- Devel - libvirt List Archives

[libvirt] [RFC] Adding new filesystem 'proxy' to 9p
by M. Mohan Kumar 10 Oct '11

10 Oct '11

Pass-through security model in QEMU 9p server needs root privilege to do few file operations (like chown, chmod to any mode/uid:gid). There are two issues in pass-through security model 1) TOCTTOU vulnerability: Following symbolic links in the server could provide access to files beyond 9p export path. 2) When libvirt is configured to run qemu as non-root user (for example, if qemu is configured to run as normal user 'qemu'), running file operations on pass-through security model would fail because it needs root privileges. To overcome above issues, following approach is suggested: A new filesytem type 'proxy' is introduced. Proxy FS uses chroot + socket combination for securing the vulnerability known with following symbolic links. Intention of adding a new filesystem type is to allow qemu to run in non-root mode, but doing privileged operations using socket IO. A new binary (known as proxy helper) will be provided as part of qemu. Proxy helper will chroot into 9p export path and create a socket pair or a named socket based on the command line parameter. Qemu and proxy helper will communicate using this socket. We need following changes in the libvirt code to accomodate new 'proxy' filesystem type: If qemu 9p server is configured to use 'proxy' FS, libvirt will do * Create a socket pair * invoke proxy_helper binary with one of the socket id from the pair as command line parameters to it with root privilege * invoke qemu with one of socket id from the pair as paramter to qemu virtfs after dropping to the configured user privilege. ie, libvirt will invoke proxy_helper as: proxy_helper -i <socket_fd_from_socket_pair> -p <9p-path-to-export> and qemu will be invoked with following virtfs parameter: -virtfs proxy,id=<id>,sock_fd=<socket_fd_from_socket_pair> ,path=/tmp/,security_model=prox,mount_tag=v_pass People who want to use proxy_helper without libvirt can use following interface: $ proxy_helper -s </socket/path> -p <9p-path-to-export> With following qemu fsdev parameter: -virtfs proxy,id=<id>,socket=</socket/path>,path=/tmp/, security_model=prox,mount_tag=v_pass -- Regards, M. Mohan Kumar

3 5

[libvirt] [PATCH 0/7] Update systemtap probing
by Daniel P. Berrange 10 Oct '11

10 Oct '11

When looking at the keep alive code I needed an easy way to monitor the RPC messages being sent/received. I toyed with writing a WireShark plugin, but this seemed very hard work. So instead I wrote a handy set of DTrace probes for the RPC layer At the same time I also needed to track a bug in the RPC console streams code. These probes were very convenient for diagnosing the problems there

