NODE_DEVICE_DRIVER_SOURCES) \ $(NODE_DEVICE_DRIVER_HAL_SOURCES) \ - $(NODE_DEVICE_DRIVER_DEVKIT_SOURCES) + $(NODE_DEVICE_DRIVER_DEVKIT_SOURCES) \ + $(SECURITY_DRIVER_SOURCES) \ + $(SECURITY_DRIVER_SELINUX_SOURCES) # # Build our version script. This is composed of three parts: diff -up libvirt-0.6.0/src/openvz_driver.c.svirt libvirt-0.6.0/src/openvz_driver.c --- libvirt-0.6.0/src/openvz_driver.c.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/openvz_driver.c 2009-02-17 10:07:06.362676000 -0500 @@ -1299,6 +1299,8 @@ static virDriver openvzDriver = { NULL, /* domainPinVcpu */ NULL, /* domainGetVcpus */ openvzDomainGetMaxVcpus, /* domainGetMaxVcpus */ + NULL, /* domainGetSecurityLabel */ + NULL, /* nodeGetSecurityModel */ openvzDomainDumpXML, /* domainDumpXML */ openvzListDefinedDomains, /* listDomains */ openvzNumDefinedDomains, /* numOfDomains */ diff -up libvirt-0.6.0/src/qemu_conf.h.svirt libvirt-0.6.0/src/qemu_conf.h --- libvirt-0.6.0/src/qemu_conf.h.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/qemu_conf.h 2009-02-17 10:07:06.368680000 -0500 @@ -33,6 +33,7 @@ #include "domain_conf.h" #include "domain_event.h" #include "threads.h" +#include "security.h" #define qemudDebug(fmt, ...) do {} while(0) @@ -83,6 +84,8 @@ struct qemud_driver { virDomainEventQueuePtr domainEventQueue; int domainEventTimer; int domainEventDispatching; + + virSecurityDriverPtr securityDriver; }; /* Status needed to reconenct to running VMs */ diff -up libvirt-0.6.0/src/qemu_driver.c.svirt libvirt-0.6.0/src/qemu_driver.c --- libvirt-0.6.0/src/qemu_driver.c.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/qemu_driver.c 2009-02-17 10:07:06.378682000 -0500 @@ -68,6 +68,7 @@ #include "memory.h" #include "uuid.h" #include "domain_conf.h" +#include "security.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -383,6 +384,50 @@ next: return 0; } +static int +qemudSecurityInit(struct qemud_driver *qemud_drv) +{ + int ret; + const char *doi, *model; + virCapsPtr caps; + virSecurityDriverPtr security_drv; + + ret = virSecurityDriverStartup(&security_drv); + if (ret == -1) { + qemudLog(QEMUD_ERR, _("Failed to start security driver")); + return -1; + } + /* No security driver wanted to be enabled: just return */ + if (ret == -2) + return 0; + + qemud_drv->securityDriver = security_drv; + doi = virSecurityDriverGetDOI(security_drv); + model = virSecurityDriverGetModel(security_drv); + + qemudLog(QEMUD_DEBUG, "Initialized security driver \"%s\" with " + "DOI \"%s\".\n", model, doi); + + /* + * Add security policy host caps now that the security driver is + * initialized. + */ + caps = qemud_drv->caps; + + caps->host.secModel.model = strdup(model); + if (!caps->host.secModel.model) { + qemudLog(QEMUD_ERR, _("Failed to copy secModel model: %s"), strerror(errno)); + return -1; + } + + caps->host.secModel.doi = strdup(doi); + if (!caps->host.secModel.doi) { + qemudLog(QEMUD_ERR, _("Failed to copy secModel DOI: %s"), strerror(errno)); + return -1; + } + + return 0; +} /** * qemudStartup: @@ -474,6 +519,11 @@ qemudStartup(void) { if ((qemu_driver->caps = qemudCapsInit()) == NULL) goto out_of_memory; + if (qemudSecurityInit(qemu_driver) < 0) { + qemudShutdown(); + return -1; + } + if (qemudLoadDriverConfig(qemu_driver, driverConf) < 0) { goto error; } @@ -1111,6 +1161,15 @@ static int qemudNextFreeVNCPort(struct q return -1; } +static int qemudDomainSetSecurityLabel(virConnectPtr conn, struct qemud_driver *driver, virDomainObjPtr vm) +{ + if (vm->def->seclabel.label != NULL) + if (driver->securityDriver && driver->securityDriver->domainSetSecurityLabel) + return driver->securityDriver->domainSetSecurityLabel(conn, driver->securityDriver, + &vm->def->seclabel); + return 0; +} + static virDomainPtr qemudDomainLookupByName(virConnectPtr conn, const char *name); @@ -1178,6 +1237,16 @@ static int qemudStartVMDaemon(virConnect return -1; } + /* + * Set up the security label for the domain here, before doing + * too much else. + */ + if (qemudDomainSetSecurityLabel(conn, driver, vm) < 0) { + qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to set security label")); + return -1; + } + if (qemudExtractVersionInfo(emulator, NULL, &qemuCmdFlags) < 0) { @@ -2721,7 +2790,94 @@ cleanup: return ret; } +static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr seclabel) +{ + struct qemud_driver *driver = (struct qemud_driver *)dom->conn->privateData; + virDomainObjPtr vm; + const char *type; + int ret = -1; + + qemuDriverLock(driver); + vm = virDomainFindByUUID(&driver->domains, dom->uuid); + qemuDriverUnlock(driver); + + if (!vm) { + char uuidstr[VIR_UUID_STRING_BUFLEN]; + + virUUIDFormat(dom->uuid, uuidstr); + qemudReportError(dom->conn, dom, NULL, VIR_ERR_INVALID_DOMAIN, + _("no domain with matching uuid '%s'"), uuidstr); + goto cleanup; + } + + if (!(type = virDomainVirtTypeToString(vm->def->virtType))) { + qemudReportError(dom->conn, dom, NULL, VIR_ERR_INTERNAL_ERROR, + _("unknown virt type in domain definition '%d'"), + vm->def->virtType); + goto cleanup; + } + + /* + * Theoretically, the pid can be replaced during this operation and + * return the label of a different process. If atomicity is needed, + * further validation will be required. + * + * Comment from Dan Berrange: + * + * Well the PID as stored in the virDomainObjPtr can't be changed + * because you've got a locked object. The OS level PID could have + * exited, though and in extreme circumstances have cycled through all + * PIDs back to ours. We could sanity check that our PID still exists + * after reading the label, by checking that our FD connecting to the + * QEMU monitor hasn't seen SIGHUP/ERR on poll(). + */ + if (virDomainIsActive(vm)) { + if (driver->securityDriver && driver->securityDriver->domainGetSecurityLabel) { + if (driver->securityDriver->domainGetSecurityLabel(dom->conn, vm, seclabel) == -1) { + qemudReportError(dom->conn, dom, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to get security label")); + goto cleanup; + } + } + } + + ret = 0; + +cleanup: + if (vm) + virDomainObjUnlock(vm); + return ret; +} + +static int qemudNodeGetSecurityModel(virConnectPtr conn, virSecurityModelPtr secmodel) +{ + struct qemud_driver *driver = (struct qemud_driver *)conn->privateData; + char *p; + + if (!driver->securityDriver) + return -2; + + p = driver->caps->host.secModel.model; + if (strlen(p) >= VIR_SECURITY_MODEL_BUFLEN-1) { + qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("security model string exceeds max %d bytes"), + VIR_SECURITY_MODEL_BUFLEN-1); + return -1; + } + strcpy(secmodel->model, p); + + p = driver->caps->host.secModel.doi; + if (strlen(p) >= VIR_SECURITY_DOI_BUFLEN-1) { + qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("security DOI string exceeds max %d bytes"), + VIR_SECURITY_DOI_BUFLEN-1); + return -1; + } + strcpy(secmodel->doi, p); + return 0; +} +/* TODO: check seclabel restore */ static int qemudDomainRestore(virConnectPtr conn, const char *path) { struct qemud_driver *driver = conn->privateData; @@ -4475,6 +4631,8 @@ static virDriver qemuDriver = { NULL, /* domainGetVcpus */ #endif qemudDomainGetMaxVcpus, /* domainGetMaxVcpus */ + qemudDomainGetSecurityLabel, /* domainGetSecurityLabel */ + qemudNodeGetSecurityModel, /* nodeGetSecurityModel */ qemudDomainDumpXML, /* domainDumpXML */ qemudListDefinedDomains, /* listDomains */ qemudNumDefinedDomains, /* numOfDomains */ diff -up libvirt-0.6.0/src/remote_internal.c.svirt libvirt-0.6.0/src/remote_internal.c --- libvirt-0.6.0/src/remote_internal.c.svirt 2009-02-17 10:07:06.207699000 -0500 +++ libvirt-0.6.0/src/remote_internal.c 2009-02-17 10:14:28.509959000 -0500 @@ -2299,6 +2299,67 @@ done: return rv; } +static int +remoteDomainGetSecurityLabel (virDomainPtr domain, virSecurityLabelPtr seclabel) +{ + remote_domain_get_security_label_args args; + remote_domain_get_security_label_ret ret; + struct private_data *priv = domain->conn->privateData; + + make_nonnull_domain (&args.dom, domain); + memset (&ret, 0, sizeof ret); + if (call (domain->conn, priv, 0, REMOTE_PROC_DOMAIN_GET_SECURITY_LABEL, + (xdrproc_t) xdr_remote_domain_get_security_label_args, (char *)&args, + (xdrproc_t) xdr_remote_domain_get_security_label_ret, (char *)&ret) == -1) { + return -1; + } + + if (ret.label.label_val != NULL) { + if (strlen (ret.label.label_val) >= sizeof seclabel->label) { + errorf (domain->conn, VIR_ERR_RPC, _("security label exceeds maximum: %zd"), + sizeof seclabel->label - 1); + return -1; + } + strcpy (seclabel->label, ret.label.label_val); + seclabel->enforcing = ret.enforcing; + } + + return 0; +} + +static int +remoteNodeGetSecurityModel (virConnectPtr conn, virSecurityModelPtr secmodel) +{ + remote_node_get_security_model_ret ret; + struct private_data *priv = conn->privateData; + + memset (&ret, 0, sizeof ret); + if (call (conn, priv, 0, REMOTE_PROC_NODE_GET_SECURITY_MODEL, + (xdrproc_t) xdr_void, NULL, + (xdrproc_t) xdr_remote_node_get_security_model_ret, (char *)&ret) == -1) { + return -1; + } + + if (ret.model.model_val != NULL) { + if (strlen (ret.model.model_val) >= sizeof secmodel->model) { + errorf (conn, VIR_ERR_RPC, _("security model exceeds maximum: %zd"), + sizeof secmodel->model - 1); + return -1; + } + strcpy (secmodel->model, ret.model.model_val); + } + + if (ret.doi.doi_val != NULL) { + if (strlen (ret.doi.doi_val) >= sizeof secmodel->doi) { + errorf (conn, VIR_ERR_RPC, _("security doi exceeds maximum: %zd"), + sizeof secmodel->doi - 1); + return -1; + } + strcpy (secmodel->doi, ret.doi.doi_val); + } + return 0; +} + static char * remoteDomainDumpXML (virDomainPtr domain, int flags) { @@ -6721,6 +6782,8 @@ static virDriver driver = { .domainPinVcpu = remoteDomainPinVcpu, .domainGetVcpus = remoteDomainGetVcpus, .domainGetMaxVcpus = remoteDomainGetMaxVcpus, + .domainGetSecurityLabel = remoteDomainGetSecurityLabel, + .nodeGetSecurityModel = remoteNodeGetSecurityModel, .domainDumpXML = remoteDomainDumpXML, .listDefinedDomains = remoteListDefinedDomains, .numOfDefinedDomains = remoteNumOfDefinedDomains, diff -up /dev/null libvirt-0.6.0/src/security.c --- /dev/null 2009-02-11 16:31:53.992012235 -0500 +++ libvirt-0.6.0/src/security.c 2009-02-17 10:07:06.396676000 -0500 @@ -0,0 +1,133 @@ +/* + * Copyright (C) 2008 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * Authors: + * James Morris <jmorris(a)namei.org> + * + */ +#include <config.h> +#include <string.h> + +#include "virterror_internal.h" + +#include "security.h" + +#if HAVE_SELINUX +#include "security_selinux.h" +#endif + +static virSecurityDriverStatus testSecurityDriverProbe(void) +{ + return SECURITY_DRIVER_DISABLE; +} + +virSecurityDriver virTestSecurityDriver = { + .name = "test", + .probe = testSecurityDriverProbe, +}; + +static virSecurityDriverPtr security_drivers[] = { + &virTestSecurityDriver, +#ifdef HAVE_SELINUX + &virSELinuxSecurityDriver, +#endif +}; + +/* + * Probe each security driver: each should perform a test to see if it + * should be loaded, e.g. if the currently active host security mechanism + * matches. If the probe succeeds, initialize the driver and return it. + * + * Returns 0 on success, and -1 on error. If no security driver wanted to + * be enabled, then return -2 and let the caller determine what this really + * means. + */ +int +virSecurityDriverStartup(virSecurityDriverPtr * drv) +{ + unsigned int i; + + for (i = 0; i < (sizeof(security_drivers) / sizeof(security_drivers[0])); i++) { + virSecurityDriverPtr tmp = security_drivers[i]; + virSecurityDriverStatus ret = tmp->probe(); + + switch (ret) { + case SECURITY_DRIVER_ENABLE: + virSecurityDriverInit(tmp); + if (tmp->open(NULL, tmp) == -1) { + return -1; + } else { + *drv = tmp; + return 0; + } + break; + + case SECURITY_DRIVER_DISABLE: + break; + + default: + return -1; + } + } + return -2; +} + +void +virSecurityReportError(virConnectPtr conn, int code, const char *fmt, ...) +{ + va_list args; + char errorMessage[1024]; + + if (fmt) { + va_start(args, fmt); + vsnprintf(errorMessage, sizeof(errorMessage) - 1, fmt, args); + va_end(args); + } else + errorMessage[0] = '\0'; + + virRaiseError(conn, NULL, NULL, VIR_FROM_SECURITY, code, + VIR_ERR_ERROR, NULL, NULL, NULL, -1, -1, "%s", + errorMessage); +} + +/* + * Helpers + */ +void +virSecurityDriverInit(virSecurityDriverPtr drv) +{ + memset(&drv->_private, 0, sizeof drv->_private); +} + +int +virSecurityDriverSetDOI(virConnectPtr conn, + virSecurityDriverPtr drv, + const char *doi) +{ + if (strlen(doi) >= VIR_SECURITY_DOI_BUFLEN) { + virSecurityReportError(conn, VIR_ERR_ERROR, + _("%s: DOI \'%s\' is " + "longer than the maximum allowed length of %d"), + __func__, doi, VIR_SECURITY_DOI_BUFLEN - 1); + return -1; + } + strcpy(drv->_private.doi, doi); + return 0; +} + +const char * +virSecurityDriverGetDOI(virSecurityDriverPtr drv) +{ + return drv->_private.doi; +} + +const char * +virSecurityDriverGetModel(virSecurityDriverPtr drv) +{ + return drv->name; +} diff -up /dev/null libvirt-0.6.0/src/security.h --- /dev/null 2009-02-11 16:31:53.992012235 -0500 +++ libvirt-0.6.0/src/security.h 2009-02-17 10:07:06.402676000 -0500 @@ -0,0 +1,72 @@ +/* + * Copyright (C) 2008 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * Authors: + * James Morris <jmorris(a)namei.org> + * + */ +#ifndef __VIR_SECURITY_H__ +#define __VIR_SECURITY_H__ + +#include "internal.h" +#include "domain_conf.h" + +/* + * Return values for security driver probing: the driver will determine + * whether it should be enabled or disabled. + */ +typedef enum { + SECURITY_DRIVER_ENABLE = 0, + SECURITY_DRIVER_ERROR = -1, + SECURITY_DRIVER_DISABLE = -2, +} virSecurityDriverStatus; + +typedef struct _virSecurityDriver virSecurityDriver; +typedef virSecurityDriver *virSecurityDriverPtr; +typedef virSecurityDriverStatus (*virSecurityDriverProbe) (void); +typedef int (*virSecurityDriverOpen) (virConnectPtr conn, + virSecurityDriverPtr drv); +typedef int (*virSecurityDomainGetLabel) (virConnectPtr conn, + virDomainObjPtr vm, + virSecurityLabelPtr sec); +typedef int (*virSecurityDomainSetLabel) (virConnectPtr conn, + virSecurityDriverPtr drv, + virSecurityLabelDefPtr secdef); + +struct _virSecurityDriver { + const char *name; + virSecurityDriverProbe probe; + virSecurityDriverOpen open; + virSecurityDomainGetLabel domainGetSecurityLabel; + virSecurityDomainSetLabel domainSetSecurityLabel; + + /* + * This is internally managed driver state and should only be accessed + * via helpers below. + */ + struct { + char doi[VIR_SECURITY_DOI_BUFLEN]; + } _private; +}; + +/* Global methods */ +int virSecurityDriverStartup(virSecurityDriverPtr * drv); + +void +virSecurityReportError(virConnectPtr conn, int code, const char *fmt, ...) + ATTRIBUTE_FORMAT(printf, 3, 4); + +/* Helpers */ +void virSecurityDriverInit(virSecurityDriverPtr drv); +int virSecurityDriverSetDOI(virConnectPtr conn, + virSecurityDriverPtr drv, + const char *doi); +const char *virSecurityDriverGetDOI(virSecurityDriverPtr drv); +const char *virSecurityDriverGetModel(virSecurityDriverPtr drv); + +#endif /* __VIR_SECURITY_H__ */ diff -up /dev/null libvirt-0.6.0/src/security_selinux.c --- /dev/null 2009-02-11 16:31:53.992012235 -0500 +++ libvirt-0.6.0/src/security_selinux.c 2009-02-17 10:07:06.407678000 -0500 @@ -0,0 +1,108 @@ +/* + * Copyright (C) 2008 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * Authors: + * James Morris <jmorris(a)namei.org> + * + * SELinux security driver. + */ +#include <config.h> +#include <selinux/selinux.h> + +#include "security.h" +#include "security_selinux.h" + +#define SECURITY_SELINUX_VOID_DOI "0" + +static int +SELinuxSecurityDriverProbe(void) +{ + return is_selinux_enabled() ? SECURITY_DRIVER_ENABLE : SECURITY_DRIVER_DISABLE; +} + +static int +SELinuxSecurityDriverOpen(virConnectPtr conn, virSecurityDriverPtr drv) +{ + /* + * Where will the DOI come from? SELinux configuration, or qemu + * configuration? For the moment, we'll just set it to "0". + */ + virSecurityDriverSetDOI(conn, drv, SECURITY_SELINUX_VOID_DOI); + + return 0; +} + +static int +SELinuxSecurityDomainGetSecurityLabel(virConnectPtr conn, + virDomainObjPtr vm, + virSecurityLabelPtr sec) +{ + security_context_t ctx; + + if (getpidcon(vm->pid, &ctx) == -1) { + virSecurityReportError(conn, VIR_ERR_ERROR, _("%s: error calling " + "getpidcon(): %s"), __func__, + strerror(errno)); + return -1; + } + + if (strlen((char *) ctx) >= VIR_SECURITY_LABEL_BUFLEN) { + virSecurityReportError(conn, VIR_ERR_ERROR, + _("%s: security label exceeds " + "maximum length: %d"), __func__, + VIR_SECURITY_LABEL_BUFLEN - 1); + return -1; + } + + strcpy(sec->label, (char *) ctx); + free(ctx); + + sec->enforcing = security_getenforce(); + if (sec->enforcing == -1) { + virSecurityReportError(conn, VIR_ERR_ERROR, _("%s: error calling " + "security_getenforce(): %s"), __func__, + strerror(errno)); + return -1; + } + + return 0; +} + +static int +SELinuxSecurityDomainSetSecurityLabel(virConnectPtr conn, + virSecurityDriverPtr drv, + const virSecurityLabelDefPtr secdef) +{ + /* TODO: verify DOI */ + + if (!STREQ(drv->name, secdef->model)) { + virSecurityReportError(conn, VIR_ERR_ERROR, + _("%s: security label driver mismatch: " + "\'%s\' model configured for domain, but " + "hypervisor driver is \'%s\'."), + __func__, secdef->model, drv->name); + return -1; + } + + if (setexeccon(secdef->label) == -1) { + virSecurityReportError(conn, VIR_ERR_ERROR, + _("%s: unable to set security context " + "'\%s\': %s."), __func__, secdef->label, + strerror(errno)); + return -1; + } + return 0; +} + +virSecurityDriver virSELinuxSecurityDriver = { + .name = "selinux", + .probe = SELinuxSecurityDriverProbe, + .open = SELinuxSecurityDriverOpen, + .domainGetSecurityLabel = SELinuxSecurityDomainGetSecurityLabel, + .domainSetSecurityLabel = SELinuxSecurityDomainSetSecurityLabel, +}; diff -up /dev/null libvirt-0.6.0/src/security_selinux.h --- /dev/null 2009-02-11 16:31:53.992012235 -0500 +++ libvirt-0.6.0/src/security_selinux.h 2009-02-17 10:07:06.413677000 -0500 @@ -0,0 +1,18 @@ +/* + * Copyright (C) 2008 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * Authors: + * James Morris <jmorris(a)namei.org> + * + */ +#ifndef __VIR_SECURITY_SELINUX_H__ +#define __VIR_SECURITY_SELINUX_H__ + +extern virSecurityDriver virSELinuxSecurityDriver; + +#endif /* __VIR_SECURITY_SELINUX_H__ */ diff -up libvirt-0.6.0/src/storage_backend.c.svirt libvirt-0.6.0/src/storage_backend.c --- libvirt-0.6.0/src/storage_backend.c.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/storage_backend.c 2009-02-17 10:07:06.419677000 -0500 @@ -276,6 +276,7 @@ virStorageBackendUpdateVolTargetInfoFD(v VIR_FREE(target->perms.label); #if HAVE_SELINUX + /* XXX: make this a security driver call */ if (fgetfilecon(fd, &filecon) == -1) { if (errno != ENODATA && errno != ENOTSUP) { virReportSystemError(conn, errno, diff -up libvirt-0.6.0/src/test.c.svirt libvirt-0.6.0/src/test.c --- libvirt-0.6.0/src/test.c.svirt 2009-01-20 15:39:28.000000000 -0500 +++ libvirt-0.6.0/src/test.c 2009-02-17 10:07:06.428677000 -0500 @@ -3510,6 +3510,8 @@ static virDriver testDriver = { NULL, /* domainPinVcpu */ NULL, /* domainGetVcpus */ NULL, /* domainGetMaxVcpus */ + NULL, /* domainGetSecurityLabel */ + NULL, /* nodeGetSecurityModel */ testDomainDumpXML, /* domainDumpXML */ testListDefinedDomains, /* listDefinedDomains */ testNumOfDefinedDomains, /* numOfDefinedDomains */ diff -up libvirt-0.6.0/src/uml_driver.c.svirt libvirt-0.6.0/src/uml_driver.c --- libvirt-0.6.0/src/uml_driver.c.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/uml_driver.c 2009-02-17 10:07:06.436676000 -0500 @@ -1852,6 +1852,8 @@ static virDriver umlDriver = { NULL, /* domainPinVcpu */ NULL, /* domainGetVcpus */ NULL, /* domainGetMaxVcpus */ + NULL, /* domainGetSecurityLabel */ + NULL, /* nodeGetSecurityModel */ umlDomainDumpXML, /* domainDumpXML */ umlListDefinedDomains, /* listDomains */ umlNumDefinedDomains, /* numOfDomains */ diff -up libvirt-0.6.0/src/virsh.c.svirt libvirt-0.6.0/src/virsh.c --- libvirt-0.6.0/src/virsh.c.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/virsh.c 2009-02-17 10:07:06.447677000 -0500 @@ -954,6 +954,7 @@ static const vshCmdOptDef opts_undefine[ {NULL, 0, 0, NULL} }; +/* XXX MAC policy for defining & undefining domains ?? */ static int cmdUndefine(vshControl *ctl, const vshCmd *cmd) { @@ -1515,6 +1516,8 @@ cmdDominfo(vshControl *ctl, const vshCmd { virDomainInfo info; virDomainPtr dom; + virSecurityModel secmodel; + virSecurityLabel seclabel; int ret = TRUE, autostart; unsigned int id; char *str, uuid[VIR_UUID_STRING_BUFLEN]; @@ -1573,6 +1576,29 @@ cmdDominfo(vshControl *ctl, const vshCmd autostart ? _("enable") : _("disable") ); } + /* Security model and label information */ + memset(&secmodel, 0, sizeof secmodel); + if (virNodeGetSecurityModel(ctl->conn, &secmodel) == -1) { + virDomainFree(dom); + return FALSE; + } else { + /* Only print something if a security model is active */ + if (secmodel.model[0] != '\0') { + vshPrint(ctl, "%-15s %s\n", _("Security model:"), secmodel.model); + vshPrint(ctl, "%-15s %s\n", _("Security DOI:"), secmodel.doi); + + /* Security labels are only valid for active domains */ + memset(&seclabel, 0, sizeof seclabel); + if (virDomainGetSecurityLabel(dom, &seclabel) == -1) { + virDomainFree(dom); + return FALSE; + } else { + if (seclabel.label[0] != '\0') + vshPrint(ctl, "%-15s %s (%s)\n", _("Security label:"), + seclabel.label, seclabel.enforcing ? "enforcing" : "permissive"); + } + } + } virDomainFree(dom); return ret; } diff -up libvirt-0.6.0/src/virterror.c.svirt libvirt-0.6.0/src/virterror.c --- libvirt-0.6.0/src/virterror.c.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/virterror.c 2009-02-17 10:07:06.454684000 -0500 @@ -151,6 +151,9 @@ static const char *virErrorDomainName(vi case VIR_FROM_UML: dom = "UML "; break; + case VIR_FROM_SECURITY: + dom = "Security Labeling "; + break; } return(dom); } @@ -962,6 +965,12 @@ virErrorMsg(virErrorNumber error, const else errmsg = _("Node device not found: %s"); break; + case VIR_ERR_NO_SECURITY_MODEL: + if (info == NULL) + errmsg = _("Security model not found"); + else + errmsg = _("Security model not found: %s"); + break; } return (errmsg); } diff -up libvirt-0.6.0/src/xml.c.svirt libvirt-0.6.0/src/xml.c --- libvirt-0.6.0/src/xml.c.svirt 2009-01-31 04:04:18.000000000 -0500 +++ libvirt-0.6.0/src/xml.c 2009-02-17 10:07:06.461676000 -0500 @@ -77,6 +77,39 @@ virXPathString(virConnectPtr conn, } /** + * virXPathStringLimit: + * @xpath: the XPath string to evaluate + * @maxlen: maximum length permittred string + * @ctxt: an XPath context + * + * Wrapper for virXPathString, which validates the length of the returned + * string. + * + * Returns a new string which must be deallocated by the caller or NULL if + * the evaluation failed. + */ +char * +virXPathStringLimit(virConnectPtr conn, + const char *xpath, + size_t maxlen, + xmlXPathContextPtr ctxt) +{ + char *tmp = virXPathString(conn, xpath, ctxt); + + if (tmp != NULL) { + if (strlen(tmp) >= maxlen) { + virXMLError(conn, VIR_ERR_INTERNAL_ERROR, + _("\'%s\' value longer than %Zd bytes in virXPathStringLimit()"), + xpath, maxlen); + return NULL; + } + } else + virXMLError(conn, VIR_ERR_INTERNAL_ERROR, + _("\'%s\' missing in virXPathStringLimit()"), xpath); + return tmp; +} + +/** * virXPathNumber: * @xpath: the XPath string to evaluate * @ctxt: an XPath context diff -up libvirt-0.6.0/src/xml.h.svirt libvirt-0.6.0/src/xml.h --- libvirt-0.6.0/src/xml.h.svirt 2008-08-12 03:13:00.000000000 -0400 +++ libvirt-0.6.0/src/xml.h 2009-02-17 10:07:06.467677000 -0500 @@ -17,6 +17,10 @@ int virXPathBoolean (virConnectPtr conn char * virXPathString (virConnectPtr conn, const char *xpath, xmlXPathContextPtr ctxt); +char * virXPathStringLimit(virConnectPtr conn, + const char *xpath, + size_t maxlen, + xmlXPathContextPtr ctxt); int virXPathNumber (virConnectPtr conn, const char *xpath, xmlXPathContextPtr ctxt, diff -up libvirt-0.6.0/tests/daemon-conf.svirt libvirt-0.6.0/tests/daemon-conf --- libvirt-0.6.0/tests/daemon-conf.svirt 2008-12-22 08:21:49.000000000 -0500 +++ libvirt-0.6.0/tests/daemon-conf 2009-02-17 10:07:06.470678000 -0500 @@ -63,6 +63,9 @@ while :; do -e '/^libnuma: Warning: .sys not mounted or no numa system/d' \ err > k && mv k err + # Filter out this diagnostic, too. + sed '/^Initialized security driver/d' err > k && mv k err + printf '%s\n\n' "remoteReadConfigFile: $f: $param_name: $msg" > expected-err diff -u expected-err err || fail=1

