- Devel - libvirt List Archives

[libvirt] [PROPOSED PATCH] Change the creation of the TAP interface for generic ethernet interfaces
by Tyler Coumbes 09 Jul '11

09 Jul '11

Currently with libvirt and qemu/kvm to use the generic ethernet interface you have to use the workarounds listed in http://fedoraproject.org/wiki/How_to_debug_Virtualization_problems#Errors_u… . This is required since the current method relies on qemu to create the TAP interface. This was reported in the past as https://bugzilla.redhat.com/show_bug.cgi?id=593903 , https://bugzilla.redhat.com/show_bug.cgi?id=593903 and https://bugzilla.redhat.com/show_bug.cgi?id=559154 . The tickets were closed with the work around stated as the fix. I have created a patch to fix the issue above and avoid the work around from the Fedora wiki requiring qemu to run as root, clear_emulator_capabilities = 1 to be set in qemu.conf, and to put SELinux into permissive mode. All three are required on Fedora 15 for a generic ethernet interface to work. This work around places the host and guests in a much more vulnerable state. I have written this against the version that ships with Fedora 15 (libvirt-0.8.8). I looked at the latest code and it appears not much has changed and I should be able to clean up the patch and apply it to the trunk. If there is interest I will clean up the patch and submit it to the list for review. The code changes it so that the TAP interface is created by libvirt and then the file descriptor is passed to qemu. Much like what is done when using bridged networking. This is done using fd= instead of ifname= just like with the bridged networking. The script= parameter is not supported with fd= so I will assume the old method will still need to be supported for backwards compatibility. What would be the best way to implement the config xml? I have not changed any xml config code yet and am looking for input on the best method. A couple of options I can think of are below. Current example which uses ifname= listed for reference (http://libvirt.org/formatdomain.html#elementsNICSEthernet) <interface type='ethernet'> <target dev='tap0'/> <script path='/etc/qemu-ifup'/> </interface> Option 1: Proposed change would be that if there is no script parameter it is assumed that fd= is used instead of ifname= and if script= is present then use ifname= Would use fd= after the patch. <interface type='ethernet'> <target dev='tap0'/> </interface> Would use ifname= after patch since it has a script= parameter. If a script parameter is needed the work around would still need to be in place. <interface type='ethernet'> <target dev='tap0'/> <script path='/etc/qemu-ifup'/> </interface> Option 2: Adding a mode parameter to the <target /> tag. mode could be either fd or ifname. If the mode is ifname then <script path=''/> would be valid. If the mode is left off and there is no script parameter than I would propose that fd= be used. If that would be an issue then ifname= could be used if the mode parameter is left off. <interface type='ethernet'> <target dev='tap0' mode='fd'/> </interface> Option 3: Something completely different then above ;-) I like option 1 unless anyone sees an issue with that method. For example this would allow for use of openvswitch with libvirt and I am sure other types of setups while still leaving sVirt enabled. I have tested a patched libvirt with an openvswitch setup. You create the TAP interface with libvirt in this manner and then add those TAP interfaces to openvswitch assigning VLANs and other attributes as needed. I am not proposing this as the long term supported method for openvswitch integration, but this allows for much more flexible networking with out sacrificing security or backwards compatibility. Thanks, Tyler Coumbes

2 1

[libvirt] Fwd: Re: [virt-tools-list] virtinst-0.500.6 question, clean build environment issues
by Jason Helfman 09 Jul '11

09 Jul '11

Any help from the authors on this one? Thanks! Jason -- Jason Helfman System Administrator experts-exchange.com http://www.experts-exchange.com/M_4830110.html E4AD 7CF1 1396 27F6 79DD 4342 5E92 AD66 8C8C FBA5

1 0

[libvirt] [PATCH] sanlock: avoid lockspace setup when auto_disk_lease is off
by Federico Simoncelli 09 Jul '11

