- Devel - libvirt List Archives

[libvirt] [PATCH] domain: don't try to interpret <driver> as virtio config for hostdev interfaces
by Laine Stump 25 Dec '13

25 Dec '13

This resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1046337 The <driver> type attribute of an interface is interpreted in two different ways depending on the <interface> type - if the interface is type='hostdev', then the driver name describes which backend to use for the hostdev device assignment (vfio or kvm), but if the interface is any emulated type *and* the model type is "virtio", then the driver name can be "vhost" or "qemu", telling which backend qemu should use to communicate with the emulated device. The problem comes when someone has defined a an interface like this (which is accepted by the parser as long as no <driver name='xxx'/> is specified): <interface type='hostdev'> ... <model type='virtio'/> ... </interface> As libvirt storing this definition in the domain's status, the driver name is automatically filled in with the backend that was automatically decided by libvirt, so it stores this in the status: <interface type='hostdev'> ... <driver name='vfio'/> ... <model type='virtio'/> ... </interface> This isn't noticed until the next time libvirtd is restarted - as it is reading the status of all domains, it encounters the above interface definition, logs an error: internal error: Unknown interface <driver name='vfio'> has been specified and fails to reload the domain status, so the domain is marked as inactive. The solution is to stop the parser from interpreting <driver> attributes as if the device was an emulated virtio device, when it is actually a hostdev. (Although the bug has existed since vfio support was added, it has just recently become more apparent because libvirt previously didn't automatically set the driver name for hostdev interfaces in the domain status to vfio/kvm as it does since commit f094aa, first appearing in v1.1.4.) --- src/conf/domain_conf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 80bc85f..e65f3e3 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -6752,7 +6752,8 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, model = NULL; } - if (def->model && STREQ(def->model, "virtio")) { + if (def->type != VIR_DOMAIN_NET_TYPE_HOSTDEV && + STREQ_NULLABLE(def->model, "virtio")) { if (backend != NULL) { int name; if ((name = virDomainNetBackendTypeFromString(backend)) < 0 || -- 1.8.3.1

2 1

[libvirt] [PATCH v2 0/3] libxl: improve vcpu pinning
by Dario Faggioli 24 Dec '13

24 Dec '13

Hi, Take two, with the comments from Jim on v1 fixed. Basically, that means I've added a few comments and removed some non necessary safety checking. Series available here: git://xenbits.xen.org/people/dariof/libvirt.git libxl/VcpuPinX-v2 Regards, Dario --- Dario Faggioli (3): libxl: implement virDomainGetVcpuPinInfo libxl: implement virDomainPinVcpuFlags libxl: correctly handle affinity reset in virDomainPinVcpu[Flags] src/libxl/libxl_driver.c | 166 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 145 insertions(+), 21 deletions(-) -- <<This happens because I choose it to happen!>> (Raistlin Majere) ----------------------------------------------------------------- Dario Faggioli, Ph.D, http://about.me/dario.faggioli Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK)

2 4

[libvirt] [PATCH] virt-login-shell: clean up usage
by Eric Blake 24 Dec '13

24 Dec '13

I noticed a couple odd things in 'virt-login-shell --help' output. * tools/virt-login-shell.c (usage): At most one option accepted, drop trailing colon. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the trivial rule. tools/virt-login-shell.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index 758d1af..8b35e34 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -161,10 +161,10 @@ usage(void) fprintf(stdout, _("\n" "Usage:\n" - " %s [options]\n\n" + " %s [option]\n\n" "Options:\n" - " -h | --help Display program help:\n" - " -V | --version Display program version:\n" + " -h | --help Display program help\n" + " -V | --version Display program version\n" "\n" "libvirt login shell\n"), progname); -- 1.8.4.2

1 0

[libvirt] [PATCH 00/14] Fix flaw in virt-login-shell CVE-2013-4400
by Daniel P. Berrange 24 Dec '13

