- Devel - libvirt List Archives

[libvirt] [PATCH 0/2] network: virNetworkUpdate section backends
by Laine Stump 21 Sep '12

21 Sep '12

These patches are the backends for ip-dhcp-range and portgroups. Since virsh, the bridge driver, and the toplevel of the NetworkObj function of virNetworkUpdate already support all sections, only the lowest level routine in network_conf.c needs to be modified (an "unsupported" error log is replaced with real functionality). These functions are self-contained (each updates the contents of a single static function) and only used by the new virNetworkUpdate API; no other code is touched by the patches, so they are fairly safe to add.

2 4

[libvirt] [PATCH] simplify xenXMDomainPinVcpu function
by liguang 21 Sep '12

21 Sep '12

supersede tedious statements getting cpu bitmap from parameter cpumap by virBitmapNewData function Signed-off-by: liguang <lig.fnst(a)cn.fujitsu.com> --- src/xen/xm_internal.c | 38 +++----------------------------------- 1 files changed, 3 insertions(+), 35 deletions(-) diff --git a/src/xen/xm_internal.c b/src/xen/xm_internal.c index a4dec62..97c19ef 100644 --- a/src/xen/xm_internal.c +++ b/src/xen/xm_internal.c @@ -827,12 +827,7 @@ int xenXMDomainPinVcpu(virDomainPtr domain, xenUnifiedPrivatePtr priv; const char *filename; xenXMConfCachePtr entry; - virBuffer mapbuf = VIR_BUFFER_INITIALIZER; - char *mapstr = NULL, *mapsave = NULL; - int i, j, n, comma = 0; int ret = -1; - virBitmapPtr cpuset = NULL; - int maxcpu = XEN_MAX_PHYSICAL_CPU; if (domain == NULL || domain->conn == NULL || domain->name == NULL || cpumap == NULL || maplen < 1 || maplen > (int)sizeof(cpumap_t)) { @@ -863,43 +858,16 @@ int xenXMDomainPinVcpu(virDomainPtr domain, goto cleanup; } - /* from bit map, build character string of mapped CPU numbers */ - for (i = 0; i < maplen; i++) - for (j = 0; j < 8; j++) - if ((cpumap[i] & (1 << j))) { - n = i*8 + j; - - if (comma) - virBufferAddLit (&mapbuf, ","); - comma = 1; - - virBufferAsprintf (&mapbuf, "%d", n); - } - - if (virBufferError(&mapbuf)) { - virBufferFreeAndReset(&mapbuf); - virReportOOMError(); - goto cleanup; - } - - mapstr = virBufferContentAndReset(&mapbuf); - mapsave = mapstr; - - if (virBitmapParse(mapstr, 0, &cpuset, maxcpu) < 0) - goto cleanup; - virBitmapFree(entry->def->cpumask); - entry->def->cpumask = cpuset; - cpuset = NULL; - + entry->def->cpumask = virBitmapNewData(cpumap, maplen); + if (!entry->def->cpumask) + goto cleanup; if (xenXMConfigSaveFile(domain->conn, entry->filename, entry->def) < 0) goto cleanup; ret = 0; cleanup: - VIR_FREE(mapsave); - VIR_FREE(cpuset); xenUnifiedUnlock(priv); return ret; } -- 1.7.2.5

2 2

[libvirt] [PATCHv2 0/2] two different possibilities for virsh net-update command
by Laine Stump 21 Sep '12