09 Jul '11

When auto_disk_lease is off we should avoid the automatic lockspace creation. Signed-off-by: Federico Simoncelli <fsimonce(a)redhat.com> --- src/locking/lock_driver_sanlock.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c index cd2bbb5..29d4176 100644 --- a/src/locking/lock_driver_sanlock.c +++ b/src/locking/lock_driver_sanlock.c @@ -294,8 +294,10 @@ static int virLockManagerSanlockInit(unsigned int version, goto error; } - if (virLockManagerSanlockSetupLockspace() < 0) - goto error; + if (driver->autoDiskLease) { + if (virLockManagerSanlockSetupLockspace() < 0) + goto error; + } return 0; -- 1.7.1

2 1

[libvirt] [PATCH 2/2] qemu: clean up OOM checks
by Michael Santos 09 Jul '11

09 Jul '11

--- src/qemu/qemu_command.c | 40 ++++++++++++++++++++-------------------- 1 files changed, 20 insertions(+), 20 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 6e4480e..19151ce 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -5712,6 +5712,9 @@ qemuParseCommandLineCPU(virDomainDefPtr dom, else feature = strdup(p); + if (!feature) + goto no_memory; + ret = virCPUDefAddFeature(cpu, feature, policy); VIR_FREE(feature); if (ret < 0) @@ -6028,6 +6031,8 @@ virDomainDefPtr qemuParseCommandLine(virCapsPtr caps, if (STREQ(arg, "-cdrom")) { disk->device = VIR_DOMAIN_DISK_DEVICE_CDROM; disk->dst = strdup("hdc"); + if (!disk->dst) + goto no_memory; disk->readonly = 1; } else { if (STRPREFIX(arg, "-fd")) { @@ -6041,8 +6046,12 @@ virDomainDefPtr qemuParseCommandLine(virCapsPtr caps, disk->bus = VIR_DOMAIN_DISK_BUS_SCSI; } disk->dst = strdup(arg + 1); + if (!disk->dst) + goto no_memory; } disk->src = strdup(val); + if (!disk->src) + goto no_memory; if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK) { char *host, *port; @@ -6058,17 +6067,14 @@ virDomainDefPtr qemuParseCommandLine(virCapsPtr caps, goto error; } *port++ = '\0'; - if (VIR_ALLOC(disk->hosts) < 0) { - virReportOOMError(); - goto error; - } + if (VIR_ALLOC(disk->hosts) < 0) + goto no_memory; disk->nhosts = 1; disk->hosts->name = host; disk->hosts->port = strdup(port); - if (!disk->hosts->port) { - virReportOOMError(); - goto error; - } + if (!disk->hosts->port) + goto no_memory; + VIR_FREE(disk->src); disk->src = NULL; break; case VIR_DOMAIN_DISK_PROTOCOL_RBD: @@ -6088,22 +6094,16 @@ virDomainDefPtr qemuParseCommandLine(virCapsPtr caps, goto error; } *vdi++ = '\0'; - if (VIR_ALLOC(disk->hosts) < 0) { - virReportOOMError(); - goto error; - } + if (VIR_ALLOC(disk->hosts) < 0) + goto no_memory; disk->nhosts = 1; disk->hosts->name = disk->src; disk->hosts->port = strdup(port); - if (!disk->hosts->port) { - virReportOOMError(); - goto error; - } + if (!disk->hosts->port) + goto no_memory; disk->src = strdup(vdi); - if (!disk->src) { - virReportOOMError(); - goto error; - } + if (!disk->src) + goto no_memory; } break; } -- 1.7.0.4

2 1

[libvirt] [PATCH 1/2] qemu: return error condition
by Michael Santos 09 Jul '11

09 Jul '11

--- src/qemu/qemu_bridge_filter.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_bridge_filter.c b/src/qemu/qemu_bridge_filter.c index f700631..03ed284 100644 --- a/src/qemu/qemu_bridge_filter.c +++ b/src/qemu/qemu_bridge_filter.c @@ -78,6 +78,7 @@ networkAllowMacOnPort(struct qemud_driver *driver, virReportSystemError(err, _("failed to add ebtables rule to allow routing to '%s'"), ifname); + return err; } return 0; @@ -99,6 +100,7 @@ networkDisallowMacOnPort(struct qemud_driver *driver, virReportSystemError(err, _("failed to add ebtables rule to allow routing to '%s'"), ifname); + return err; } return 0; -- 1.7.0.4

