- Devel - libvirt List Archives

[libvirt] [PATCH] libxl: Fix devid init in libxlMakeNicList
by Stefan Bader 08 Jan '14

08 Jan '14

This basically reverts commit ba64b97134a6129a48684f22f31be92c3b6eef96 "libxl: Allow libxl to set NIC devid". However assigning devid's before calling libxlMakeNic does not work as that is calling libxl_device_nic_init which sets it back to -1. Right now auto-assignment only works in the hotplug case. But even if that would be fixed at some point (if that is possible at all), this would add a weird dependency between Xen and libvirt versions. The change here should accept any auto-assignment that makes it into libxl_device_nic_init. My understanding is that a caller always is allowed to make the devid choice itself. And assuming libxlMakeNicList is only used on domain creation, a sequential numbering should be ok. Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com> --- src/libxl/libxl_conf.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 04d01af..4cefadf 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -918,6 +918,13 @@ libxlMakeNicList(virDomainDefPtr def, libxl_domain_config *d_config) for (i = 0; i < nnics; i++) { if (libxlMakeNic(def, l_nics[i], &x_nics[i])) goto error; + /* + * The devid (at least right now) will not get initialized by + * libxl in the setup case but is required for starting the + * device-model. + */ + if (x_nics[i].devid < 0) + x_nics[i].devid = i; } d_config->nics = x_nics; -- 1.7.9.5

2 3

[libvirt] [PATCH 1/1] virsh nodecpustats erroneously returns stats for offline cpus on Linux
by Pradipta Kr. Banerjee 08 Jan '14

08 Jan '14

From: "Pradipta Kr. Banerjee" <bpradip(a)in.ibm.com> virsh nodecpustats erroneously returns stats for offline cpus on Linux To retrieve node cpu statistics on Linux system, the linuxNodeGetCPUstats function performs a minimal match of the input cpuid with the cpuid read from /proc/cpustat. On systems with larger cpus this can result in erroneous data. For eg if /proc/stat has similar data cpu 3645648 485 361475 3691194868 176595 40645 69850 0 1526172 0 cpu0 494045 62 42763 138516619 16107 2339 2431 0 248345 0 cpu4 402646 59 34745 138617562 17738 1413 1196 0 193948 0 cpu8 318662 32 32119 138715131 7903 927 982 0 115429 0 cpu12 247004 33 30465 138791438 5251 759 913 0 51938 0 and cpu 1,2 are offline, then 'virsh nodecpustats 1' displays data for cpu12 whereas virsh nodecpustats 2 correctly throws the following error "error: Unable to get node cpu stats error: Invalid cpuNum in linuxNodeGetCPUStats" This patch fixes the above mentioned problem Signed-off-by: Pradipta Kr. Banerjee <bpradip(a)in.ibm.com> --- src/nodeinfo.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 1838547..c9e5ff1 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -614,6 +614,8 @@ linuxNodeGetCPUStats(FILE *procstat, unsigned long long usr, ni, sys, idle, iowait; unsigned long long irq, softirq, steal, guest, guest_nice; char cpu_header[3 + INT_BUFSIZE_BOUND(cpuNum)]; + char cpu_header_read[3 + INT_BUFSIZE_BOUND(cpuNum)]; + char cpu_header_fmt[8]; if ((*nparams) == 0) { /* Current number of cpu stats supported by linux */ @@ -631,8 +633,11 @@ linuxNodeGetCPUStats(FILE *procstat, if (cpuNum == VIR_NODE_CPU_STATS_ALL_CPUS) { strcpy(cpu_header, "cpu"); + snprintf(cpu_header_fmt, sizeof(cpu_header_fmt), "%%%ds", 3); } else { snprintf(cpu_header, sizeof(cpu_header), "cpu%d", cpuNum); + snprintf(cpu_header_fmt, sizeof(cpu_header_fmt), "%%%ds", + (int)(3 + INT_BUFSIZE_BOUND(cpuNum))); } while (fgets(line, sizeof(line), procstat) != NULL) { @@ -649,6 +654,14 @@ linuxNodeGetCPUStats(FILE *procstat, continue; } + /* + * Process with stats gathering only if the cpuid from /proc/stat + * matches exactly with the input cpuid + */ + sscanf(buf, cpu_header_fmt, cpu_header_read); + if (STRNEQ(cpu_header, cpu_header_read)) + continue; + for (i = 0; i < *nparams; i++) { virNodeCPUStatsPtr param = &params[i]; -- 1.8.3.1