5 24

[libvirt] KVM netowrk setting
by aliahsan naqvi 03 Mar '09

03 Mar '09

HI All I have KVM virtual machine running under bridging.I don't want to use bridging/Nating.I want to use routing via IPTABLES to route traffic toward the virtual machine is that possible.These thing benifit me in flitering .And i have live ip on virtual machine.Please let me how i can achive this. _________________________________________________________________ Windows Live™ Groups: Create an online spot for your favorite groups to meet. http://windowslive.com/online/groups?ocid=TXT_TAGLM_WL_groups_032009

1 0

[libvirt] [PATCH] virsh: adjust remaining format strings to avoid emitting trailing space
by Jim Meyering 03 Mar '09

03 Mar '09

This may help avoid testing churn and makes the format strings more uniform. This is identical to yesterday's change, http://git.et.redhat.com/?p=libvirt.git;a=commitdiff;h=b285e110625 but applies the same idea to all of the format strings. >From 2a837515b419cadd1943b3078e5d7b3b116e42ef Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 3 Mar 2009 13:28:39 +0100 Subject: [PATCH] virsh: adjust remaining format strings to avoid emitting trailing space * src/virsh.c (cmdNetworkList, cmdPoolList, cmdVolList): Change format strings like "%-20s\n" to "%s\n". --- src/virsh.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/virsh.c b/src/virsh.c index 6a257ca..9f143a0 100644 --- a/src/virsh.c +++ b/src/virsh.c @@ -2640,7 +2640,7 @@ cmdNetworkList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) else autostartStr = autostart ? "yes" : "no"; - vshPrint(ctl, "%-20s %-10s %-10s\n", + vshPrint(ctl, "%-20s %-10s %s\n", virNetworkGetName(network), _("active"), autostartStr); @@ -3370,7 +3370,8 @@ cmdPoolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) qsort(&inactiveNames[0], maxinactive, sizeof(char*), namesorter); } } - vshPrintExtra(ctl, "%-20s %-10s %-10s\n", _("Name"), _("State"), _("Autostart")); + vshPrintExtra(ctl, "%-20s %-10s %s\n", + _("Name"), _("State"), _("Autostart")); vshPrintExtra(ctl, "-----------------------------------------\n"); for (i = 0; i < maxactive; i++) { @@ -3389,7 +3390,7 @@ cmdPoolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) else autostartStr = autostart ? "yes" : "no"; - vshPrint(ctl, "%-20s %-10s %-10s\n", + vshPrint(ctl, "%-20s %-10s %s\n", virStoragePoolGetName(pool), _("active"), autostartStr); @@ -3412,7 +3413,7 @@ cmdPoolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) else autostartStr = autostart ? "yes" : "no"; - vshPrint(ctl, "%-20s %-10s %-10s\n", + vshPrint(ctl, "%-20s %-10s %s\n", inactiveNames[i], _("inactive"), autostartStr); @@ -4155,7 +4156,7 @@ cmdVolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) qsort(&activeNames[0], maxactive, sizeof(char *), namesorter); } - vshPrintExtra(ctl, "%-20s %-40s\n", _("Name"), _("Path")); + vshPrintExtra(ctl, "%-20s %s\n", _("Name"), _("Path")); vshPrintExtra(ctl, "-----------------------------------------\n"); for (i = 0; i < maxactive; i++) { @@ -4174,7 +4175,7 @@ cmdVolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) } - vshPrint(ctl, "%-20s %-40s\n", + vshPrint(ctl, "%-20s %s\n", virStorageVolGetName(vol), path); free(path); -- 1.6.2.rc1.285.gc5f54

2 1

[libvirt] [PATCH] don't leak a file descriptor on failed pciGetDevice call
by Jim Meyering 03 Mar '09

