- Devel - libvirt List Archives

[libvirt] [PATCH v2 1/2] Honour current sensitivity and category ranges in SELinux label generation
by Daniel P. Berrange 14 Aug '12

14 Aug '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Currently the dynamic label generation code will create labels with a sensitivity of s0, and a category pair in the range 0-1023. This is fine when running a standard MCS policy because libvirtd will run with a label system_u:system_r:virtd_t:s0-s0:c0.c1023 With custom policies though, it is possible for libvirtd to have a different sensitivity, or category range. For example system_u:system_r:virtd_t:s2-s3:c512.c1023 In this case we must assign the VM a sensitivity matching the current lower sensitivity value, and categories in the range 512-1023 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/security/security_selinux.c | 106 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 102 insertions(+), 4 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 48fd78b..bc24dca 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -106,13 +106,108 @@ virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr) int c1 = 0; int c2 = 0; char *mcs = NULL; + security_context_t ourSecContext = NULL; + context_t ourContext = NULL; + char *sens, *cat, *tmp; + int catMin, catMax, catRange; + + if (getcon(&ourSecContext) < 0) { + virReportSystemError(errno, "%s", + _("Unable to get current process SELinux context")); + goto cleanup; + } + if (!(ourContext = context_new(ourSecContext))) { + virReportSystemError(errno, + _("Unable to parse current SELinux context '%s'"), + ourSecContext); + goto cleanup; + } + + if (!(sens = strdup(context_range_get(ourContext)))) { + virReportOOMError(); + goto cleanup; + } + + /* Find and blank out the category part */ + if (!(tmp = strchr(sens, ':'))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse sensitivity level in %s"), + sens); + goto cleanup; + } + *tmp = '\0'; + cat = tmp + 1; + /* Find and blank out the sensitivity upper bound */ + if ((tmp = strchr(sens, '-'))) + *tmp = '\0'; + /* sens now just contains the sensitivity lower bound */ + + /* Find & extract category min */ + tmp = cat; + if (tmp[0] != 'c') { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse category in %s"), + cat); + goto cleanup; + } + tmp++; + if (virStrToLong_i(tmp, &tmp, 10, &catMin) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse category in %s"), + cat); + goto cleanup; + } + + /* We *must* have a pair of categories otherwise + * there's no range to allocate VM categories from */ + if (!tmp[0]) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("No category range available")); + goto cleanup; + } + + /* Find & extract category max (if any) */ + if (tmp[0] != '.') { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse category in %s"), + cat); + goto cleanup; + } + tmp++; + if (tmp[0] != 'c') { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse category in %s"), + cat); + goto cleanup; + } + tmp++; + if (virStrToLong_i(tmp, &tmp, 10, &catMax) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse category in %s"), + cat); + goto cleanup; + } + + /* +1 since virRandomInt range is exclusive of the upper bound */ + catRange = (catMax - catMin) + 1; + + if (catRange < 8) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Category range c%d-c%d too small"), + catMin, catMax); + goto cleanup; + } + + VIR_DEBUG("Using sensitivity level '%s' cat min %d max %d range %d", + sens, catMin, catMax, catRange); for (;;) { - c1 = virRandomBits(10); - c2 = virRandomBits(10); + c1 = virRandomInt(catRange); + c2 = virRandomInt(catRange); + VIR_DEBUG("Try cat %s:c%d,c%d", sens, c1+catMin, c2+catMin); if (c1 == c2) { - if (virAsprintf(&mcs, "s0:c%d", c1) < 0) { + if (virAsprintf(&mcs, "%s:c%d", sens, catMin + c1) < 0) { virReportOOMError(); return NULL; } @@ -122,7 +217,7 @@ virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr) c1 = c2; c2 = t; } - if (virAsprintf(&mcs, "s0:c%d,c%d", c1, c2) < 0) { + if (virAsprintf(&mcs, "%s:c%d,c%d", sens, catMin + c1, catMin + c2) < 0) { virReportOOMError(); return NULL; } @@ -136,6 +231,9 @@ virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr) cleanup: VIR_DEBUG("Found context '%s'", NULLSTR(mcs)); + VIR_FREE(sens); + freecon(ourSecContext); + context_free(ourContext); return mcs; } -- 1.7.11.2