24 Dec '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The following series of patches have been pushed to master as a fix for CVE-2013-4400. The first four patches are the core fix. The remaining 10 patches are preventative measures to help avoid further problems in the future. I will be pushing at least the first 4 patches to stable branches and any of the further patches if I find they apply without merge problems. Daniel P. Berrange (14): Add helpers for getting env vars in a setuid environment Only allow 'stderr' log output when running setuid (CVE-2013-4400) Close all non-stdio FDs in virt-login-shell (CVE-2013-4400) Don't link virt-login-shell against libvirt.so (CVE-2013-4400) Set a sane $PATH for virt-login-shell Make virCommand env handling robust in setuid env Remove all direct use of getenv Block all use of getenv with syntax-check Only allow the UNIX transport in remote driver when setuid Don't allow remote driver daemon autostart when running setuid Add stub getegid impl for platforms lacking it Remove (nearly) all use of getuid()/getgid() Block all use of libvirt.so in setuid programs Move virt-login-shell into libvirt-login-shell sub-RPM Makefile.am | 1 + bootstrap.conf | 1 + cfg.mk | 8 ++++ config-post.h | 44 ++++++++++++++++++ configure.ac | 1 + daemon/Makefile.am | 1 + daemon/libvirtd.c | 2 +- examples/domain-events/events-c/Makefile.am | 3 +- examples/hellolibvirt/Makefile.am | 2 +- examples/openauth/Makefile.am | 2 +- gnulib/lib/Makefile.am | 2 +- libvirt.spec.in | 28 +++++++---- python/Makefile.am | 1 + src/Makefile.am | 72 +++++++++++++++++++++++++++++ src/driver.c | 3 +- src/libvirt.c | 54 +++++++++++++++------- src/libvirt_private.syms | 6 ++- src/locking/lock_daemon.c | 6 +-- src/locking/lock_driver_lockd.c | 6 +-- src/locking/lock_manager.c | 2 +- src/lxc/lxc_controller.c | 2 +- src/lxc/lxc_driver.c | 4 +- src/lxc/lxc_process.c | 2 +- src/qemu/qemu_command.c | 8 ++-- src/qemu/qemu_driver.c | 6 +-- src/remote/remote_driver.c | 37 +++++++++++---- src/rpc/virnetsocket.c | 16 +++---- src/rpc/virnettlscontext.c | 4 +- src/storage/storage_backend.c | 4 +- src/storage/storage_backend_fs.c | 4 +- src/storage/storage_backend_logical.c | 2 +- src/util/virauth.c | 2 +- src/util/vircommand.c | 50 +++++++++++++++----- src/util/vircommand.h | 8 +++- src/util/virfile.c | 23 +++++---- src/util/viridentity.c | 8 ++-- src/util/virlog.c | 18 ++++++-- src/util/virrandom.c | 2 +- src/util/virstoragefile.c | 2 +- src/util/virutil.c | 47 +++++++++++++++++-- src/util/virutil.h | 8 ++++ src/vbox/vbox_XPCOMCGlue.c | 2 +- src/vbox/vbox_driver.c | 2 +- src/vbox/vbox_tmpl.c | 6 +-- tests/commandtest.c | 8 ++-- tests/qemumonitortestutils.c | 2 +- tests/virnetsockettest.c | 4 +- tools/Makefile.am | 9 +++- tools/virsh.c | 18 ++++---- tools/virt-login-shell.c | 14 ++++++ 50 files changed, 430 insertions(+), 137 deletions(-) create mode 100644 config-post.h -- 1.8.3.1

2 16

[libvirt] [PATCH v2] virnettlscontexttest fails with GNUTLS 3.0.28
by Cédric Bosdonnat 24 Dec '13