03 Mar '09

This loop would mistakenly return early (skipping the closedir) upon pciGetDevice failure. >From 2d4d1d25edf8f1c3f4770707215bba67d73fd59f Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 3 Mar 2009 11:11:07 +0100 Subject: [PATCH] don't leak a file descriptor on failed pciGetDevice call * src/pci.c (pciIterDevices): Always close dir handle. --- src/pci.c | 14 +++++++++----- 1 files changed, 9 insertions(+), 5 deletions(-) diff --git a/src/pci.c b/src/pci.c index 2343be3..501c6aa 100644 --- a/src/pci.c +++ b/src/pci.c @@ -233,6 +233,7 @@ pciIterDevices(virConnectPtr conn, { DIR *dir; struct dirent *entry; + int ret = 0; *matched = NULL; @@ -252,14 +253,17 @@ pciIterDevices(virConnectPtr conn, if (entry->d_name[0] == '.') continue; - if (sscanf(entry->d_name, "%x:%x:%x.%x", &domain, &bus, &slot, &function) < 4) { + if (sscanf(entry->d_name, "%x:%x:%x.%x", + &domain, &bus, &slot, &function) < 4) { VIR_WARN("Unusual entry in " PCI_SYSFS "devices: %s", entry->d_name); continue; } try = pciGetDevice(conn, domain, bus, slot, function); - if (!try) - return -1; + if (!try) { + ret = -1; + break; + } if (predicate(try, dev)) { VIR_DEBUG("%s %s: iter matched on %s", dev->id, dev->name, try->name); @@ -269,7 +273,7 @@ pciIterDevices(virConnectPtr conn, pciFreeDevice(conn, try); } closedir(dir); - return 0; + return ret; } static uint8_t @@ -823,7 +827,7 @@ void pciFreeDevice(virConnectPtr conn ATTRIBUTE_UNUSED, pciDevice *dev) { VIR_DEBUG("%s %s: freeing", dev->id, dev->name); - if (dev->fd) + if (dev->fd >= 0) close(dev->fd); VIR_FREE(dev); } -- 1.6.2.rc1.285.gc5f54

2 4

[libvirt] PATCH: Remove qemudLog() macro, use logging.h instead
by Daniel P. Berrange 03 Mar '09

03 Mar '09

The qemudLog() macro just spews its messages to stderr. This patch changes it to use the proper logging.h APIs, so the output channel is configurable in the expected way. Daniel diff --git a/src/iptables.c b/src/iptables.c --- a/src/iptables.c +++ b/src/iptables.c @@ -45,8 +45,7 @@ #include "util.h" #include "memory.h" #include "virterror_internal.h" - -#define qemudLog(level, msg...) fprintf(stderr, msg) +#include "logging.h" enum { ADD = 0, @@ -101,7 +100,7 @@ notifyRulesUpdated(const char *table, char ebuf[1024]; if (virRun(NULL, argv, NULL) < 0) - qemudLog(QEMUD_WARN, _("Failed to run '%s %s': %s"), + VIR_WARN(_("Failed to run '%s %s': %s"), LOKKIT_PATH, arg, virStrerror(errno, ebuf, sizeof ebuf)); } @@ -149,8 +148,8 @@ notifyRulesRemoved(const char *table, len = virFileReadAll(SYSCONF_DIR "/sysconfig/system-config-firewall", MAX_FILE_LEN, &content); if (len < 0) { - qemudLog(QEMUD_WARN, "%s", _("Failed to read " SYSCONF_DIR - "/sysconfig/system-config-firewall")); + VIR_WARN("%s", _("Failed to read " SYSCONF_DIR + "/sysconfig/system-config-firewall")); return; } @@ -178,8 +177,8 @@ notifyRulesRemoved(const char *table, write_error:; char ebuf[1024]; - qemudLog(QEMUD_WARN, _("Failed to write to " SYSCONF_DIR - "/sysconfig/system-config-firewall : %s"), + VIR_WARN(_("Failed to write to " SYSCONF_DIR + "/sysconfig/system-config-firewall : %s"), virStrerror(errno, ebuf, sizeof ebuf)); if (f) fclose(f); @@ -244,13 +243,13 @@ iptRulesSave(iptRules *rules) char ebuf[1024]; if ((err = virFileMakePath(rules->dir))) { - qemudLog(QEMUD_WARN, _("Failed to create directory %s : %s"), + VIR_WARN(_("Failed to create directory %s : %s"), rules->dir, virStrerror(err, ebuf, sizeof ebuf)); return; } if ((err = writeRules(rules->path, rules->rules, rules->nrules))) { - qemudLog(QEMUD_WARN, _("Failed to saves iptables rules to %s : %s"), + VIR_WARN(_("Failed to saves iptables rules to %s : %s"), rules->path, virStrerror(err, ebuf, sizeof ebuf)); return; } @@ -551,8 +550,7 @@ iptRulesReload(iptRules *rules) rule->argv[rule->command_idx] = (char *) "--delete"; if (virRun(NULL, rule->argv, NULL) < 0) - qemudLog(QEMUD_WARN, - _("Failed to remove iptables rule '%s'" + VIR_WARN(_("Failed to remove iptables rule '%s'" " from chain '%s' in table '%s': %s"), rule->rule, rules->chain, rules->table, virStrerror(errno, ebuf, sizeof ebuf)); @@ -562,8 +560,8 @@ iptRulesReload(iptRules *rules) for (i = 0; i < rules->nrules; i++) if (virRun(NULL, rules->rules[i].argv, NULL) < 0) - qemudLog(QEMUD_WARN, _("Failed to add iptables rule '%s'" - " to chain '%s' in table '%s': %s"), + VIR_WARN(_("Failed to add iptables rule '%s'" + " to chain '%s' in table '%s': %s"), rules->rules[i].rule, rules->chain, rules->table, virStrerror(errno, ebuf, sizeof ebuf)); } diff --git a/src/qemu_conf.c b/src/qemu_conf.c --- a/src/qemu_conf.c +++ b/src/qemu_conf.c @@ -47,6 +47,7 @@ #include "datatypes.h" #include "xml.h" #include "nodeinfo.h" +#include "logging.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -77,8 +78,6 @@ VIR_ENUM_IMPL(qemuDiskCacheV2, VIR_DOMAI "writeback"); -#define qemudLog(level, msg...) fprintf(stderr, msg) - int qemudLoadDriverConfig(struct qemud_driver *driver, const char *filename) { virConfPtr conf; @@ -469,18 +468,16 @@ rewait: if (errno == EINTR) goto rewait; - qemudLog(QEMUD_ERR, - _("Unexpected exit status from qemu %d pid %lu"), - WEXITSTATUS(status), (unsigned long)child); + VIR_ERROR(_("Unexpected exit status from qemu %d pid %lu"), + WEXITSTATUS(status), (unsigned long)child); ret = -1; } /* Check & log unexpected exit status, but don't fail, * as there's really no need to throw an error if we did * actually read a valid version number above */ if (WEXITSTATUS(status) != 0) { - qemudLog(QEMUD_WARN, - _("Unexpected exit status '%d', qemu probably failed"), - WEXITSTATUS(status)); + VIR_ERROR(_("Unexpected exit status '%d', qemu probably failed"), + WEXITSTATUS(status)); } return ret; diff --git a/src/qemu_driver.c b/src/qemu_driver.c --- a/src/qemu_driver.c +++ b/src/qemu_driver.c @@ -82,8 +82,6 @@ static int qemudShutdown(void); -#define qemudLog(level, msg...) fprintf(stderr, msg) - static void qemuDriverLock(struct qemud_driver *driver) { virMutexLock(&driver->lock); @@ -220,9 +218,9 @@ qemudAutostartConfigs(struct qemud_drive int ret = qemudStartVMDaemon(conn, driver, vm, NULL, -1); if (ret < 0) { virErrorPtr err = virGetLastError(); - qemudLog(QEMUD_ERROR, _("Failed to autostart VM '%s': %s\n"), - vm->def->name, - err ? err->message : NULL); + VIR_ERROR(_("Failed to autostart VM '%s': %s\n"), + vm->def->name, + err ? err->message : NULL); } else { virDomainEventPtr event = virDomainEventNewFromObj(vm, @@ -306,8 +304,8 @@ qemudReconnectVMs(struct qemud_driver *d if ((config = virDomainConfigFile(NULL, driver->stateDir, vm->def->name)) == NULL) { - qemudLog(QEMUD_ERROR, _("Failed to read domain status for %s\n"), - vm->def->name); + VIR_ERROR(_("Failed to read domain status for %s\n"), + vm->def->name); goto next_error; } @@ -316,14 +314,14 @@ qemudReconnectVMs(struct qemud_driver *d vm->newDef = vm->def; vm->def = status->def; } else { - qemudLog(QEMUD_ERROR, _("Failed to parse domain status for %s\n"), - vm->def->name); + VIR_ERROR(_("Failed to parse domain status for %s\n"), + vm->def->name); goto next_error; } if ((rc = qemudOpenMonitor(NULL, driver, vm, status->monitorpath, 1)) != 0) { - qemudLog(QEMUD_ERROR, _("Failed to reconnect monitor for %s: %d\n"), - vm->def->name, rc); + VIR_ERROR(_("Failed to reconnect monitor for %s: %d\n"), + vm->def->name, rc); goto next_error; } @@ -369,7 +367,7 @@ qemudStartup(void) { return -1; if (virMutexInit(&qemu_driver->lock) < 0) { - qemudLog(QEMUD_ERROR, "%s", _("cannot initialize mutex")); + VIR_ERROR("%s", _("cannot initialize mutex")); VIR_FREE(qemu_driver); return -1; } @@ -422,8 +420,8 @@ qemudStartup(void) { if (virFileMakePath(qemu_driver->stateDir) < 0) { char ebuf[1024]; - qemudLog(QEMUD_ERROR, _("Failed to create state dir '%s': %s\n"), - qemu_driver->stateDir, virStrerror(errno, ebuf, sizeof ebuf)); + VIR_ERROR(_("Failed to create state dir '%s': %s\n"), + qemu_driver->stateDir, virStrerror(errno, ebuf, sizeof ebuf)); goto error; } @@ -901,7 +899,7 @@ static int qemudWaitForMonitor(virConnec "console", 3); if (close(logfd) < 0) { char ebuf[1024]; - qemudLog(QEMUD_WARN, _("Unable to close logfile: %s\n"), + VIR_WARN(_("Unable to close logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); } @@ -1299,29 +1297,29 @@ static int qemudStartVMDaemon(virConnect tmp = progenv; while (*tmp) { if (safewrite(vm->logfile, *tmp, strlen(*tmp)) < 0) - qemudLog(QEMUD_WARN, _("Unable to write envv to logfile: %s\n"), + VIR_WARN(_("Unable to write envv to logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); if (safewrite(vm->logfile, " ", 1) < 0) - qemudLog(QEMUD_WARN, _("Unable to write envv to logfile: %s\n"), + VIR_WARN(_("Unable to write envv to logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); tmp++; } tmp = argv; while (*tmp) { if (safewrite(vm->logfile, *tmp, strlen(*tmp)) < 0) - qemudLog(QEMUD_WARN, _("Unable to write argv to logfile: %s\n"), + VIR_WARN(_("Unable to write argv to logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); if (safewrite(vm->logfile, " ", 1) < 0) - qemudLog(QEMUD_WARN, _("Unable to write argv to logfile: %s\n"), + VIR_WARN(_("Unable to write argv to logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); tmp++; } if (safewrite(vm->logfile, "\n", 1) < 0) - qemudLog(QEMUD_WARN, _("Unable to write argv to logfile: %s\n"), + VIR_WARN(_("Unable to write argv to logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); if ((pos = lseek(vm->logfile, 0, SEEK_END)) < 0) - qemudLog(QEMUD_WARN, _("Unable to seek to end of logfile: %s\n"), + VIR_WARN(_("Unable to seek to end of logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); for (i = 0 ; i < ntapfds ; i++) @@ -1399,7 +1397,7 @@ static void qemudShutdownVMDaemon(virCon if (!virDomainIsActive(vm)) return; - qemudLog(QEMUD_DEBUG, _("Shutting down VM '%s'\n"), vm->def->name); + VIR_DEBUG(_("Shutting down VM '%s'\n"), vm->def->name); if (virKillProcess(vm->pid, 0) == 0 && virKillProcess(vm->pid, SIGTERM) < 0) @@ -1414,7 +1412,7 @@ static void qemudShutdownVMDaemon(virCon if (close(vm->logfile) < 0) { char ebuf[1024]; - qemudLog(QEMUD_WARN, _("Unable to close logfile: %s\n"), + VIR_WARN(_("Unable to close logfile: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); } if (vm->monitor != -1) @@ -1426,7 +1424,7 @@ static void qemudShutdownVMDaemon(virCon virKillProcess(vm->pid, SIGKILL); if (qemudRemoveDomainStatus(conn, driver, vm) < 0) { - qemudLog(QEMUD_WARN, _("Failed to remove domain status for %s"), + VIR_WARN(_("Failed to remove domain status for %s"), vm->def->name); } vm->pid = -1; @@ -1473,8 +1471,8 @@ qemudDispatchVMEvent(int watch, int fd, if (events & (VIR_EVENT_HANDLE_HANGUP | VIR_EVENT_HANDLE_ERROR)) quit = 1; else { - qemudLog(QEMUD_ERROR, _("unhandled fd event %d for %s"), - events, vm->def->name); + VIR_ERROR(_("unhandled fd event %d for %s"), + events, vm->def->name); failed = 1; } } @@ -1587,7 +1585,7 @@ qemudMonitorCommandExtra(const virDomain /* Log, but ignore failures to write logfile for VM */ if (safewrite(vm->logfile, buf, strlen(buf)) < 0) { char ebuf[1024]; - qemudLog(QEMUD_WARN, _("Unable to log VM console data: %s\n"), + VIR_WARN(_("Unable to log VM console data: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); } @@ -1599,7 +1597,7 @@ qemudMonitorCommandExtra(const virDomain /* Log, but ignore failures to write logfile for VM */ if (safewrite(vm->logfile, buf, strlen(buf)) < 0) { char ebuf[1024]; - qemudLog(QEMUD_WARN, _("Unable to log VM console data: %s\n"), + VIR_WARN(_("Unable to log VM console data: %s\n"), virStrerror(errno, ebuf, sizeof ebuf)); } VIR_FREE(buf); @@ -3380,7 +3378,7 @@ static int qemudDomainAttachPciDiskDevic s += strlen(PCI_ATTACH_OK_MSG); if (virStrToLong_i ((const char*)s, &dummy, 10, &dev->data.disk->slotnum) == -1) - qemudLog(QEMUD_WARN, "%s", _("Unable to parse slot number\n")); + VIR_WARN("%s", _("Unable to parse slot number\n")); } else { qemudReportError (conn, dom, NULL, VIR_ERR_OPERATION_FAILED, _("adding %s disk failed"), type); @@ -4512,8 +4510,8 @@ cleanup: * overwrite the previous error, though, so we just throw something * to the logs and hope for the best */ - qemudLog(QEMUD_ERROR, _("Failed to resume guest %s after failure\n"), - vm->def->name); + VIR_ERROR(_("Failed to resume guest %s after failure\n"), + vm->def->name); } else { DEBUG ("cont reply: %s", info); diff --git a/src/uuid.c b/src/uuid.c --- a/src/uuid.c +++ b/src/uuid.c @@ -37,8 +37,7 @@ #include "internal.h" #include "util.h" #include "virterror_internal.h" - -#define qemudLog(level, msg...) fprintf(stderr, msg) +#include "logging.h" #ifndef ENODATA #define ENODATA EIO @@ -102,8 +101,7 @@ virUUIDGenerate(unsigned char *uuid) if ((err = virUUIDGenerateRandomBytes(uuid, VIR_UUID_BUFLEN))) { char ebuf[1024]; - qemudLog(QEMUD_WARN, - _("Falling back to pseudorandom UUID," + VIR_WARN(_("Falling back to pseudorandom UUID," " failed to generate random bytes: %s"), virStrerror(err, ebuf, sizeof ebuf)); } -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 2

[libvirt] tls_allowed_ip_list?
by Chris Lalancette 03 Mar '09

03 Mar '09

All, While doing testing on TLS, I came across the mention of "tls_allowed_ip_list" in the website documentation, here: http://libvirt.org/remote.html#Remote_libvirtd_configuration However, I don't see any implementation of the tls_allowed_ip_list in libvirt itself; a grep through the sources show that we are implementing "tls_allowed_dn_list", but not "tls_allowed_ip_list". Am I missing something in the sources? Should we update the libvirt.org documentation and remove that (seemingly non-existent) parameter? Or should I go in and implement the "tls_allowed_ip_list"? -- Chris Lalancette