2 3

[libvirt] [PATCH] openvz: unlock virDomainObj objects in openvzOpen
by Dmitry Guryanov 14 Aug '12

14 Aug '12

openvzOpen fucntion must leave unlocked virDomainObj objects in driver->domains. Now even simple commands like list or domain lookup hang, for example virsh -c openvz:///system list --all. Signed-off-by: Dmitry Guryanov <dguryanov(a)parallels.com> --- src/openvz/openvz_conf.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/openvz/openvz_conf.c b/src/openvz/openvz_conf.c index e62bf8c..802a9f8 100644 --- a/src/openvz/openvz_conf.c +++ b/src/openvz/openvz_conf.c @@ -673,6 +673,7 @@ int openvzLoadDomains(struct openvz_driver *driver) { goto cleanup; } + virDomainObjUnlock(dom); dom = NULL; } -- 1.7.1

2 1

[libvirt] [PATCH v2] Add virRandom() API to generate numbers with non-power-of-2 limit
by Daniel P. Berrange 14 Aug '12

14 Aug '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> The current virRandomBits() API is only usable if the caller wants a random number in the range [0, (n-1)] where n is a power of two. This adds a virRandom() API which generates a double in the range [0.0,1.0] with 48 bits of entropy. It then also adds a virRandomInt(uint32_t max) API which generates an unsigned in the range [0,@max] Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/libvirt_private.syms | 2 ++ src/util/virrandom.c | 32 ++++++++++++++++++++++++++++++++ src/util/virrandom.h | 2 ++ 3 files changed, 36 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 018d3a9..1905d6f 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1641,8 +1641,10 @@ virPidFileDeletePath; # virrandom.h +virRandom; virRandomBits; virRandomGenerateWWN; +virRandomInt; # virsocketaddr.h diff --git a/src/util/virrandom.c b/src/util/virrandom.c index 50bed46..2092afc 100644 --- a/src/util/virrandom.c +++ b/src/util/virrandom.c @@ -23,6 +23,7 @@ #include <stdlib.h> #include <inttypes.h> +#include <math.h> #include "virrandom.h" #include "threads.h" @@ -108,6 +109,37 @@ uint64_t virRandomBits(int nbits) return ret; } + +/** + * virRandom: + * + * Generate an evenly distributed random number between [0.0,1.0] + * + * Return: a random number with 48 bits of entropy + */ +double virRandom(void) +{ + uint64_t val = virRandomBits(48); + + return ldexp(val, -48); +} + + +/** + * virRandomInt32: + * @max: upper limit + * + * Generate an evenly distributed random integer between [0,@max] + * + * Return: a random number between [0,@max] + */ +uint32_t virRandomInt(uint32_t max) +{ + double val = virRandom(); + return val * max; +} + + #define QUMRANET_OUI "001a4a" #define VMWARE_OUI "000569" #define MICROSOFT_OUI "0050f2" diff --git a/src/util/virrandom.h b/src/util/virrandom.h index 29a055d..bd34c94 100644 --- a/src/util/virrandom.h +++ b/src/util/virrandom.h @@ -25,6 +25,8 @@ # include "internal.h" uint64_t virRandomBits(int nbits); +double virRandom(void); +uint32_t virRandomInt(uint32_t max); int virRandomGenerateWWN(char **wwn, const char *virt_type); #endif /* __VIR_RANDOM_H__ */ -- 1.7.11.2

2 2

[libvirt] [PATCH v10 0/7] file descriptor passing using fd sets
by Corey Bryant 14 Aug '12