2 1

[libvirt] [PATCH v4] graphics: add support for action_if_connected in qemu
by Michal Privoznik 09 Jul '11

09 Jul '11

This option accepts 3 values: -keep, to keep current client connected (Spice+VNC) -disconnect, to disconnect client (Spice) -fail, to fail setting password if there is a client connected (Spice) --- diff to v3: -rebase to current HEAD & resend diff to v2: -fixed typo -added test. However, functionality provided by this patch will show up only when talking to qemu monitor (set_password command). diff to v1: -Eric's review suggestions included -update 'Since' docs/formatdomain.html.in | 13 +++++- docs/schemas/domain.rng | 16 +++++++ src/conf/domain_conf.c | 44 ++++++++++++++++++- src/conf/domain_conf.h | 11 +++++ src/libvirt_private.syms | 2 + src/qemu/qemu_hotplug.c | 15 +++++- .../qemuxml2argv-graphics-spice-timeout.xml | 2 +- 7 files changed, 94 insertions(+), 9 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 3a64983..ad15c35 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1878,7 +1878,11 @@ qemu-kvm -net nic,model=? /dev/null in clear text. The <code>keymap</code> attribute specifies the keymap to use. It is possible to set a limit on the validity of the password be giving an timestamp <code>passwdValidTo='2010-04-09T15:51:00'</code> - assumed to be in UTC. NB, this may not be supported by all hypervisors.<br/> + assumed to be in UTC. <span class="since">Since 0.8.5</span> + The <code>connected</code> attribute allows control of connected client + during password changes. VNC accepts <code>keep</code> value only. + <span class="since">since 0.9.4</span> + NB, this may not be supported by all hypervisors.<br/> <br/> Rather than using listen/port, QEMU supports a <code>socket</code> attribute for listening on a unix domain socket path. @@ -1897,7 +1901,12 @@ qemu-kvm -net nic,model=? /dev/null in clear text. The <code>keymap</code> attribute specifies the keymap to use. It is possible to set a limit on the validity of the password be giving an timestamp <code>passwdValidTo='2010-04-09T15:51:00'</code> - assumed to be in UTC. NB, this may not be supported by all hypervisors. + assumed to be in UTC. <span class="since">Since 0.8.5</span> + The <code>connected</code> attribute allows control of connected client + during password changes. SPICE accepts <code>keep</code> to keep client + connected, <code>disconnect</code> to disconnect client and + <code>fail</code> to fail changing password. <span class="since">Since 0.9.4</span> + NB, this may not be supported by all hypervisors. <span class="since">"spice" since 0.8.6</span>. </p> <p> diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index 891662d..241dda5 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -1284,6 +1284,13 @@ <data type="dateTime"/> </attribute> </optional> + <optional> + <attribute name="connected"> + <choice> + <value>keep</value> + </choice> + </attribute> + </optional> </group> <group> <attribute name="type"> @@ -1327,6 +1334,15 @@ <data type="dateTime"/> </attribute> </optional> + <optional> + <attribute name="connected"> + <choice> + <value>fail</value> + <value>disconnect</value> + <value>keep</value> + </choice> + </attribute> + </optional> <interleave> <zeroOrMore> <element name="channel"> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index f9bf51e..c44d64a 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -317,6 +317,13 @@ VIR_ENUM_IMPL(virDomainGraphics, VIR_DOMAIN_GRAPHICS_TYPE_LAST, "desktop", "spice") +VIR_ENUM_IMPL(virDomainGraphicsAuthConnected, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_LAST, + "default", + "fail", + "disconnect", + "keep") + VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelName, VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST, "main", @@ -3942,9 +3949,12 @@ error: static int -virDomainGraphicsAuthDefParseXML(xmlNodePtr node, virDomainGraphicsAuthDefPtr def) +virDomainGraphicsAuthDefParseXML(xmlNodePtr node, + virDomainGraphicsAuthDefPtr def, + int type) { char *validTo = NULL; + char *connected = virXMLPropString(node, "connected"); def->passwd = virXMLPropString(node, "passwd"); @@ -3985,6 +3995,28 @@ virDomainGraphicsAuthDefParseXML(xmlNodePtr node, virDomainGraphicsAuthDefPtr de def->expires = 1; } + if (connected) { + int action = virDomainGraphicsAuthConnectedTypeFromString(connected); + if (action <= 0) { + virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unknown connected value %s"), + connected); + VIR_FREE(connected); + return -1; + } + VIR_FREE(connected); + + /* VNC supports connected='keep' only */ + if (type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && + action != VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_KEEP) { + virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("VNC supports connected='keep' only")); + return -1; + } + + def->connected = action; + } + return 0; } @@ -4054,7 +4086,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node, int flags) { !def->data.vnc.listenAddr[0]) VIR_FREE(def->data.vnc.listenAddr); - if (virDomainGraphicsAuthDefParseXML(node, &def->data.vnc.auth) < 0) + if (virDomainGraphicsAuthDefParseXML(node, &def->data.vnc.auth, + def->type) < 0) goto error; } else if (def->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) { char *fullscreen = virXMLPropString(node, "fullscreen"); @@ -4190,7 +4223,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node, int