24 Dec '13

On openSUSE 12.x with GNUTLS 3.0.28, virnettlscontexttest fails. It has been reported to work from GNUTLS 3.1.11 on Fedora 19. Changed the constraints on gnutls to 3.1+ for unit test cacert4req. --- v2: Changed the condition for 4.0 to work and made commit message more explicit. tests/virnettlscontexttest.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c index fc512fc..f3917bf 100644 --- a/tests/virnettlscontexttest.c +++ b/tests/virnettlscontexttest.c @@ -268,7 +268,9 @@ mymain(void) * be rejected. GNUTLS < 3 does not reject it and * we don't anticipate them changing this behaviour */ - DO_CTX_TEST(true, cacert4req.filename, servercert4req.filename, GNUTLS_VERSION_MAJOR >= 3); + DO_CTX_TEST(true, cacert4req.filename, servercert4req.filename, + (GNUTLS_VERSION_MAJOR == 3 && GNUTLS_VERSION_MINOR >= 1) || + GNUTLS_VERSION_MAJOR > 3); DO_CTX_TEST(true, cacert5req.filename, servercert5req.filename, true); DO_CTX_TEST(true, cacert6req.filename, servercert6req.filename, true); -- 1.8.4.4

2 1

[libvirt] python api list
by Umar Draz 24 Dec '13

24 Dec '13

Hi All, http://libvirt.org/php/api-reference.html The above link has a complete list of the functions regarding php api for libvrt. Where I can find the same kind of page for python? Br. Umar

2 1

[libvirt] [PATCH v2] PanicCheckABIStability: Need to check for existence
by John Ferlan 21 Dec '13

21 Dec '13

Commit id '4313fead' added a call to virDomainPanicCheckABIStability() which did not check whether the panic device existed before making a call to virDomainDeviceInfoCheckABIStability() which ended up segfaulting: Thread 1 (Thread 0x7f5332837700 (LWP 10964)): (src=<optimized out>, dst=<optimized out>) at conf/domain_conf.c:13007 (dst=<optimized out>, src=<optimized out>) at conf/domain_conf.c:13712 (src=<optimized out>, dst=<optimized out>) at conf/domain_conf.c:14056 (domain=domain@entry=0x7f53000057c0, vm=vm@entry=0x7f53000036d0, defptr=defptr@entry=0x7f5332836978, snap=snap@entry=0x7f5332836970, update_current=update_current@entry=0x7f5332836962, flags=flags@entry=1) at conf/snapshot_conf.c:1230 (domain=0x7f53000057c0, xmlDesc=<optimized out>, flags=1) at qemu/qemu_driver.c:12719 (domain=domain@entry=0x7f53000057c0, xmlDesc=0x7f53000081d0 "<domainsnapshot>\n <name>snap2</name>\n <description>new-desc</description>\n <state>running</state>\n <parent>\n <name>snap1</name>\n </parent>\n <creationTime>1387487268</creationTime>\n <memory s"..., flags=1) at libvirt.c:19695 ... (gdb) up 3 (gdb) print *other->def->dom $2 = {virtType = 2, id = -1, .. ... rng = 0x0, panic = 0x0, namespaceData = 0x0,... ... (gdb) print *def->dom $3 = {virtType = 2, id = -1, ... ... rng = 0x0, panic = 0x0, namespaceData = 0x0,... ... (gdb) Also seen using following sequence: virsh save $dom $file virsh save-image-edit $file add (or remove) a <panic/> line <devices> ... <panic> <address type='isa' iobase='0x505'/> </panic> ... </devices> Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- Changes since v1 - Added !src && !dst check, which results in: error: unsupported configuration: Target domain panic device count '0' does not match source count '1' src/conf/domain_conf.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 0079234..773c29d 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -13709,6 +13709,17 @@ static bool virDomainPanicCheckABIStability(virDomainPanicDefPtr src, virDomainPanicDefPtr dst) { + if (!src && !dst) + return true; + + if (!src || !dst) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Target domain panic device count '%d' " + "does not match source count '%d'"), + src ? 1 : 0, dst ? 1 : 0); + return false; + } + return virDomainDeviceInfoCheckABIStability(&src->info, &dst->info); } -- 1.8.3.1

2 1

[libvirt] [PATCH 1/2] Implementation deficiency in virInitctlSetRunLevel v4
by Reco 21 Dec '13

