- Devel - libvirt List Archives

[libvirt] [test-API][PATCH v3] Add ownership_test.py test case
by Wayne Sun 31 Aug '11

31 Aug '11

* Save a domain to a file which chown is qemu:qemu, check the ownership of the file after save and restore operation. With use_nfs enable or not, the saved file could be on local or mounted root_squash nfs dir. --- repos/domain/ownership_test.py | 315 ++++++++++++++++++++++++++++++++++++++++ 1 files changed, 315 insertions(+), 0 deletions(-) create mode 100644 repos/domain/ownership_test.py diff --git a/repos/domain/ownership_test.py b/repos/domain/ownership_test.py new file mode 100644 index 0000000..1957428 --- /dev/null +++ b/repos/domain/ownership_test.py @@ -0,0 +1,315 @@ +#!/usr/bin/env python +"""Setting the dynamic_ownership in /etc/libvirt/qemu.conf, + check the ownership of saved domain file. Test could be on + local or root_squash nfs. The default owner of the saved + domain file is qemu:qemu in this case. + domain:ownership_test + guestname + #GUESTNAME# + dynamic_ownership + 0|1 + use_nfs + enable|disable + + use_nfs is a flag for decide using root_squash nfs or not +""" + +__author__ = 'Wayne Sun: gsun(a)redhat.com' +__date__ = 'Mon Jul 25, 2011' +__version__ = '0.1.0' +__credits__ = 'Copyright (C) 2011 Red Hat, Inc.' +__all__ = ['ownership_test'] + +import os +import re +import sys +import commands + +QEMU_CONF = "/etc/libvirt/qemu.conf" +SAVE_FILE = "/mnt/test.save" +TEMP_FILE = "/tmp/test.save" + +from utils.Python import utils + +def append_path(path): + """Append root path of package""" + if path in sys.path: + pass + else: + sys.path.append(path) + +from lib import connectAPI +from lib import domainAPI +from utils.Python import utils +from exception import LibvirtAPI + +pwd = os.getcwd() +result = re.search('(.*)libvirt-test-API', pwd) +append_path(result.group(0)) + +def return_close(conn, logger, ret): + conn.close() + logger.info("closed hypervisor connection") + return ret + +def check_params(params): + """Verify inputing parameter dictionary""" + logger = params['logger'] + keys = ['guestname', 'dynamic_ownership', 'use_nfs'] + for key in keys: + if key not in params: + logger.error("%s is required" %key) + return 1 + return 0 + +def nfs_setup(util, logger): + """setup nfs on localhost + """ + logger.info("set nfs service") + cmd = "echo /tmp *\(rw,root_squash\) > /etc/exports" + ret, out = util.exec_cmd(cmd, shell=True) + if ret: + logger.error("failed to config nfs export") + return 1 + + logger.info("start nfs service") + cmd = "service nfs start" + ret, out = util.exec_cmd(cmd, shell=True) + if ret: + logger.error("failed to start nfs service") + return 1 + else: + for i in range(len(out)): + logger.info(out[i]) + + return 0 + +def chown_file(util, filepath, logger): + """touch a file and setting the chown + """ + if os.path.exists(filepath): + os.remove(filepath) + + touch_cmd = "touch %s" % filepath + logger.info(touch_cmd) + ret, out = util.exec_cmd(touch_cmd, shell=True) + if ret: + logger.error("failed to touch a new file") + logger.error(out[0]) + return 1 + + logger.info("set chown of %s as 107:107" % filepath) + chown_cmd = "chown 107:107 %s" % filepath + ret, out = util.exec_cmd(chown_cmd, shell=True) + if ret: + logger.error("failed to set the ownership of %s" % filepath) + return 1 + + logger.info("set %s mode as 664" % filepath) + cmd = "chmod 664 %s" % filepath + ret, out = util.exec_cmd(cmd, shell=True) + if ret: + logger.error("failed to set the mode of %s" % filepath) + return 1 + + return 0 + +def prepare_env(util, guestname, dynamic_ownership, use_nfs, logger): + """configure dynamic_ownership in /etc/libvirt/qemu.conf, + set chown of the file to save + """ + logger.info("set the dynamic ownership in %s as %s" % \ + (QEMU_CONF, dynamic_ownership)) + set_cmd = "echo dynamic_ownership = %s >> %s" % (dynamic_ownership, QEMU_CONF) + ret, out = util.exec_cmd(set_cmd, shell=True) + if ret: + logger.error("failed to set dynamic ownership") + return 1 + + logger.info("restart libvirtd") + restart_cmd = "service libvirtd restart" + ret, out = util.exec_cmd(restart_cmd, shell=True) + if ret: + logger.error("failed to restart libvirtd") + return 1 + else: + for i in range(len(out)): + logger.info(out[i]) + + if use_nfs == 'enable': + filepath = TEMP_FILE + elif use_nfs == 'disable': + filepath = SAVE_FILE + + ret = chown_file(util, filepath, logger) + if ret: + return 1 + + if use_nfs == 'enable': + ret = nfs_setup(util, logger) + if ret: + return 1 + + cmd = "setsebool virt_use_nfs 1" + logger.info(cmd) + ret, out = util.exec_cmd(cmd, shell=True) + if ret: + logger.error("Failed to setsebool virt_use_nfs") + return 1 + + logger.info("mount the nfs path to /mnt") + mount_cmd = "mount -o vers=3 127.0.0.1:/tmp /mnt" + ret, out = util.exec_cmd(mount_cmd, shell=True) + if ret: + logger.error("Failed to mount the nfs path") + for i in range(len(out)): + logger.info(out[i]) + return 1 + + return 0 + +def ownership_get(logger): + """check the ownership of file""" + + statinfo = os.stat(SAVE_FILE) + uid = statinfo.st_uid + gid = statinfo.st_gid + + logger.info("the uid and gid of %s is %s:%s" %(SAVE_FILE, uid, gid)) + + return 0, uid, gid + +def ownership_test(params): + """Save a domain to a file, check the ownership of + the file after save and restore + """ + # Initiate and check parameters + params_check_result = check_params(params) + if params_check_result: + return 1 + + logger = params['logger'] + guestname = params['guestname'] + dynamic_ownership = params['dynamic_ownership'] + use_nfs = params['use_nfs'] + test_result = False + + util = utils.Utils() + + # set env + logger.info("prepare the environment") + ret = prepare_env(util, guestname, dynamic_ownership, use_nfs, logger) + if ret: + logger.error("failed to prepare the environment") + return 1 + + # Connect to local hypervisor connection URI + uri = util.get_uri('127.0.0.1') + conn = connectAPI.ConnectAPI() + virconn = conn.open(uri) + + # save domain to the file + logger.info("save the domain to the file") + domobj = domainAPI.DomainAPI(virconn) + try: + domobj.save(guestname, SAVE_FILE) + logger.info("Success save domain to file") + except LibvirtAPI, e: + logger.error("API error message: %s, error code is %s" % \ + (e.response()['message'], e.response()['code'])) + logger.error("Error: fail to save %s domain" %guestname) + return return_close(conn, logger, 1) + + logger.info("check the ownership of %s after save" % SAVE_FILE) + ret, uid, gid = ownership_get(logger) + if use_nfs == 'enable': + if uid == 107 and gid == 107: + logger.info("As expected, the chown not change.") + test_result = True + else: + logger.error("The chown of %s is %s:%s, it's not as expected" % \ + (SAVE_FILE, uid, gid)) + return return_close(conn, logger, 1) + elif use_nfs == 'disable': + if dynamic_ownership == '1': + if uid == 0 and gid == 0: + logger.info("As expected, the chown changed to root:root") + test_result = True + else: + logger.error("The chown of %s is %s:%s, it's not as expected" % \ + (SAVE_FILE, uid, gid)) + return return_close(conn, logger, 1) + elif dynamic_ownership == '0': + if uid == 107 and gid == 107: + logger.info("As expected, the chown not change.") + test_result = True + else: + logger.error("The chown of %s is %s:%s, it's not as expected" % \ + (SAVE_FILE, uid, gid)) + return return_close(conn, logger, 1) + else: + logger.error("wrong dynamic_ownership value %s" % dynamic_ownership) + return return_close(conn, logger, 1) + + + # restore domain from file + logger.info("restore the domain from the file") + try: + domobj.restore(guestname, SAVE_FILE) + logger.info("check the ownership of %s after restore" % SAVE_FILE) + ret, uid, gid = ownership_get(logger) + if uid == 107 and gid == 107: + logger.info("As expected, the chown not change.") + test_result = True + else: + logger.error("The chown of %s is %s:%s, not change back as expected" % \ + (SAVE_FILE, uid, gid)) + test_result = False + except LibvirtAPI, e: + logger.error("API error message: %s, error code is %s" % \ + (e.response()['message'], e.response()['code'])) + logger.error("Error: fail to restore %s domain" %guestname) + test_result = False + + if test_result: + return return_close(conn, logger, 0) + else: + return return_close(conn, logger, 1) + +def ownership_test_clean(params): + """clean testing environment""" + logger = params['logger'] + use_nfs = params['use_nfs'] + + util = utils.Utils() + + if use_nfs == 'enable': + logger.info("umount the nfs path") + umount_cmd = "umount /mnt" + ret, out = util.exec_cmd(umount_cmd, shell=True) + if ret: + logger.error("Failed to mount the nfs path") + for i in range(len(out)): + logger.error(out[i]) + + logger.info("stop nfs service") + cmd = "service nfs stop" + ret, out = util.exec_cmd(cmd, shell=True) + if ret: + logger.error("Failed to stop nfs service") + for i in range(len(out)): + logger.error(out[i]) + + logger.info("clear the exports file") + cmd = ">/etc/exports" + if ret: + logger.error("Failed to clear exports file") + + filepath = TEMP_FILE + elif use_nfs == 'disable': + filepath = SAVE_FILE + + if os.path.exists(filepath): + logger.info("remove dump file from save %s" % filepath) + os.remove(filepath) + -- 1.7.1