5 6

[libvirt] [PATCH] docs: add LXC multi console command docs and a example
by Chen Hanxiao 08 Jan '14

08 Jan '14

From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- docs/drvlxc.html.in | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/docs/drvlxc.html.in b/docs/drvlxc.html.in index 7494eb3..0f3efb0 100644 --- a/docs/drvlxc.html.in +++ b/docs/drvlxc.html.in @@ -659,16 +659,25 @@ running, this will turn it into a "transient" guest. <p> The <code>virsh console</code> command can be used to connect -to the text console associated with a container. If the container -has been configured with multiple console devices, then the -<code>--devname</code> argument can be used to choose the -console to connect to +to the text console associated with a container. </p> <pre> # virsh -c lxc:/// console myguest </pre> +<p> +If the container has been configured with multiple console devices, +then the <code>--devname</code> argument can be used to choose the +console to connect to. +In LXC, multiple consoles will be named +as 'console0', 'console1', 'console2', etc. +</p> + +<pre> +# virsh -c lxc:/// console myguest --devname console1 +</pre> + <h3><a name="usageEnter">Running commands in a container</a></h3> <p> -- 1.8.2.1

3 2

[libvirt] [PATCH] LXC: create monitor socket under selinux context of domain
by Gao feng 08 Jan '14

08 Jan '14

the unix socket /var/run/libvirt/lxc/domain.sock is not created under the selinux context which configured by <seclabel>. If we try to connect the domain.sock under the selinux context of domain in virtLXCProcessConnectMonitor,selinux will deny this connect operation. type=AVC msg=audit(1387953696.067:662): avc: denied { connectto } for pid=21206 comm="libvirtd" path="/usr/local/var/run/libvirt/lxc/systemd.sock" scontext=unconfined_u:system_r:svirt_lxc_net_t:s0:c770,c848 tcontext=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket fix this problem by creating socket under selinux context of domain. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_controller.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index a2ae599..5ca960f 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -745,6 +745,9 @@ static int virLXCControllerSetupServer(virLXCControllerPtr ctrl) ctrl))) goto error; + if (virSecurityManagerSetSocketLabel(ctrl->securityManager, ctrl->def) < 0) + goto error; + if (!(svc = virNetServerServiceNewUNIX(sockpath, 0700, 0, @@ -757,6 +760,9 @@ static int virLXCControllerSetupServer(virLXCControllerPtr ctrl) 5))) goto error; + if (virSecurityManagerClearSocketLabel(ctrl->securityManager, ctrl->def) < 0) + goto error; + if (virNetServerAddService(ctrl->server, svc, NULL) < 0) goto error; virObjectUnref(svc); -- 1.8.4.2

2 1

[libvirt] [PATCH 0/2] virsh: Fix mishandling of inactive configuration on device hotplug
by Peter Krempa 08 Jan '14

08 Jan '14

Peter Krempa (2): virsh: Don't use legacy API if --current is used on device hot(un)plug virsh: Use inactive definition when removing disk from config tools/virsh-domain.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) -- 1.8.5.2

2 5

[libvirt] [PATCH] virConnectUnregisterCloseCallback: Unlock @conn prior to error dispatch
by Michal Privoznik 08 Jan '14

