- Devel - libvirt List Archives

[libvirt] [PATCH 0/8] Filtering of object lists via ACLs
by Daniel P. Berrange 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The current ACL checks validate access to the object being passed in to the API calls. There are a few APIs (all the virConnectList* / virConnectNum* ones) which are used to get lists of objects in the first place. Currently you could find out that there is a VM called "foo", but you can't then do virDomainLookupByName since the ACL check may block it. This series introduces filtering in the object list APIs, so you can't even see the existance of an object called "foo", if you don't have permission over it. This is not yet filtering the legacy Xen driver. Daniel P. Berrange (8): Add access control filtering of domain objects Add access control filtering of network objects Add access control filtering of node device objects Add access control filtering of storage objects Add access control filtering of secret objects Add access control filtering of nwfilter objects Add access control filtering of interface objects Extend the ACL test case to validate filter rule checks src/Makefile.am | 1 + src/check-aclrules.pl | 97 ++++++++++++ src/conf/domain_conf.c | 91 +++++++---- src/conf/domain_conf.h | 17 ++- src/conf/interface_conf.h | 3 + src/conf/network_conf.c | 12 +- src/conf/network_conf.h | 13 +- src/conf/node_device_conf.c | 12 +- src/conf/node_device_conf.h | 12 +- src/conf/storage_conf.c | 12 +- src/conf/storage_conf.h | 11 +- src/interface/interface_backend_netcf.c | 262 +++++++++++++++++++++++++++----- src/interface/interface_backend_udev.c | 56 +++++-- src/libvirt_private.syms | 6 +- src/libxl/libxl_driver.c | 15 +- src/lxc/lxc_driver.c | 15 +- src/network/bridge_driver.c | 44 +++--- src/node_device/node_device_driver.c | 28 ++-- src/nwfilter/nwfilter_driver.c | 39 +++-- src/openvz/openvz_driver.c | 7 +- src/parallels/parallels_driver.c | 14 +- src/parallels/parallels_network.c | 2 +- src/qemu/qemu_driver.c | 24 +-- src/rpc/gendispatch.pl | 42 +++-- src/secret/secret_driver.c | 14 +- src/storage/storage_driver.c | 62 +++++--- src/test/test_driver.c | 18 ++- src/uml/uml_driver.c | 15 +- src/vmware/vmware_driver.c | 12 +- 29 files changed, 716 insertions(+), 240 deletions(-) -- 1.8.1.4

2 19

[libvirt] Hostdev: USB passthrough, about hostport support
by Gonglei (Arei) 03 Jul '13

03 Jul '13

Hi, the Qemu upstream has a hostport property which allows to specify the host usb devices to pass through by bus number and physical port. Will the libvirt have a plan to support this? Thanks! The Qemu's patch: http://git.qemu.org/?p=qemu-stable-1.4.git;a=commitdiff;h=9056a2972a9e93519… Best Regards! -Gonglei

1 0

[libvirt] [PATCH 1/2] virCgroupNewPartition: Don't leak @newpath
by Michal Privoznik 03 Jul '13

03 Jul '13

The @newpath variable is allocated in virCgroupSetPartitionSuffix(). But it's newer freed. --- src/util/vircgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index ae71859..e0b25ed 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -1249,7 +1249,7 @@ int virCgroupNewPartition(const char *path, int rc; char *parentPath = NULL; virCgroupPtr parent = NULL; - char *newpath; + char *newpath = NULL; VIR_DEBUG("path=%s create=%d controllers=%x", path, create, controllers); @@ -1295,6 +1295,7 @@ cleanup: virCgroupFree(group); virCgroupFree(&parent); VIR_FREE(parentPath); + VIR_FREE(newpath); return rc; } #else -- 1.8.1.5

2 4

[libvirt] [libvirt-perl][PATCH] Add missing bracket to Sys::Virt::Domain man page
by Ján Tomko 03 Jul '13