3 5

[libvirt] [PATCH]: Fix qemu+tls negotiation
by Chris Lalancette 03 Mar '09

03 Mar '09

All, While doing testing on the migration stuff, I noticed that a connection string using tls (in my case, qemu+tls://host/system) was hanging up trying to connect. I traced this down to a bug in the newer qemud negotiation implementation. What is happening is that we are forgetting to clear client->handshake to 0 after successfully doing a remoteAccessCheck(); this means we were never putting the '\1' byte on the transmit queue to be sent to the client, so the client was essentially waiting forever for the server to respond. Fix this by clearing the handshake once we've successfully done the handshake. Signed-off-by: Chris Lalancette <clalance(a)redhat.com>

3 3

[libvirt] new test failure: QEMU XML-2-ARGV hostdev-pci-address
by Jim Meyering 03 Mar '09

03 Mar '09

FYI, at least on my Fedora 10 system, "make check" gets one failure: 52) QEMU XML-2-ARGV hostdev-pci-address ... Failed to open file '/sys/bus/pci/devices/0000:06:12.5/vendor': No such file or directory Failed to open file '/sys/bus/pci/devices/0000:06:12.5/device': No such file or directory libvir: error : this function is not supported by the hypervisor: Failed to read product/vendor ID for 0000:06:12.5 FAILED It's true, the containing directory doesn't exist: $ ls -1 /sys/bus/pci/devices/0000* /sys/bus/pci/devices/0000:00:00.0@ /sys/bus/pci/devices/0000:00:02.0@ /sys/bus/pci/devices/0000:00:02.1@ /sys/bus/pci/devices/0000:00:03.0@ /sys/bus/pci/devices/0000:00:19.0@ /sys/bus/pci/devices/0000:00:1a.0@ /sys/bus/pci/devices/0000:00:1a.1@ /sys/bus/pci/devices/0000:00:1a.2@ /sys/bus/pci/devices/0000:00:1a.7@ /sys/bus/pci/devices/0000:00:1b.0@ /sys/bus/pci/devices/0000:00:1c.0@ /sys/bus/pci/devices/0000:00:1c.1@ /sys/bus/pci/devices/0000:00:1c.2@ /sys/bus/pci/devices/0000:00:1c.3@ /sys/bus/pci/devices/0000:00:1c.4@ /sys/bus/pci/devices/0000:00:1d.0@ /sys/bus/pci/devices/0000:00:1d.1@ /sys/bus/pci/devices/0000:00:1d.2@ /sys/bus/pci/devices/0000:00:1d.7@ /sys/bus/pci/devices/0000:00:1e.0@ /sys/bus/pci/devices/0000:00:1f.0@ /sys/bus/pci/devices/0000:00:1f.2@ /sys/bus/pci/devices/0000:00:1f.3@ /sys/bus/pci/devices/0000:03:00.0@ /sys/bus/pci/devices/0000:06:00.0@ /sys/bus/pci/devices/0000:06:03.0@ $ readlink /sys/bus/pci/devices/0000:00:1c.4 ../../../devices/pci0000:00/0000:00:1c.4 I'll look into it in about 30 minutes.

1 0

[libvirt] tweak a format string and add a test
by Jim Meyering 02 Mar '09

02 Mar '09

I'm about to commit these (like what I already posted, but now the test kills libvirtd): >From 944052f2287f1a07034be16ea08d620c55eecd6e Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Mon, 2 Mar 2009 14:46:20 +0100 Subject: [PATCH 1/2] virsh: tweak a format string to avoid emitting trailing space * src/virsh.c (cmdNetworkList): Change format not to right-pad with spaces, as that would have required a trailing blank in an expected output file. --- src/virsh.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/virsh.c b/src/virsh.c index 8ae79c5..c23fdda 100644 --- a/src/virsh.c +++ b/src/virsh.c @@ -2596,7 +2596,7 @@ cmdNetworkList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) qsort(&inactiveNames[0], maxinactive, sizeof(char*), namesorter); } } - vshPrintExtra(ctl, "%-20s %-10s %-10s\n", _("Name"), _("State"), _("Autostart")); + vshPrintExtra(ctl, "%-20s %-10s %s\n", _("Name"), _("State"), _("Autostart")); vshPrintExtra(ctl, "-----------------------------------------\n"); for (i = 0; i < maxactive; i++) { -- 1.6.2.rc1.285.gc5f54 >From dfeac0d70dce4a84ee5d70553ec3929bdbeab0c4 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Mon, 2 Mar 2009 14:32:59 +0100 Subject: [PATCH 2/2] tests: test for a recent fix * tests/libvirtd-net-persist: New file. Test for the "Mark defined networks as persistent" fix. * tests/Makefile.am (test_scripts): Add it. --- tests/Makefile.am | 1 + tests/libvirtd-net-persist | 58 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+), 0 deletions(-) create mode 100755 tests/libvirtd-net-persist diff --git a/tests/Makefile.am b/tests/Makefile.am index bec4f60..7479e03 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -81,6 +81,7 @@ test_scripts += \ daemon-conf \ define-dev-segfault \ int-overflow \ + libvirtd-net-persist \ read-bufsiz \ read-non-seekable \ start \ diff --git a/tests/libvirtd-net-persist b/tests/libvirtd-net-persist new file mode 100755 index 0000000..50a1ef4 --- /dev/null +++ b/tests/libvirtd-net-persist @@ -0,0 +1,58 @@ +#!/bin/sh +# ensure that net-destroy doesn't make network disappear (persistence-related) + +if test "$VERBOSE" = yes; then + set -x + libvirtd --version + virsh --version +fi + +test -z "$srcdir" && srcdir=$(pwd) +test -z "$abs_top_srcdir" && abs_top_srcdir=$(pwd)/.. +. "$srcdir/test-lib.sh" + +fail=0 + +pwd=$(pwd) || fail=1 +sock_dir="$pwd" +cat > conf <<EOF || fail=1 +unix_sock_dir = "$sock_dir" +log_outputs = "3:file:$pwd/log" +EOF + +cat > net.xml <<EOF || fail=1 +<network> + <name>N</name> + <ip address="192.168.199.1" netmask="255.255.255.0"></ip> +</network> +EOF + +cat > exp <<EOF || fail=1 +Network N defined from net.xml + +Network N destroyed + +Name State Autostart +----------------------------------------- +N inactive no + +EOF + +libvirtd --config=conf > libvirtd-log 2>&1 & pid=$! +sleep 1 + +url="qemu:///session?socket=@$sock_dir/libvirt-sock" +virsh -c "$url" \ + 'net-define net.xml; net-destroy N; net-list --all' > out 2>&1 \ + || fail=1 + +# if libvird's log is empty, sleep for a second before killing it +test -s libvirtd-log || sleep 1 +kill $pid + +compare exp out || fail=1 + +printf "Shutting down network 'N'\n" > log-exp +compare log-exp libvirtd-log || fail=1 + +exit $fail -- 1.6.2.rc1.285.gc5f54

3 3

[libvirt] [PATCH 1..2] make a test more robust, and add two more
by Jim Meyering 02 Mar '09

02 Mar '09

Here's a rebased patch from a month or two ago. It's only fixing and adding tests, so I'll commit it momentarily. Dan Berrange noticed that daemon-conf could interfere with existing domains, so the latter patch below makes it use the new log-setting and unix_sock_dir-setting config options as well as the option to select a per-test PID file. >From efee209a2adf6f2478de26fe25c73bd4c38316ea Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Thu, 8 Jan 2009 20:18:17 +0100 Subject: [PATCH 1/2] add two tests * tests/libvirtd-pool: New file. Exercise the new unix_sock_dir option * tests/libvirtd-fail: New file. * tests/Makefile.am (test_scripts): Add libvirtd-fail and libvirtd-pool. *** empty log message *** --- tests/Makefile.am | 2 + tests/libvirtd-fail | 21 +++++++++++++++++ tests/libvirtd-pool | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 86 insertions(+), 0 deletions(-) create mode 100755 tests/libvirtd-fail create mode 100755 tests/libvirtd-pool diff --git a/tests/Makefile.am b/tests/Makefile.am index b40785f..11ffe76 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -81,7 +81,9 @@ test_scripts += \ daemon-conf \ define-dev-segfault \ int-overflow \ + libvirtd-fail \ libvirtd-net-persist \ + libvirtd-pool \ read-bufsiz \ read-non-seekable \ start \ diff --git a/tests/libvirtd-fail b/tests/libvirtd-fail new file mode 100755 index 0000000..92b82c4 --- /dev/null +++ b/tests/libvirtd-fail @@ -0,0 +1,21 @@ +#!/bin/sh +# Ensure that libvirt fails when given nonexistent --config=FILE + +if test "$VERBOSE" = yes; then + set -x + libvirtd --version +fi + +test -z "$srcdir" && srcdir=$(pwd) +test -z "$abs_top_srcdir" && abs_top_srcdir=$(pwd)/.. +. "$srcdir/test-lib.sh" + +fail=0 + +libvirtd --config=no-such-file > log 2>&1 && fail=1 +cat <<\EOF > exp +Failed to open file 'no-such-file': No such file or directory +EOF + +compare exp log || fail=1 +exit $fail diff --git a/tests/libvirtd-pool b/tests/libvirtd-pool new file mode 100755 index 0000000..370f3b1 --- /dev/null +++ b/tests/libvirtd-pool @@ -0,0 +1,63 @@ +#!/bin/sh +# Get coverage of libvirtd's config-parsing code. + +if test "$VERBOSE" = yes; then + set -x + libvirtd --version + virsh --version +fi + +test -z "$srcdir" && srcdir=$(pwd) +test -z "$abs_top_srcdir" && abs_top_srcdir=$(pwd)/.. +. "$srcdir/test-lib.sh" + +fail=0 + +pwd=$(pwd) || fail=1 +sock_dir="$pwd" +cat > conf <<EOF || fail=1 +unix_sock_dir = "$sock_dir" +log_outputs = "3:file:$pwd/log" +EOF + +libvirtd --config=conf > libvirtd-log 2>&1 & pid=$! +sleep 1 + +url="qemu:///session?socket=@$sock_dir/libvirt-sock" +virsh --connect "$url" \ + pool-define-as P dir src-host /src/path /src/dev S /target-path > out 2>&1 \ + || fail=1 +virsh --connect "$url" pool-dumpxml P >> out 2>&1 || fail=1 + +# remove random uuid +sed 's/<uuid>.*/-/' out > k && mv k out || fail=1 + +kill $pid + +cat <<EOF > pool-list-exp +Pool P defined + +<pool type='dir'> + <name>P</name> + - + <capacity>0</capacity> + <allocation>0</allocation> + <available>0</available> + <source> + </source> + <target> + <path>/target-path</path> + <permissions> + <mode>0700</mode> + <owner>500</owner> + <group>500</group> + </permissions> + </target> +</pool> + +EOF + +compare pool-list-exp out || fail=1 +compare /dev/null libvirtd-log || fail=1 + +exit $fail -- 1.6.2.rc1.285.gc5f54 >From e94ab9fcb3e5e1c180308d638956cfc05078df1e Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 13 Jan 2009 10:54:41 +0100 Subject: [PATCH 2/2] tests: further isolate a test that runs libvirtd * tests/daemon-conf: Specify a non-default socket directory. Specify test-specific log directory and pid file, too. --- tests/daemon-conf | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/tests/daemon-conf b/tests/daemon-conf index 7a53eff..a5e86ae 100755 --- a/tests/daemon-conf +++ b/tests/daemon-conf @@ -67,8 +67,18 @@ done # Run with the unmodified config file. sleep_secs=2 + +# Be careful to specify a non-default socket directory: +sed 's,^unix_sock_dir.*,unix_sock_dir="'"$(pwd)"'",' tmp.conf > k || fail=1 +mv k tmp.conf || fail=1 + +# Also, specify a test-specific log directory: +sed 's,^log_outputs.*,log_outputs="3:file:'"$(pwd)/log"'",' tmp.conf > k \ + || fail=1 +mv k tmp.conf || fail=1 + printf "running libvirtd with a valid config file ($sleep_secs seconds)\n" 1>&2 -libvirtd --config=tmp.conf > log 2>&1 & pid=$! +libvirtd --pid-file=pid-file --config=tmp.conf > log 2>&1 & pid=$! sleep $sleep_secs kill $pid -- 1.6.2.rc1.285.gc5f54

2 1

[libvirt] [PATCH] Don't log qemu monitor output from blockStats
by Cole Robinson 02 Mar '09

02 Mar '09

The attached patch changes the qemu driver blockStats command to not log qemu monitor output. virt-manager offers an option to continually poll VM disk stats, and if the app is left running for a while with many VMs, this can make the logs huge, for little benefit (a user reported 100 MB with virt-manager left running overnight). The output from the command is still printed with a DEBUG call, so the info isn't completely lost. Thanks, Cole

2 3

[libvirt] PATCH: Add two missing symbol exports
by Daniel P. Berrange 02 Mar '09

02 Mar '09

If building with --with-driver-modules, the Xen and OpenVZ drivers fail to dlopen() because of a couple of missing symbol exports. THis patch adds them Daniel Index: src/libvirt_private.syms =================================================================== RCS file: /data/cvs/libvirt/src/libvirt_private.syms,v retrieving revision 1.23 diff -u -p -u -p -r1.23 libvirt_private.syms --- src/libvirt_private.syms 2 Mar 2009 17:39:43 -0000 1.23 +++ src/libvirt_private.syms 2 Mar 2009 18:23:07 -0000 @@ -26,6 +26,7 @@ virCapabilitiesFormatXML; virCapabilitiesFree; virCapabilitiesNew; virCapabilitiesSetMacPrefix; +virCapabilitiesGenerateMac; # conf.h @@ -47,6 +48,7 @@ virGetStoragePool; virGetStorageVol; virGetNodeDevice; virUnrefDomain; +virUnrefConnect; # domain_conf.h -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 1

[libvirt] PATCH: Always reset PCI devices
by Daniel P. Berrange 02 Mar '09

02 Mar '09

Mark's patches added a attribute managed='yes|no' for PCI <hostdev> configuration. This allows the caller app to indicate who is responsible for attaching/detaching the PCI device from the host drivers. When using managed=yes, libvirt does it, while using managed=no, the someone else should do it - typically blacklist the devices in /etc/modprobe.conf Before launching a guest though the devices need to be reset. Mark made the reset operation conditional on managed=yes, which was not what I had intended. libvirtd should always reset the devices so they are in a sane state before booting, regardless of who manages the host driver binding. The forthcoming PCI passthrough suppor in the Xen driver will work in this way - we'll only support managed=no, but XenD will still always do the reset of devices I also add a comment to remind us that we should add validation that the PCI device is not still in use in the non-managed case. Daniel Index: src/qemu_conf.c =================================================================== RCS file: /data/cvs/libvirt/src/qemu_conf.c,v retrieving revision 1.132 diff -u -p -u -p -r1.132 qemu_conf.c --- src/qemu_conf.c 2 Mar 2009 16:40:31 -0000 1.132 +++ src/qemu_conf.c 2 Mar 2009 18:23:07 -0000 @@ -1411,7 +1411,9 @@ int qemudBuildCommandLine(virConnectPtr } pciFreeDevice(conn, dev); - } + } /* else { + XXX validate that non-managed device isn't in use + } */ } } @@ -1421,8 +1423,7 @@ int qemudBuildCommandLine(virConnectPtr virDomainHostdevDefPtr hostdev = vm->def->hostdevs[i]; pciDevice *dev; - if (!hostdev->managed || - hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS || + if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS || hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI) continue; -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 1

[libvirt] [PATCH] tests: fix an error that made us skip the daemon-conf test
by Jim Meyering 02 Mar '09

02 Mar '09

FYI, I'm committing this as obvious. Otherwise, you'd get this: grep: /h/meyering/w/co/libvirt/lib/config.h: No such file or directory ./daemon-conf: skipping test: configured without QEMU support SKIP: daemon-conf >From e92b94d5b84d2f840ea3e0f88c17411167cfeac8 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Mon, 2 Mar 2009 20:01:50 +0100 Subject: [PATCH] tests: fix an error that made us skip the daemon-conf test * tests/Makefile.am (CONFIG_HEADER): Correct definition. --- tests/Makefile.am | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 7479e03..b40785f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -125,7 +125,7 @@ TESTS_ENVIRONMENT = \ abs_top_srcdir=`cd '$(top_srcdir)'; pwd` \ abs_builddir=`cd '$(builddir)'; pwd` \ abs_srcdir=`cd '$(srcdir)'; pwd` \ - CONFIG_HEADER='$(abs_top_builddir)/lib/config.h' \ + CONFIG_HEADER='$(abs_top_builddir)/config.h' \ PATH="$(path_add)$(PATH_SEPARATOR)$$PATH" \ SHELL="$(SHELL)" \ LIBVIRT_DRIVER_DIR="$(abs_top_builddir)/src/.libs" \ -- 1.6.2.rc1.285.gc5f54

1 0

[libvirt] many more config variables required? or 1 "prefix" config
by Jim Meyering 02 Mar '09

02 Mar '09

I found network-related config from one test leaking into another and making the latter test fail, despite my use of what I thought was everything required to keep them separate (unix_sock_dir and log_outputs both set in config, and --pid-file specified on command line). Unfortunately, there are still hard-coded references to some files. /* Configuration paths are either ~/.libvirt/qemu/... (session) or * /etc/libvirt/qemu/... (system). That's from network_driver.c, to set these variables: struct network_driver ->networkConfigDir ->networkAutostartDir However, storage_driver is nearly identical in that respect. It also uses ~/.libvirt/ vs SYSCONF_DIR/libvirt. Same for uml_driver.c. So, rather than adding new variables for each of these six new parameters, how about just one new config parameter to allow specification of a directory prefix that would replace "~" and "/etc" in determining how to form config-related names? Being able to run multiple libvirtd processes in parallel without having one affect another is a hard requirement for any serious testing.