3 2

[libvirt] [test-API][PATCH 1/3] Remove API wrappers that have been flagged internal use
by Guannan Ren 31 Aug '11

31 Aug '11

*lib/connectAPI.py --- lib/connectAPI.py | 108 ----------------------------------------------------- 1 files changed, 0 insertions(+), 108 deletions(-) diff --git a/lib/connectAPI.py b/lib/connectAPI.py index cfa4fea..9f2b728 100644 --- a/lib/connectAPI.py +++ b/lib/connectAPI.py @@ -248,114 +248,6 @@ class ConnectAPI(object): code = e.get_error_code() raise exception.LibvirtAPI(message, code) - def dispatch_domain_event_callback(self, dom, event, detail): - try: - return self.conn.dispatchDomainEventCallbacks(dom, event, detail) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - - def dispatch_domain_event_generic_callback(self, dom, cbData): - try: - return self.conn.dispatchDomainEventGenericCallback(dom, cbData) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - - def dispatch_domain_event_graphics_callback(self, - dom, - phase, - localAddr, - remoteAddr, - authScheme, - subject, - cbData): - try: - return self.conn.dispatchDomainEventGraphicsCallback(dom, - phase, - localAddr, - remoteAddr, - authScheme, - subject, - cbData) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - - def dispatch_domain_event_IOError_callback(self, - dom, - srcPath, - devAlias, - action, - cbData): - try: - return self.conn.dispatchDomainEventIOErrorCallback(dom, - srcPath, - devAlias, - action, - cbData) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - - def dispatch_domain_event_IOError_reason_callback(self, - dom, - srcPath, - devAlias, - action, - reason, - cbData): - try: - return self.conn.dispatchDomainEventIOErrorReasonCallback(dom, - srcPath, - devAlias, - action, - reason, - cbData) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - - def dispatch_domain_event_lifecycle_callback(self, - dom, - event, - detail, - cbData): - try: - return self.conn.dispatchDomainEventLifecycleCallback(dom, - event, - detail, - cbData) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - - def dispatch_domain_event_RTC_change_callback(self, dom, offset, cbData): - try: - return self.conn.dispatchDomainEventRTCChangeCallback(dom, - offset, - cbData) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - - def dispatch_domain_event_watchdog_callback(self, dom, action, cbData): - try: - return self.conn.dispatchDomainEventWatchdogCallback(dom, - action, - cbData) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) - def domain_event_deregister(self, cb): try: return self.conn.domainEventDeregister(cb) -- 1.7.1

2 3

[libvirt] [PATCH] Remove bogus virSecurityManagerSetProcessFDLabel method
by Daniel P. Berrange 31 Aug '11

