- Devel - libvirt List Archives

[libvirt] [PATCHv2 0/3] Rebase of patch to add support for RBD storage pools
by Adam Walters 03 Dec '13

03 Dec '13

This series of patches adds support for RBD storage pools to the latest version of libvirt. Included in this is a simple structure to build additional network storage pool support off of (really a couple of if/else blocks, so nothing fancy). This code passes check, check-syntax, and the valgrind tests. Additionally, the code is tested working in my environment. In fact, the machine I am sending this email from is a VM being run under qemu+libvirt with backend storage being an RBD storage pool using this code. Unfortunately, I only have the one RBD pool and libvirt host, so the code could use additional testing. If anyone finds any problems with my code, please let me know. I will fix them and resubmit the patch as needed. Hopefully someone else out there finds this support as useful as I do. While not many libvirt management clients utilize the storage API today, it does look to be the better method to interact with storage, and thus likely to be the best way to go in the future. I figure that additional storage backend support may well help to get others using the API instead of duplicating configuration options across every VM. Adam Walters (3): qemu: config: Add qemuAddRBDPoolSourceHost helper function qemu: conf: Parse RBD storage pool from domain xml qemu: command: Handle RBD storage pools src/qemu/qemu_command.c | 11 +++++++++ src/qemu/qemu_conf.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+) -- 1.8.4.2

2 4

[libvirt] [PATCH] Doc: Explicitly declaring that nodedev-destroy only works for vHBA
by Osier Yang 03 Dec '13

03 Dec '13

Though trying to destroy a physical HBA doesn't make sense at all, it's still a bit misleading with saying "only works for HBA". Signed-off-by: Osier Yang <jyang(a)redhat.com> --- src/libvirt.c | 5 +++-- tools/virsh.pod | 6 +++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index ae05300..4ebd13f 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -16065,8 +16065,9 @@ error: * virNodeDeviceDestroy: * @dev: a device object * - * Destroy the device object. The virtual device is removed from the host operating system. - * This function may require privileged access + * Destroy the device object. The virtual device (only works for vHBA + * currently) is removed from the host operating system. This function + * may require privileged access. * * Returns 0 in case of success and -1 in case of failure. */ diff --git a/tools/virsh.pod b/tools/virsh.pod index dac9a08..557df9c 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -2158,9 +2158,9 @@ contains xml for a top-level <device> description of a node device. =item B<nodedev-destroy> I<device> Destroy (stop) a device on the host. I<device> can be either device -name or wwn pair in "wwnn,wwpn" format (only works for HBA). Note -that this makes libvirt quit managing a host device, and may even make -that device unusable by the rest of the physical host until a reboot. +name or wwn pair in "wwnn,wwpn" format (only works for vHBA currently). +Note that this makes libvirt quit managing a host device, and may even +make that device unusable by the rest of the physical host until a reboot. =item B<nodedev-detach> I<nodedev> [I<--driver backend_driver>] -- 1.8.1.4

2 3

[libvirt] [question] We can create two network of one same linux bridge or local ethernet. It is a bug?
by Sheldon 03 Dec '13

03 Dec '13

> We can create two network of one same linux bridge or local ethernet: This is not harmful. But I wonder should this case is allowed? Why? more detail as follow. > > virsh # net-list --all > Name State Autostart Persistent > ---------------------------------------------------------- > br1 active yes yes > br2 active yes yes > default active yes yes > > virsh # net-dumpxml br1 > <network> > <name>br1</name> > <uuid>d5410814-1bea-b10d-04b8-9fbd3a1cfc65</uuid> > <forward mode='bridge'/> > <bridge name='br0' /> > </network> > > virsh # net-dumpxml br2 > <network> > <name>br2</name> > <uuid>99f20705-57cd-da31-f193-d13af4158792</uuid> > <forward mode='bridge'/> > <bridge name='br0' /> > </network> > > virsh # net-list --all > Name State Autostart Persistent > ---------------------------------------------------------- > br0 active yes yes > br1 active yes yes > default active yes yes > > virsh # net-dumpxml br0 > <network> > <name>br0</name> > <uuid>a35c840a-9bdc-070d-43f5-8e834040aa42</uuid> > <forward dev='eth0' mode='bridge'> > <interface dev='eth0'/> > </forward> > </network> > > virsh # net-dumpxml br1 > <network> > <name>br1</name> > <uuid>f1c87b80-2dfc-2a71-3fb6-56ef83daf29a</uuid> > <forward dev='eth0' mode='bridge'> > <interface dev='eth0'/> > </forward> > </network> -- Sheldon Feng(冯少合)<shaohef(a)linux.vnet.ibm.com> IBM Linux Technology Center