08 Jan '14

The function checks for @conn to be valid and locks its mutex. Then, it checks if callee is unregistering the same callback that he registered previously. If this fails an error is reported and the control jumps to 'error' label. Here, if @conn has some errors (and it certainly does - the one that's been just reported) the conn->mutex is locked again - without any previous unlock: Thread 1 (Thread 0x7fb500ef1800 (LWP 18982)): #0 __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135 #1 0x00007fb4fd99ce56 in _L_lock_918 () from /lib64/libpthread.so.0 #2 0x00007fb4fd99ccaa in __GI___pthread_mutex_lock (mutex=0x7fb50153b670) at pthread_mutex_lock.c:64 #3 0x00007fb5007e574d in virMutexLock (m=m@entry=0x7fb50153b670) at util/virthreadpthread.c:85 #4 0x00007fb5007b198e in virDispatchError (conn=conn@entry=0x7fb50153b5e0) at util/virerror.c:594 #5 0x00007fb5008a3735 in virConnectUnregisterCloseCallback (conn=0x7fb50153b5e0, cb=cb@entry=0x7fb500f588e0 <vshCatchDisconnect>) at libvirt.c:21025 #6 0x00007fb500f5d690 in vshReconnect (ctl=ctl@entry=0x7fffff60e710) at virsh.c:328 #7 0x00007fb500f5dc50 in vshCommandRun (ctl=ctl@entry=0x7fffff60e710, cmd=0x7fb50152ca80) at virsh.c:1755 #8 0x00007fb500f5861b in main (argc=<optimized out>, argv=<optimized out>) at virsh.c:3393 And since the conn's mutex is not recursive, the virDispatchError will never ever lock it successfully. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/libvirt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libvirt.c b/src/libvirt.c index 2f5f023..71c9d8c 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -21022,9 +21022,9 @@ virConnectUnregisterCloseCallback(virConnectPtr conn, return 0; error: - virDispatchError(conn); virObjectUnlock(conn->closeCallback); virMutexUnlock(&conn->lock); + virDispatchError(conn); return -1; } -- 1.8.5.1

2 2

[libvirt] [ruby-libvirt] Don't free more entries than we retrieved
by Guido Günther 08 Jan '14