31 Aug '11

The virSecurityManagerSetProcessFDLabel method was introduced after a mis-understanding from a conversation about SELinux socket labelling. The virSecurityManagerSetSocketLabel method should have been used for all such scenarios. * src/security/security_apparmor.c, src/security/security_apparmor.c, src/security/security_driver.h, src/security/security_manager.c, src/security/security_manager.h, src/security/security_selinux.c, src/security/security_stack.c: Remove SetProcessFDLabel driver --- src/security/security_apparmor.c | 29 ----------------------------- src/security/security_dac.c | 9 --------- src/security/security_driver.h | 4 ---- src/security/security_manager.c | 11 ----------- src/security/security_manager.h | 3 --- src/security/security_selinux.c | 14 -------------- src/security/security_stack.c | 18 ------------------ 7 files changed, 0 insertions(+), 88 deletions(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index dbd1290..299dcc6 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -799,34 +799,6 @@ AppArmorSetImageFDLabel(virSecurityManagerPtr mgr, return reload_profile(mgr, vm, fd_path, true); } -static int -AppArmorSetProcessFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, - int fd) -{ - int rc = -1; - char *proc = NULL; - char *fd_path = NULL; - - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; - - if (secdef->imagelabel == NULL) - return 0; - - if (virAsprintf(&proc, "/proc/self/fd/%d", fd) == -1) { - virReportOOMError(); - return rc; - } - - if (virFileResolveLink(proc, &fd_path) < 0) { - virSecurityReportError(VIR_ERR_INTERNAL_ERROR, - "%s", _("could not find path for descriptor")); - return rc; - } - - return reload_profile(mgr, vm, fd_path, true); -} - virSecurityDriver virAppArmorSecurityDriver = { 0, SECURITY_APPARMOR_NAME, @@ -863,5 +835,4 @@ virSecurityDriver virAppArmorSecurityDriver = { AppArmorRestoreSavedStateLabel, AppArmorSetImageFDLabel, - AppArmorSetProcessFDLabel, }; diff --git a/src/security/security_dac.c b/src/security/security_dac.c index e5465fc..af02236 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -697,14 +697,6 @@ virSecurityDACSetImageFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, return 0; } -static int -virSecurityDACSetProcessFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, - int fd ATTRIBUTE_UNUSED) -{ - return 0; -} - virSecurityDriver virSecurityDriverDAC = { sizeof(virSecurityDACData), @@ -743,5 +735,4 @@ virSecurityDriver virSecurityDriverDAC = { virSecurityDACRestoreSavedStateLabel, virSecurityDACSetImageFDLabel, - virSecurityDACSetProcessFDLabel, }; diff --git a/src/security/security_driver.h b/src/security/security_driver.h index 94f27f8..aea90b0 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -84,9 +84,6 @@ typedef int (*virSecurityDomainSecurityVerify) (virSecurityManagerPtr mgr, typedef int (*virSecurityDomainSetImageFDLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, int fd); -typedef int (*virSecurityDomainSetProcessFDLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, - int fd); struct _virSecurityDriver { size_t privateDataLen; @@ -124,7 +121,6 @@ struct _virSecurityDriver { virSecurityDomainRestoreSavedStateLabel domainRestoreSavedStateLabel; virSecurityDomainSetImageFDLabel domainSetSecurityImageFDLabel; - virSecurityDomainSetProcessFDLabel domainSetSecurityProcessFDLabel; }; virSecurityDriverPtr virSecurityDriverLookup(const char *name); diff --git a/src/security/security_manager.c b/src/security/security_manager.c index b2fd0d0..cae9b83 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -346,14 +346,3 @@ int virSecurityManagerSetImageFDLabel(virSecurityManagerPtr mgr, virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); return -1; } - -int virSecurityManagerSetProcessFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, - int fd) -{ - if (mgr->drv->domainSetSecurityProcessFDLabel) - return mgr->drv->domainSetSecurityProcessFDLabel(mgr, vm, fd); - - virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); - return -1; -} diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 38342c2..12cd498 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -96,8 +96,5 @@ int virSecurityManagerVerify(virSecurityManagerPtr mgr, int virSecurityManagerSetImageFDLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, int fd); -int virSecurityManagerSetProcessFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, - int fd); #endif /* VIR_SECURITY_MANAGER_H__ */ diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index cddbed5..ca54f9b 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1321,19 +1321,6 @@ SELinuxSetImageFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, return SELinuxFSetFilecon(fd, secdef->imagelabel); } -static int -SELinuxSetProcessFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - int fd) -{ - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; - - if (secdef->label == NULL) - return 0; - - return SELinuxFSetFilecon(fd, secdef->label); -} - virSecurityDriver virSecurityDriverSELinux = { 0, SECURITY_SELINUX_NAME, @@ -1370,5 +1357,4 @@ virSecurityDriver virSecurityDriverSELinux = { SELinuxRestoreSavedStateLabel, SELinuxSetImageFDLabel, - SELinuxSetProcessFDLabel, }; diff --git a/src/security/security_stack.c b/src/security/security_stack.c index f263f5b..3f601c1 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -402,23 +402,6 @@ virSecurityStackSetImageFDLabel(virSecurityManagerPtr mgr, } -static int -virSecurityStackSetProcessFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, - int fd) -{ - virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); - int rc = 0; - - if (virSecurityManagerSetProcessFDLabel(priv->secondary, vm, fd) < 0) - rc = -1; - if (virSecurityManagerSetProcessFDLabel(priv->primary, vm, fd) < 0) - rc = -1; - - return rc; -} - - virSecurityDriver virSecurityDriverStack = { sizeof(virSecurityStackData), "stack", @@ -455,5 +438,4 @@ virSecurityDriver virSecurityDriverStack = { virSecurityStackRestoreSavedStateLabel, virSecurityStackSetImageFDLabel, - virSecurityStackSetProcessFDLabel, }; -- 1.7.4.4