14 Aug '12

libvirt's sVirt security driver provides SELinux MAC isolation for Qemu guest processes and their corresponding image files. In other words, sVirt uses SELinux to prevent a QEMU process from opening files that do not belong to it. sVirt provides this support by labeling guests and resources with security labels that are stored in file system extended attributes. Some file systems, such as NFS, do not support the extended attribute security namespace, and therefore cannot support sVirt isolation. A solution to this problem is to provide fd passing support, where libvirt opens files and passes file descriptors to QEMU. This, along with SELinux policy to prevent QEMU from opening files, can provide image file isolation for NFS files stored on the same NFS mount. This patch series adds the add-fd, remove-fd, and query-fdsets QMP monitor commands, which allow file descriptors to be passed via SCM_RIGHTS, and assigned to specified fd sets. This allows fd sets to be created per file with fds having, for example, different access rights. When QEMU needs to reopen a file with different access rights, it can search for a matching fd in the fd set. Fd sets also allow for easy tracking of fds per file, helping to prevent fd leaks. Support is also added to the block layer to allow QEMU to dup an fd from an fdset when the filename is of the /dev/fdset/nnn format, where nnn is the fd set ID. No new SELinux policy is required to prevent open of NFS files (files with type nfs_t). The virt_use_nfs boolean type simply needs to be set to false, and open will be prevented (and dup will be allowed). For example: # setsebool virt_use_nfs 0 # getsebool virt_use_nfs virt_use_nfs --> off Corey Bryant (7): qemu-char: Add MSG_CMSG_CLOEXEC flag to recvmsg qapi: Introduce add-fd, remove-fd, query-fdsets block: Prevent detection of /dev/fdset/ as floppy block: Convert open calls to qemu_open block: Convert close calls to qemu_close block: Enable qemu_open/close to work with fd sets monitor: Clean up fd sets on monitor disconnect block/raw-posix.c | 46 +++++---- block/raw-win32.c | 6 +- block/vdi.c | 5 +- block/vmdk.c | 25 ++--- block/vpc.c | 4 +- block/vvfat.c | 16 +-- cutils.c | 5 + monitor.c | 291 +++++++++++++++++++++++++++++++++++++++++++++++++++++ monitor.h | 5 + osdep.c | 114 +++++++++++++++++++++ qapi-schema.json | 98 ++++++++++++++++++ qemu-char.c | 12 ++- qemu-common.h | 2 + qemu-tool.c | 20 ++++ qmp-commands.hx | 122 ++++++++++++++++++++++ savevm.c | 4 +- 16 files changed, 720 insertions(+), 55 deletions(-) -- 1.7.10.4

3 12

[libvirt] [PATCH] util: typos in fallback code fo virDoubleToStr
by Martin Kletzander 14 Aug '12

14 Aug '12

Fixes for some typos that somehow didn't get to the final push of the commit 43bfa23e6f968be9a8c134a4b5c3cfb6da3816d9. --- Pushing as a build-breaker. src/util/util.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/util.c b/src/util/util.c index 4a720d8..9068e0f 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -2106,7 +2106,7 @@ virDoubleToStr(char **strp, double number) char *radix, *tmp; struct lconv *lc; - if ((ret = virVasprintf(strp, "%lf", number) < 0) + if ((ret = virAsprintf(strp, "%lf", number) < 0)) goto error; lc = localeconv(); @@ -2115,7 +2115,7 @@ virDoubleToStr(char **strp, double number) if (tmp) { *tmp = '.'; if (strlen(radix) > 1) - memmove(tmp + 1, tmp + strlen(radix), strlen(*strp) - (tmp - str)); + memmove(tmp + 1, tmp + strlen(radix), strlen(*strp) - (tmp - *strp)); } #endif /* HAVE_NEWLOCALE */ -- 1.7.8.6

1 0

[libvirt] [PATCH 0/4] support <vlan> element for interfaces and networks
by Laine Stump 14 Aug '12