21 Dec '13

Implement virProcessRunInMountNamespace, which runs callback of type virProcessNamespaceCallback in a container namespace. Hope it'll nail it this time. --- src/libvirt_private.syms | 1 + src/util/virprocess.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++ src/util/virprocess.h | 6 +++++ 3 files changed, 70 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 2dbb8f8..e210fd0 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1646,6 +1646,7 @@ virProcessGetNamespaces; virProcessGetStartTime; virProcessKill; virProcessKillPainfully; +virProcessRunInMountNamespace; virProcessSetAffinity; virProcessSetMaxFiles; virProcessSetMaxMemLock; diff --git a/src/util/virprocess.c b/src/util/virprocess.c index 9fc3207..7bb494e 100644 --- a/src/util/virprocess.c +++ b/src/util/virprocess.c @@ -31,6 +31,7 @@ # include <sys/resource.h> #endif #include <sched.h> +#include <stdlib.h> #ifdef __FreeBSD__ # include <sys/param.h> @@ -847,3 +848,65 @@ int virProcessGetStartTime(pid_t pid, return 0; } #endif + +#ifdef HAVE_SETNS +int virProcessRunInMountNamespace(pid_t pid, + virProcessNamespaceCallback cb, + void *opaque) +{ + char* path = NULL; + int ret = -1; + int cpid = -1; + int status = -1; + int fd = -1; + + if (virAsprintf(&path, "/proc/%llu/ns/mnt", + (unsigned long long)pid) < 0) { + goto cleanup; + } + + if ((fd = open(path, O_RDONLY)) < 0) { + virReportSystemError(errno, "%s", + _("Kernel does not provide mount namespace")); + goto cleanup; + } + + switch (cpid = fork()) { + case 0: + if (setns(fd, 0) == -1) { + _exit(-1); + } + + ret = cb(pid, opaque); + _exit(ret); + break; + case -1: + virReportSystemError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Fork failed")); + goto cleanup; + default: + if (virProcessWait(cpid, &status) < 0 || status < 0) { + virReportSystemError(errno, + _("Callback failed with status %i"), + status); + ret = 1; + } else { + ret = 0; + } + } + +cleanup: + VIR_FREE(path); + VIR_FORCE_CLOSE(fd); + return ret; +} +#else +int virProcessRunInMountNamespace(pid_t pid ATTRIBUTE_UNUSED, + virProcessNamespaceCallback cb ATTRIBUTE_UNUSED, + void *opaque ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Mount namespaces are not available on this platform")); + return -1; +} +#endif diff --git a/src/util/virprocess.h b/src/util/virprocess.h index 9f77bc5..205abf7 100644 --- a/src/util/virprocess.h +++ b/src/util/virprocess.h @@ -60,4 +60,10 @@ int virProcessSetNamespaces(size_t nfdlist, int virProcessSetMaxMemLock(pid_t pid, unsigned long long bytes); int virProcessSetMaxProcesses(pid_t pid, unsigned int procs); int virProcessSetMaxFiles(pid_t pid, unsigned int files); + +typedef int (*virProcessNamespaceCallback)(pid_t pid, void *opaque); + +int virProcessRunInMountNamespace(pid_t pid, + virProcessNamespaceCallback cb, + void *opaque); #endif /* __VIR_PROCESS_H__ */ -- 1.7.10.4

3 8

[libvirt] [PATCHv6 0/3] Implement RBD storage pool support
by Adam Walters 21 Dec '13

21 Dec '13

Here is a re-based re-submission of my patches to implement RBD storage pool support for QEMU domains. Nothing in it has changed other than it has been rebased against the latest. The race condition I located still exists, but I have some patches forthcoming to address that issue. The code here still works well for me, but I only have the one host to test this on. If possible, I would like to try and get this merged for the 1.2.1 release cycle, so that other users can benefit from the addition of added storage pool support. As always, if you find any problems with my patches, please let me know, and I will fix them as soon as I can. Adam Walters (3): qemu: conf: Implement qemuAddRBDPoolSourceHost function qemu: conf: Implement RBD storage pool support domain: conf: Fix secret type checking src/conf/domain_conf.c | 6 +++-- src/qemu/qemu_conf.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 65 insertions(+), 3 deletions(-) -- 1.8.5.2