flags) { !def->data.spice.listenAddr[0]) VIR_FREE(def->data.spice.listenAddr); - if (virDomainGraphicsAuthDefParseXML(node, &def->data.spice.auth) < 0) + if (virDomainGraphicsAuthDefParseXML(node, &def->data.spice.auth, + def->type) < 0) goto error; cur = node->children; @@ -9231,6 +9265,10 @@ virDomainGraphicsAuthDefFormatAttr(virBufferPtr buf, strftime(strbuf, sizeof(strbuf), "%Y-%m-%dT%H:%M:%S", tm); virBufferAsprintf(buf, " passwdValidTo='%s'", strbuf); } + + if (def->connected) + virBufferEscapeString(buf, " connected='%s'", + virDomainGraphicsAuthConnectedTypeToString(def->connected)); } static int diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index e81977c..bff1c53 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -639,12 +639,22 @@ enum virDomainGraphicsType { VIR_DOMAIN_GRAPHICS_TYPE_LAST, }; +enum virDomainGraphicsAuthConnectedType { + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_DEFAULT = 0, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_FAIL, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_DISCONNECT, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_KEEP, + + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_LAST +}; + typedef struct _virDomainGraphicsAuthDef virDomainGraphicsAuthDef; typedef virDomainGraphicsAuthDef *virDomainGraphicsAuthDefPtr; struct _virDomainGraphicsAuthDef { char *passwd; unsigned int expires: 1; /* Whether there is an expiry time set */ time_t validTo; /* seconds since epoch */ + int connected; /* action if connected */ }; enum virDomainGraphicsSpiceChannelName { @@ -1579,6 +1589,7 @@ VIR_ENUM_DECL(virDomainHostdevSubsys) VIR_ENUM_DECL(virDomainInput) VIR_ENUM_DECL(virDomainInputBus) VIR_ENUM_DECL(virDomainGraphics) +VIR_ENUM_DECL(virDomainGraphicsAuthConnected) VIR_ENUM_DECL(virDomainGraphicsSpiceChannelName) VIR_ENUM_DECL(virDomainGraphicsSpiceChannelMode) VIR_ENUM_DECL(virDomainGraphicsSpiceImageCompression) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 626ac6c..89aeac9 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -270,6 +270,8 @@ virDomainFindByID; virDomainFindByName; virDomainFindByUUID; virDomainGetRootFilesystem; +virDomainGraphicsAuthConnectedTypeFromString; +virDomainGraphicsAuthConnectedTypeToString; virDomainGraphicsDefFree; virDomainGraphicsSpiceChannelModeTypeFromString; virDomainGraphicsSpiceChannelModeTypeToString; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index a7f11ab..58689f6 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1065,10 +1065,12 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, return -1; } - /* If a password lifetime was, or is set, then we must always run, - * even if new password matches old password */ + /* If a password lifetime was, or is set, or action if connected has + * changed, then we must always run, even if new password matches + * old password */ if (olddev->data.vnc.auth.expires || dev->data.vnc.auth.expires || + olddev->data.vnc.auth.connected != dev->data.vnc.auth.connected || STRNEQ_NULLABLE(olddev->data.vnc.auth.passwd, dev->data.vnc.auth.passwd)) { VIR_DEBUG("Updating password on VNC server %p %p", @@ -1084,6 +1086,7 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, dev->data.vnc.auth.passwd = NULL; olddev->data.vnc.auth.validTo = dev->data.vnc.auth.validTo; olddev->data.vnc.auth.expires = dev->data.vnc.auth.expires; + olddev->data.vnc.auth.connected = dev->data.vnc.auth.connected; } else { ret = 0; } @@ -1116,6 +1119,7 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, * even if new password matches old password */ if (olddev->data.spice.auth.expires || dev->data.spice.auth.expires || + olddev->data.spice.auth.connected != dev->data.spice.auth.connected || STRNEQ_NULLABLE(olddev->data.spice.auth.passwd, dev->data.spice.auth.passwd)) { VIR_DEBUG("Updating password on SPICE server %p %p", @@ -1131,6 +1135,7 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, dev->data.spice.auth.passwd = NULL; olddev->data.spice.auth.validTo = dev->data.spice.auth.validTo; olddev->data.spice.auth.expires = dev->data.spice.auth.expires; + olddev->data.spice.auth.connected = dev->data.spice.auth.connected; } else { VIR_DEBUG("Not updating since password didn't change"); ret = 0; @@ -1874,16 +1879,20 @@ qemuDomainChangeGraphicsPasswords(struct qemud_driver *driver, qemuDomainObjPrivatePtr priv = vm->privateData; time_t now = time(NULL); char expire_time [64]; + const char *connected = NULL; int ret; if (!auth->passwd && !driver->vncPassword) return 0; + if (auth->connected) + connected = virDomainGraphicsAuthConnectedTypeToString(auth->connected); + qemuDomainObjEnterMonitorWithDriver(driver, vm); ret = qemuMonitorSetPassword(priv->mon, type, auth->passwd ? auth->passwd : defaultPasswd, - NULL); + connected); if (ret == -2) { if (type != VIR_DOMAIN_GRAPHICS_TYPE_VNC) { diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml index 4c0c57e..6389de5 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml @@ -71,7 +71,7 @@ </console> <input type='tablet' bus='usb'/> <input type='mouse' bus='ps2'/> - <graphics type='spice' port='5900' autoport='no' passwd='sercet' passwdValidTo='2011-05-31T16:11:22'/> + <graphics type='spice' port='5900' autoport='no' passwd='sercet' passwdValidTo='2011-05-31T16:11:22' connected='disconnect'/> <sound model='ac97'> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </sound> -- 1.7.5.rc3

