- Devel - libvirt List Archives

[libvirt] [PATCH] qemu: fix memory leak on -machine usage error
by Eric Blake 03 Apr '13

03 Apr '13

Commit f84b92ea introduced a memory leak on error; John Ferlan reported that valgrind caught it during 'make check'. * src/qemu/qemu_command.c (qemuBuildMachineArgStr): Plug leak. --- Pushing under the trivial rule. src/qemu/qemu_command.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 693d30d..29424d6 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -5228,6 +5228,7 @@ qemuBuildMachineArgStr(virCommandPtr cmd, virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("dump-guest-core is not available " "with this QEMU binary")); + virBufferFreeAndReset(&buf); return -1; } -- 1.8.1.4

1 0

[libvirt] how to use svirt
by yue 03 Apr '13

03 Apr '13

hi,all i know svirt is merged into libvirt upstream, but how to use them? thanks

1 0

[libvirt] (no subject)
by Dan Walsh 03 Apr '13

03 Apr '13

Most of them effect virt-sandbox-service, with the biggest change beeing the addition of InteractiveContainers. We want to be able to support OpenShift, which requres the abiltiy to run a command within a container environement but does not want to use the systemd/unitfiles. These containers will run a setup script and then a user process to actually run the application. >From Dan Walsh <dwalsh(a)redhat.com> # This line is ignored. From: Dan Walsh <dwalsh(a)redhat.com> Subject: In-Reply-To:

4 36

[libvirt] [PATCH 0/2] Fix numeric overflow in qemu block job handling
by Peter Krempa 03 Apr '13

03 Apr '13

The JSON generator and qemu QMP protocol limit numeric values to LLONG_MAX even for unsigned values. A bug in the code caused numeric overflow when passing through speed parameters to qemu block job commands. Background: https://bugzilla.redhat.com/show_bug.cgi?id=927156 Peter Krempa (2): qemu-JSON: Error out if number is out of range instead of overflowing to negative qemu-blockjob: Fix limit of bandwidth for block jobs to supported value src/qemu/qemu_monitor.c | 21 ++++++++++++--------- src/qemu/qemu_monitor_json.c | 10 ++++++++-- 2 files changed, 20 insertions(+), 11 deletions(-) -- 1.8.1.5

2 6

[libvirt] [PATCH 0/2] Improve security hardening of binaries
by Daniel P. Berrange 03 Apr '13

03 Apr '13

Fedora has a "hardened build" option in RPM specfiles: https://fedoraproject.org/wiki/Packaging:Guidelines#PIE While we could enable that in the RPM, this would only apply to Fedora. Thus these patches directly integrate it in libvirt's configure.ac / Makefile.am files. With these 2 patches all executables gain -fPIE and -z relro -z now. Using the checksec.sh script from http://www.trapkit.de/tools/checksec.html We can see the difference, before: $ ~/checksec.sh --file /usr/sbin/libvirtd 'RELRO STACK CANARY NX PIE RPATH RUNPATH FILE Partial RELRO Canary found NX enabled No PIE No RPATH No RUNPATH /usr/sbin/libvirtd After $ ~/checksec.sh --file /usr/sbin/libvirtd 'RELRO STACK CANARY NX PIE RPATH RUNPATH FILE Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH /usr/sbin/libvirtd

2 4

[libvirt] [libvirt-designer 0/3] A few more cleanups
by Christophe Fergeau 03 Apr '13

03 Apr '13

Hey, here are a few small patches for libvirt-designer to fix a few leaks/polish minor things. Christophe

2 7

[libvirt] [PATCH 1/1] Fix the crash when seclable is freed
by Li Zhang 03 Apr '13

03 Apr '13

From: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> When seclabel's type is VIR_DOMAIN_SECLABEL_NONE, virSecurityLabelDefPtr's members are not allocated. So it will cause crash when calling VIR_FREE. This problem is found when running autotest on PPC. Failed to remove cgroup for virt-tests-vm1 *** glibc detected *** /usr/sbin/libvirtd: free(): invalid pointer: 0x00003fff9c187510 *** ======= Backtrace: ========= /lib64/libc.so.6(+0xb89c4)[0x3fffa9bc89c4] /lib64/libvirt.so.0(virFree-0x3e2320)[0x3fffaa82e9c0] /lib64/libvirt.so.0(virSecurityLabelDefFree-0x378984)[0x3fffaa89d69c] /lib64/libvirt.so.0(virDomainDefFree-0x367c98)[0x3fffaa8ae968] /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so(qemuProcessStop-0xc85f8)[0x3fffa2899d58] /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so(+0xc3668)[0x3fffa28e3668] /lib64/libvirt.so.0(virDomainDestroy-0x309bd0)[0x3fffaa90f6f0] /usr/sbin/libvirtd[0x10035230] /lib64/libvirt.so.0(virNetServerProgramDispatch-0x289b50)[0x3fffaa995930] /lib64/libvirt.so.0(+0x20db18)[0x3fffaa98db18] /lib64/libvirt.so.0(+0xfbd24)[0x3fffaa87bd24] /lib64/libvirt.so.0(+0xfaec8)[0x3fffaa87aec8] /lib64/libpthread.so.0(+0xc604)[0x3fffa9d7c604] /lib64/libc.so.6(clone-0xb8fe4)[0x3fffa9c3f094] Signed-off-by: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> --- src/conf/domain_conf.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index f3fca7f..2856660 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1006,6 +1006,8 @@ virSecurityLabelDefFree(virSecurityLabelDefPtr def) { if (!def) return; + if (def->type == VIR_DOMAIN_SECLABEL_NONE) + return; VIR_FREE(def->model); VIR_FREE(def->label); VIR_FREE(def->imagelabel); -- 1.7.5.4