08 Jan '14

The vir*List* functions return the number of fetched entries. We mustn't free more, otherwise we'll crash like #0 0xb779d424 in __kernel_vsyscall () #1 0xb733981f in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #2 0xb733ccd3 in __GI_abort () at abort.c:90 #3 0xb7376275 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0xb74767d0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199 #4 0xb7380e52 in malloc_printerr (action=<optimized out>, str=<optimized out>, ptr=0xb7087000) at malloc.c:4923 #5 0xb7381b90 in _int_free (av=0xb74b7440 <main_arena>, p=0xb7086ff8, have_lock=0) at malloc.c:3779 #6 0xb75c059f in ruby_xfree () from /usr/lib/libruby-1.9.1.so.1.9 #7 0xb7076448 in ruby_libvirt_generate_list () from /usr/lib/ruby/vendor_ruby/1.9.1/i486-linux/_libvirt.so ... since we're trying to free random addresses. --- ext/libvirt/connect.c | 4 ++-- ext/libvirt/domain.c | 2 +- ext/libvirt/nodedevice.c | 2 +- ext/libvirt/storage.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ext/libvirt/connect.c b/ext/libvirt/connect.c index 36cac20..1af64a1 100644 --- a/ext/libvirt/connect.c +++ b/ext/libvirt/connect.c @@ -67,7 +67,7 @@ names = alloca(sizeof(char *) * num); \ r = virConnectList##objs(ruby_libvirt_connect_get(c), names, num); \ ruby_libvirt_raise_error_if(r < 0, e_RetrieveError, "virConnectList" # objs, ruby_libvirt_connect_get(c)); \ - return ruby_libvirt_generate_list(num, names); \ + return ruby_libvirt_generate_list(r < 0 ? 0 : r, names); \ } while(0) static VALUE c_connect; @@ -1508,7 +1508,7 @@ static VALUE libvirt_connect_list_nodedevices(int argc, VALUE *argv, VALUE c) ruby_libvirt_raise_error_if(r < 0, e_RetrieveError, "virNodeListDevices", ruby_libvirt_connect_get(c)); - return ruby_libvirt_generate_list(num, names); + return ruby_libvirt_generate_list(r < 0 ? 0 : r, names); } /* diff --git a/ext/libvirt/domain.c b/ext/libvirt/domain.c index ddce2d8..bc46753 100644 --- a/ext/libvirt/domain.c +++ b/ext/libvirt/domain.c @@ -1532,7 +1532,7 @@ static VALUE libvirt_domain_list_snapshots(int argc, VALUE *argv, VALUE d) "virDomainSnapshotListNames", ruby_libvirt_connect_get(d)); - return ruby_libvirt_generate_list(num, names); + return ruby_libvirt_generate_list(r < 0 ? 0 : r, names); } /* diff --git a/ext/libvirt/nodedevice.c b/ext/libvirt/nodedevice.c index 98b3715..041cda2 100644 --- a/ext/libvirt/nodedevice.c +++ b/ext/libvirt/nodedevice.c @@ -124,7 +124,7 @@ static VALUE libvirt_nodedevice_list_caps(VALUE c) "virNodeDeviceListCaps", ruby_libvirt_connect_get(c)); - return ruby_libvirt_generate_list(num, names); + return ruby_libvirt_generate_list(r < 0 ? 0 : r, names); } /* diff --git a/ext/libvirt/storage.c b/ext/libvirt/storage.c index 4b96d2e..008410a 100644 --- a/ext/libvirt/storage.c +++ b/ext/libvirt/storage.c @@ -340,7 +340,7 @@ static VALUE libvirt_storage_pool_list_volumes(VALUE p) "virStoragePoolListVolumes", ruby_libvirt_connect_get(p)); - return ruby_libvirt_generate_list(num, names); + return ruby_libvirt_generate_list(r < 0 ? 0 : r, names); } /* -- 1.8.5.2

2 6

[libvirt] [PATCH] LXC: don't set socket create selinux context in virLXCProcessConnectMonitor
by Gao feng 08 Jan '14

08 Jan '14

the unix socket /var/run/libvirt/lxc/domain.sock is not created under the selinux context which configured by <seclabel>. If we try to connect the domain.sock under the selinux context of domain in virtLXCProcessConnectMonitor,selinux will deny this connect operation. type=AVC msg=audit(1387953696.067:662): avc: denied { connectto } for pid=21206 comm="libvirtd" path="/usr/local/var/run/libvirt/lxc/systemd.sock" scontext=unconfined_u:system_r:svirt_lxc_net_t:s0:c770,c848 tcontext=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket Since there is no harm to access doamin.sock outof domain's context, this patch removes the setsockcreatecon in virLXCProcessConnectMonitor. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_process.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index cc9c1a2..b336ade 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -640,9 +640,6 @@ static virLXCMonitorPtr virLXCProcessConnectMonitor(virLXCDriverPtr driver, virLXCMonitorPtr monitor = NULL; virLXCDriverConfigPtr cfg = virLXCDriverGetConfig(driver); - if (virSecurityManagerSetSocketLabel(driver->securityManager, vm->def) < 0) - goto cleanup; - /* Hold an extra reference because we can't allow 'vm' to be * deleted while the monitor is active */ virObjectRef(vm); @@ -652,15 +649,6 @@ static virLXCMonitorPtr virLXCProcessConnectMonitor(virLXCDriverPtr driver, if (monitor == NULL) virObjectUnref(vm); - if (virSecurityManagerClearSocketLabel(driver->securityManager, vm->def) < 0) { - if (monitor) { - virObjectUnref(monitor); - monitor = NULL; - } - goto cleanup; - } - -cleanup: virObjectUnref(cfg); return monitor; } -- 1.8.4.2