21 Sep '12

The two following patches are alternate approaches that each have a slightly different commandline syntax. In V1 of the net-update patch, I tried having a single string option that could contain either an xml string, or the name of a file containing an xml string, then two options that would be used to make the decision of file vs. xml: net-update netname add ip-dhcp-host --xml "<host mac='xx..' .../>" net-update netname add ip-dhcp-host /tmp/myfile.xml (or 'net-update netname add ip-dhcp-host --file /tmp/myfile.xml') (the trick here is that "--xml" is a boolean option, *not* a string option that gets set to "<host...", and the string itself goes into a generic, usually unnamed option called xmldata. Likewise, the filename is being put into xmldata, and if the "--xml" boolean option isn't given on the commandline, it's assumed that it is a file. The ability to specifically say it is a file was just added for completeness, but really is semantically useless.) The problem with this is that someone looking at the syntax in the help might come up with a confusing commandline like this: net-update netname add --xmldata /tmp/myfile.xml --file \ --section ip-dhcp-host --live or net-update netname add --xmldata "<host mac='x:x...'/>" --xml \ --section ip-dhcp-host --live or even worse, they would specify "--xmldata", but leave out --xml, and virsh would attempt to interpret the text as a filename. On the other hand, if I named the string option "file" and the boolean option --xmldata, that would make things confusing even in the case that the command was *correct*: net-update netname add --file "<host mac='x:x...'/>" --xmldata \ --section ip-dhcp-host --live Of course, in any of those cases, if the user followed the "normal" command specification, it would look just fine, but it seems like there is a lot of room to cause confusion. So, for V2, I'm trying two different approaches: PATCHv2 1/2: Have a single required "xml" arg, and "auto-detect" whether it is xml text or a filename by looking at the first character - if the first character is "<", interpret it as an xml element. If not, interpret it as a filename. This leads to the simplest commandlines, since you *never* need to specify "--file" or "--xml" (unless you really want to): net-update netname add ip-dhcp-host "<host mac='xx..' .../>" net-update netname add ip-dhcp-host /tmp/myfile.xml (The ambiguous case of a filename starting with "<" can be avoided by specifying the filename as "./<....") There may be some circumstance I'm not aware of where a fully formed XML element doesn't necessarily start with a "<" though, or someone may be 100% against auto-disambiguating the string type, so I'm also sending a different version: PATCHv2 2/2: Have two separate optional string args, "file" and "xml". Manually check in the code that only one of them has been specified. Since both are optional, you must *always* provide the option name on the commandline ("--file" or "--xml"). In this case, the commandlines look like this: net-update netname add ip-dhcp-host --xml "<host mac='xx..' .../>" net-update netname add ip-dhcp-host --file /tmp/myfile.xml I'm (as usual) completely undecided about which of these versions to go with (including the first, which should still be considered, although I don't really like the possibility of creating confusing commandlines that it creates), so all votes/opinions/etc are welcome!

2 4

[libvirt] [PATCH] docs: fix typo in filesystem docs
by Eric Blake 21 Sep '12

21 Sep '12

Noticed this by reading the page. It would be so much nicer if our tools could automatically flag things like this as part of 'make'. * docs/formatdomain.html.in: Remove extra '>'. --- Pushing under the trivial rule. docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index f05350e..04de870 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1772,7 +1772,7 @@ which gives the memory usage limit in kibibytes. Only used by LXC driver. <span class="since"> (since 0.9.13)</span></dd> - <dt><code>type='bind'></code></dt> + <dt><code>type='bind'</code></dt> <dd> A directory inside the guest will be bound to another directory inside the guest. Only used by LXC driver -- 1.7.11.4

1 0

[libvirt] [PATCH] maint: fix up copyright notice inconsistencies
by Eric Blake 21 Sep '12

21 Sep '12

1 0

[libvirt] [PATCH] doc: include article about libvirt+audit in relatedlinks.html
by Marcelo Cerri 21 Sep '12

21 Sep '12

This patch adds to relatedlinks.html a link to an article about libvirt describing how the Linux audit subsystem can be used to track qemu guest's life-cycle. --- This is an article that I wrote sometime ago that I think that can be useful for many people that make use of libvirt. docs/relatedlinks.html.in | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/relatedlinks.html.in b/docs/relatedlinks.html.in index f5357c5..9e96f66 100644 --- a/docs/relatedlinks.html.in +++ b/docs/relatedlinks.html.in @@ -59,6 +59,9 @@ <li> <a href="http://en.wikipedia.org/wiki/Virtualization">Wikipedia Virtualization</a> </li> + <li> + <a href="http://www.ibm.com/developerworks/linux/library/l-kvm-libvirt-audit/index.h…">IBM developerworks article about libvirt and audit.</a> + </li> </ul> <h2>Blogs and Podcasts</h2> -- 1.7.12

2 1

[libvirt] [PATCH] security: also parse user/group names instead of just IDs for DAC labels
by Marcelo Cerri 21 Sep '12

21 Sep '12

The DAC driver is missing parsing of group and user names for DAC labels and currently just parses uid and gid. This patch extends it to support names, so the following security label definition is now valid: <seclabel type='static' model='dac' relabel='yes'> <label>qemu:qemu</label> <imagelabel>qemu:qemu</imagelabel> </seclabel> --- src/security/security_dac.c | 49 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 40 insertions(+), 9 deletions(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index be65d6e..7e11e31 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -66,28 +66,59 @@ void virSecurityDACSetDynamicOwnership(virSecurityManagerPtr mgr, } static +int parseId(const char *str, unsigned int *id) +{ + char *endptr = NULL; + + if (str == NULL || id == NULL) + return -1; + + if (virStrToLong_ui(str, &endptr, 10, id) || endptr != NULL) + return -1; + + return 0; +} + +static int parseIds(const char *label, uid_t *uidPtr, gid_t *gidPtr) { + int rc = -1; unsigned int theuid; unsigned int thegid; - char *endptr = NULL; + char *sep = NULL; + char *tmp_label = NULL; if (label == NULL) - return -1; + goto done; - if (virStrToLong_ui(label, &endptr, 10, &theuid) || - endptr == NULL || *endptr != ':') { - return -1; - } + tmp_label = strdup(label); + if (tmp_label == NULL) + goto done; - if (virStrToLong_ui(endptr + 1, NULL, 10, &thegid)) - return -1; + sep = strchr(tmp_label, ':'); + if (sep == NULL) + goto done; + *sep = '\0'; + + if (virGetUserID(tmp_label, &theuid) < 0 && + parseId(tmp_label, &theuid) < 0) + goto done; + + if (virGetGroupID(sep + 1, &thegid) < 0 && + parseId(sep + 1, &thegid) < 0) + goto done; if (uidPtr) *uidPtr = theuid; if (gidPtr) *gidPtr = thegid; - return 0; + + rc = 0; + +done: + VIR_FREE(tmp_label); + + return rc; } /* returns 1 if label isn't found, 0 on success, -1 on error */ -- 1.7.12