2 4

[libvirt] [PATCH 0/5] Fix misc problems in the RPC code
by Daniel P. Berrange 08 Jul '11

08 Jul '11

This series of patches fixes a couple of memory leaks, one crash and a missing reply to the final RPC message on a connection being closed

2 10

[libvirt] [PATCH] Fix mistaken order of server cert/key parameters in constructor
by Daniel P. Berrange 08 Jul '11

08 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> The virNetTLSContextNew was being passed key/cert parameters in the wrong order. This wasn't immediately visible because if virNetTLSContextNewPath was used, a second bug reversed the order of those parameters again. Only if the paths were manually specified in /etc/libvirt/libvirtd.conf did the bug appear * src/rpc/virnettlscontext.c: Fix order of params passed to virNetTLSContextNew --- src/rpc/virnettlscontext.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index ad8e2dc..1120e1e 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -396,10 +396,10 @@ static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath, virNetTLSContextPtr ctxt = NULL; if (virNetTLSContextLocateCredentials(pkipath, tryUserPkiPath, isServer, - &cacert, &cacrl, &key, &cert) < 0) + &cacert, &cacrl, &cert, &key) < 0) return NULL; - ctxt = virNetTLSContextNew(cacert, cacrl, key, cert, + ctxt = virNetTLSContextNew(cacert, cacrl, cert, key, x509dnWhitelist, requireValidCert, isServer); VIR_FREE(cacert); @@ -435,7 +435,7 @@ virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert, const char *const*x509dnWhitelist, bool requireValidCert) { - return virNetTLSContextNew(cacert, cacrl, key, cert, + return virNetTLSContextNew(cacert, cacrl, cert, key, x509dnWhitelist, requireValidCert, true); } -- 1.7.6