03 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=954254 --- Pushed as trivial. lib/Sys/Virt/Domain.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Sys/Virt/Domain.pm b/lib/Sys/Virt/Domain.pm index 053f127..3630cf0 100644 --- a/lib/Sys/Virt/Domain.pm +++ b/lib/Sys/Virt/Domain.pm @@ -540,7 +540,7 @@ Update the configuration of an existing device. The new configuration is given by C<$xml>. The optional <$flags> parameter defaults to 0 but can accept one of the device hotplug flags described later. -=item $data = $dom->block_peek($path, $offset, $size[, $flags) +=item $data = $dom->block_peek($path, $offset, $size[, $flags]) Peek into the guest disk C<$path>, at byte C<$offset> capturing C<$size> bytes of data. The returned scalar may contain embedded -- 1.8.1.5

1 0

[libvirt] [PATCH] doc: blkio: add some notification
by Gao feng 03 Jul '13

03 Jul '13

If the I/O elevator of disk is not cfq, the setting of blkio.weight is ineffective. And the setting up blkio.weight_device will fail. Add notification for this situation. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- docs/formatdomain.html.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 47d91ab..8d048be 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -740,7 +740,8 @@ <dd> The optional <code>blkiotune</code> element provides the ability to tune Blkio cgroup tunable parameters for the domain. If this is omitted, it defaults to the OS provided - defaults. Since 0.8.8</dd> + defaults. Notice: blkiotune is effective only when the I/O elevator + of disk is cfq. Since 0.8.8</dd> <dt><code>weight</code></dt> <dd> The optional <code>weight</code> element is the overall I/O weight of the guest. The value should be in the range [100, @@ -761,7 +762,8 @@ mandatory sub-elements, <code>path</code> describing the absolute path of the device, and <code>weight</code> giving the relative weight of that device, in the range [100, - 1000]. Since 0.9.8</dd> + 1000]. The setting up device.weight will fail if the I/O elevator + of this disk device is not cfq. Since 0.9.8</dd> </dl> -- 1.8.1.4

2 2

[libvirt] [PATCH] Crash of libvirtd by unprivileged user in virConnectListAllInterfaces
by Eric Blake 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> On Thu, Jun 27, 2013 at 03:56:42PM +0100, Daniel P. Berrange wrote: > Hi Security Team, > > I've discovered a way for an unprivileged user with a readonly connection > to libvirtd, to crash the daemon. Ok, the final patch for this is issue will be the simpler variant that Eric suggested The embargo can be considered to be lifted on Monday July 1st, at 0900 UTC The following is the GIT change that DV or myself will apply to libvirt GIT master immediately before the 1.1.0 release: >From 177b4165c531a4b3ba7f6ab6aa41dca9ceb0b8cf Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" <berrange(a)redhat.com> Date: Fri, 28 Jun 2013 10:48:37 +0100 Subject: [PATCH] CVE-2013-2218: Fix crash listing network interfaces with filters The virConnectListAllInterfaces method has a double-free of the 'struct netcf_if' object when any of the filtering flags cause an interface to be skipped over. For example when running the command 'virsh iface-list --inactive' This is a regression introduced in release 1.0.6 by commit 7ac2c4fe624f30f2c8270116513fa2ddab07631f Author: Guannan Ren <gren(a)redhat.com> Date: Tue May 21 21:29:38 2013 +0800 interface: list all interfaces with flags == 0 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- Posting as a courtesy FYI for anyone reading this list but who does not have access to the security list and doesn't want to crawl through git. This commit has been included in 1.1.0 and has been applied to all affected stable branches (just v1.0.6-maint). The rule in determining that a CVE was necessary is the "escalation of privilege" test - any time a read-only client can cause a denial-of-service against a more-privileged read-write client (by crashing libvirtd), there is an escalation. src/interface/interface_backend_netcf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/interface/interface_backend_netcf.c b/src/interface/interface_backend_netcf.c index a995816..9aa673d 100644 --- a/src/interface/interface_backend_netcf.c +++ b/src/interface/interface_backend_netcf.c @@ -412,6 +412,7 @@ netcfConnectListAllInterfaces(virConnectPtr conn, (MATCH(VIR_CONNECT_LIST_INTERFACES_INACTIVE) && (status & NETCF_IFACE_INACTIVE)))) { ncf_if_free(iface); + iface = NULL; continue; } -- 1.8.1.4