14 Aug '12

The purpose of these patches is to define a data type that can properly describe an interface's vlan configuration (including multiple vlans for trunking), provide XML parser and formatter to translate to and from the new data type, add the new <vlan> element to both domain <interface> and to <network> in appropriate places, and to provide the new vlan data to the hypervisor driver. Once these 4 patches are applied, all that will be left to support vlan configuration for any network connection that supports it, is to request the vlan data for the interface with virDomainNetGetActualVlan(netdef). If that function returns NULL, there is no vlan config for this interface; if it's non-zero, it is a pointer to virNetDevVlan, and you can grab the data from there. Since I currently know of only two types of network connection we will be able to easily support this for (sr-iov VFs using PCI passthrough, and openvswitch), any type other than those will refuse to start if a vlan has been requested (see PATCH 4/4). This covers validation for the qemu and lxc drivers (since they use common code), but I'm not sure about xen, esx, or any other driver - they will likely require extra code to either implement transparent vlan configuration, or log an error if it's requested (my guess is that, in spite of our best efforts, *many* people will misunderstand the limitations of this functionality, and try to put all sorts of interfaces on vlans; it will be much friendlier to inform them of the problem rather than simply ignore the vlan config. == This patchset was developed on top of the 9 part patchset here: https://www.redhat.com/archives/libvir-list/2012-August/msg00293.html and the 5 part set here: https://www.redhat.com/archives/libvir-list/2012-August/msg00293.html It doesn't depend on any of the functionality, but not having those patchset will probably lead to some merge conflicts.

2 6

[libvirt] [PATCH 0/5] network: report #connections in network xml
by Laine Stump 14 Aug '12

14 Aug '12

The forward devices in direct mode (aka macvtap) networks already have a counter to keep track of how many guest interfaces are using each physical device. This series renames that counter to "connections", then adds another connects counter to the toplevel of each network, and outputs both of these counters (when non-0) with the live XML for the network (i.e. it isn't output if you ask for the --inactive xml). Someone working on a management application had requested this info, and it already existed, so I thought I may as well expose it. In-Reply-To:

1 6

[libvirt] [PATCH v4] json: fix interface locale dependency
by Martin Kletzander 14 Aug '12

14 Aug '12

libvirt creates invalid commands if wrong locale is selected. For example with locale that uses comma as a decimal point, JSON commands created with decimal numbers are invalid because comma separates the entries in JSON. Fortunately even when decimal point is affected, thousands grouping is not, because for grouping to be enabled with *printf, there has to be an apostrophe flag specified (and supported). This patch adds specific internal function for converting doubles to strings with C locale. -- v4: - changed according to Eric's suggestions --- bootstrap.conf | 1 + configure.ac | 4 +- src/libvirt_private.syms | 1 + src/util/json.c | 2 +- src/util/util.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++ src/util/util.h | 3 ++ 6 files changed, 71 insertions(+), 3 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index c112ccd..a4e1c2f 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -62,6 +62,7 @@ ioctl isatty largefile listen +localeconv maintainer-makefile manywarnings mkstemp diff --git a/configure.ac b/configure.ac index 8a04d91..3951012 100644 --- a/configure.ac +++ b/configure.ac @@ -132,8 +132,8 @@ AC_CHECK_SIZEOF([long]) dnl Availability of various common functions (non-fatal if missing), dnl and various less common threadsafe functions AC_CHECK_FUNCS_ONCE([cfmakeraw geteuid getgid getgrnam_r getmntent_r \ - getpwuid_r getuid initgroups kill mmap posix_fallocate posix_memalign \ - regexec sched_getaffinity]) + getpwuid_r getuid initgroups kill mmap newlocale posix_fallocate \ + posix_memalign regexec sched_getaffinity]) dnl Availability of pthread functions (if missing, win32 threading is dnl assumed). Because of $LIB_PTHREAD, we cannot use AC_CHECK_FUNCS_ONCE. diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index c023dbf..018d3a9 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1140,6 +1140,7 @@ virArgvToString; virAsprintf; virBuildPathInternal; virDirCreate; +virDoubleToStr; virEnumFromString; virEnumToString; virEventAddHandle; diff --git a/src/util/json.c b/src/util/json.c index 5132989..40d50a1 100644 --- a/src/util/json.c +++ b/src/util/json.c @@ -201,7 +201,7 @@ virJSONValuePtr virJSONValueNewNumberDouble(double data) { virJSONValuePtr val = NULL; char *str; - if (virAsprintf(&str, "%lf", data) < 0) + if (virDoubleToStr(&str, data) < 0) return NULL; val = virJSONValueNewNumber(str); VIR_FREE(str); diff --git a/src/util/util.c b/src/util/util.c index e5bb27b..4a720d8 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -44,6 +44,7 @@ #include <signal.h> #include <termios.h> #include <pty.h> +#include <locale.h> #if HAVE_LIBDEVMAPPER_H # include <libdevmapper.h> @@ -2060,6 +2061,68 @@ int virEnumFromString(const char *const*types, return -1; } +/* In case thread-safe locales are available */ +#if HAVE_NEWLOCALE + +static locale_t virLocale; + +static int +virLocaleOnceInit(void) +{ + virLocale = newlocale(LC_ALL_MASK, "C", (locale_t)0); + if (!virLocale) + return -1; + return 0; +} + +VIR_ONCE_GLOBAL_INIT(virLocale) +#endif + +/** + * virDoubleToStr + * + * converts double to string with C locale (thread-safe). + * + * Returns -1 on error, size of the string otherwise. + */ +int +virDoubleToStr(char **strp, double number) +{ + int ret = -1; + +#if HAVE_NEWLOCALE + + locale_t old_loc; + + if (virLocaleInitialize() < 0) + goto error; + + old_loc = uselocale(virLocale); + ret = virAsprintf(strp, "%lf", number); + uselocale(old_loc); + +#else + + char *radix, *tmp; + struct lconv *lc; + + if ((ret = virVasprintf(strp, "%lf", number) < 0) + goto error; + + lc = localeconv(); + radix = lc->decimal_point; + tmp = strstr(*strp, radix); + if (tmp) { + *tmp = '.'; + if (strlen(radix) > 1) + memmove(tmp + 1, tmp + strlen(radix), strlen(*strp) - (tmp - str)); + } + +#endif /* HAVE_NEWLOCALE */ + error: + return ret; +} + const char *virEnumToString(const char *const*types, unsigned int ntypes, int type) diff --git a/src/util/util.h b/src/util/util.h index d151c27..a5d892d 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -209,6 +209,9 @@ char *virStrcpy(char *dest, const char *src, size_t destbytes) ATTRIBUTE_RETURN_CHECK; # define virStrcpyStatic(dest, src) virStrcpy((dest), (src), sizeof(dest)) +int virDoubleToStr(char **strp, double number) + ATTRIBUTE_NONNULL(1) ATTRIBUTE_RETURN_CHECK; + int virDiskNameToIndex(const char* str); char *virIndexToDiskName(int idx, const char *prefix); -- 1.7.8.6