3 3

[libvirt] [PATCH] qemu: fix lastError memory leak
by Wangyufei (James) 02 Dec '13

02 Dec '13

When an error occurred in qemuMonitorIO, it will be saved in mon->lastError, but the memory which mon->lastError.message, mon->lastError.str1, mon->lastError.str2 and mon->lastError.str3 will not be freed at last. The same bug happened in qemuAgentIO. So I add the following code to fix it. Signed-off-by: Zhou Yimin <zhouyimin(a)huawei.com> --- src/qemu/qemu_agent.c | 2 ++ src/qemu/qemu_monitor.c | 2 ++ 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c index 2cd0ccc..475b43e 100644 --- a/src/qemu/qemu_agent.c +++ b/src/qemu/qemu_agent.c @@ -161,6 +161,8 @@ static void qemuAgentDispose(void *obj) (mon->cb->destroy)(mon, mon->vm); virCondDestroy(&mon->notify); VIR_FREE(mon->buffer); + if (mon->lastError.code != VIR_ERR_OK) + virResetError(&mon->lastError); } static int diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 1514715..df72c5d 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -263,6 +263,8 @@ static void qemuMonitorDispose(void *obj) virJSONValueFree(mon->options); VIR_FREE(mon->balloonpath); VIR_FORCE_CLOSE(mon->logfd); + if (mon->lastError.code != VIR_ERR_OK) + virResetError(&mon->lastError); } -- 1.7.3.1.msysgit.0 Best Regards, -WangYufei

2 1

[libvirt] [PATCH python] Skip copying manually written python for C APIs which don't exist
by Daniel P. Berrange 02 Dec '13

02 Dec '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> If the libvirt-override-virXXXX.py file has methods which call C APIs that don't exist in the version of libvirt built against we need to skip copying their code. eg for 0.9.13 libvirt we should not copy the 'listAllDomains' method. The way this works is that it breaks the override file into individual methods by looking for ' def '. It then collects the contents until the next method start, whereupon it looks for a libvirtmod.XXXXXX API call. It checks if the XXXXX part is present in the XML description we have, and if not, it discards the entire method. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- generator.py | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/generator.py b/generator.py index e8d8ea9..a9f98ab 100755 --- a/generator.py +++ b/generator.py @@ -1719,11 +1719,51 @@ def buildWrappers(module): classes.write("\n") # Append "<classname>.py" to class def, iff it exists try: + wantfuncs = [] extra = open("libvirt-override-" + classname + ".py", "r") classes.write (" #\n") classes.write (" # %s methods from %s.py (hand coded)\n" % (classname,classname)) classes.write (" #\n") - classes.writelines(extra.readlines()) + cached = None + + + # Since we compile with older libvirt, we don't want to pull + # in manually written python methods which call C methods + # that don't exist. This code attempts to detect which + # methods to skip by looking at the libvirtmod.XXXX calls + + def shouldSkip(lines): + for line in lines: + offset = line.find("libvirtmod.") + if offset != -1: + func = line[offset + 11:] + offset = func.find("(") + func = func[0:offset] + if func not in functions_skipped: + return True + return False + + for line in extra.readlines(): + offset = line.find(" def ") + if offset != -1: + name = line[offset+5:] + offset = name.find("(") + name = name[0:offset] + if cached is not None: + if not shouldSkip(cached): + classes.writelines(cached) + if name == "__del__": + cached = None + classes.write(line) + else: + cached = [line] + else: + if cached is not None: + cached.append(line) + else: + classes.write(line) + if not shouldSkip(cached): + classes.writelines(cached) classes.write("\n") extra.close() except: -- 1.8.3.1