2 1

[libvirt] Bug 980449 - resource leak about event
by Wangyufei (A) 03 Jul '13

03 Jul '13

Hi All, I have filed the following bug for Libvirt event issue : Bug 980449<https://bugzilla.redhat.com/show_bug.cgi?id=980449> - resource leak about event Thanks, WangYufei

1 0

[libvirt] [PATCH v6 0/5] libvirt supports Guest Panicked
by Chen Fan 02 Jul '13

02 Jul '13

Changes: v5-v6: Refactor the patches, and fix the incorrect indentation and name. v4-v5: 1. fix the incorrect indentation and explanation (of some reasons). v3-v4: 1. Supports the dumpcore options of the oncrash element in the XML. 2. Move the previous code to processWatchdogEvent(). v2-v3: 1. split into 3 patches v1-v2: 1. fix the incorrect domain state: paused -> crashed, when crash the guest while libvirt isn't running, then restart libvirtd. Chen Fan (5): libvirt: Define domain crash event types qemu: Refactor the processwatchdogEvent code that can make the driver workpool more generalized qemu: Need to use qemuProcessShutdownOrReboot(), so we defined it at qemu_process.h qemu: Implement 'oncrash' events when guest panicked qemu: Implement 'oncrash' coredump events when guest panicked examples/domain-events/events-c/event-test.c | 10 ++ include/libvirt/libvirt.h.in | 16 ++ src/conf/domain_conf.c | 12 +- src/qemu/qemu_domain.h | 11 +- src/qemu/qemu_driver.c | 222 ++++++++++++++++++++++++--- src/qemu/qemu_monitor.c | 14 +- src/qemu/qemu_monitor.h | 4 + src/qemu/qemu_monitor_json.c | 7 + src/qemu/qemu_process.c | 60 +++++++- src/qemu/qemu_process.h | 3 + tools/virsh-domain-monitor.c | 8 + 11 files changed, 328 insertions(+), 39 deletions(-) -- 1.8.1.4

5 14

[libvirt] [PATCHv2] build: don't ship access syms files in tarball
by Eric Blake 02 Jul '13