2 2

[libvirt] [PATCH] virsh: say save-image-edit failed only when it does
by Ján Tomko 14 Aug '12

14 Aug '12

The common code for editing files in virsh-edit.c expects EDIT_DEFINE to return 0 on failure. virDomainSaveImageDefineXML returns 0 on success. --- tools/virsh-domain.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 33b1727..69e0133 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -2973,7 +2973,7 @@ cmdSaveImageEdit(vshControl *ctl, const vshCmd *cmd) "not changed.\n"), file); \ ret = true; goto edit_cleanup; #define EDIT_DEFINE \ - virDomainSaveImageDefineXML(ctl->conn, file, doc_edited, define_flags) + (virDomainSaveImageDefineXML(ctl->conn, file, doc_edited, define_flags) == 0) #define EDIT_FREE /* */ #include "virsh-edit.c" -- 1.7.8.6

2 1

[libvirt] [PATCH] Do not unlink sanlock lockspace if registering with sanlock daemon returns error
by Asad Saeed 14 Aug '12

14 Aug '12

This is a patch for bug 847848 If registering an existing lockspace with the sanlock daemon returns an error, libvirt should not proceed to unlink the lockspace. Signed-off-by: Asad Saeed <asad.saeed(a)acidseed.com> --- src/locking/lock_driver_sanlock.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c index 9ec99dd..f046102 100644 --- a/src/locking/lock_driver_sanlock.c +++ b/src/locking/lock_driver_sanlock.c @@ -242,7 +242,7 @@ static int virLockManagerSanlockSetupLockspace(void) virReportSystemError(-rv, _("Unable to add lockspace %s"), path); - goto error_unlink; + goto error; } else { VIR_DEBUG("Lockspace %s is already registered", path); } -- 1.7.1

2 1