2 1

Re: [libvirt] [libvirt-users] virsh detach typo
by Eric Blake 02 Dec '13

02 Dec '13

On 12/02/2013 02:28 PM, Mauricio Tavares wrote: > [root@vmhost vms]# virsh detach-disk puppet vdb > error: No found disk whose source path or target is vdb > > [root@vmhost vms]# virsh --version > 0.10.2 > [root@vmhost vms]# > > This probably was solved already but if not, "No found disk" probably > sounds better if it was "No disk found" Sure. I'm pushing this under the trivial rule: From aaa7484097333c8194ee6323f5a479e8121cc18c Mon Sep 17 00:00:00 2001 From: Eric Blake <eblake(a)redhat.com> Date: Mon, 2 Dec 2013 14:40:15 -0700 Subject: [PATCH] virsh: improve grammar in error message Based on a suggestion from Mauricio Tavares. * tools/virsh-domain.c (cmdDetachInterface, vshFindDisk): Improve wording. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- tools/virsh-domain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 1fe138c..8b80e1e 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -9802,7 +9802,7 @@ cmdDetachInterface(vshControl *ctl, const vshCmd *cmd) obj = xmlXPathEval(BAD_CAST buf, ctxt); if (obj == NULL || obj->type != XPATH_NODESET || obj->nodesetval == NULL || obj->nodesetval->nodeNr == 0) { - vshError(ctl, _("No found interface whose type is %s"), type); + vshError(ctl, _("No interface found whose type is %s"), type); goto cleanup; } @@ -9960,7 +9960,7 @@ vshFindDisk(const char *doc, } } - vshError(NULL, _("No found disk whose source path or target is %s"), path); + vshError(NULL, _("No disk found whose source path or target is %s"), path); cleanup: xmlXPathFreeObject(obj); -- 1.8.3.1 -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] [PATCH] qemu: add "-boot strict" to commandline whenever possible
by Laine Stump 02 Dec '13