02 Jul '13

On a mingw VPATH build (such as done by ./autobuild.sh), the tarball created by 'make dist' was including generated files. The VPATH rules were then seeing that the tarball files were up-to-date, and not regenerating files locally, leading to this failure: GEN libvirt.syms cat: libvirt_access.syms: No such file or directory cat: libvirt_access_qemu.syms: No such file or directory cat: libvirt_access_lxc.syms: No such file or directory make: *** [libvirt.syms] Error 1 We already have a category for generated sym files, which are intentionally not part of the tarball; stick the access sym files in that category. Rearrange the declarations a bit to make it harder to repeat the problem in the future, and drop assignments that are now redundant (GENERATED_SYM_FILES are already listed as BUILT_FILES, so we don't have to repeat that for ACCESS_DRIVER_SYM_FILES). * src/Makefile.am (USED_SYM_FILES): Don't include generated files. (GENERATED_SYM_FILES): Access syms files are generated. (libvirt.syms): Include access syms files here. (ACCESS_DRIVER_SYMFILES): Rename... (ACCESS_DRIVER_SYM_FILES): ...for consistency. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- v1 discussion was here: https://www.redhat.com/archives/libvir-list/2013-July/msg00054.html Pushing under the build-breaker rule; now that I'm more confident at why the build was failing, and also pushing to v1.1.0-maint. src/Makefile.am | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 285334b..15a2840 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -815,7 +815,7 @@ ACCESS_DRIVER_GENERATED = \ $(srcdir)/access/viraccessapichecklxc.h \ $(srcdir)/access/viraccessapichecklxc.c -ACCESS_DRIVER_SYMFILES = \ +ACCESS_DRIVER_SYM_FILES = \ libvirt_access.syms \ libvirt_access_qemu.syms \ libvirt_access_lxc.syms @@ -927,8 +927,14 @@ libvirt_driver_la_CFLAGS = \ libvirt_driver_la_LIBADD = \ $(GNUTLS_LIBS) $(CURL_LIBS) $(DLOPEN_LIBS) +# All .syms files should be placed in exactly one of these three lists, +# depending on whether they are stored in git and/or used in the build. SYM_FILES = $(USED_SYM_FILES) USED_SYM_FILES = $(srcdir)/libvirt_private.syms +GENERATED_SYM_FILES = \ + $(ACCESS_DRIVER_SYM_FILES) \ + libvirt.syms libvirt.def libvirt_qemu.def libvirt_lxc.def \ + $(NULL) if WITH_TEST noinst_LTLIBRARIES += libvirt_driver_test.la @@ -1474,9 +1480,8 @@ EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) endif -USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) -BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) -CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) +BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) +CLEANFILES += $(ACCESS_DRIVER_GENERATED) libvirt_access.syms: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am @@ -1713,12 +1718,9 @@ EXTRA_DIST += \ $(SYM_FILES) \ $(NULL) -GENERATED_SYM_FILES = \ - libvirt.syms libvirt.def libvirt_qemu.def libvirt_lxc.def - BUILT_SOURCES += $(GENERATED_SYM_FILES) -libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) \ +libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) $(ACCESS_DRIVER_SYM_FILES) \ $(top_builddir)/config.status $(AM_V_GEN)rm -f $@-tmp $@ ; \ printf '# WARNING: generated from the following:\n# $^\n\n' >$@-tmp && \ @@ -1726,7 +1728,7 @@ libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) \ printf '\n\n# Private symbols\n\n' >>$@-tmp && \ printf 'LIBVIRT_PRIVATE_$(VERSION) {\n\n' >>$@-tmp && \ printf 'global:\n\n' >>$@-tmp && \ - cat $(USED_SYM_FILES) >>$@-tmp && \ + cat $(USED_SYM_FILES) $(ACCESS_DRIVER_SYM_FILES) >>$@-tmp && \ printf '\n\nlocal:\n*;\n\n};' >>$@-tmp && \ chmod a-w $@-tmp && \ mv $@-tmp libvirt.syms -- 1.8.1.4

1 0

[libvirt] [PATCH] build: avoid build failure without polkit
by Eric Blake 02 Jul '13

02 Jul '13

rpmbuild of mingw-libvirt.spec failed with: GEN libvirt.syms GEN libvirt_qemu.def cat: libvirt_access.syms: No such file or directory cat: libvirt_access_qemu.syms: No such file or directory cat: libvirt_access_lxc.syms: No such file or directory I traced this to unconditionally trying to use the ACL .syms files, even when polkit isn't in use. build: avoid build failure without polkit * src/Makefile.am (USED_SYM_FILES): Mark access driver symbols according to use. --- Even though this fixes a build-breaker (./autobuild.sh), I'm reluctant to push this without review. In particular, I'm worried that I may need a v2 that further conditionalizes whether libvirt_access_qemu.syms is sometimes omitted based on rpm arguments, even if libvirt_access.syms is present. src/Makefile.am | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 4cf999d..042bcba 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1469,12 +1469,13 @@ $(ACCESS_DRIVER_POLKIT_POLICY): $(srcdir)/access/viraccessperm.h \ CLEANFILES += $(ACCESS_DRIVER_POLKIT_POLICY) BUILT_SOURCES += $(ACCESS_DRIVER_POLKIT_POLICY) +USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) else EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) +SYM_FILES += $(ACCESS_DRIVER_SYMFILES) endif -USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) -- 1.8.1.4

2 5