3 17

[libvirt] Qemu/KVM is 3x slower under libvirt
by Reeted 09 Oct '11

09 Oct '11

I repost this, this time by also including the libvirt mailing list. Info on my libvirt: it's the version in Ubuntu 11.04 Natty which is 0.8.8-1ubuntu6.5 . I didn't recompile this one, while Kernel and qemu-kvm are vanilla and compiled by hand as described below. My original message follows: This is really strange. I just installed a new host with kernel 3.0.3 and Qemu-KVM 0.14.1 compiled by me. I have created the first VM. This is on LVM, virtio etc... if I run it directly from bash console, it boots in 8 seconds (it's a bare ubuntu with no graphics), while if I boot it under virsh (libvirt) it boots in 20-22 seconds. This is the time from after Grub to the login prompt, or from after Grub to the ssh-server up. I was almost able to replicate the whole libvirt command line on the bash console, and it still goes almost 3x faster when launched from bash than with virsh start vmname. The part I wasn't able to replicate is the -netdev part because I still haven't understood the semantics of it. This is my bash commandline: /opt/qemu-kvm-0.14.1/bin/qemu-system-x86_64 -M pc-0.14 -enable-kvm -m 2002 -smp 2,sockets=2,cores=1,threads=1 -name vmname1-1 -uuid ee75e28a-3bf3-78d9-3cba-65aa63973380 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/vmname1-1.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=readline -rtc base=utc -boot order=dc,menu=on -drive file=/dev/mapper/vgPtpVM-lvVM_Vmname1_d1,if=none,id=drive-virtio-disk0,boot=on,format=raw,cache=none,aio=native -device virtio-blk-pci,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,id=virtio-disk0 -drive if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw,cache=none,aio=native -device ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -net nic,model=virtio -net tap,ifname=tap0,script=no,downscript=no -usb -vnc 127.0.0.1:0 -vga cirrus -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5 Which was taken from libvirt's command line. The only modifications I did to the original libvirt commandline (seen with ps aux) were: - Removed -S - Network was: -netdev tap,fd=17,id=hostnet0,vhost=on,vhostfd=18 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:05:36:60,bus=pci.0,addr=0x3 Has been simplified to: -net nic,model=virtio -net tap,ifname=tap0,script=no,downscript=no and manual bridging of the tap0 interface. Firstly I had thought that this could be fault of the VNC: I have compiled qemu-kvm with no separate vnc thread. I thought that libvirt might have connected to the vnc server at all times and this could have slowed down the whole VM. But then I also tried connecting vith vncviewer to the KVM machine launched directly from bash, and the speed of it didn't change. So no, it doesn't seem to be that. BTW: is the slowdown of the VM on "no separate vnc thread" only in effect when somebody is actually connected to VNC, or always? Also, note that the time difference is not visible in dmesg once the machine has booted. So it's not a slowdown in detecting devices. Devices are always detected within the first 3 seconds, according to dmesg, at 3.6 seconds the first ext4 mount begins. It seems to be really the OS boot that is slow... it seems an hard disk performance problem. Thank you R.

4 15

[libvirt] [PATCH] qemuDomainAttach: Initialize pidfile variable
by Michal Privoznik 09 Oct '11

09 Oct '11

If parsing qemu command line fails (e.g. because of non-existing process number supplied), we jump to cleanup label where we free pidfile. Therefore it needs to be initialized. Otherwise we free random pointer. --- Pushing under trivial rule. src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 2e6f3e4..5588d93 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10179,7 +10179,7 @@ static virDomainPtr qemuDomainAttach(virConnectPtr conn, virDomainPtr dom = NULL; virDomainChrSourceDefPtr monConfig = NULL; bool monJSON = false; - char *pidfile; + char *pidfile = NULL; virCheckFlags(0, NULL); -- 1.7.3.4

1 0

[libvirt] [PATCH] qemu: silence Coverity false positive
by Eric Blake 08 Oct '11

08 Oct '11

Coverity complained that 4 out of 5 callers to virJSONValueObjectGetBoolean checked for errors. But we documented that we don't care in this case. * src/qemu/qemu_monitor_json.c (qemuMonitorJSONGetBlockInfo): Use ignore_value. --- Pushing under the trivial rule. src/qemu/qemu_monitor_json.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index c4f8360..3d383c8 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -40,6 +40,7 @@ #include "datatypes.h" #include "virterror_internal.h" #include "json.h" +#include "ignore-value.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -1418,7 +1419,8 @@ int qemuMonitorJSONGetBlockInfo(qemuMonitorPtr mon, /* Don't check for success here, because 'tray-open' is presented iff * medium is ejected. */ - virJSONValueObjectGetBoolean(dev, "tray-open", &info->tray_open); + ignore_value(virJSONValueObjectGetBoolean(dev, "tray-open", + &info->tray_open)); break; } -- 1.7.4.4

1 0

[libvirt] [PATCH] lxc: fix logic bug
by Eric Blake 08 Oct '11

08 Oct '11

Detected by Coverity. We want to increment the size_t counter, not the pointer to the counter. * src/lxc/lxc_controller.c (lxcSetupLoopDevices): Use correct precedence. --- Pushing under the trivial rule. src/lxc/lxc_controller.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index 52d382e..51488e7 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -210,7 +210,7 @@ static int lxcSetupLoopDevices(virDomainDefPtr def, size_t *nloopDevs, int **loo virReportOOMError(); goto cleanup; } - (*loopDevs)[*nloopDevs++] = fd; + (*loopDevs)[(*nloopDevs)++] = fd; } VIR_DEBUG("Setup all loop devices"); -- 1.7.4.4