3 4

[libvirt] [PATCH] snapshot: forbid snapshot on autodestroy domain
by Eric Blake 31 Aug '11

31 Aug '11

There is no reason to forbid pausing an autodestroy domain (not to mention that 'virsh start --paused --autodestroy' succeeds in creating a paused autodestroy domain). Meanwhile, qemu was failing to enforce the API documentation that autodestroy domains cannot be saved. And while the original documentation only mentioned save/restore, snapshots are another form of saving that are close enough in semantics as to make no sense on one-shot domains. * src/qemu/qemu_driver.c (qemudDomainSuspend): Drop bogus check. (qemuDomainSaveInternal, qemuDomainSnapshotCreateXML): Forbid saves of autodestroy domains. * src/libvirt.c (virDomainCreateWithFlags, virDomainCreateXML): Document snapshot interaction. --- Sending this one separately for v1, but I'll insert it into the front of my snapshot series (before 1/43) when I post v4 of that. src/libvirt.c | 4 ++-- src/qemu/qemu_driver.c | 18 ++++++++++++------ 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index 65a099b..711580e 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -1822,7 +1822,7 @@ virDomainGetConnect (virDomainPtr dom) * object is finally released. This will also happen if the * client application crashes / loses its connection to the * libvirtd daemon. Any domains marked for auto destroy will - * block attempts at migration or save-to-file + * block attempts at migration, save-to-file, or snapshots. * * Returns a new domain object or NULL in case of failure */ @@ -7073,7 +7073,7 @@ error: * object is finally released. This will also happen if the * client application crashes / loses its connection to the * libvirtd daemon. Any domains marked for auto destroy will - * block attempts at migration or save-to-file + * block attempts at migration, save-to-file, or snapshots. * * If the VIR_DOMAIN_START_BYPASS_CACHE flag is set, and there is a * managed save file for this domain (created by virDomainManagedSave()), diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f21122d..737eec8 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1360,12 +1360,6 @@ static int qemudDomainSuspend(virDomainPtr dom) { goto cleanup; } - if (qemuProcessAutoDestroyActive(driver, vm)) { - qemuReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("domain is marked for auto destroy")); - goto cleanup; - } - priv = vm->privateData; if (priv->job.asyncJob == QEMU_ASYNC_JOB_MIGRATION_OUT) { @@ -2225,6 +2219,12 @@ qemuDomainSaveInternal(struct qemud_driver *driver, virDomainPtr dom, int directFlag = 0; virFileDirectFdPtr directFd = NULL; + if (qemuProcessAutoDestroyActive(driver, vm)) { + qemuReportError(VIR_ERR_OPERATION_INVALID, + "%s", _("domain is marked for auto destroy")); + return -1; + } + memset(&header, 0, sizeof(header)); memcpy(header.magic, QEMUD_SAVE_MAGIC, sizeof(header.magic)); header.version = QEMUD_SAVE_VERSION; @@ -8471,6 +8471,12 @@ static virDomainSnapshotPtr qemuDomainSnapshotCreateXML(virDomainPtr domain, goto cleanup; } + if (qemuProcessAutoDestroyActive(driver, vm)) { + qemuReportError(VIR_ERR_OPERATION_INVALID, + "%s", _("domain is marked for auto destroy")); + goto cleanup; + } + /* in a perfect world, we would allow qemu to tell us this. The problem * is that qemu only does this check device-by-device; so if you had a * domain that booted from a large qcow2 device, but had a secondary raw -- 1.7.4.4