02 Dec '13

This resolves: https://bugzilla.redhat.com/show_bug.cgi?id=888635 (which was already closed as CANTFIX because the qemu "-boot strict" commandline option wasn't available at the time). Problem: you couldn't have a domain that used PXE to boot, but also had an un-bootable disk device *even if that disk wasn't listed in the boot order*, because if PXE timed out (e.g. due to the bridge forwarding delay), the BIOS would move on to the next target, which would be the unbootable disk device (again - even though it wasn't given a boot order), and get stuck at a "BOOT DISK FAILURE, PRESS ANY KEY" message until a user intervened. The solution available since sometime around QEMU 1.5, is to add "-boot strict=on" to *every* qemu command. When this is done, if any devices have a boot order specified, then QEMU will *only* attempt to boot from those devices that have an explicit boot order, ignoring the rest. --- src/qemu/qemu_capabilities.c | 3 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 6 ++++++ tests/qemucapabilitiesdata/caps_1.5.3-1.caps | 1 + tests/qemucapabilitiesdata/caps_1.6.0-1.caps | 1 + tests/qemucapabilitiesdata/caps_1.6.50-1.caps | 1 + tests/qemuxml2argvtest.c | 4 ++++ 7 files changed, 17 insertions(+) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 548b988..a68e555 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -243,6 +243,8 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "virtio-mmio", "ich9-intel-hda", "kvm-pit-lost-tick-policy", + + "boot-strict", /* 160 */ ); struct _virQEMUCaps { @@ -2279,6 +2281,7 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = { { "machine", "mem-merge", QEMU_CAPS_MEM_MERGE }, { "drive", "discard", QEMU_CAPS_DRIVE_DISCARD }, { "realtime", "mlock", QEMU_CAPS_MLOCK }, + { "boot-opts", "strict", QEMU_CAPS_BOOT_STRICT }, }; static int diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 02d47c6..aea64ea 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -198,6 +198,7 @@ enum virQEMUCapsFlags { QEMU_CAPS_DEVICE_VIRTIO_MMIO = 157, /* -device virtio-mmio */ QEMU_CAPS_DEVICE_ICH9_INTEL_HDA = 158, /* -device ich9-intel-hda */ QEMU_CAPS_KVM_PIT_TICK_POLICY = 159, /* kvm-pit.lost_tick_policy */ + QEMU_CAPS_BOOT_STRICT = 160, /* -boot strict */ QEMU_CAPS_LAST, /* this must always be the last item */ }; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 763417f..84736d7 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -8204,6 +8204,12 @@ qemuBuildCommandLine(virConnectPtr conn, def->os.bios.rt_delay); } + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_BOOT_STRICT)) { + if (boot_nparams++) + virBufferAddChar(&boot_buf, ','); + virBufferAddLit(&boot_buf, "strict=on"); + } + if (boot_nparams > 0) { virCommandAddArg(cmd, "-boot"); diff --git a/tests/qemucapabilitiesdata/caps_1.5.3-1.caps b/tests/qemucapabilitiesdata/caps_1.5.3-1.caps index 09cf657..2b00449 100644 --- a/tests/qemucapabilitiesdata/caps_1.5.3-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.5.3-1.caps @@ -131,4 +131,5 @@ <flag name='usb-storage.removable'/> <flag name='ich9-intel-hda'/> <flag name='kvm-pit-lost-tick-policy'/> + <flag name='boot-strict'/> </qemuCaps> diff --git a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps index 33ee73b..7bce4aa 100644 --- a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps @@ -135,4 +135,5 @@ <flag name='virtio-mmio'/> <flag name='ich9-intel-hda'/> <flag name='kvm-pit-lost-tick-policy'/> + <flag name='boot-strict'/> </qemuCaps> diff --git a/tests/qemucapabilitiesdata/caps_1.6.50-1.caps b/tests/qemucapabilitiesdata/caps_1.6.50-1.caps index a66034a..bfaab9d 100644 --- a/tests/qemucapabilitiesdata/caps_1.6.50-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.6.50-1.caps @@ -134,4 +134,5 @@ <flag name='virtio-mmio'/> <flag name='ich9-intel-hda'/> <flag name='kvm-pit-lost-tick-policy'/> + <flag name='boot-strict'/> </qemuCaps> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index dad5973..631ece7 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -418,6 +418,10 @@ mymain(void) QEMU_CAPS_DEVICE, QEMU_CAPS_DRIVE, QEMU_CAPS_DRIVE_BOOT, QEMU_CAPS_BOOTINDEX, QEMU_CAPS_VIRTIO_BLK_SCSI, QEMU_CAPS_VIRTIO_BLK_SG_IO); + DO_TEST("boot-strict", + QEMU_CAPS_DEVICE, QEMU_CAPS_DRIVE, QEMU_CAPS_DRIVE_BOOT, + QEMU_CAPS_BOOTINDEX, QEMU_CAPS_BOOT_STRICT, + QEMU_CAPS_VIRTIO_BLK_SCSI, QEMU_CAPS_VIRTIO_BLK_SG_IO); DO_TEST("bootloader", QEMU_CAPS_DOMID, QEMU_CAPS_KVM); DO_TEST("reboot-timeout-disabled", QEMU_CAPS_REBOOT_TIMEOUT); -- 1.8.4.2

2 1

[libvirt] [PATCH] Fix VMware support for Fusion 6 / Workstation 10
by Brad Ackerman 02 Dec '13

02 Dec '13

This patch gets VMware Fusion 6 working, but the support for ThinPrint needs work—I’m not sure what a good way would be to represent that in libvirt; none of the existing virDomainChrType values seem to be appropriate. Also, what’s the best way to work this into the test suite? Responds to BZ 1036248. — Brad Ackerman N1MNB PGP: 0x9F49A373 brad(a)facefault.org <*> http://bsa.smugmug.com/

3 2

[libvirt] [PATCH] Added python binding for the new network events API
by Cédric Bosdonnat 02 Dec '13

