- Devel - libvirt List Archives

[libvirt] [PATCH 00/12] Fine grained access control for libvirt APIs
by Daniel P. Berrange 05 Jul '12

05 Jul '12

This is a repost of https://www.redhat.com/archives/libvir-list/2012-January/msg00907.html which got no comments last time out. This series of patch is the minimal required to get a working proof of concept implementation of fine grained access control in libvirt. This demonstrates - Obtaining a client identity from a socket - Ensuring RPC calls are executed with the correct identity sset - A policykit access driver that checks based on access vector alone - A SELinux access driver that checks based on access vector + object - A set of hooks in the QEMU driver to protect virDomainObjPtr access Things that are not done - APIs for changing the real/effective identity post-connect - A simple RBAC access driver for doing (Access vector, object) checks - SELinux policy for the SELinux driver - Access control hooks on all other QEMU driver methods - Access control hooks in LXC, UML, other libvirtd side drivers - Access control hooks in storage, network, interface, etc drivers - Document WTF todo to propagate SELinux contexts across TCP sockets using IPSec. Any hints welcome... - Lots more I can't think of right now I should note that the policykit driver is mostly useless because it is unable to let you do checks on anything other than permission name and UNIX process ID at this time. So what I've implemented with the polkit driver is really little more than a slightly more fine grained version of the VIR_CONNECT_RO flag. In theory it is supposed to be extendable to allow other types of identity information besides the process ID, and to include some kind of object identiers in the permission check, but no one seems to be attacking this. So I expect the simple RBAC driver to be the most used one in the common case usage of libvirt, and of course the SELinux driver.

4 34

[libvirt] [PATCH] Only ummount /proc, /sys, /dev if the root source is '/'
by Daniel P. Berrange 05 Jul '12

05 Jul '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Previous commits added code to unmount the existing /proc, /sys and /dev hierarchies on the root filesystem of the container. This should only have been done if the container's root filesystem was the same as the host's root. ie if the root source is '/'. As it is, this causes LXC containersr to fail to start if their root source is not '/' Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/lxc/lxc_container.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 4f8703c..145accb 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1416,12 +1416,14 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef, if (lxcContainerPivotRoot(root) < 0) goto cleanup; - /* Gets rid of any existing stuff under /proc, /sys & /tmp + /* If we have the root source being '/', then we need to + * get rid of any existing stuff under /proc, /sys & /tmp. * We need new namespace aware versions of those. We must * do /proc last otherwise we won't find /proc/mounts :-) */ - if (lxcContainerUnmountSubtree("/sys", false) < 0 || - lxcContainerUnmountSubtree("/dev", false) < 0 || - lxcContainerUnmountSubtree("/proc", false) < 0) + if (STREQ(root->src, "/") && + (lxcContainerUnmountSubtree("/sys", false) < 0 || + lxcContainerUnmountSubtree("/dev", false) < 0 || + lxcContainerUnmountSubtree("/proc", false) < 0)) goto cleanup; /* Mounts the core /proc, /sys, etc filesystems */ -- 1.7.10.4

2 1

[libvirt] [PATCH libvirt-java 1/2] Return a byte[] array with secretGetValue
by Wido den Hollander 05 Jul '12

05 Jul '12

We break the API with this, but Java does not support multiple method signatures with different return types. The old method returned a String, but since a secret can be binary data this type is not suited. Users who now that their secret is in fact a String, can use cast with: Secret secret = conn.secretLookupByUUIDString("uuuuuuuid"); String value = new String(secret.getValue()); Signed-off-by: Wido den Hollander <wido(a)widodh.nl> --- src/main/java/org/libvirt/Secret.java | 13 ++++++++++--- src/main/java/org/libvirt/jna/Libvirt.java | 2 +- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/src/main/java/org/libvirt/Secret.java b/src/main/java/org/libvirt/Secret.java index 48f7895..39d9122 100644 --- a/src/main/java/org/libvirt/Secret.java +++ b/src/main/java/org/libvirt/Secret.java @@ -5,6 +5,9 @@ import org.libvirt.jna.SecretPointer; import com.sun.jna.Native; import com.sun.jna.NativeLong; +import com.sun.jna.ptr.LongByReference; +import com.sun.jna.Pointer; +import java.nio.ByteBuffer; /** * A secret defined by libvirt @@ -106,12 +109,16 @@ public class Secret { /** * Fetches the value of the secret - * + * * @return the value of the secret, or null on failure. */ - public String getValue() throws LibvirtException { - String returnValue = libvirt.virSecretGetValue(VSP, new NativeLong(), 0); + public byte[] getValue() throws LibvirtException { + LongByReference value_size = new LongByReference(); + Pointer value = libvirt.virSecretGetValue(VSP, value_size, 0); processError(); + ByteBuffer bb = value.getByteBuffer(0, value_size.getValue()); + byte[] returnValue = new byte[bb.remaining()]; + bb.get(returnValue); return returnValue; } diff --git a/src/main/java/org/libvirt/jna/Libvirt.java b/src/main/java/org/libvirt/jna/Libvirt.java index b1e53a2..f53199d 100644 --- a/src/main/java/org/libvirt/jna/Libvirt.java +++ b/src/main/java/org/libvirt/jna/Libvirt.java @@ -330,7 +330,7 @@ public interface Libvirt extends Library { public int virSecretGetUUID(SecretPointer virSecretPtr, byte[] uuidString); public int virSecretGetUUIDString(SecretPointer virSecretPtr, byte[] uuidString); public String virSecretGetUsageID(SecretPointer virSecretPtr); - public String virSecretGetValue(SecretPointer virSecretPtr, NativeLong value_size, int flags); + public Pointer virSecretGetValue(SecretPointer virSecretPtr, LongByReference value_size, int flags); public String virSecretGetXMLDesc(SecretPointer virSecretPtr, int flags); public SecretPointer virSecretLookupByUsage(ConnectionPointer virConnectPtr, int usageType, String usageID); public SecretPointer virSecretLookupByUUID(ConnectionPointer virConnectPtr, byte[] uuidBytes); -- 1.7.9.5