2 2

[libvirt] [PATCH] Fix sanlock socket security labelling
by Daniel P. Berrange 31 Aug '11

31 Aug '11

It is not possible to change the label of a TCP socket once it has been opened. When creating a TCP socket care must be taken to ensure the socket creation label is set & then cleared. Remove the bogus call to virSecurityManagerSetProcessFDLabel from the lock driver guest setup code and instead make use of virSecurityManagerSetSocketLabel --- src/qemu/qemu_process.c | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 58b4d36..c22974f 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -2081,15 +2081,26 @@ static int qemuProcessHook(void *data) h->vm->pid = getpid(); VIR_DEBUG("Obtaining domain lock"); + /* + * Since we're going to leak the returned FD to QEMU, + * we need to make sure it gets a sensible label. + * This mildly sucks, because there could be other + * sockets the lock driver opens that we don't want + * labelled. So far we're ok though. + */ + if (virSecurityManagerSetSocketLabel(h->driver->securityManager, h->vm) < 0) + goto cleanup; if (virDomainLockProcessStart(h->driver->lockManager, h->vm, /* QEMU is always pased initially */ true, &fd) < 0) goto cleanup; + if (virSecurityManagerClearSocketLabel(h->driver->securityManager, h->vm) < 0) + goto cleanup; if (qemuProcessLimits(h->driver) < 0) - return -1; + goto cleanup; /* This must take place before exec(), so that all QEMU * memory allocation is on the correct NUMA node @@ -2111,12 +2122,6 @@ static int qemuProcessHook(void *data) if (virSecurityManagerSetProcessLabel(h->driver->securityManager, h->vm) < 0) goto cleanup; - if (fd != -1) { - VIR_DEBUG("Setting up lock manager FD labelling"); - if (virSecurityManagerSetProcessFDLabel(h->driver->securityManager, h->vm, fd) < 0) - goto cleanup; - } - ret = 0; cleanup: -- 1.7.4.4

2 1

[libvirt] [PATCH] Fix incorrect path length check in sanlock lockspace setup
by Daniel P. Berrange 31 Aug '11

31 Aug '11

The code for creating a sanlock lockspace accidentally used SANLK_NAME_LEN instead of SANLK_PATH_LEN for a size check. This meant disk paths were limited to 48 bytes ! * src/locking/lock_driver_sanlock.c: Fix disk path length check --- src/locking/lock_driver_sanlock.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c index b85f1fa..b93fe01 100644 --- a/src/locking/lock_driver_sanlock.c +++ b/src/locking/lock_driver_sanlock.c @@ -159,10 +159,10 @@ static int virLockManagerSanlockSetupLockspace(void) memcpy(ls.name, VIR_LOCK_MANAGER_SANLOCK_AUTO_DISK_LOCKSPACE, SANLK_NAME_LEN); ls.host_id = 0; /* Doesn't matter for initialization */ ls.flags = 0; - if (!virStrcpy(ls.host_id_disk.path, path, SANLK_NAME_LEN)) { + if (!virStrcpy(ls.host_id_disk.path, path, SANLK_PATH_LEN)) { virLockError(VIR_ERR_INTERNAL_ERROR, _("Lockspace path '%s' exceeded %d characters"), - path, SANLK_NAME_LEN); + path, SANLK_PATH_LEN); goto error; } ls.host_id_disk.offset = 0; -- 1.7.4.4

2 1

[libvirt] [PATCH] build: simplify use of verify
by Eric Blake 31 Aug '11

31 Aug '11

Back in 2008 when this line of util.h was written, gnulib's verify module didn't allow the use of multiple verify() in one file in combination with our choice of gcc -W options. But that has since been fixed in gnulib, and newer gnulib even maps verify() to the C1x feature of _Static_assert, which gives even nicer diagnostics with a new enough compiler, so we might as well go with the simpler verify(). * src/util/util.h (VIR_ENUM_IMPL): Use simpler verify, now that gnulib module is smarter. --- As pointed out here: https://www.redhat.com/archives/libvir-list/2011-August/msg01348.html src/util/util.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/util/util.h b/src/util/util.h index 6e6265f..908ba7b 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -202,7 +202,7 @@ const char *virEnumToString(const char *const*types, # define VIR_ENUM_IMPL(name, lastVal, ...) \ static const char *const name ## TypeList[] = { __VA_ARGS__ }; \ - extern int (* name ## Verify (void)) [verify_true (ARRAY_CARDINALITY(name ## TypeList) == lastVal)]; \ + verify(ARRAY_CARDINALITY(name ## TypeList) == lastVal); \ const char *name ## TypeToString(int type) { \ return virEnumToString(name ## TypeList, \ ARRAY_CARDINALITY(name ## TypeList), \ -- 1.7.4.4