02 Dec '13

This patch was extracted from the network events feature patch to fit the new libvirt-python repository. --- generator.py | 2 + libvirt-override-virConnect.py | 34 +++++++++ libvirt-override.c | 154 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 190 insertions(+) diff --git a/generator.py b/generator.py index a9f98ab..02ea821 100755 --- a/generator.py +++ b/generator.py @@ -491,6 +491,8 @@ skip_function = ( 'virConnectDomainEventDeregister', # overridden in virConnect.py 'virConnectDomainEventRegisterAny', # overridden in virConnect.py 'virConnectDomainEventDeregisterAny', # overridden in virConnect.py + 'virConnectNetworkEventRegisterAny', # overridden in virConnect.py + 'virConnectNetworkEventDeregisterAny', # overridden in virConnect.py 'virSaveLastError', # We have our own python error wrapper 'virFreeError', # Only needed if we use virSaveLastError 'virConnectListAllDomains', # overridden in virConnect.py diff --git a/libvirt-override-virConnect.py b/libvirt-override-virConnect.py index 23fadfd..15e9c54 100644 --- a/libvirt-override-virConnect.py +++ b/libvirt-override-virConnect.py @@ -198,6 +198,40 @@ except AttributeError: pass + def _dispatchNetworkEventLifecycleCallback(self, net, event, cbData): + """Dispatches events to python user network lifecycle event callbacks + """ + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virNetwork(self, _obj=net), event, opaque) + return 0 + + def networkEventDeregisterAny(self, callbackID): + """Removes a Network Event Callback. De-registering for a + network callback will disable delivery of this event type """ + try: + ret = libvirtmod.virConnectNetworkEventDeregisterAny(self._o, callbackID) + if ret == -1: raise libvirtError ('virConnectNetworkEventDeregisterAny() failed', conn=self) + del self.networkEventCallbackID[callbackID] + except AttributeError: + pass + + def networkEventRegisterAny(self, net, eventID, cb, opaque): + """Adds a Network Event Callback. Registering for a network + callback will enable delivery of the events """ + if not hasattr(self, 'networkEventCallbackID'): + self.networkEventCallbackID = {} + cbData = { "cb": cb, "conn": self, "opaque": opaque } + if net is None: + ret = libvirtmod.virConnectNetworkEventRegisterAny(self._o, None, eventID, cbData) + else: + ret = libvirtmod.virConnectNetworkEventRegisterAny(self._o, net._o, eventID, cbData) + if ret == -1: + raise libvirtError ('virConnectNetworkEventRegisterAny() failed', conn=self) + self.networkEventCallbackID[ret] = opaque + return ret + def domainEventRegisterAny(self, dom, eventID, cb, opaque): """Adds a Domain Event Callback. Registering for a domain callback will enable delivery of the events """ diff --git a/libvirt-override.c b/libvirt-override.c index 93b9c5f..d613b0d 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -6569,6 +6569,156 @@ libvirt_virConnectDomainEventDeregisterAny(ATTRIBUTE_UNUSED PyObject * self, return py_retval; } +#if LIBVIR_CHECK_VERSION(1, 2, 1) +static void +libvirt_virConnectNetworkEventFreeFunc(void *opaque) +{ + PyObject *pyobj_conn = (PyObject*)opaque; + LIBVIRT_ENSURE_THREAD_STATE; + Py_DECREF(pyobj_conn); + LIBVIRT_RELEASE_THREAD_STATE; +} + +static int +libvirt_virConnectNetworkEventLifecycleCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virNetworkPtr net, + int event, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_net; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virNetworkPtr */ + virNetworkRef(net); + pyobj_net = libvirt_virNetworkPtrWrap(net); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"_dispatchNetworkEventLifecycleCallback", + (char*)"OiO", + pyobj_net, + event, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_net); + + if (!pyobj_ret) { + DEBUG("%s - ret:%p\n", __FUNCTION__, pyobj_ret); + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static PyObject * +libvirt_virConnectNetworkEventRegisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; /* return value */ + PyObject *pyobj_conn; /* virConnectPtr */ + PyObject *pyobj_net; + PyObject *pyobj_cbData; /* hash of callback data */ + int eventID; + virConnectPtr conn; + int ret = 0; + virConnectNetworkEventGenericCallback cb = NULL; + virNetworkPtr net; + virNetworkEventID eventId = VIR_NETWORK_EVENT_ID_LAST; + + if (!PyArg_ParseTuple + (args, (char *) "OOiO:virConnectNetworkEventRegisterAny", + &pyobj_conn, &pyobj_net, &eventID, &pyobj_cbData)) { + DEBUG("%s failed parsing tuple\n", __FUNCTION__); + return VIR_PY_INT_FAIL; + } + + DEBUG("libvirt_virConnectNetworkEventRegister(%p %p %d %p) called\n", + pyobj_conn, pyobj_net, eventID, pyobj_cbData); + conn = PyvirConnect_Get(pyobj_conn); + if (pyobj_net == Py_None) + net = NULL; + else + net = PyvirNetwork_Get(pyobj_net); + + if ( ((eventID & 0xFF00) >> 8) != VIR_EVENT_NAMESPACE_NETWORK) { + return VIR_PY_INT_FAIL; + } + + eventId = (virNetworkEventID) (eventID & 0xFF); + switch (eventId) { + case VIR_NETWORK_EVENT_ID_LIFECYCLE: + cb = VIR_NETWORK_EVENT_CALLBACK(libvirt_virConnectNetworkEventLifecycleCallback); + break; + + case VIR_NETWORK_EVENT_ID_LAST: + break; + } + + if (!cb) { + return VIR_PY_INT_FAIL; + } + + Py_INCREF(pyobj_cbData); + + LIBVIRT_BEGIN_ALLOW_THREADS; + ret = virConnectNetworkEventRegisterAny(conn, net, eventID, + cb, pyobj_cbData, + libvirt_virConnectNetworkEventFreeFunc); + LIBVIRT_END_ALLOW_THREADS; + + if (ret < 0) { + Py_DECREF(pyobj_cbData); + } + + py_retval = libvirt_intWrap(ret); + return py_retval; +} + +static PyObject * +libvirt_virConnectNetworkEventDeregisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; + PyObject *pyobj_conn; + int callbackID; + virConnectPtr conn; + int ret = 0; + + if (!PyArg_ParseTuple + (args, (char *) "Oi:virConnectNetworkEventDeregister", + &pyobj_conn, &callbackID)) + return NULL; + + DEBUG("libvirt_virConnectNetworkEventDeregister(%p) called\n", pyobj_conn); + + conn = (virConnectPtr) PyvirConnect_Get(pyobj_conn); + + LIBVIRT_BEGIN_ALLOW_THREADS; + + ret = virConnectNetworkEventDeregisterAny(conn, callbackID); + + LIBVIRT_END_ALLOW_THREADS; + py_retval = libvirt_intWrap(ret); + return py_retval; +} +#endif /* LIBVIR_CHECK_VERSION(1, 2, 1)*/ + #if LIBVIR_CHECK_VERSION(0, 10, 0) static void libvirt_virConnectCloseCallbackDispatch(virConnectPtr conn ATTRIBUTE_UNUSED, @@ -7369,6 +7519,10 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virConnectDomainEventDeregister", libvirt_virConnectDomainEventDeregister, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventRegisterAny", libvirt_virConnectDomainEventRegisterAny, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventDeregisterAny", libvirt_virConnectDomainEventDeregisterAny, METH_VARARGS, NULL}, +#if LIBVIR_CHECK_VERSION(1, 2, 1) + {(char *) "virConnectNetworkEventRegisterAny", libvirt_virConnectNetworkEventRegisterAny, METH_VARARGS, NULL}, + {(char *) "virConnectNetworkEventDeregisterAny", libvirt_virConnectNetworkEventDeregisterAny, METH_VARARGS, NULL}, +#endif /* LIBVIR_CHECK_VERSION(1, 2, 1) */ #if LIBVIR_CHECK_VERSION(0, 10, 0) {(char *) "virConnectRegisterCloseCallback", libvirt_virConnectRegisterCloseCallback, METH_VARARGS, NULL}, {(char *) "virConnectUnregisterCloseCallback", libvirt_virConnectUnregisterCloseCallback, METH_VARARGS, NULL}, -- 1.8.4.2