2 1

[libvirt] [PATCH] Account for defined networks when generating bridge names
by Cole Robinson 02 Mar '09

02 Mar '09

This is the second part of the fix for rhbz 479622. If we are generating a bridge name for a virtual network, don't collide with any bridge name in a defined network. This patch also generates a bridge name at network define time, if none was passed in the xml. The downside to all this is that it won't fix things for existing victims of the bug: if they have 2 networks with the same bridge device in the xml, we can't intelligently remedy the situation. This patch just helps prevent future users getting into that predicament. Thanks, Cole

3 6

[libvirt] [PATCH] Remove redundant monitorWatch
by Cole Robinson 02 Mar '09

02 Mar '09

For some reason there are two VMDef members being used to keep track of monitor event handles: monitor_watch and monitorWatch. Remove the latter. Thanks, Cole

3 5

[libvirt] [PATCH] Better error reporting in qemu AttachDevice
by Cole Robinson 02 Mar '09

02 Mar '09

The attached patch fixes qemu AttachDevice to show the invalid disk bus or type in it's error messages. This also adds an error message where previously we could fall through, leading virsh to print 'Unknown Error' if attempting to hotplug an IDE disk. Thanks, Cole

3 3

[libvirt] [PATCH] Recognize available media in nodedev hal driver
by Cole Robinson 02 Mar '09

02 Mar '09

The host device hal driver can't tell when a storage device has media available, the culprit being an incorrect return value check. The attached patch fixes this. Unfortunately the driver also doesn't properly detect media eject and media inserted hal events. I've been poking at this but it's a more involved fix. Thanks, Cole

3 3

[libvirt] [PATCH] Mark defined networks as persistent
by Cole Robinson 02 Mar '09

02 Mar '09

We aren't setting the persistent bit when a network is defined, so 'destroy' makes them disappear (though they will reappear later since their persistent config is never removed). Attached patch fixes this. Thanks, Cole

3 5

[libvirt] [PATCH] Don't validate disk type in virsh attach-disk
by Cole Robinson 02 Mar '09

02 Mar '09

virsh attempts to validate the requested disk type, rather than just let the underlying driver do it. This was erroneously denying floppy device attaches. Patch attached. Thanks, Cole

3 8

[libvirt] [PATCH 0/6] Add device assignment related node device methods (v2)
by Mark McLoughlin 02 Mar '09

02 Mar '09

Hey, Okay, here's the patches again with the following changes: - Pass virConnectPtr to all pciDevice methods - Read the vendor/product ID from sysfs rather than supplying it to pciGetDevice() - Re-factor the Dettach/ReAttach() so that it can be more easily used with pciback - Add <hostdev managed='(yes|no)'> - Dettach and reset managed hostdev devices before starting a QEMU guest Cheers, Mark.

3 9

[libvirt] How to stop libvirt from deleting tap device after shutdown
by Matthias Dahl 02 Mar '09

02 Mar '09

Hi. I am currently setting up a new server machine which will host several kvm's managed largely by libvirt. The network setup though is done prior to libvirtd startup and shouldn't be touched by it. So currently everything works just fine with 0.6.0 except that libvirt deletes the tap device after I shut a kvm machine down which is something I naturally don't want. I looked through all the documentation I could find but I could not come up with a solution. Forgot to mention: all kvm machine are connected through a tap device with no bridge or whatsoever but 1:1 NAT. This done for performance reasons. As model I use "virtio". Any help would be greatly appreciated. Best regards, Matthias Dahl = XML File for one of the machines =========================================== <domain type='kvm'> <name>charon</name> <uuid>08a3af0e-f145-54c6-30a2-efdab5478523</uuid> <memory>2097152</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type arch='x86_64' machine='pc'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <devices> <emulator>/usr/bin/kvm</emulator> <disk type='file' device='disk'> <source file='/dev/diskspace/kvm_charon'/> <target dev='vda' bus='virtio'/> </disk> <interface type='ethernet'> <mac address='52:54:00:25:6f:3f'/> <script path='/bin/true'/> <target dev='charon_pvnet1'/> <model type='virtio'/> </interface> <serial type='pty'> <source path='/dev/pts/1'/> <target port='0'/> </serial> <console type='pty' tty='/dev/pts/1'> <source path='/dev/pts/1'/> <target port='0'/> </console> </devices> </domain>

2 1

[libvirt] PATCH: Fix DBus thread safety
by Daniel P. Berrange 02 Mar '09

02 Mar '09

We are using DBus from multiple threads in libvirtd. We are not calling dbus_threads_init_default(). Very bad things result. Happy-crashy-daemon This patch fixes that, and also stops DBus messing around with SIGPIPE and also stops it calling exit() when the bus disconnects, so we can actually see the error & continue with life. Daniel diff -rup libvirt-0.6.0.orig/qemud/qemud.c libvirt-0.6.0.new/qemud/qemud.c --- libvirt-0.6.0.orig/qemud/qemud.c 2009-02-18 10:56:34.000000000 +0000 +++ libvirt-0.6.0.new/qemud/qemud.c 2009-02-18 12:52:18.000000000 +0000 @@ -860,6 +860,10 @@ static struct qemud_server *qemudNetwork if (auth_unix_rw == REMOTE_AUTH_POLKIT || auth_unix_ro == REMOTE_AUTH_POLKIT) { DBusError derr; + + dbus_connection_set_change_sigpipe(FALSE); + dbus_threads_init_default(); + dbus_error_init(&derr); server->sysbus = dbus_bus_get(DBUS_BUS_SYSTEM, &derr); if (!(server->sysbus)) { @@ -868,6 +872,7 @@ static struct qemud_server *qemudNetwork dbus_error_free(&derr); goto cleanup; } + dbus_connection_set_exit_on_disconnect(server->sysbus, FALSE); } #endif diff -rup libvirt-0.6.0.orig/src/node_device_hal.c libvirt-0.6.0.new/src/node_device_hal.c --- libvirt-0.6.0.orig/src/node_device_hal.c 2009-01-16 12:44:22.000000000 +0000 +++ libvirt-0.6.0.new/src/node_device_hal.c 2009-02-18 12:52:48.000000000 +0000 @@ -685,6 +685,9 @@ static int halDeviceMonitorStartup(void) nodeDeviceLock(driverState); /* Allocate and initialize a new HAL context */ + dbus_connection_set_change_sigpipe(FALSE); + dbus_threads_init_default(); + dbus_error_init(&err); hal_ctx = libhal_ctx_new(); if (hal_ctx == NULL) { @@ -696,6 +699,8 @@ static int halDeviceMonitorStartup(void) fprintf(stderr, "%s: dbus_bus_get failed\n", __FUNCTION__); goto failure; } + dbus_connection_set_exit_on_disconnect(dbus_conn, FALSE); + if (!libhal_ctx_set_dbus_connection(hal_ctx, dbus_conn)) { fprintf(stderr, "%s: libhal_ctx_set_dbus_connection failed\n", __FUNCTION__); -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

4 5

[libvirt] [PATCH] small fixes in storage_conf.c
by Ryota Ozaki 02 Mar '09

02 Mar '09

Hi, These patches fix: - missing VIR_FREE for the return value of virXPathString - wrong error message "missing owner element" where should be "missing group element" Signed-off-by: Ryota Ozaki <ozaki.ryota(a)gmail.com>

3 3

[libvirt] [PATCH] don't dereference uninitialized pointer
by Jim Meyering 02 Mar '09

02 Mar '09

>From a907d2da7e7f9d1f58009ff6a95454ac0eb2cbf1 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Mon, 2 Mar 2009 10:10:02 +0100 Subject: [PATCH] don't dereference uninitialized pointer * src/storage_conf.c (virStoragePoolDefParsePerms): Initialize "ptr" to NULL. --- ChangeLog | 6 ++++++ src/storage_conf.c | 2 +- 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 12715f5..ede7e0d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2009-03-02 Jim Meyering <meyering(a)redhat.com> + + don't dereference uninitialized pointer + * src/storage_conf.c (virStoragePoolDefParsePerms): Initialize + "ptr" to NULL. + Fri Feb 27 17:15:00 CET 2009 Chris Lalancette <clalance(a)redhat.com> * src/qemu_driver.c: If there is a failure during offline migrate, diff --git a/src/storage_conf.c b/src/storage_conf.c index 70107a2..4a53ff4 100644 --- a/src/storage_conf.c +++ b/src/storage_conf.c @@ -381,7 +381,7 @@ virStoragePoolDefParsePerms(virConnectPtr conn, if (!mode) { perms->mode = 0700; } else { - char *end; + char *end = NULL; perms->mode = strtol(mode, &end, 8); if (*end || perms->mode < 0 || perms->mode > 0777) { virStorageReportError(conn, VIR_ERR_XML_ERROR, -- 1.6.2.rc1.285.gc5f54

2 2

[libvirt] Update on host interface configuration
by David Lutterkort 01 Mar '09

01 Mar '09

Hi, I thought I'd write an update of what I've been doing with the host interface configuration previously discussed[1] After talking with Dan Williams, who is working in NetworkManager, it is clear that the network interface functionality for libvirt is also useful for NM and would help them with handling system-wide interface configuration. To accomodate that, I will implement network interface configuration in a separate library (inspiringly called 'netcf', until somebody thinks of something catchier) and add public API to libvirt that will use netcf to do the actual work. One thorny issue is how libvirt's public API and netcf's public API relate to each other, especially since both libvirt and netcf use XML descriptions to describe network interfaces (netcf does that for exactly the same reasons that libvirt does it, since it will have to deal with similar stability issues) For the time being, I am assuming that the two XML descriptions are identical, with no guarantee that that will always be the case. If and when we run into a case where libvirt's and netcf's needs diverge, we'll break that identity. On the implementation side, that means that, for now, netcf will do all the validation and pass errors back to libvirt. In more concrete terms, I put up a git repo[2] for netcf. There's hardly any code in there, the things I'd particularly appreciate review/feedback on are * the RelaxNG specification of the interface XML (in xml/interface.rng) together with examples of such interface specifications (in tests/interface/) * the (very rough) sketch of the netcf public API, which should map almost 1-1 to the public libvirt API in src/netcf.h I know that the XML schema doesn't cover everything we've discussed in [1], but I think it's a small enough subset to tackle relatively quickly and large enough to be useful. So, one of the main things to think about when looking at the schema is places where the schema would make it hard to make desirable enhancements in the near future (like Marius' point about default routes/gateways) One important point about the model of network config in the schema is that it is centered around what NM calls a 'connection' (though it's called 'interface' in the schema): a grouping of the components that make up the interface the user really cares about (a bridge or a bond) together with the components subordinate to it (e.g. ethernet interfaces enslaved to the bridge or bond) It's those groups that netcf deals with, i.e. if eth0 is enslaved to br0, netcf won't list eth0 as an interface, but only br0, with eth0 as a subinterface. For the implementation, netcf will have a separate backend for each network configuration regime (initscripts for Fedora/RHEL, /etc/network/interfaces for Debian, ...) - once the initscripts backend is done, I'd be very grateful for contributions for the other backends. To sketch out the initscripts implementation, I wrote two XSL stylesheets, xml/initscripts-get.xml that goes from interface XML -> initscripts files (via Augeas) and xml/initscripts-put.xml to go the other way for querying; I'll use those for the core of the initscripts backend. Whether other backands can be done in a similar manner is TBD. David [1] https://www.redhat.com/archives/libvir-list/2009-January/msg00350.html [2] http://git.et.redhat.com/?p=netcf.git;a=tree

5 10

[libvirt] virsh and api
by Zvi Dubitzky 01 Mar '09

01 Mar '09

Hi How about adding the following info to the virsh / dominfo command ( and to the programmable libvirt API:): - IP address of the domain in case the host was configured as a bridge - cpu utilization (at least for Linux) Is that possible ? thanks Zvi Dubitzky Virtualization and System Architecture Email:dubi@il.ibm.com IBM Haifa Research Laboratory Phone: +972-4-8296182 Haifa, 31905, ISRAEL

1 0

[libvirt] Problem installing KVM Guest from command line
by aliahsan naqvi 28 Feb '09

28 Feb '09

Hi All >From past many days i am trying to install KVM Guest Machine from command line via virt-install.Below is many command i have testing this on Fedora 9 and fedora 10 but not able to do it. virt-install -n testing -r 256 -w bridge:virbr0 --location /mnt/Fedora-10-i386-DVD.iso --accelerate --os-type=linux --hvm --nographics -f /var/imgVM1 --force -x "console=ttyS0" I am installing from HTTP server.After give Network information.Following error comes.i have also tried with NFS and ftp but same result.It seem guest machine not able to get ip address.Because when i ping the ip address of the guest which is provided in Networking setting during guest installation.It was not pingable.And this http server is working fine.i can browse all the install directory with no problem and i have install other machine with the http install directory. I am getting following error after TCP/IP Manual/ DHCP Configuration Network Settings +-----------+ Error +------------+ | | | Unable to retrieve | | http://192.168.1.8/fedora | | /linux/releases/10/Fedora/i38 | | 6/os//images/install.img. | | | | +----+ | | | OK | | | +----+ | | | | | +--------------------------------+ Please Advise.Please let me if i am doing some thing wrong or this a bug. _________________________________________________________________ Windows Live™: Life without walls. http://windowslive.com/explore?ocid=TXT_TAGLM_WL_allup_1a_explore_032009

1 0

RE: [libvirt] Help with bridged networking
by Jesus Urroa 27 Feb '09

27 Feb '09

Hi, Thanks all for your help, I installed libvirt 0.6.0-4 and kvm 84-1 from fedora's rawhide and that solved the problem. However know I have a new problem I tried the other virtual machines and some of them just don't start, they seem to stop when the bios jumps to the disk and grub, any ideas? The only thing I can think of is to upgrade the host kernel but if I'm not wrong I have to upgrade to Fedora 9 or 10, and I would like to try something else before because I want to have everything running before leaving xen completely > Subject: RE: [libvirt] Help with bridged networking > From: lutter(a)redhat.com > To: observer1(a)hotmail.es > Date: Fri, 27 Feb 2009 08:48:13 -0800 > > On Fri, 2009-02-27 at 00:55 +0000, Jesus Urroa wrote: > > My mistake I see the lines for the ip config commented out in the file > > and I place them again > > Anyway I remove the card from the bridge to simplify the problem a > > little, this the output of brctl show for the bridge using only xen > > (no libvirt at all) and using kvm with libvirt and running only 2 vms: > > > > worknet 8000.feffffffffff no vif1.0 > > vif4.0 > > vif5.0 > > vif6.1 > > vif7.1 > > vif8.0 > > > > worknet 8000.00ff52959073 no vnet0 > > > > vnet3 > > With the non-Xen setup, your bridge should have the same IP address as > the enslaved NIC. > > What exactly is not working ? Can VM's on the same bridge ping each > other ? > > Did you add teh following iptables rule (to forward packages from the > bridge to the outside): > > # echo "-I FORWARD -m physdev --physdev-is-bridged -j ACCEPT" > /etc/sysconfig/iptables-forward-bridged > # lokkit --custom-rules=ipv4:filter:/etc/sysconfig/iptables-forward-bridged > # service libvirtd reload > > Otherwise, your VM;s can't talk to the outside. > > David > > _________________________________________________________________ Anímate y disfruta con los mejores juegos de Messenger, ¡descúbrelos! http://www.vivelive.com/juegos/

1 0

[libvirt] internal error Timed out while reading console log output
by jmandawg 27 Feb '09