4 9

[libvirt] [PATCH v2 0/3] Support for limiting guest coredumps
by Martin Kletzander 20 Sep '12

20 Sep '12

Even though I got a sparse ACK on v1, it's been some time, all the things should be fixed. Also the QEMU patch is already upstream. This series applies on the disable_s3/s4 series [1] and works with qemu patch [2] (upstream already). Basically qemu supports marking guest memory as (not)dumpable using madvise(2) system call and in case the guest memory is not desired the option can reduce the coredump by a reasonable size. [1] https://www.redhat.com/archives/libvir-list/2012-August/msg00572.html [2] http://lists.nongnu.org/archive/html/qemu-devel/2012-08/msg00554.html Martin Kletzander (3): Add support for limiting guest coredump qemu: add support for dump-guest-core option tests: Add tests for dump-core option docs/formatdomain.html.in | 12 +++- docs/schemas/domaincommon.rng | 8 +++ src/conf/domain_conf.c | 25 ++++++- src/conf/domain_conf.h | 10 +++ src/libvirt_private.syms | 2 + src/qemu/qemu_capabilities.c | 4 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 81 +++++++++++++++++++--- tests/qemuargv2xmltest.c | 2 + tests/qemuhelptest.c | 3 +- .../qemuxml2argv-machine-core-off.args | 5 ++ .../qemuxml2argv-machine-core-off.xml | 26 +++++++ .../qemuxml2argv-machine-core-on.args | 5 ++ .../qemuxml2argv-machine-core-on.xml | 26 +++++++ tests/qemuxml2argvtest.c | 3 + tests/qemuxml2xmltest.c | 2 + 16 files changed, 201 insertions(+), 14 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-core-off.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-core-off.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-core-on.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-core-on.xml -- 1.7.12

3 13

[libvirt] [PATCH v2 0/3] Add support for reboot-timeout
by Martin Kletzander 20 Sep '12

20 Sep '12

This series introduces simple reboot timeout support. That means what should be done in case all boot options fail, reboot or not. And if yes, then how long the machine should wait. Before adding the support for that into XML parser, builder, and qemu, I felt the need to cleanup the boot parsing and enums (I couldn't look at that), so that's the first patch. Most of it is mechanical, the rest should be pretty straight-forward. --- v2: - modified according to mprivozn and danpb - ACK'd patch not sent Martin Kletzander (3): Add support for reboot-timeout qemu: Add support for reboot-timeout QEMU Tests for reboot-timeout docs/formatdomain.html.in | 11 +++++-- docs/schemas/domaincommon.rng | 24 +++++++++++---- src/conf/domain_conf.c | 34 ++++++++++++++++++---- src/conf/domain_conf.h | 3 ++ src/qemu/qemu_capabilities.c | 4 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 28 ++++++++++++++++++ tests/qemuargv2xmltest.c | 4 +++ .../qemuxml2argv-reboot-timeout-disabled.args | 3 ++ .../qemuxml2argv-reboot-timeout-disabled.xml | 21 +++++++++++++ .../qemuxml2argv-reboot-timeout-enabled.args | 3 ++ .../qemuxml2argv-reboot-timeout-enabled.xml | 21 +++++++++++++ tests/qemuxml2argvtest.c | 5 ++++ tests/qemuxml2xmltest.c | 4 +++ 14 files changed, 151 insertions(+), 15 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-disabled.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-disabled.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-enabled.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-reboot-timeout-enabled.xml -- 1.7.12

2 11

[libvirt] [PATCHv3] security: Don't ignore errors when parsing DAC security labels
by Peter Krempa 20 Sep '12