2 2

[libvirt] [ruby-libvirt] Allow to set URI via environment variable
by Guido Günther 08 Jan '14

08 Jan '14

This allows us to run tests with the destdriver like: RUBY_LIBVIRT_TEST_URI=test:///default \ RUBYLIB=lib/:ext/libvirt/ \ ruby tests/test_open.rb --- I've only converted three modules so far since they were simple but these already help to run tests during package build. tests/test_nodedevice.rb | 2 +- tests/test_open.rb | 36 ++++++++++++++++++------------------ tests/test_stream.rb | 2 +- tests/test_utils.rb | 2 ++ 4 files changed, 22 insertions(+), 20 deletions(-) diff --git a/tests/test_nodedevice.rb b/tests/test_nodedevice.rb index 7da1a5f..50a1304 100644 --- a/tests/test_nodedevice.rb +++ b/tests/test_nodedevice.rb @@ -9,7 +9,7 @@ require 'test_utils.rb' set_test_object("nodedevice") -conn = Libvirt::open("qemu:///system") +conn = Libvirt::open(URI) # TESTGROUP: nodedevice.name testnode = conn.lookup_nodedevice_by_name(conn.list_nodedevices[0]) diff --git a/tests/test_open.rb b/tests/test_open.rb index 17baa93..c67eaab 100644 --- a/tests/test_open.rb +++ b/tests/test_open.rb @@ -21,49 +21,49 @@ expect_success(Libvirt, "nil arg", "version", nil) {|x| x.class == Array and x.l expect_success(Libvirt, "Test arg", "version", "Test") {|x| x.class == Array and x.length == 2} # TESTGROUP: Libvirt::open -expect_too_many_args(Libvirt, "open", "qemu:///system", 1) +expect_too_many_args(Libvirt, "open", URI, 1) expect_connect_error("open", "foo:///system") conn = expect_success(Libvirt, "no args", "open") {|x| x.class == Libvirt::Connect } conn.close -conn = expect_success(Libvirt, "qemu:///system", "open", "qemu:///system") {|x| x.class == Libvirt::Connect } +conn = expect_success(Libvirt, URI, "open", URI) {|x| x.class == Libvirt::Connect } conn.close conn = expect_success(Libvirt, "nil arg", "open", nil) {|x| x.class == Libvirt::Connect } conn.close # TESTGROUP: Libvirt::open_read_only -expect_too_many_args(Libvirt, "open_read_only", "qemu:///system", 1) +expect_too_many_args(Libvirt, "open_read_only", URI, 1) expect_connect_error("open_read_only", "foo:///system") conn = expect_success(Libvirt, "no args", "open_read_only") {|x| x.class == Libvirt::Connect } conn.close -conn = expect_success(Libvirt, "qemu:///system", "open_read_only", "qemu:///system") {|x| x.class == Libvirt::Connect } +conn = expect_success(Libvirt, URI, "open_read_only", URI) {|x| x.class == Libvirt::Connect } conn.close conn = expect_success(Libvirt, "nil arg", "open_read_only", nil) {|x| x.class == Libvirt::Connect } conn.close # TESTGROUP: Libvirt::open_auth -expect_too_many_args(Libvirt, "open_auth", "qemu:///system", [], "hello there", 1, 2) +expect_too_many_args(Libvirt, "open_auth", URI, [], "hello there", 1, 2) expect_connect_error("open_auth", "foo:///system") expect_invalid_arg_type(Libvirt, "open_auth", 1) -expect_invalid_arg_type(Libvirt, "open_auth", "qemu:///system", [], "hello", "foo") +expect_invalid_arg_type(Libvirt, "open_auth", URI, [], "hello", "foo") conn = expect_success(Libvirt, "no args", "open_auth") {|x| x.class == Libvirt::Connect } conn.close -conn = expect_success(Libvirt, "uri arg", "open_auth", "qemu:///system") {|x| x.class == Libvirt::Connect } +conn = expect_success(Libvirt, "uri arg", "open_auth", URI) {|x| x.class == Libvirt::Connect } conn.close -conn = expect_success(Libvirt, "uri and empty cred args", "open_auth", "qemu:///system", []) {|x| x.class == Libvirt::Connect } +conn = expect_success(Libvirt, "uri and empty cred args", "open_auth", URI, []) {|x| x.class == Libvirt::Connect } conn.close -conn = expect_success(Libvirt, "uri and full cred args", "open_auth", "qemu:///system", [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE]) {|x| x.class == Libvirt::Connect } +conn = expect_success(Libvirt, "uri and full cred args", "open_auth", URI, [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE]) {|x| x.class == Libvirt::Connect } conn.close -conn = expect_success(Libvirt, "uri, full cred, and user args", "open_auth", "qemu:///system", [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE], "hello") {|x| x.class == Libvirt::Connect } +conn = expect_success(Libvirt, "uri, full cred, and user args", "open_auth", URI, [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE], "hello") {|x| x.class == Libvirt::Connect } conn.close # equivalent to expect_invalid_arg_type begin - conn = Libvirt::open_auth("qemu:///system", {}) do |cred| + conn = Libvirt::open_auth(URI, {}) do |cred| end rescue TypeError => e puts_ok "#{$test_object}.open_auth invalid arg type threw #{TypeError.to_s}" @@ -73,7 +73,7 @@ end # equivalent to expect_invalid_arg_type begin - conn = Libvirt::open_auth("qemu:///system", 1) do |cred| + conn = Libvirt::open_auth(URI, 1) do |cred| end rescue TypeError => e puts_ok "#{$test_object}.open_auth invalid arg type threw #{TypeError.to_s}" @@ -83,7 +83,7 @@ end # equivalent to expect_invalid_arg_type begin - conn = Libvirt::open_auth("qemu:///system", 'foo') do |cred| + conn = Libvirt::open_auth(URI, 'foo') do |cred| end rescue TypeError => e puts_ok "#{$test_object}.open_auth invalid arg type threw #{TypeError.to_s}" @@ -93,7 +93,7 @@ end # equivalent to "expect_success" begin - conn = Libvirt::open_auth("qemu:///system", [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE], "hello") do |cred| + conn = Libvirt::open_auth(URI, [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE], "hello") do |cred| if not cred["userdata"].nil? puts "userdata is #{cred["userdata"]}" end @@ -122,7 +122,7 @@ end # equivalent to "expect_success" begin - conn = Libvirt::open_auth("qemu:///system") do |cred| + conn = Libvirt::open_auth(URI) do |cred| end puts_ok "Libvirt.open_auth uri, succeeded" @@ -135,7 +135,7 @@ end # equivalent to "expect_success" begin - conn = Libvirt::open_auth("qemu:///system", [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE], "hello", Libvirt::CONNECT_RO) do |cred| + conn = Libvirt::open_auth(URI, [Libvirt::CRED_AUTHNAME, Libvirt::CRED_PASSPHRASE], "hello", Libvirt::CONNECT_RO) do |cred| if not cred["userdata"].nil? puts "userdata is #{cred["userdata"]}" end @@ -163,7 +163,7 @@ rescue => e end # TESTGROUP: Libvirt::event_invoke_handle_callback -conn = Libvirt::open("qemu:///system") +conn = Libvirt::open(URI) expect_too_many_args(Libvirt, "event_invoke_handle_callback", 1, 2, 3, 4, 5) expect_too_few_args(Libvirt, "event_invoke_handle_callback") @@ -188,7 +188,7 @@ expect_invalid_arg_type(Libvirt, "event_invoke_handle_callback", 1, 1, 1, { "lib conn.close # TESTGROUP: Libvirt::event_invoke_timeout_callback -conn = Libvirt::open("qemu:///system") +conn = Libvirt::open(URI) expect_too_many_args(Libvirt, "event_invoke_timeout_callback", 1, 2, 3) expect_too_few_args(Libvirt, "event_invoke_timeout_callback") diff --git a/tests/test_stream.rb b/tests/test_stream.rb index 07ec222..e272104 100644 --- a/tests/test_stream.rb +++ b/tests/test_stream.rb @@ -9,7 +9,7 @@ require 'test_utils.rb' set_test_object("stream") -conn = Libvirt::open("qemu:///system") +conn = Libvirt::open(URI) # TESTGROUP: stream.send st = conn.stream diff --git a/tests/test_utils.rb b/tests/test_utils.rb index 1bac1cc..519de27 100644 --- a/tests/test_utils.rb +++ b/tests/test_utils.rb @@ -2,6 +2,8 @@ $FAIL = 0 $SUCCESS = 0 $SKIPPED = 0 +URI = ENV['RUBY_LIBVIRT_TEST_URI'] || "qemu:///system" + $GUEST_BASE = '/var/lib/libvirt/images/ruby-libvirt-tester' $GUEST_DISK = $GUEST_BASE + '.qcow2' $GUEST_SAVE = $GUEST_BASE + '.save' -- 1.8.5.2