27 Feb '09

Hi, I just compiled installed Libvirt from the latest git repo, and for some reason when I try to start a VM from virsh I get the following error: virsh # start XPTest error: Failed to start domain XPTest error: internal error unable to start guest: and the corresponding output from libvirtd running in verbose mode: 08:19:53.163: info : Received unexpected signal 17 08:20:00.083: info : Received unexpected signal 17 08:20:00.095: info : Received unexpected signal 17 08:20:03.200: error : internal error Timed out while reading console log output libvir: QEMU error : internal error Timed out while reading console log output 08:20:03.200: error : internal error unable to start guest: libvir: QEMU error : internal error unable to start guest: Here is the command virsh is trying to run from the Libvirt log file: LC_ALL=C PATH=/usr/bin:/bin:/root/bin:/usr/X11R6/bin:/usr/local/kvm/bin:/usr/local/sb in:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games HOME=/root USER=root LOGNAME=root /usr/bin/kvm -S -M pc -m 512 -smp 1 -name XPTest -uuid 732fcba8-b71f-face-e067-cf8431fc94aa -monitor pty -pidfile /var/run/libvirt/qemu//XPTest.pid -localtime -no-acpi -boot c -drive file=/var/kvm-images/XPTest/XP_Test.img,if=ide,index=0,boot=on -net nic,macaddr=00:0c:29:f6:c4:f8,vlan=0,model=e1000 -net tap,fd=20,script=,vlan=0,ifname=vnet3 -serial none -parallel none -usb -usbdevice tablet -vnc 0.0.0.0:9 If I start the VM from the commandline manually using this command and then shutdown, I can successfully start it from Virsh qemu-system-x86_64 -no-acpi -m 512 -hda XP_Test.img \ -net nic,macaddr=00:0C:29:F6:C4:F8 \ -net tap \ -usb -usbdevice tablet \ -monitor unix:monitor,server,nowait \ -soundhw all \ -pidfile pid & virsh # version Compiled against library: libvir 0.6.0 Using library: libvir 0.6.0 Using API: QEMU 0.6.0 Running hypervisor: QEMU 0.9.1 Any help would be appreciated. Thanks, John

1 1

[libvirt] [PATCH]: Fix non-live migration failure
by Chris Lalancette 27 Feb '09

27 Feb '09

There is a logic error in the Qemu driver when doing a non-live migrate. During a non-live migrate, on the source host during the Perform step, we pause the domain; however, if there was ever a failure, we were forgetting to unpause the domain, meaning that the domain was paused forever. Add a flag to tell us when we should unpause the domain after a failure. Also, as pointed out by DV, we were unnecessarily using a snprintf to a buffer to execute qemu monitor commands, when we could get away with just sending a static string. Fix that as well. Signed-off-by: Chris Lalancette <clalance(a)redhat.com>

2 2

[libvirt] libvirt tls vnc
by Michael Kress 27 Feb '09

27 Feb '09

Hi, is there a comprehensive howto/tutorial you can recommend me on how to set up libvirt with vnc over tls properly? What I'm trying to do is to use vnc for production use outside my local network and therefore I'd like to secure the vnc sessions. I already made some attempts with ssvnc and Ultr@VNC (both windows clients) but these attemps all failed. I can't get the vnc server (launched by virt-install / kvm) to be displayed via tls. It all runs perfectly without tls. Thanx for any hints! Michael

4 16

[libvirt] using virsh remotely
by Andreas Rittershofer 27 Feb '09

27 Feb '09

I can use virsh as a command line tool, for exampe virsh list gives me the list of the running machines and I am back to the prompt. When I make virsh -c qemu+ssh://maschine-2/system list I get the list of the running machine on the remote machine-2 - but that's it, I am not back to the prompt automatically. I want virsh to behave used remotely as used locally - execute the command and go back to the prompt. How this can be done? mfg ar -- Hier könnte keine Signatur stehen.

2 2

[libvirt] adding bandwidth control support
by Max Zhen 27 Feb '09

27 Feb '09

My last post failed, resend... Max Zhen at 2008-12-24 18:39 wrote: > Hi, > > I'm working on adding bandwidth control support in > virt-install/virsh/libvirt on Xen. > This support can allow setting bandwidth control in dom0 (I'm working on > Solaris dom0 now) for virtual nic devices used in a domU. > I've attached my design in this email. > Basically, this design is about how to represent bandwidth limit > information in command line for virsh/virt-install and how to represent > it in current XML configuration file for a domU. > > Your comments will be highly appreciated :). > > Thanks, > Max > > There are a few things to do to achieve this goal: 1. extend current command line syntax of 'virsh attach-interface' 2. extend current command line syntax of 'virt-install' 3. define bandwidth representation in XML format For 1. I will change the current command line syntax to: virsh attach-interface <domain> <type> <source> [--target <target>] [--mac <mac>] [--script <script>] [--rate <rate-string>] So that we are able to specify bandwidth as "--rate 100M" in command line, like: #virsh attach-interface domu bridge bge0 --rate 100M In this case, bandwidth is specified as an integer with one of the scale suffixes K, M, or G for Kbps, Mbps, or Gbps. For 2. I will add one more option "--rate=rate-string" to current option set of virt-install command. Users can repeatedly add more than one 'rate' options to set bandwidth for multiple nic devices respectively, if needed. For example, with below command line, we start installing a domain with two nic devices whose bandwidth are set to 100Mb/s and 200Mb/s respectively: #virt-install -n snv105 -r 2048 -p --file=/root/snv105 --location=/solarisdvd.iso -b bge0 --rate=100M -b bge1 --rate=200M In this case, bandwidth is specified as an integer with one of the scale suffixes K, M, or G for Kbps, Mbps, or Gbps. For 3. All user specified bandwidth will be represented as part of interface element currently defined in XML configuration file. The new format looks like: <interface type='bridge'> <source bridge='e1000g1'/> <flowcontrol> <rate unit='megabit' period='second' value='100'/> </flowcontrol> </interface> So, I create a new element, "flowcontrol", inside "interface" element. Inside "flowcontrol", I provide bandwidth by setting "rate" element with three attributes, "unit", "period" and "value" to express the bandwidth limit. The supported unit can be 'gigabit', 'megabit' and 'kilobit'. The supported period can be 'second', 'millisecond' and 'microsecond'. And value is an integer to express the amount of data in unit allowed to be transfered in period of time. More elements can be added inside "flowcontrol" element, if we want to add more flow control policies in the future.

2 5

[libvirt] Help with bridged networking
by watcher lines 26 Feb '09

26 Feb '09

Hi, I have setup my virtual networks with initscripts like in this link: http://wiki.libvirt.org/page/Networking#Bridged_networking_.28aka_.22shared…, but there is no networking whitin any system either between vms or with the host and the vms. This setup is for kvm, but with Xen in Fedora 8 it works perfect, but xen is now deprecated in Fedora. This is my setup: /etc/sysconfig/network-scripts/ifcfg-worknet: # worknet bridge DEVICE=worknet BOOTPROTO=none BROADCAST=172.16.1.255 #HWADDR=00:50:56:C0:00:01 IPADDR=172.16.1.1 NETMASK=255.255.255.0 NETWORK=172.16.1.0 ONBOOT=yes TYPE=Bridge STP=off DELAY=0 With Xen this alone lets ip traffic pass between host and to allow dhcp and other protocols i have this line in my iptables: -A FORWARD -i worknet -j ACCEPT This is the software I'm using: libvirt-0.4.4-2.fc8 kvm-60-7.fc8 Thanks for your attention. _________________________________________________________________ Consigue gratis el nuevo Messenger. ¡Descárgatelo! http://download.live.com/

1 0

[libvirt] networking with two hosts
by Andreas Rittershofer 26 Feb '09

26 Feb '09

The following situation is given: Host A with VM1 and VM2 running. Host B with VM3 und VM4 running. Task 1.) Each VM must have network access to each other VM and to the outside. Task 2.) When one host fails, all VMs are running on the remainig host and 1.) must still be fulfilled. Does somebody has any hints about realising this scenario with libvirt and KVM? mfg ar -- Hier könnte keine Signatur stehen.

3 7

[libvirt] Adding VirtualBox support to libvirt
by Pritesh Kothari 26 Feb '09

26 Feb '09

Hi, I am in the process of adding support for virtualbox in libvirt. Basically Virtualbox exports its API through XPCOM. Now to simplify things I was thinking of using C++ and already existing xpcom component in virtualbox but since libvirt exports C API i am not sure if i should use C++ or stick to plain C. I would like to request the libvirt community for its comment on this. Regards, Pritesh

4 10

[libvirt] PATCH: Support memory balloon device in QEMU (incomplete)
by Daniel P. Berrange 26 Feb '09

26 Feb '09

This is an incomplete patch starting to support the memory balloon device in QEMU guests. This requires the VirtIO Balloon driver be present in the guest. In much the same way as with Xen guests, this lets you adjust the memory allocation of the guest on the fly, ceiling limited by the initial memory allocation when booted. The missing bit is to use 'info balloon' to fetch the current allocation for the virDomainGetInfo() API call. Regards, Daniel diff -r 2662c220efc8 src/qemu_driver.c --- a/src/qemu_driver.c Thu Feb 26 15:31:11 2009 +0000 +++ b/src/qemu_driver.c Thu Feb 26 15:31:23 2009 +0000 @@ -2223,6 +2223,46 @@ cleanup: return ret; } + +static int qemudDomainSetMemoryBalloon(virConnectPtr conn, + virDomainObjPtr vm, + unsigned long newmem) { + char *cmd; + char *reply; + + /* + * 'newmem' is in KB, QEMU monitor works in MB, and we all wish + * we just worked in bytes with unsigned long long everywhere. + */ + if (virAsprintf(&cmd, "balloon %lu", (newmem / 1024)) < 0) { + virReportOOMError(conn); + return -1; + } + + if (qemudMonitorCommand(vm, cmd, &reply) < 0) { + qemudReportError(conn, dom, NULL, VIR_ERR_OPERATION_FAILED, + "%s", _("could not balloon memory allocation")); + VIR_FREE(cmd); + return -1; + } + VIR_FREE(cmd); + + /* If the command failed qemu prints: + * device not found, device is locked ... + * No message is printed on success it seems */ + DEBUG ("balloon reply: %s", reply); + if (strstr(reply, "\nunknown command:")) { + qemudReportError (conn, dom, NULL, VIR_ERR_OPERATION_FAILED, + _("memory ballooning is not supported %s"), reply); + VIR_FREE(reply); + return -1; + } + VIR_FREE(reply); + + return 0; +} + + static int qemudDomainSetMemory(virDomainPtr dom, unsigned long newmem) { struct qemud_driver *driver = dom->conn->privateData; virDomainObjPtr vm; @@ -2240,20 +2280,18 @@ static int qemudDomainSetMemory(virDomai goto cleanup; } + if (newmem > vm->def->maxmem) { + qemudReportError(dom->conn, dom, NULL, VIR_ERR_INVALID_ARG, + "%s", _("cannot set memory higher than max memory")); + goto cleanup; + } + if (virDomainIsActive(vm)) { - qemudReportError(dom->conn, dom, NULL, VIR_ERR_NO_SUPPORT, - "%s", _("cannot set memory of an active domain")); - goto cleanup; - } - - if (newmem > vm->def->maxmem) { - qemudReportError(dom->conn, dom, NULL, VIR_ERR_INVALID_ARG, - "%s", _("cannot set memory higher than max memory")); - goto cleanup; - } - - vm->def->memory = newmem; - ret = 0; + ret = qemudDomainSetMemoryBalloon(dom->conn, vm, newmem); + } else { + vm->def->memory = newmem; + ret = 0; + } cleanup: if (vm) -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

1 0

[libvirt] [PATCH]: Fix non-live migration failure case
by Chris Lalancette 26 Feb '09

26 Feb '09

All, There was a logic error in the Qemu driver when doing a non-live migrate. During a non-live migrate, on the source host during the Perform step, we pause the domain; however, if there was ever a failure, we were forgetting to unpause the domain, meaning that the domain was paused forever. Add a flag to tell us when we should unpause the domain after a failure. Signed-off-by: Chris Lalancette <clalance(a)redhat.com>

2 2

[libvirt] [PATCH 0/1] Resend of example program
by David Allan 26 Feb '09

26 Feb '09

I'm just resending this patch, as nobody objected to it after I incorporated the feedback I got, but it never got applied, either. Dave

2 2

[libvirt] PATCH: Fix autostart of session daemon
by Daniel P. Berrange 26 Feb '09

26 Feb '09

When connecting qemu:///session we can autostart the libvirtd daemon. With the node device APIs present, it can take upto a second to start up while talking to dbus. The remote driver was only waiting for a fraction of a second. This changes it to wait for upto 2 seconds, and also not to spawn multiple instances of the daemon. Daniel diff -rup libvirt-0.6.0.orig/src/remote_internal.c libvirt-0.6.0.new/src/remote_internal.c --- libvirt-0.6.0.orig/src/remote_internal.c 2009-02-18 10:56:34.000000000 +0000 +++ libvirt-0.6.0.new/src/remote_internal.c 2009-02-18 13:35:26.000000000 +0000 @@ -654,12 +654,13 @@ doRemoteOpen (virConnectPtr conn, */ if (errno == ECONNREFUSED && flags & VIR_DRV_OPEN_REMOTE_AUTOSTART && - trials < 5) { + trials < 20) { close(priv->sock); priv->sock = -1; - if (remoteForkDaemon(conn) == 0) { + if (trials > 0 || + remoteForkDaemon(conn) == 0) { trials++; - usleep(5000 * trials * trials); + usleep(1000 * 100 * trials); goto autostart_retry; } } -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 2

[libvirt] storage_backend_fs.c Bug
by Russell 26 Feb '09

26 Feb '09

Line 1133 of storage_backend_fs.c in 0.6.0: if (vol->target.backingStore != NULL) { virStorageReportError(conn, VIR_ERR_NO_SUPPORT, _("copy-on-write image not supported with " "qcow-create")); return -1; } virStorageVolTarget has no member called backingStore, resulting in compile errors.

5 5

[libvirt] [PATCH] Don't generate python bindings multiple times w/ parallel build
by Cole Robinson 26 Feb '09

26 Feb '09

The attached patch was posted by Michael Marineau at: https://bugzilla.redhat.com/show_bug.cgi?id=472702 It prevents generating the python bindings multiple times in a parallel build. Works fine in my testing, so I figured I'd pass it along here for better exposure, since it has been languishing in bugzilla. Thanks, Cole

3 2

[libvirt] [PATCH 0/5] Add device assignment related node device methods
by Mark McLoughlin 25 Feb '09

25 Feb '09

Hi, The following patches implement three new node device methods that are needed for KVM PCI device assignment. The dettach method unbinds the device from its device driver and binds it to the pci-stub driver, if available. This ensures the device is not being used by the host. The reattach method undos this operation. It unbinds the device from pci-stub and attempts to re-bind it to the original device driver. This allows the device to be used by the host again. The reset method is intended to be used on a dettached device before it is used by the guest or host. This operation may in future affect other devices, so it is intended that all devices to be assigned to a guest are first dettached before any device is reset. A writeup of some more background details are available here: http://marc.info/?l=kvm&m=123454366317045 Cheers, Mark.

2 13

[libvirt] [PATCH] document static host IP assignment
by Charles Duffy 25 Feb '09

25 Feb '09

Back in August 2008, DV added support for providing static IP/hostname assignments to dnsmasq via <host> elements in the network definition. Since this functionality isn't covered in the documentation, I wrote up a quick patch, attached.

3 2

[libvirt] [PATCH 0/2] Dettach and reset devices before assigning to guests
by Mark McLoughlin 25 Feb '09

25 Feb '09

Hi, The following two patches build on the previous series. The idea is simple - when starting a guest, we should automatically dettach and reset any devices assigned to it. Rather than change the semantics of the existing hostdev source, we only do this when the node device name is used as the hostdev source. Directly specifying the device address rather than its name can be seen as an option for people who know what they're doing. Cheers, Mark.