2 2

[libvirt] [PATCH 0/6] Use fd: protocol for migration
by Jiri Denemark 31 Aug '11

31 Aug '11

Since qemu doesn't give us any reasonable errors when migration fails because of connection issues, we now create a connection to destination qemu ourselves and just pass the created socket to qemu. Daniel P. Berrange (1): Add API for duplicating a socket/client file descriptor Jiri Denemark (5): Add backlog parameter to virNetSocketListen Support changing UNIX socket owner in virNetSocketNewListenUNIX qemu: Refactor do{Tunnel,Native}Migrate functions qemu: Use virNetSocket for tunneled migration qemu: Use fd: protocol for migration src/qemu/qemu_migration.c | 541 +++++++++++++++++++++-------------------- src/rpc/virnetclient.c | 20 ++ src/rpc/virnetclient.h | 3 + src/rpc/virnetserverservice.c | 6 +- src/rpc/virnetsocket.c | 29 ++- src/rpc/virnetsocket.h | 5 +- tests/virnetsockettest.c | 10 +- 7 files changed, 336 insertions(+), 278 deletions(-) -- 1.7.6

3 27

[libvirt] [PATCH v2 0/5] Virtual interface link state modification
by Peter Krempa 30 Aug '11

30 Aug '11

This patchset adds the ability for libvirt users to control interface link state of the virtual network devices provided by hypervisors. Modification of the link state is accomplished by adding a new XML element <link state"up"> or "down" to the domain XML. The corresponding network interface is thereafter initialised with the desired state. Live modification of the link state is achieved by calling virDomainUpdateDeviceFlags containing a modified interface configuration. Yet, users may modify only link state of an interface. This feature allows propagation of network topology changes to guests, testing scenarios in complex virtual networks, etc ... Future upgrade: - add support for VirtualBox Modifications to v1: - use virUpdateDeviceFlags instead of dedicated API - incorporate helpful comments by Eric Blake https://bugzilla.redhat.com/show_bug.cgi?id=643373 Peter Krempa (5): link-state: util: Add equality comparision functions for structures link-state: conf: Add element to XML for controling link state link-state: qemu: Add monitor handling for link state modification link-state: qemu: Add net intf modification to virUpdateDeviceFlags link-state: virsh: Add wrapper commands for changing link state docs/formatdomain.html.in | 21 +++ docs/schemas/domain.rng | 11 ++ src/conf/domain_conf.c | 24 ++++ src/conf/domain_conf.h | 11 ++ src/qemu/qemu_driver.c | 24 ++++ src/qemu/qemu_hotplug.c | 176 ++++++++++++++++++++++++++ src/qemu/qemu_hotplug.h | 8 ++ src/qemu/qemu_monitor.c | 19 +++ src/qemu/qemu_monitor.h | 4 + src/qemu/qemu_monitor_json.c | 23 ++++ src/qemu/qemu_monitor_json.h | 4 + src/qemu/qemu_monitor_text.c | 46 +++++++ src/qemu/qemu_monitor_text.h | 4 + src/qemu/qemu_process.c | 47 +++++++- src/util/network.c | 62 +++++++++ src/util/network.h | 5 + tools/virsh.c | 286 ++++++++++++++++++++++++++++++++++++++++++ tools/virsh.pod | 11 ++ 18 files changed, 785 insertions(+), 1 deletions(-) -- 1.7.3.4

1 5

[libvirt] Could Libvirt detect the guest's media change and report it?
by Wayne Xia 30 Aug '11

30 Aug '11

There is some request in the management of VMs: If a guest OS give a "eject" command to reject its media, could this action be reported by libvirt? Is this possible or is there any plan to enable this in libvirt? -- Best Regards Wayne Xia mail:xiawenc@linux.vnet.ibm.com tel:86-010-82450803

2 1