2 1

[libvirt] [PATCH] Allow to install apparmor profiles
by Guido Günther 07 Jan '14

07 Jan '14

Make it easy to install the shipped examples. The aim is to have reasonably working templates so that distros only need to minimally patch these and can feed things upstream more easily. This was prompted by http://bugs.debian.org/725144 --- configure.ac | 12 +++++++++++- examples/apparmor/Makefile.am | 18 ++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 2622dfd..97752f4 100644 --- a/configure.ac +++ b/configure.ac @@ -1418,6 +1418,16 @@ elif test "with_secdriver_apparmor" != "no" ; then fi AM_CONDITIONAL([WITH_SECDRIVER_APPARMOR], [test "$with_secdriver_apparmor" != "no"]) +if test "$with_apparmor" != "no"; then +AC_ARG_WITH([apparmor-profiles], + [AS_HELP_STRING([--with-apparmor-profiles], + [install apparmor profiles @<:@default=no@:>@])], + [with_apparmor_profiles=yes], + [with_apparmor_profiles=no]) +else + with_apparmor_profiles="no" +fi +AM_CONDITIONAL([WITH_APPARMOR_PROFILES], [test "$with_apparmor_profiles" != "no"]) dnl DTrace static probes AC_ARG_WITH([dtrace], @@ -2607,7 +2617,7 @@ AC_MSG_NOTICE([]) AC_MSG_NOTICE([Security Drivers]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([ SELinux: $with_secdriver_selinux ($SELINUX_MOUNT)]) -AC_MSG_NOTICE([AppArmor: $with_secdriver_apparmor]) +AC_MSG_NOTICE([AppArmor: $with_secdriver_apparmor (install profiles: $with_apparmor_profiles)]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([Driver Loadable Modules]) AC_MSG_NOTICE([]) diff --git a/examples/apparmor/Makefile.am b/examples/apparmor/Makefile.am index 79cf5c9..6e69440 100644 --- a/examples/apparmor/Makefile.am +++ b/examples/apparmor/Makefile.am @@ -19,3 +19,21 @@ EXTRA_DIST= \ libvirt-qemu \ usr.lib.libvirt.virt-aa-helper \ usr.sbin.libvirtd + +if WITH_APPARMOR_PROFILES +apparmordir = $(sysconfdir)/apparmor.d/ +apparmor_DATA = \ + usr.lib.libvirt.virt-aa-helper \ + usr.sbin.libvirtd \ + $(NULL) + +abstractionsdir = $(apparmordir)/abstractions +abstractions_DATA = \ + libvirt-qemu \ + $(NULL) + +templatesdir = $(apparmordir)/libvirtd +templates_DATA = \ + TEMPLATE \ + $(NULL) +endif WITH_APPARMOR_PROFILES -- 1.8.5.1

2 2