2 6

[libvirt] "type 'hvm' & arch 'i686' combination is not supported" error
by Frederik Himpe 25 Feb '09

25 Feb '09

I recently updated for libvirt 0.4.6 to libvirt 0.6.0. Now several of the virtual machines I defined, are not shown in virt-manager nor by virsh list --all, although the config files are still in /etc/libvirt/qemu. I tried to run virsh create, and this error is shown: libvir: Domain Config error : internal error os type 'hvm' & arch 'i686' combination is not supported This configuration was working perfectly with libvirt 0.4.6. I needed to change i686 to x86_64 in all config files of 32 bit systems to make them work again. Is there no way libvirt could migrate those configuration files automatically? -- Frederik Himpe

2 5

[libvirt] Patch to python-virtinst to allow it to choose svirt labels
by Daniel J Walsh 24 Feb '09

24 Feb '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Also found at least one big bug in python-virtinst, VirtualDisk.py was dropping the "/" between dirname and basename of installation object, when you told it to create the object. I think we want to have a big switch stored in libvirt somewhere saying whether or not we want isolated virtual machines. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkme++4ACgkQrlYvE4MpobM5ewCeP3iaq3HwT/Rw71E2YElbxKyg 66gAoJaCUkQkBvJz80wjztYiwOGsAKaj =GlDN -----END PGP SIGNATURE----- diff -r -u virtinst-0.400.1/virtinst/Guest.py virtinst-0.400.1.new/virtinst/Guest.py --- virtinst-0.400.1/virtinst/Guest.py 2009-01-26 14:33:25.000000000 -0500 +++ virtinst-0.400.1.new/virtinst/Guest.py 2009-02-19 17:36:35.000000000 -0500 @@ -32,6 +32,8 @@ import __builtin__ import CapabilitiesParser import VirtualDevice +import selinux +import random import osdict from VirtualDisk import VirtualDisk @@ -315,8 +317,9 @@ self._install_disk = None # VirtualDisk that contains install media if type is None: - type = "xen" - self.type = type + self.type = "xen" + else: + self.type = type if not location is None: self.location = location @@ -526,6 +529,7 @@ self._vcpus = None self._cpuset = None self._graphics_dev = None + self._seclabel = None self._os_type = None self._os_variant = None @@ -552,12 +556,34 @@ self.disknode = None # this needs to be set in the subclass + self.default_seclabel , self.default_imagelabel = self._default_seclabels() + + while self._seclabel == None: + seclabel, imagelabel = self.gen_seclabels() + if self.is_conflict_seclabel(self.conn, seclabel): + continue + self.set_seclabel(seclabel) + self.set_imagelabel(imagelabel) + def get_installer(self): return self._installer def set_installer(self, val): self._installer = val installer = property(get_installer, set_installer) + # Security context used to secure guest image + def get_imagelabel(self): + return self._imagelabel + def set_imagelabel(self, val): + self._imagelabel = val + imagelabel = property(get_imagelabel, set_imagelabel) + + # Security context used to secure guest process + def get_seclabel(self): + return self._seclabel + def set_seclabel(self, val): + self._seclabel = val + seclabel = property(get_seclabel, set_seclabel) def get_type(self): return self._installer.type @@ -565,7 +591,6 @@ self._installer.type = val type = property(get_type, set_type) - # Domain name of the guest def get_name(self): return self._name @@ -750,7 +775,7 @@ if enabled not in (True, False): raise ValueError, _("Graphics enabled must be True or False") - if enabled == True: + if enabled: gdev = VirtualGraphics(type=gtype) if port: gdev.port = port @@ -807,9 +832,23 @@ """Ensure that devices are setup""" for disk in self._install_disks: disk.setup(progresscb) + # Not sure of this, might want to put this in VirtualDisk class + selinux.setfilecon(disk.path, self._imagelabel) for nic in self._install_nics: nic.setup(self.conn) + def _get_seclabel_xml(self): + xml = "" + if self._seclabel != None: + xml = """ + <seclabel model='selinux'> + <label>%s</label> + <image>%s</image> + </seclabel> +""" % ( self._seclabel, self._imagelabel) + print xml + return xml + def _get_disk_xml(self, install=True): """Return xml for disk devices (Must be implemented in subclass)""" raise NotImplementedError @@ -899,6 +938,7 @@ <devices> %(devices)s </devices> + %(secxml)s </domain> """ % { "type": self.type, "name": self.name, \ @@ -909,7 +949,8 @@ "maxramkb": self.maxmemory * 1024, \ "devices": self._get_device_xml(install), \ "osblob": osblob, \ - "action": action } + "action": action, \ + "secxml": self._get_seclabel_xml()} def start_install(self, consolecb=None, meter=None, removeOld=False, @@ -1026,6 +1067,108 @@ if self.domain is not None: raise RuntimeError, _("Domain has already been started!") + def _default_seclabels(self): + try: + fd = open(selinux.selinux_virtual_domain_context_path(), 'r') + except OSError, (err_no, msg): + raise RuntimeError, \ + "failed to SELinux virtual domains context: %s: %s %s" % (selinux.selinux_virtual_domain_context_path(),err_no, msg) + + label = fd.read() + fd.close() + try: + fd = open(selinux.selinux_virtual_image_context_path(), 'r') + except OSError, (err_no, msg): + raise RuntimeError, \ + "failed to SELinux virtual domains context: %s: %s %s" % (selinux.selinux_virtual_domain_context_path(), err_no, msg) + + image = fd.read() + fd.close() + + return (label, image) + + def is_conflict_seclabel(self, conn, seclabel): + """ + check if security label is in use by any other VMs on passed + connection. + + @param conn: connection to check for collisions on + @type conn: libvirt.virConnect + + @param seclabel: Security Label + @type str: Security label + + @return: True if a collision, False otherwise + @rtype: C{bool} + """ + if not seclabel: + return False + + vms = [] + # get working domain's name + ids = conn.listDomainsID() + for i in ids: + try: + vm = conn.lookupByID(i) + vms.append(vm) + except libvirt.libvirtError: + # guest probably in process of dieing + logging.warn("Failed to lookup domain id %d" % i) + # get defined domain + names = conn.listDefinedDomains() + for name in names: + try: + vm = conn.lookupByName(name) + vms.append(vm) + except libvirt.libvirtError: + # guest probably in process of dieing + logging.warn("Failed to lookup domain name %s" % name) + + count = 0 + for vm in vms: + doc = None + try: + doc = libxml2.parseDoc(vm.XMLDesc(0)) + except: + continue + ctx = doc.xpathNewContext() + try: + try: + label = ctx.xpathEval("/domain/seclabel/label/") + if label[0].content == seclabel: + count += 1 + break + except: + continue + finally: + if ctx is not None: + ctx.xpathFreeContext() + if doc is not None: + doc.freeDoc() + if count > 0: + return True + else: + return False + + def _get_random_mcs(self): + f1 = random.randrange(1024) + f2 = random.randrange(1024) + if f1 < f2: + return "s0:c%s,c%s" % (f1, f2) + else: + if f1 == f2: + return "s0:c%s" % f1 + else: + return "s0:c%s,c%s" % (f2, f1) + + def gen_seclabels(self): + mcs = self._get_random_mcs() + con = self.default_seclabel.split(':') + seclabel = "%s:%s:%s:%s" % (con[0], con[1], con[2], mcs) + con = self.default_imagelabel.split(':') + imagelabel = "%s:%s:%s:%s" % (con[0], con[1], con[2], mcs) + return (seclabel, imagelabel) + def _set_defaults(self): if self.uuid is None: while 1: diff -r -u virtinst-0.400.1/virtinst/VirtualDisk.py virtinst-0.400.1.new/virtinst/VirtualDisk.py --- virtinst-0.400.1/virtinst/VirtualDisk.py 2009-01-26 14:33:25.000000000 -0500 +++ virtinst-0.400.1.new/virtinst/VirtualDisk.py 2009-02-19 19:43:44.000000000 -0500 @@ -172,8 +172,6 @@ """ return "%s:%s" %(self.type, self.path) - - def _get_path(self): return self._path def _set_path(self, val, validate=True): @@ -413,7 +411,7 @@ newpath = self.vol_object.path() elif self.vol_install: newpath = _util.get_xml_path(self.vol_install.pool.XMLDesc(0), - "/pool/target/path") + \ + "/pool/target/path") + "/" + \ self.vol_install.name if newpath and newpath != self.path:

3 6

[libvirt] iptables and libvirt
by Karl Wirth 24 Feb '09

24 Feb '09

Hi, I would like your feedback on the following idea. What if we could flexibly change the iptables rules for the different guests as they are deployed onto the node/host. The idea would be to do all of this within the iptables of the host leaving alone the iptables of the guests themselves. Here are some specifics: - Physical systems typically isolated using firewalls protecting well known ports. - With virt, on shared physical device, use a bridge to give full LAN access to vm - Or a virtual network which is an isolated bridge with no physical connection. Guest can talk to each other directly. Only NAT'd outbound. - The idea is to eventually make it easy to centrally set up iptable rules for guests that are applied in the host iptables. - We would have to be able to migrate the iptables rules and the state data with vm as it moves The benefits of this would be we could: - Create networking controls that provide same isolation as physical systems - Control which VMs can talk to which others Integration option: - Integration in virtd because it knows about the guests and their network parameters. Thanks for your feedback. Best regards, Karl

6 8

[libvirt] About virtualization, libvirt and xen...
by Patrick Archibal 24 Feb '09

24 Feb '09

Hello, I have understand that : ---------------------------- guest ---------------------------- driver_device0_guest ---------------------------- hypervisor ---------------------------- driver_device0_hypervisor ---------------------------- device0 ---------------------------- in order to access to a device, a guest use driver_device0_guest The driver_device0_guest is modified to ask the hypervisor instead of the device0 directly. Then the hypervisor uses the driver_device0_hypervisor in order to ask the device0. It's my understant, maybe it's false. I have few questions : 1 - what is the difference between libvirt and virtio. 2 - why developpers for xen, kvm... must develop drivers each time there are new devices ? Because the driver must ask the hypervisor instead of device directly. 3 - The devices presented to the guest are real or emulated ? (for xen and/or kvm) if devices are real, for example, i can use my graphic card with a virtual machine ?? 4 - Can you tell me why kvm is best or xen is best in enterprise. In my understand, in the future, kvm is in good position because the developpment is integrated in the kernel. Also, i feel xen progress because firms like citrix contribute but it's seems there is no big update since few years. My vision is xen is best for production environnement because it takes advantages of minimal hypervisor code while kvm must be install with the kernel. Also, it seems, performance will be better in kvm with virtio. Can we use virtio with xen ? _________________________________________________________________ Vous voulez savoir ce que vous pouvez faire avec le nouveau Windows Live ? Lancez-vous ! http://www.microsoft.com/windows/windowslive/default.aspx

2 1

[libvirt] [Patch 0/1] enable --checkpoint option in 'virsh save'
by Matt McCowan 24 Feb '09

24 Feb '09

Along the lines of Xen's 'xm save' function with the '-c' checkpoint flag, following up is a patch to basically make-it-so, plus enable it for qemu. Patch merges with CVS, and passes tests as described in the HACKING file. The code implementing the '--live' option for 'virsh migrate' was copied/pasted/mod'ed to create the --checkpoint option for 'virsh save' Regards Matt McCowan

2 2

[libvirt] networking static ip address
by Francisco José Martín 23 Feb '09

23 Feb '09

Hi, we are using the 0.6.0 version and an Ubuntu guest os under KVM virtualization. We have tried several ways to assign a static ip address to the guest os eth0 device on boot, but we didn't success. Is there any easy way to do it? We are trying to have a guest with the ip 192.168.0.1 in the eth0 device, enslaved to the br0 bridge on the host machine, which seems to be a pretty easy setup to test. When the guest OS is booted, the eth0 device exists, but is not up, and doesn't have the IP. Regards, Francisco.

3 3

[libvirt] [PATCH 1/5] Fix a typo in hostdev docs
by Mark McLoughlin 23 Feb '09

23 Feb '09

It's: <address bus='0x06' slot='0x02' function='0x0'/> not: <address>bus='0x06' slot='0x02' function='0x0'</address> Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> --- docs/formatdomain.html | 2 +- docs/formatdomain.html.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html b/docs/formatdomain.html index 17384b3..17dc0cd 100644 --- a/docs/formatdomain.html +++ b/docs/formatdomain.html @@ -485,7 +485,7 @@ ... <hostdev mode='subsystem' type='pci'> <source> - <address>bus='0x06' slot='0x02' function='0x0'</address> + <address bus='0x06' slot='0x02' function='0x0'/> </source> </hostdev> ...</pre> diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index c1e6a16..ee32354 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -397,7 +397,7 @@ ... <hostdev mode='subsystem' type='pci'> <source> - <address>bus='0x06' slot='0x02' function='0x0'</address> + <address bus='0x06' slot='0x02' function='0x0'/> </source> </hostdev> ...</pre> -- 1.6.0.6

2 9

[libvirt] networking with VMs on two nodes
by Andreas Rittershofer 23 Feb '09

23 Feb '09

I have two nodes and on each several virtual machines running under KVM/qemu. I've set up the default-network on each node and so I can: 1.) ping from host do guest 2.) ping from guest to host 3.) ping from guest tu guest But all this is only possibe on each node by itself. What I need now is network connection between a VM on node 1 to another VM on node 2. How to setup this? When both nodes are fine every node runs a few guests. But when one node goes down, all guests have to be run on the remaining node. mfg ar -- Hier könnte keine Signatur stehen.

1 0

[libvirt] Re: [et-mgmt-tools] attach hot usb device
by Cole Robinson 23 Feb '09

23 Feb '09

cc-ing libvir-list (future libvirt questions should be directed there) jmandawg wrote: > Hi, > > > > Quick question, since I can’t get to the qemu monitor anymore, how do I > hot add a usb device (smartphone)? > > Is it possible to do through virsh? > Sure: - Use 'lsusb' to determine the bus and device. Example listing looks like: Bus 001 Device 006: ID 0781:5151 SanDisk Corp. Cruzer Micro 256/512MB Flash Drive - Put hostdev xml in a file: cat << __EOF__ > usb.xml <hostdev mode='subsystem' type='usb'> <source> <address bus='1' device='6'/> </source> </hostdev> __EOF__ - Run 'virsh attach-device {VMNAME} usb.xml' on a running VM. Hope that helps, Cole

2 3

[libvirt] Networking with libvirt
by Andreas Rittershofer 22 Feb '09

22 Feb '09

I want to setup networking under KVM and with libvirt. I read a lot the last two days, but it is not working as desired. I don't want bridging, I want it with a tap-device created via vde_switch. I cannot figure out what to put in /etc/libvirt/qemu/machine.xml and /etc/ libvirt/qemu/networks/network.xml - there is no really good documentation. /var/log/libvirt/qemu/maschine.log shows a lot of parameters when I start the VM with virsh start machine, but I cannot figure out where to set these values or where to set the defaults. mfg ar -- Hier könnte keine Signatur stehen.

1 2

[libvirt] update documentation
by jesse lauren farinacci 22 Feb '09

22 Feb '09

I hit a small snag when following the documentation, specifically the doc says to use <clock sync='localtime'/> when it should say <clock offset='localtime'/>.