1 0

[libvirt] [PATCH] virsh: Update the help information for undefine command.
by tangchen 08 Oct '11

08 Oct '11

virsh undefine command can now undefine an active guest, but the help information is still the old. This patch modifies it and make it coincident to the manpage of virsh. Signed-off-by: tangchen <tangchen(a)cn.fujitsu.com> --- tools/virsh.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 48f2b8a..c3b467e 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -1897,8 +1897,10 @@ cmdDefine(vshControl *ctl, const vshCmd *cmd) * "undefine" command */ static const vshCmdInfo info_undefine[] = { - {"help", N_("undefine an inactive domain")}, - {"desc", N_("Undefine the configuration for an inactive domain.")}, + {"help", N_("Undefine a domain, active or inactive.")}, + {"desc", N_("Undefine a domain. If the domain is running, this converts \n" + " it to a transient domain, without stopping it. If the \n" + " domain is inactive, the domain configuration is removed.")}, {NULL, NULL} }; -- 1.7.3.1 -- Best Regards, Tang chen -------------------------------------------------- Tang Chen Development Dept.I Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST) No.6 Wenzhu Road, Nanjing, 210012, China TEL: +86+25-86630566-8527 FUJITSU INTERNAL: 7998-8527 FAX: +86+25-83317685 EMail: tangchen(a)cn.fujitsu.com -------------------------------------------------- This communication is for use by the intended recipient(s) only and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not an intended recipient of this communication, you are hereby notified that any dissemination, distribution or copying hereof is strictly prohibited. If you have received this communication in error, please notify me by reply e-mail, permanently delete this communication from your system, and destroy any hard copies you may have printed

2 2

[libvirt] [libvirt-tck] Fix labels in SELINUX tests
by Guido Günther 07 Oct '11

07 Oct '11

Hi, attached patch is needed to properly skip the SELinux tests if SELinux isn't enabled. Cheers, -- Guido

2 2

[libvirt] [PATCH 0/2] snapshot: allow editing disk-only snapshots
by Eric Blake 07 Oct '11

07 Oct '11

I tested that both of these patches in isolation were sufficient to fix 'virsh snapshot-current dom name' when running the same version of virsh as libvirtd (what will become 0.9.7). However, both patches are required, so that both virsh 0.9.5 and libvirtd 0.9.7, as well as virsh 0.9.7 and libvirt 0.9.5, will work (leaving only the combination of 0.9.5 in both virsh and libvirtd broken). Eric Blake (2): snapshot: let virsh edit disk snapshots snapshot: simplify redefinition of disk snapshot src/conf/domain_conf.c | 44 +++++++++++++++++++++++--------------------- tools/virsh.c | 5 +++++ 2 files changed, 28 insertions(+), 21 deletions(-) -- 1.7.4.4

2 5

[libvirt] [PATCH] snapshot: fix virsh error message typo
by Eric Blake 07 Oct '11

07 Oct '11

* tools/virsh.c (cmdSnapshotList): Spell exclusive correctly. --- Pushing under the trivial rule. tools/virsh.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 48f2b8a..62581f6 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -13133,19 +13133,19 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) if (vshCommandOptBool(cmd, "parent")) { if (vshCommandOptBool(cmd, "roots")) { vshError(ctl, "%s", - _("--parent and --roots are mutually exlusive")); + _("--parent and --roots are mutually exclusive")); return false; } if (tree) { vshError(ctl, "%s", - _("--parent and --tree are mutually exlusive")); + _("--parent and --tree are mutually exclusive")); return false; } parent_filter = 1; } else if (vshCommandOptBool(cmd, "roots")) { if (tree) { vshError(ctl, "%s", - _("--roots and --tree are mutually exlusive")); + _("--roots and --tree are mutually exclusive")); return false; } flags |= VIR_DOMAIN_SNAPSHOT_LIST_ROOTS; -- 1.7.4.4

1 0