20 Sep '12

The DAC security driver silently ignored errors when parsing the DAC label and used default values instead. With a domain containing the following label definition: <seclabel type='static' model='dac' relabel='yes'> <label>sdfklsdjlfjklsdjkl</label> </seclabel> the domain would start normaly but the disk images would be still owned by root and no error was displayed. This patch changes the behavior if the parsing of the label fails (note that a not present label is not a failure and in this case the default label should be used) the error isn't masked but is raised that causes the domain start to fail with a descriptive error message: virsh # start tr error: Failed to start domain tr error: internal error invalid argument: failed to parse DAC label 'sdfklsdjlfjklsdjkl' for domain 'tr' I also changed the error code to "invalid argument" from "internal error" and tweaked the various error messages to contain correct and useful information. --- Diff to v2: - Fixed all error reporting paths to contain useful messages - Tweaked error messages to contain more information - Fixed printing of seclabel->label instead of seclabel->imagelabel in the imagelabel parsing func. src/security/security_dac.c | 95 +++++++++++++++++++++++++++++---------------- 1 file changed, 61 insertions(+), 34 deletions(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 211fb37..be65d6e 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -90,6 +90,7 @@ int parseIds(const char *label, uid_t *uidPtr, gid_t *gidPtr) return 0; } +/* returns 1 if label isn't found, 0 on success, -1 on error */ static int virSecurityDACParseIds(virDomainDefPtr def, uid_t *uidPtr, gid_t *gidPtr) { @@ -98,20 +99,18 @@ int virSecurityDACParseIds(virDomainDefPtr def, uid_t *uidPtr, gid_t *gidPtr) virSecurityLabelDefPtr seclabel; if (def == NULL) - return -1; + return 1; seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME); if (seclabel == NULL || seclabel->label == NULL) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("security label for DAC not found in domain %s"), - def->name); - return -1; + VIR_DEBUG("DAC seclabel for domain '%s' wasn't found", def->name); + return 1; } if (seclabel->label && parseIds(seclabel->label, &uid, &gid)) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("failed to parse uid and gid for DAC " - "security driver: %s"), seclabel->label); + virReportError(VIR_ERR_INVALID_ARG, + _("failed to parse DAC label '%s' for domain '%s'"), + seclabel->label, def->name); return -1; } @@ -127,19 +126,35 @@ static int virSecurityDACGetIds(virDomainDefPtr def, virSecurityDACDataPtr priv, uid_t *uidPtr, gid_t *gidPtr) { - if (virSecurityDACParseIds(def, uidPtr, gidPtr) == 0) - return 0; + int ret; - if (priv) { - if (uidPtr) - *uidPtr = priv->user; - if (gidPtr) - *gidPtr = priv->group; - return 0; + if (!def && !priv) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to determine default DAC label " + "for an unknown object")); + return -1; } - return -1; + + if ((ret = virSecurityDACParseIds(def, uidPtr, gidPtr)) <= 0) + return ret; + + if (!priv) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("DAC security label couldn't be determined " + "for domain '%s'"), def->name); + return -1; + } + + if (uidPtr) + *uidPtr = priv->user; + if (gidPtr) + *gidPtr = priv->group; + + return 0; } + +/* returns 1 if label isn't found, 0 on success, -1 on error */ static int virSecurityDACParseImageIds(virDomainDefPtr def, uid_t *uidPtr, gid_t *gidPtr) @@ -149,21 +164,19 @@ int virSecurityDACParseImageIds(virDomainDefPtr def, virSecurityLabelDefPtr seclabel; if (def == NULL) - return -1; + return 1; seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_DAC_NAME); if (seclabel == NULL || seclabel->imagelabel == NULL) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("security label for DAC not found in domain %s"), - def->name); - return -1; + VIR_DEBUG("DAC imagelabel for domain '%s' wasn't found", def->name); + return 1; } if (seclabel->imagelabel && parseIds(seclabel->imagelabel, &uid, &gid)) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("failed to parse uid and gid for DAC " - "security driver: %s"), seclabel->label); + virReportError(VIR_ERR_INVALID_ARG, + _("failed to parse DAC imagelabel '%s' for domain '%s'"), + seclabel->imagelabel, def->name); return -1; } @@ -179,17 +192,31 @@ static int virSecurityDACGetImageIds(virDomainDefPtr def, virSecurityDACDataPtr priv, uid_t *uidPtr, gid_t *gidPtr) { - if (virSecurityDACParseImageIds(def, uidPtr, gidPtr) == 0) - return 0; + int ret; - if (priv) { - if (uidPtr) - *uidPtr = priv->user; - if (gidPtr) - *gidPtr = priv->group; - return 0; + if (!def && !priv) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to determine default DAC imagelabel " + "for an unknown object")); + return -1; + } + + if ((ret = virSecurityDACParseImageIds(def, uidPtr, gidPtr)) <= 0) + return ret; + + if (!priv) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("DAC security imagelabel couldn't be determined " + "for domain '%s'"), def->name); + return -1; } - return -1; + + if (uidPtr) + *uidPtr = priv->user; + if (gidPtr) + *gidPtr = priv->group; + + return 0; } -- 1.7.12

2 2