2 1

[libvirt] [PATCH] Add docs about audit subsystem logging
by Daniel P. Berrange 02 Dec '13

02 Dec '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Adds a new page to the website "Deployment" section describing what data is sent to the audit logs and how to configure libvirtd audit settings. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/auditlog.html.in | 321 ++++++++++++++++++++++++++++++++++++++++++++++++++ docs/sitemap.html.in | 4 + 2 files changed, 325 insertions(+) create mode 100644 docs/auditlog.html.in diff --git a/docs/auditlog.html.in b/docs/auditlog.html.in new file mode 100644 index 0000000..c827ab9 --- /dev/null +++ b/docs/auditlog.html.in @@ -0,0 +1,321 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> + <body> + <h1>Audit log</h1> + + <ul id="toc"></ul> + + <h2><a name="intro">Introduction</a></h2> + + <p> + A number of the libvirt virtualization drivers (QEMU/KVM and LXC) include + support for logging details of important operations to the host's audit + subsystem. This provides administrators / auditors with a canonical historical + record of changes to virtual machines' / containers' lifecycle states and + their configuration. On hosts which are running the Linux audit daemon, + the logs will usually end up in <code>/var/log/audit/audit.log</code> + </p> + + <h2><a name="config">Configuration</a></h2> + + <p> + The libvirt audit integration is enabled by default on any host which has + the Linux audit subsystem active, and disabled otherwise. It is possible + to alter this behaviour in the <code>/etc/libvirt/libvirtd.conf</code> + configuration file, via the <code>audit_level</code> parameter + </p> + + <ul> + <li><code>audit_level=0</code> - libvirt auditing is disabled regardless + of host audit subsystem enablement.</li> + <li><code>audit_level=1</code> - libvirt auditing is enabled if the host + audit subsystem is enabled, otherwise it is disabled. This is the + default behaviour.</li> + <li><code>audit_level=2</code> - libvirt auditing is enabled regardless + of host audit subsystem enablement. If the host audit subsystem is + disabled, then libvirtd will refuse to complete startup and exit with + an error.</li> + </ul> + + <p> + In addition to have formal messages sent to the audit subsystem it is + possible to tell libvirt to inject messages into its own logging + layer. This will result in messages ending up in the systemd journal + or <code>/var/log/libvirt/libivrtd.log</code> on non-systemd hosts. + This is disabled by default, but can be requested by setting the + <code>audit_logging=1</code> configuration parameter in the same file + mentioned above. + </p> + + <h2><a name="types">Message types</a></h2> + + <p> + Libvirt defines three core audit message types each of which will + be described below. There are a number of common fields that will + be reported for all message types. + </p> + + <dl> + <dt>pid</dt> + <dd>Process ID of the libvirtd daemon generating the audit record.</dd> + <dt>uid</dt> + <dd>User ID of the libvirtd daemon process generating the audit record.</dd> + <dt>subj</dt> + <dd>Security context of the libvirtd daemon process generating the audit record.</dd> + <dt>msg</dt> + <dd>String containing a list of key=value pairs specific to the type of audit record being reported.</dd> + </dl> + + <p> + Some fields in the <code>msg</code> string are common to audit records + </p> + + <dl> + <dt>virt</dt> + <dd>Type of virtualization driver used. One of <code>qemu</code> or <code>lxc</code></dd> + <dt>vm</dt> + <dd>Host driver unique name of the guest</dd> + <dt>uuid</dt> + <dd>Globally unique identifier for the guest</dd> + <dt>exe</dt> + <dd>Path of the libvirtd daemon</dd> + <dt>hostname</dt> + <dd>Currently unused</dd> + <dt>addr</dt> + <dd>Currently unused</dd> + <dt>terminal</dt> + <dd>Currently unused</dd> + <dt>res</dt> + <dd>Result of the action, either <code>success</code> or <code>failed</code></dd> + </dl> + + <h3><a name="typecontrol">VIRT_CONTROL</a></h3> + + <p> + Reports change in the lifecycle state of a virtual machine. The <code>msg</code> + field will include the following sub-fields + </p> + + <dl> + <dt>op</dt> + <dd>Type of operation performed. One of <code>start</code>, <code>stop</code> or <code>init</code></dd> + <dt>reason</dt> + <dd>The reason which caused the operation to happen</dd> + <dt>vm-pid</dt> + <dd>ID of the primary/leading process associated with the guest</dd> + <dt>init-pid</dt> + <dd>ID of the <code>init</code> process in a container. Only if <code>op=init</code> and <code>virt=lxc</code></dd> + <dt>pid-ns</dt> + <dd>Namespace ID of the <code>init</code> process in a container. Only if <code>op=init</code> and <code>virt=lxc</code></dd> + </dl> + + <h3><a name="typemachine">VIRT_MACHINE_ID</a></h3> + + <p> + Reports