4 5

[libvirt] [PATCH] Fix bugzilla link in virsh man page
by Mark McLoughlin 22 Feb '09

22 Feb '09

Note, I haven't generated a new virsh.1 because Pod::Man 2.16 gives a bunch of warnings even with the existing version. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> --- docs/virsh.pod | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/virsh.pod b/docs/virsh.pod index 8b42ea0..58bba6b 100644 --- a/docs/virsh.pod +++ b/docs/virsh.pod @@ -540,9 +540,9 @@ L<virt-install(1)>, L<xm(1)>, L<virt-top(1)>, L<virt-mem(1)>, L<virt-df(1)>, L<h =head1 BUGS -Bugs can be view on the RedHat bugzilla page under the libvirt +Bugs can be filed in Red Hat bugzilla under the Virtualization Tools/libvirt L<https://bugzilla.redhat.com/> -L<https://bugzilla.redhat.com/bugzilla/buglist.cgi?product=Fedora+Core&compon…> +L<https://bugzilla.redhat.com/buglist.cgi?product=Virtualization+Tools&compon…> =end -- 1.6.0.6

2 8

[libvirt] restore as init script
by Matthias Pfafferodt 21 Feb '09

21 Feb '09

Hello, first i'm using kvm-84 and libvirt 0.6.0 on opensuse 11.1. I try to use the attached script to save some domains on shutdown and restore them on host boot. The script also tries to cleanly shutdown all other domains. The save and shutdown part is working as expected but on system boot the restore of the saved domains fails. If I manually run 'rclibvirtdomains start' after a boot it needs 1 to 3 tries to restore the domain. After that I can run a stop/start cycle of libvirtdomains without problems. How can I debug this problem? After the system boot libvirt seems to have problems to connect to qemu/kvm. The log messages are for a failed start: --- start log --- LC_ALL=C PATH=/bin:/sbin:/usr/bin:/usr/sbin HOME=/ /usr/bin/qemu-kvm -S -M pc -m 1024 -smp 1 -name kvm-virt03 -uuid 864c0b59-705e-5d78-dc3e-1a9de7dd305f -monitor pty -pidfile /var/run/libvirt/qemu//kvm-virt03.pid -boot c -drive file=/dev/virtual/kvm_virt03,if=ide,index=0,boot=on -net nic,macaddr=00:16:3e:00:01:05,vlan=0,model=e1000 -net tap,fd=15,script=,vlan=0,ifname=vnet0 -serial none -parallel none -usb -vnc 192.168.110.78:0 -k de -soundhw es1370 -incoming exec:cat char device redirected to /dev/pts/6 qemu_popen: returning result of qemu_fopen_ops cat: write error: Broken pipe --- end log --- and for a successful start: --- start log --- LC_ALL=C PATH=/bin:/sbin:/usr/bin:/usr/sbin HOME=/ /usr/bin/qemu-kvm -S -M pc -m 1024 -smp 1 -name kvm-virt03 -uuid 864c0b59-705e-5d78-dc3e-1a9de7dd305f -monitor pty -pidfile /var/run/libvirt/qemu//kvm-virt03.pid -boot c -drive file=/dev/virtual/kvm_virt03,if=ide,index=0,boot=on -net nic,macaddr=00:16:3e:00:01:05,vlan=0,model=e1000 -net tap,fd=15,script=,vlan=0,ifname=vnet0 -serial none -parallel none -usb -vnc 192.168.110.78:0 -k de -soundhw es1370 -incoming exec:cat char device redirected to /dev/pts/6 qemu_popen: returning result of qemu_fopen_ops info cpus * CPU #0: pc=0xffffffff80221f1d thread_id=7398 cont --- end log --- Kind regards Matthias Pfafferodt -- Matthias Pfafferodt - http://www.mapfa.de Matthias.Pfafferodt <at> mapfa.de ## Path: System/Virtualization ## Description: libvirtd stop configuration ## Type: yesno ## Default: yes # # On 'libvirtd stop' all running domains are killed. If # LIBVIRTDOMAINS_SHUTDOWN is set to 'yes' all running vm's are given time # for a gracefully shutdown. # LIBVIRTDOMAINS_SHUTDOWN="yes" ## Path: System/Virtualization ## Description: libvirtd timeout ## Type: integer ## Default: 300 # # On 'libvirtd stop' the vm's are ask to shutdown. This optine gives the # maximum number of seconds the script will wait until libvirt is stopped. # LIBVIRTDOMAINS_SHUTDOWN_MAXWAIT=300 ## Path: System/Virtualization ## Description: should domains be saved ## Type: yesno ## Default: yes # # If set to yes domains are saved on shutdown and restored on boot. # LIBVIRTDOMAINS_SAVE="yes" ## Path: System/Virtualization ## Description: domains which should be save and restored ## Type: string ## Default: # # The listed vms are saved on shutdown and restored at boot time # LIBVIRTDOMAINS_SAVE_VM="kvm-virt03" ## Path: System/Virtualization ## Description: save path for domains ## Type: string ## Default: /var/lib/libvirtdomains/save # # Path there the domains should be saved # LIBVIRTDOMAINS_SAVE_DIR="/var/lib/libvirtdomains/save"

1 0

[libvirt] bridge-to-lan interfaces with network type
by Zhengang Li 21 Feb '09

21 Feb '09

Hi All, The documentation on the libvirt website explains the way to define a bridge to LAN network interfaces with a 'bridge' type. E.g.: <interface type='bridge'> <source bridge='br0'/> <mac address='52:54:00:00:00:11'/> </interface> I'm working in a limited environment. Only 'network' type interfaces can be defined for a guest. Is it possible to define a bridge-to-lan interfaces with a 'network' type? The question actually goes to: How to write a network definition xml for libvirt to use as bridge to LAN type NIC in guest? I tried with 'nat' and 'route' forward in network xml, neither works for me. Regards, Zhengang

3 2

[libvirt] can't install fedora guest
by Farkas Levente 19 Feb '09

19 Feb '09

hi, while i try to install fedora-10 guest on centos-5 host i've got the error bellow virt-manager. our setup: virt-manager-0.6.1-1 libvirt-0.6.0-1 kvm-83-1 ----------------------------------------------- Unable to complete install 'libvirt.libvirtError internal error unable to start guest: Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/create.py", line 717, in do_install dom = guest.start_install(False, meter = meter) File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 926, in start_install return self._do_install(consolecb, meter, removeOld, wait) File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 966, in _do_install self.domain = self.conn.createLinux(install_xml, 0) File "/usr/lib64/python2.4/site-packages/libvirt.py", line 973, in createLinux if ret is None:raise libvirtError('virDomainCreateLinux() failed', conn=self) libvirtError: internal error unable to start guest: ----------------------------------------------- while this is in virt-manager's log: ----------------------------------------------- [Fri, 06 Feb 2009 10:27:15 virt-manager 31523] DEBUG (Storage:908) Storage volume 'fedora-i386.img' install complete. [Fri, 06 Feb 2009 10:27:15 virt-manager 31523] DEBUG (Guest:964) Creating guest from: <domain type='kvm'> <name>fedora-i386</name> <currentMemory>524288</currentMemory> <memory>524288</memory> <uuid>75330b36-f8e3-8459-2d71-fb47245d7203</uuid> <os> <type arch='x86_64'>hvm</type> <boot dev='cdrom'/> </os> <features> <acpi/><apic/> </features> <clock offset="utc"/> <on_poweroff>destroy</on_poweroff> <on_reboot>destroy</on_reboot> <on_crash>destroy</on_crash> <vcpu>1</vcpu> <devices> <emulator>/usr/bin/qemu-kvm</emulator> <console type='pty'/> <disk type='file' device='disk'> <source file='/var/lib/libvirt/images/fedora-i386.img'/> <target dev='vda' bus='virtio'/> </disk> <disk type='block' device='cdrom'> <source dev='/dev/hda'/> <target dev='hdc' bus='ide'/> <readonly/> </disk> <interface type='bridge'> <source bridge='eth0'/> <mac address='54:52:00:5d:99:c0'/> <model type='virtio'/> </interface> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='-1' keymap='en-us'/> <sound model='es1370'/> </devices> </domain> [Fri, 06 Feb 2009 10:27:16 virt-manager 31523] ERROR (create:735) Unable to complete install 'libvirt.libvirtError internal error unable to start guest: Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/create.py", line 717, in do_install dom = guest.start_install(False, meter = meter) File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 926, in start_install return self._do_install(consolecb, meter, removeOld, wait) File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 966, in _do_install self.domain = self.conn.createLinux(install_xml, 0) File "/usr/lib64/python2.4/site-packages/libvirt.py", line 973, in createLinux if ret is None:raise libvirtError('virDomainCreateLinux() failed', conn=self) libvirtError: internal error unable to start guest: ' [Fri, 06 Feb 2009 10:27:16 virt-manager 31523] DEBUG (error:76) Uncaught Error: Unable to complete install: 'internal error unable to start guest: ' : Unable to complete install 'libvirt.libvirtError interna l error unable to start guest: Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/create.py", line 717, in do_install dom = guest.start_install(False, meter = meter) File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 926, in start_install return self._do_install(consolecb, meter, removeOld, wait) File "/usr/lib/python2.4/site-packages/virtinst/Guest.py", line 966, in _do_install self.domain = self.conn.createLinux(install_xml, 0) File "/usr/lib64/python2.4/site-packages/libvirt.py", line 973, in createLinux if ret is None:raise libvirtError('virDomainCreateLinux() failed', conn=self) libvirtError: internal error unable to start guest: ' ----------------------------------------------- -- Levente "Si vis pacem para bellum!"

4 11

[libvirt] Java binding - JVM crashes .. sometimes
by Daniel Schwager 18 Feb '09

18 Feb '09

Hi, since I updated to the new libvirt-version (CVS snapshot of today), my JVM running my multi-thread application "sometimes" will crashes if I open or close libvirt-connection (on KVM hypervisor). I didn't find out the exact szenario - simple junit tests are running well. But inside my main application (multi tread, multiple fast access to libvirt java interface) will crash the JVM. The crash-report looks like ALWAYS like the following 2 examples. Is there a way to - debug this - make the JNI code more robust ? - make the open/close of libvirt more robust ? I think the JVM crashes, because the libvirt crashes. Is there a way to look inside libvirt to see a "crash" of the native libvirt-prog ? My application runs very well with the old version libvirt-0.4.5. I think, problem starts with >= 0.5. One more: Something, it happens, that a virsh -command on the commandline prints out an error message similar to "Can't connect to hypervisor" (I can't reproduce it at the moment). Multiple repeating the command works well. This happens not often - but sometimes.. Now, the Stacktrace of the crashed JVM ** first ... Instructions: (pc=0x0000000001206351) 0x0000000001206341: c0 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f c9 c3 0x0000000001206351: 49 8b 3e e8 47 f7 fc ff 84 c0 74 18 48 8b 15 bc Stack: [0x0000000002430000,0x0000000002531000], sp=0x000000000252f0d0, free space=1020k Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code) V [libjvm.so+0x34a351] V [libjvm.so+0x325201] Java frames: (J=compiled Java code, j=interpreted, Vv=VM code) j org.libvirt.Connect._close(J)I+0 j org.libvirt.Connect.close()V+5 j org.libvirt.Connect.finalize()V+1 v ~StubRoutines::call_stub j java.lang.ref.Finalizer.invokeFinalizeMethod(Ljava/lang/Object;)V+0 j java.lang.ref.Finalizer.runFinalizer()V+45 j java.lang.ref.Finalizer.access$100(Ljava/lang/ref/Finalizer;)V+1 j java.lang.ref.Finalizer$FinalizerThread.run()V+11 v ~StubRoutines::call_stub ... ** Second ... Stack: [0x000000002a061000,0x000000002a162000], sp=0x000000002a15e050, free space=1012k Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code) V [libjvm.so+0x34a351] V [libjvm.so+0x325201] Java frames: (J=compiled Java code, j=interpreted, Vv=VM code) j org.libvirt.Connect._open(Ljava/lang/String;)J+0 j org.libvirt.Connect.<init>(Ljava/lang/String;Z)V+23 j de.dtnet.virtcontroller.server.command.VDomain.open(Ljava/lang/String;)Lorg/libvirt/Connect;+74 ... Viele Gruesse Daniel Schwager ------------------------------------------------------------------- DT Netsolution GmbH - Taläckerstr. 30 - D-70437 Stuttgart Geschäftsführer: Daniel Schwager, Stefan Hörz - HRB Stuttgart 19870 Tel: +49-711-849910-32, Fax: -932 - Mailto:daniel.schwager@dtnet.de

2 5

[libvirt] A problem about libvir
by 刘刚 18 Feb '09

18 Feb '09

Hello, I have a problem for help. I use the libvir library 0.4.2 on Xen 3.2.0, the host OS is Suse 10.2 . I start a windows domain (windows xp). I use the function virDomainAttachDevice() to attach an iSCSI device to the windows domain,but it failed. I can use this function to attach an iSCSI device to a linux domain. How can I attach an iSCSI device to a windows domain ? or libvir doesn't support attach device to windows domain ? thanks a lot! MOBILE: 13622388220 HUAWEI TECHNOLOGIES CO.,LTD. Address: Huawei Industrial Base Bantian Longgang Shenzhen 518129, P.R.China E-mail: liugang8440265(a)huawei.com www.huawei.com

1 0

[libvirt] [PATCH] Remove invalid ATTRIBUTE_UNUSED
by Cole Robinson 18 Feb '09

18 Feb '09

Stumbled on an ATTRIBUTE_UNUSED that is actually used. Patch attached. Thanks, Cole

4 5

[libvirt] [PATCH] Initialize vm def monitor fd
by Cole Robinson 17 Feb '09

17 Feb '09

We weren't properly initializing the monitor fd value in the VM definition structure. If qemu failed to start up, this could lead to closing stdin, which made all sorts of poo hit the fan. The attached patch fixes this. Thanks, Cole

3 4

[libvirt] Bug in qemud/Makefile.in, compiling CVS-snapshot failed.
by Daniel Schwager 17 Feb '09

17 Feb '09

Hi, i checked out the current CVS snapshot (20090217-1530GMT+1), but compiling failed: sh autogen.sh make rpm .... make[4]: Leaving directory `/root/rpmbuild/BUILD/libvirt-0.6.99/src' make[3]: Leaving directory `/root/rpmbuild/BUILD/libvirt-0.6.99/src' Making all in qemud make[3]: Entering directory `/root/rpmbuild/BUILD/libvirt-0.6.99/qemud' Makefile:1284: *** missing separator. Stop. make[3]: Leaving directory `/root/rpmbuild/BUILD/libvirt-0.6.99/qemud' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/rpmbuild/BUILD/libvirt-0.6.99' ... Please adapt the qemud/Makefile.in to use TAB instead of spaces in the "remote_protocol.c: remote_protocol.h" make-target. regards Danny

2 1

[libvirt] [PATCH] Fix daemon TCP listen cleanup
by Cole Robinson 17 Feb '09

17 Feb '09

Just looking through the code, I stumbled on a bug in a cleanup routine in the daemon. Patch attached. Thanks, Cole

3 3

[libvirt] [PATCH] Detect bridge name collisions when defining a virtual network
by Cole Robinson 17 Feb '09

17 Feb '09

The attached patch is a partial fix for rhbz 479622. If a virtual network is defined with an explicit bridge name, make sure it doesn't collide with other virtual network bridge names. Thanks, Cole

2 1

[libvirt] [PATCH 1/4] fix problem with MKDIR_P vs mkdir_p
by Maximilian Wilhelm 17 Feb '09

17 Feb '09

From: Matthias Bolte <photon(a)upb.de> configure defines mkdir_p but src/Makefile.am uses MKDIR_P --- src/Makefile.am | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 9d934b4..eff9039 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -589,6 +589,8 @@ endif endif EXTRA_DIST += $(LXC_CONTROLLER_SOURCES) +MKDIR_P = $(mkdir_p) + install-exec-local: $(MKDIR_P) "$(DESTDIR)$(localstatedir)/cache/libvirt" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/images" -- 1.5.6.5

3 14

[libvirt] Network Configuration question
by Remko Nolten 17 Feb '09

17 Feb '09

Hi! For a shared virtual hosting project with some friends we need a pretty specialized network configuration. Because we have virtually no time for experimenting (no pun intended), and the hosting organization has no experience with libvirt/KVM configurations they suggested to try and ask here. So, this is the situation: We have a server with one physical connection. Each user gets one virtual machine with its own IP-address (we have our own ip-range). The hosting organization gives us one "main" address 'A' with netmask 255.255.255.0 (/24) and a default gateway for our host machine. Besides this we get a number of addresses B1, B2, etc. with netmask 255.255.255.255 (/32) and without a default gateway. The switch just routes the traffic to our server for each ip-address we own (A and Bn). According to our hosting organization, the normal solution is to configure a loopback interface for each of the ip-addresses on the server so you can configure your software just to use one of the addresses. But we are not sure how this will work out in our virtual environment. Our intuition tells us we need to use the routing network forwarding mode, but when we bring the server to the data center we don't want to have any surprises. :) Here at home I don't have to possibility to create similar circumstances as in the data center due to some restriction from my ISP, so I hope someone can tell me if our intuition is correct or that we need to use some other method. Thanks in advance! -- Remko Nolten Tel: 06-45600767 E-mail: remko(a)nolten.nu

3 4

[libvirt] [PATCH] Don't check volume format for lvm backing store
by Cole Robinson 16 Feb '09

16 Feb '09

With the recently added COW support, we were trying to validate the passed logical volume's format, when there won't ever be one pulled from the xml (logical volumes don't have any valid format values). Just remove this check, and let any validation in this manner be done by the actual call to 'lvcreate'. Thanks, Cole

3 4

[libvirt] [PATCH] Fix generating python bindings
by Cole Robinson 16 Feb '09

16 Feb '09

The recent API additions virSaveLastError and virFreeError upset the python bindings generator. Add a rule to explicitly skip them for the bindings, since (as far as I can tell) the libvirtError class provides everything we need. Thanks, Cole

3 4

[libvirt] [PATCH] Fix virsh {net,pool}-edit
by Cole Robinson 16 Feb '09

16 Feb '09

The dumpxml commands for networks and pools don't support any flag arguments, and in fact explictly fail if flags != 0. This is not the case for vm dumpxml though, and flags were added to the base 'edit' implementation in virsh recently. The net and pool derivatives were not addressing this difference, so any net-edit or pool-edit attempt currently gives an error like: Network error : invalid argument in virNetworkGetXMLDesc The attached patch is one way to fix this. Thanks to Charles Duffy for the report. - Cole

3 7