4 10

[libvirt] Networking options in libvirt_lxc
by Purcareata Bogdan-B43198 03 Apr '13

03 Apr '13

Hello, I am doing some research on [subject] and I would like to find out some information regarding various scenarios. I've studied the official documentation at [1] and some of the mailing list archives. The configurations I have in mind are somewhat inspired by what the sf LXC package offers in terms of networking. What I've tested so far and works: - Shared networking - all host interfaces are present in the container if no <interface> tag has been specified in the domain configuration. I'm assuming this is because the container is started in the same network namespace like the host. Is it possible to make only a subset of these interfaces visible inside the container? - Bridge to LAN - connecting a domain interface to a host bridge; - Direct attachment through a Macvtap device - all 3 modes (vepa, bridge and private) work as expected, "passthrough" requires some capabilities in the physical device (SRIOV), which I don't have - assuming I have a device with this capability, is this configuration supported by (implemented in) the libvirt_lxc driver? What other scenarios I would be interested in: - host network interface private to the container - much like what lxc.network.phys is offering: "dedicated NIC from host passed through". I've read some documentation about <hostdev> and how to assign PCI devices to virtual machine, but I understand this is only possible with KVM - it's assigned from the kernel, it makes more sense, etc. However, I've also read a thread on the mailing list regarding <hostdev mode="capabilities">, which offers access from a container to a device, but it's currenly only applicable to block and character devices. Is there currently any way to make a host interface private to a container? Thank you very much! Best regards, Bogdan P. [1] http://libvirt.org

2 2

[libvirt] [PATCH] virsh: Fix typo in docs
by Peter Krempa 03 Apr '13

03 Apr '13

s/persitent/persistent/ --- Pushed under trivial rule. tools/virsh.pod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 9ca4435..1c8f9ee 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -2152,7 +2152,7 @@ Returns basic information about the I<network> object. Returns the list of active networks, if I<--all> is specified this will also include defined but inactive networks, if I<--inactive> is specified only the inactive ones will be listed. You may also want to filter the returned networks -by I<--persistent> to list the persitent ones, I<--transient> to list the +by I<--persistent> to list the persistent ones, I<--transient> to list the transient ones, I<--autostart> to list the ones with autostart enabled, and I<--no-autostart> to list the ones with autostart disabled. -- 1.8.1.5

1 0

[libvirt] [PATCH] sec_manager: Refuse to start domain with unsupported seclabel
by Michal Privoznik 03 Apr '13

03 Apr '13

https://bugzilla.redhat.com/show_bug.cgi?id=947387 If a user configures a domain to use a seclabel of a specific type, but the appropriate driver is not accessible, we should refuse to start the domain. For instance, if user requires selinux, but it is either non present in the system, or is just disabled, we should not start the domain. Moreover, since we are touching only those labels we have a security driver for, the other labels may confuse libvirt when reconnecting to a domain on libvirtd restart. In our selinux example, when starting up a domain, missing security label is okay, as we auto-generate one. But later, when libvirt is re-connecting to a live qemu instance, we parse a state XML, where security label is required and it is an error if missing: error : virSecurityLabelDefParseXML:3228 : XML error: security label is missing This results in a qemu process left behind without any libvirt control. --- src/security/security_manager.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/security/security_manager.c b/src/security/security_manager.c index b671a91..757fe28 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -425,7 +425,7 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm) { int ret = -1; - size_t i; + size_t i, j; virSecurityManagerPtr* sec_managers = NULL; virSecurityLabelDefPtr seclabel; bool generated = false; @@ -437,6 +437,19 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, return ret; virObjectLock(mgr); + for (i = 0; vm->nseclabels; i++) { + for (j = 0; sec_managers[j]; j++) + if (STREQ(vm->seclabels[i]->model, sec_managers[j]->drv->name)) + break; + + if (!sec_managers[j]) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Unable to find security driver for label %s"), + vm->seclabels[i]->model); + goto cleanup; + } + } + for (i = 0; sec_managers[i]; i++) { generated = false; seclabel = virDomainDefGetSecurityLabelDef(vm, sec_managers[i]->drv->name); -- 1.8.1.5

2 2