2 6

[libvirt] [PATCH] Wire up <loader> to set the QEMU BIOS path
by Daniel P. Berrange 05 Jul '12

05 Jul '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> * src/qemu/qemu_command.c: Wire up -bios with <loader> * tests/qemuxml2argvdata/qemuxml2argv-bios.args, tests/qemuxml2argvdata/qemuxml2argv-bios.xml: Expand existing BIOS test case to cover <loader> --- src/qemu/qemu_command.c | 9 +++++++++ tests/qemuxml2argvdata/qemuxml2argv-bios.args | 3 ++- tests/qemuxml2argvdata/qemuxml2argv-bios.xml | 1 + 3 files changed, 12 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ea9431f..c82f5bc 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -4052,6 +4052,11 @@ qemuBuildCommandLine(virConnectPtr conn, if (enableKVM) virCommandAddArg(cmd, "-enable-kvm"); + if (def->os.loader) { + virCommandAddArg(cmd, "-bios"); + virCommandAddArg(cmd, def->os.loader); + } + /* Set '-m MB' based on maxmem, because the lower 'memory' limit * is set post-startup using the balloon driver. If balloon driver * is not supported, then they're out of luck anyway. Update the @@ -7581,6 +7586,10 @@ virDomainDefPtr qemuParseCommandLine(virCapsPtr caps, WANT_VALUE(); if (!(def->os.kernel = strdup(val))) goto no_memory; + } else if (STREQ(arg, "-bios")) { + WANT_VALUE(); + if (!(def->os.loader = strdup(val))) + goto no_memory; } else if (STREQ(arg, "-initrd")) { WANT_VALUE(); if (!(def->os.initrd = strdup(val))) diff --git a/tests/qemuxml2argvdata/qemuxml2argv-bios.args b/tests/qemuxml2argvdata/qemuxml2argv-bios.args index f9727c4..ac98000 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-bios.args +++ b/tests/qemuxml2argvdata/qemuxml2argv-bios.args @@ -1,5 +1,6 @@ LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ -/usr/bin/qemu -S -M pc -m 1024 -smp 1 -nodefaults -device sga \ +/usr/bin/qemu -S -M pc -bios /usr/share/seabios/bios.bin \ +-m 1024 -smp 1 -nodefaults -device sga \ -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \ -hda /dev/HostVG/QEMUGuest1 -serial pty \ -usb -device usb-tablet,id=input0 -vnc 127.0.0.1:0 \ diff --git a/tests/qemuxml2argvdata/qemuxml2argv-bios.xml b/tests/qemuxml2argvdata/qemuxml2argv-bios.xml index cfc5587..ac15d45 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-bios.xml +++ b/tests/qemuxml2argvdata/qemuxml2argv-bios.xml @@ -6,6 +6,7 @@ <vcpu>1</vcpu> <os> <type arch='i686' machine='pc'>hvm</type> + <loader>/usr/share/seabios/bios.bin</loader> <boot dev='hd'/> <bootmenu enable='yes'/> <bios useserial='yes'/> -- 1.7.7.6

3 3

[libvirt] [PATCH] qemu: Always set auth_supported for Ceph disks.
by Wido den Hollander 05 Jul '12

05 Jul '12

Recently the Ceph project defaulted auth_supported from 'none' to 'cephx'. When no auth information was set for Ceph disks this would lead to librados defaulting to 'cephx', but there would be no additional authorization information. We now explicitly set auth_supported to none when passing down arguments to Qemu. Signed-off-by: Wido den Hollander <wido(a)widodh.nl> --- src/qemu/qemu_command.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 6549f57..1c59695 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1782,6 +1782,8 @@ qemuBuildRBDString(virConnectPtr conn, disk->auth.username); goto error; } + } else { + virBufferAddLit(opt, ":auth_supported=none"); } if (disk->nhosts > 0) { -- 1.7.9.5