the association of a security context with a guest. The <code>msg</code> + field will include the following sub-fields + </p> + + <dl> + <dt>model</dt> + <dd>The security driver type. One of <code>selinux</code> or <code>apparmor</code></dd> + <dt>vm-ctx</dt> + <dd>Security context for the guest process</dd> + <dt>img-ctx</dt> + <dd>Security context for the guest disk images and other assigned host resources</dd> + </dl> + + <h3><a name="typeresource">VIRT_RESOURCE</a></h3> + + <p> + Reports the usage of a host resource by a guest. The fields include will + vary according to the type of device being reported. When the guest is + initially booted records will be generated for all assigned resources. + If any changes are made to the running guest configuration, for example + hotplug devices, or adjust resources allocation, further records will + be generated. + </p> + + <h4><a name="typeresourcevcpu">Virtual CPU</a></h4> + + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>vcpu</code></dd> + <dt>old-vcpu</dt> + <dd>Original vCPU count, or 0</dd> + <dt>new-vcpu</dt> + <dd>Updated vCPU count</dd> + </dl> + + + <h4><a name="typeresourcemem">Memory</a></h4> + + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>mem</code></dd> + <dt>old-mem</dt> + <dd>Original memory size in bytes, or 0</dd> + <dt>new-mem</dt> + <dd>Updated memory size in bytes</dd> + </dl> + + <h4><a name="typeresourcedisk">Disk</a></h4> + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>disk</code></dd> + <dt>old-disk</dt> + <dd>Original host file or device path acting as the disk backing file</dd> + <dt>new-disk</dt> + <dd>Updated host file or device path acting as the disk backing file</dd> + </dl> + + <h4><a name="typeresourcenic">Network interface</a></h4> + + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>net</code></dd> + <dt>old-net</dt> + <dd>Original MAC address of the guest network interface</dd> + <dt>new-net</dt> + <dd>Updated MAC address of the guest network interface</dd> + </dl> + + <p> + If there is a host network interace associated with the guest NIC then + further records may be generated + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>net</code></dd> + <dt>net</dt> + <dd>MAC address of the host network interface</dd> + <dt>rdev</dt> + <dd>Name of the host network interface</dd> + </dl> + + <h4><a name="typeresourcefs">Filesystem</a></h4> + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>fs</code></dd> + <dt>old-fs</dt> + <dd>Original host directory, file or device path backing the filesystem </dd> + <dt>new-fs</dt> + <dd>Updated host directory, file or device path backing the filesystem</dd> + </dl> + + <h4><a name="typeresourcehost">Host device</a></h4> + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>hostdev</code> or <code>dev</code></dd> + <dt>dev</dt> + <dd>The unique bus identifier of the USB, PCI or SCSI device, if <code>resrc=dev</code></dd> + <dt>disk</dt> + <dd>The path of the block device assigned to the guest, if <code>resrc=hostdev</code></dd> + <dt>chardev</dt> + <dd>The path of the charecter device assigned to the guest, if <code>resrc=hostdev</code></dd> + </dl> + + <h4><a name="typeresourcetpm">TPM</a></h4> + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>tpm</code></dd> + <dt>device</dt> + <dd>The path of the host TPM device assigned to the guest</dd> + </dl> + + <h4><a name="typeresourcerng">RNG</a></h4> + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>rng</code></dd> + <dt>old-rng</dt> + <dd>Original path of the host entropy source for the RNG</dd> + <dt>new-rng</dt> + <dd>Updated path of the host entropy source for the RNG</dd> + </dl> + + + <h4><a name="typeresourceredir">Redirected device</a></h4> + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>redir</code></dd> + <dt>bus</dt> + <dd>The bus type, only <code>usb</code> allowed</dd> + <dt>device</dt> + <dd>The device type, only <code>USB redir</code> allowed</dd> + </dl> + + <h4><a name="typeresourcecgroup">Control group</a></h4> + + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt>reason</dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt>resrc</dt> + <dd>The type of resource assigned. Set to <code>cgroup</code></dd> + <dt>cgroup</dt> + <dd>The name of the cgroup controller</dd> + </dl> + + </body> +</html> diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in index d821a9e..60daf15 100644 --- a/docs/sitemap.html.in +++ b/docs/sitemap.html.in @@ -91,6 +91,10 @@ <span>The library and the daemon logging support</span> </li> <li> + <a href="auditlog.html">Audit log</a> + <span>Audit trail logs for host operations</span> + </li> + <li> <a href="firewall.html">Firewall</a> <span>Firewall and network filter configuration</span> </li> -- 1.8.3.1

3 3