1 3

[libvirt] [PATCH 2/2] Implementation deficiency in virInitctlSetRunLevel v4
by Reco 21 Dec '13

21 Dec '13

Use helper virProcessRunInMountNamespace in lxcDomainShutdownFlags and lxcDomainReboot. --- src/lxc/lxc_driver.c | 44 ++++++++++++++++++++++++++++---------------- 1 file changed, 28 insertions(+), 16 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index e5298d1..2385f5b 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2694,12 +2694,21 @@ lxcConnectListAllDomains(virConnectPtr conn, static int +virDomainShutdownCallback(pid_t pid ATTRIBUTE_UNUSED, + void *opaque ATTRIBUTE_UNUSED) +{ + int rc; + rc = virInitctlSetRunLevel(VIR_INITCTL_RUNLEVEL_POWEROFF, NULL); + return rc; +} + + +static int lxcDomainShutdownFlags(virDomainPtr dom, unsigned int flags) { virLXCDomainObjPrivatePtr priv; virDomainObjPtr vm; - char *vroot = NULL; int ret = -1; int rc; @@ -2726,14 +2735,12 @@ lxcDomainShutdownFlags(virDomainPtr dom, goto cleanup; } - if (virAsprintf(&vroot, "/proc/%llu/root", - (unsigned long long)priv->initpid) < 0) - goto cleanup; - if (flags == 0 || (flags & VIR_DOMAIN_SHUTDOWN_INITCTL)) { - if ((rc = virInitctlSetRunLevel(VIR_INITCTL_RUNLEVEL_POWEROFF, - vroot)) < 0) { + rc = virProcessRunInMountNamespace(priv->initpid, + virDomainShutdownCallback, + NULL); + if (rc < 0) { goto cleanup; } if (rc == 0 && flags != 0 && @@ -2761,7 +2768,6 @@ lxcDomainShutdownFlags(virDomainPtr dom, ret = 0; cleanup: - VIR_FREE(vroot); if (vm) virObjectUnlock(vm); return ret; @@ -2773,13 +2779,22 @@ lxcDomainShutdown(virDomainPtr dom) return lxcDomainShutdownFlags(dom, 0); } + +virDomainRebootCallback(pid_t pid ATTRIBUTE_UNUSED, + void *opaque ATTRIBUTE_UNUSED) +{ + int rc; + rc = virInitctlSetRunLevel(VIR_INITCTL_RUNLEVEL_REBOOT, NULL); + return rc; +} + + static int lxcDomainReboot(virDomainPtr dom, unsigned int flags) { virLXCDomainObjPrivatePtr priv; virDomainObjPtr vm; - char *vroot = NULL; int ret = -1; int rc; @@ -2806,14 +2821,12 @@ lxcDomainReboot(virDomainPtr dom, goto cleanup; } - if (virAsprintf(&vroot, "/proc/%llu/root", - (unsigned long long)priv->initpid) < 0) - goto cleanup; - if (flags == 0 || (flags & VIR_DOMAIN_REBOOT_INITCTL)) { - if ((rc = virInitctlSetRunLevel(VIR_INITCTL_RUNLEVEL_REBOOT, - vroot)) < 0) { + rc = virProcessRunInMountNamespace(priv->initpid, + virDomainRebootCallback, + NULL); + if (rc < 0) { goto cleanup; } if (rc == 0 && flags != 0 && @@ -2841,7 +2854,6 @@ lxcDomainReboot(virDomainPtr dom, ret = 0; cleanup: - VIR_FREE(vroot); if (vm) virObjectUnlock(vm); return ret; -- 1.7.10.4

3 3