2 2

[libvirt] Tracking VM installations
by Zeeshan Ali (Khattak) 05 Jul '12

05 Jul '12

Hi, We have a requirement in Boxes for showing progress bars on VMs under installation: https://github.com/gnome-design-team/gnome-mockups/raw/master/boxes/boxes-i… https://bugzilla.gnome.org/show_bug.cgi?id=679107 However, we are bit clueless on how that could be achieved. The only idea I have is to know the number of passes (reboots) and typical disk usage in each pass for "every" (we only do this for express installs so we don't need this for all) OS and estimate the progress based on that knowledge. If that idea is worth looking into, we'll need this information in libosinfo and hence me cross-posting this to virt-tools-list. Other ideas welcome! Keep in mind that we don't need to be very accurate, just accurate enough to not annoy the user. -- Regards, Zeeshan Ali (Khattak) FSF member#5124

3 5

[libvirt] [RFC] Allowing promiscuous mode for domains network interfaces
by Jean-Baptiste Rouault 05 Jul '12

05 Jul '12

Hi all, By default, OpenVZ and VirtualBox (> 4.0.x) filter network packets by MAC addresses : only broadcast, multicast and packets directly targeted to VMs are transmitted. This behaviour prevents from using promiscuous mode inside domains. I'd like to write some patches to disable these filters from libvirt. Would it be ok to modify OpenVZ and VirtualBox drivers so that they disable the filters by default ? If this is not acceptable, what about making it configurable through domains' XML ? Regards, Jean-Baptiste -- Jean-Baptiste ROUAULT Ingénieur R&D - diateam : Architectes de l'information Phone : +33 (0)2 98 050 050 Fax : +33 (0)2 98 050 051

2 2

[libvirt] [PATCH v7 0/8] Add basic driver for Parallels Virtuozzo Server
by Dmitry Guryanov 05 Jul '12

05 Jul '12

Parallels Cloud Server is a virtualization solution that allows users to simultaneously run multiple virtual machines and containers on the same physical server. More information can be found here: http://www.parallels.com/products/pcs/ Also beta version of Parallels Cloud Server can be downloaded there. Dmitry Guryanov (8): parallels: add driver skeleton parallels: add functions to list domains and get info parallels: implement functions for domain life cycle management parallels: get info about serial ports parallels: add support of VNC remote display parallels: implement virDomainDefineXML operation for existing domains parallels: add storage driver parallels: implement VM creation cfg.mk | 1 + configure.ac | 23 + docs/drvparallels.html.in | 28 + include/libvirt/virterror.h | 2 +- libvirt.spec.in | 9 +- mingw32-libvirt.spec.in | 6 + po/POTFILES.in | 4 + src/Makefile.am | 15 + src/conf/domain_conf.c | 3 +- src/conf/domain_conf.h | 1 + src/driver.h | 1 + src/libvirt.c | 9 + src/parallels/parallels_driver.c | 1309 +++++++++++++++++++++++++++++++++ src/parallels/parallels_driver.h | 75 ++ src/parallels/parallels_storage.c | 1456 +++++++++++++++++++++++++++++++++++++ src/parallels/parallels_utils.c | 131 ++++ src/util/virterror.c | 3 +- 17 files changed, 3072 insertions(+), 4 deletions(-) create mode 100644 docs/drvparallels.html.in create mode 100644 src/parallels/parallels_driver.c create mode 100644 src/parallels/parallels_driver.h create mode 100644 src/parallels/parallels_storage.c create mode 100644 src/parallels/parallels_utils.c

3 16

[libvirt] can't receive keepalive message during migration
by Hu Tao 05 Jul '12

05 Jul '12

Hi, When testing migration, I found a problem that the server can't receive keepalive reply from client when doing migration. The log shows that virsh did send the keepalive reply, but server didn't reveive it. The strange part is it's OK to migrate from host A to Host B, but always fails to migrate from host B to host A. When disable keepalive, migration will success. Any ideas? -- Thanks, Hu Tao

2 2

[libvirt] [PATCH] virsh: Avoid division by 0 in vshCalloc
by Peter Krempa 04 Jul '12

04 Jul '12

vshCalloc function uses xalloc_oversized macro that can't take 0 as it's second argument. If vshCalloc is called with size 0, virsh ends with a floating point exception. This patch changes vshCalloc to return NULL if no memory is requested. --- tools/virsh.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 53d1825..d3d5c6a 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -460,6 +460,9 @@ _vshCalloc(vshControl *ctl, size_t nmemb, size_t size, const char *filename, int { char *x; + if (!size) + return NULL; + if (!xalloc_oversized(nmemb, size) && VIR_ALLOC_N(x, nmemb * size) == 0) return x; -- 1.7.8.6

3 5