2 1

[libvirt] [PATCH] util: Don't try to fchown files opened as non-root
by Jiri Denemark 08 Jul '11

08 Jul '11

When virFileOpenAs is called with VIR_FILE_OPEN_AS_UID flag and uid/gid different from root/root while libvirtd is running as root, we fork a new child, change its effective UID/GID to uid/gid and run virFileOpenAsNoFork. It doesn't make any sense to fchown() the opened file in this case since we already know that uid/gid can access the file when open succeeds and one of the following situations may happen: - the file is already owned by uid/gid and we skip fchown even before this patch - the file is owned by uid but not gid because it was created in a directory with SETGID set, in which case it is desirable not to change the group - the file may be owned by a completely different user and/or group because it was created on a root-squashed or even all-squashed NFS filesystem, in which case fchown would most likely fail anyway --- src/util/util.c | 31 +++++++++++++++++++------------ 1 files changed, 19 insertions(+), 12 deletions(-) diff --git a/src/util/util.c b/src/util/util.c index 3d0ceea..8ff25da 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -652,7 +652,6 @@ virFileOpenAsNoFork(const char *path, int openflags, mode_t mode, { int fd = -1; int ret = 0; - struct stat st; if ((fd = open(path, openflags, mode)) < 0) { ret = -errno; @@ -660,18 +659,25 @@ virFileOpenAsNoFork(const char *path, int openflags, mode_t mode, path); goto error; } - if (fstat(fd, &st) == -1) { - ret = -errno; - virReportSystemError(errno, _("stat of '%s' failed"), path); - goto error; - } - if (((st.st_uid != uid) || (st.st_gid != gid)) - && (fchown(fd, uid, gid) < 0)) { - ret = -errno; - virReportSystemError(errno, _("cannot chown '%s' to (%u, %u)"), - path, (unsigned int) uid, (unsigned int) gid); - goto error; + + /* VIR_FILE_OPEN_AS_UID in flags means we are running in a child process + * owned by uid and gid */ + if (!(flags & VIR_FILE_OPEN_AS_UID)) { + struct stat st; + if (fstat(fd, &st) == -1) { + ret = -errno; + virReportSystemError(errno, _("stat of '%s' failed"), path); + goto error; + } + if (((st.st_uid != uid) || (st.st_gid != gid)) + && (fchown(fd, uid, gid) < 0)) { + ret = -errno; + virReportSystemError(errno, _("cannot chown '%s' to (%u, %u)"), + path, (unsigned int) uid, (unsigned int) gid); + goto error; + } } + if ((flags & VIR_FILE_OPEN_FORCE_PERMS) && (fchmod(fd, mode) < 0)) { ret = -errno; @@ -757,6 +763,7 @@ virFileOpenAs(const char *path, int openflags, mode_t mode, if ((!(flags & VIR_FILE_OPEN_AS_UID)) || (getuid() != 0) || ((uid == 0) && (gid == 0))) { + flags &= ~VIR_FILE_OPEN_AS_UID; return virFileOpenAsNoFork(path, openflags, mode, uid, gid, flags); } -- 1.7.6

2 2

[libvirt] [PATCH] qemu: Don't chown files on NFS share if dynamic_ownership is off
by Michal Privoznik 08 Jul '11

08 Jul '11

When dynamic ownership is disabled we don't want to chown any files, not just local. --- src/qemu/qemu_driver.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 52b7dfd..968865f 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -2163,11 +2163,10 @@ static int qemudDomainSaveFlag(struct qemud_driver *driver, virDomainPtr dom, is_reg = true; } else { is_reg = !!S_ISREG(sb.st_mode); - /* If the path is regular local file which exists + /* If the path is regular file which exists * already and dynamic_ownership is off, we don't * want to change it's ownership, just open it as-is */ - if (is_reg && !driver->dynamicOwnership && - virStorageFileIsSharedFS(path) == 0) { + if (is_reg && !driver->dynamicOwnership) { uid=sb.st_uid; gid=sb.st_gid; } -- 1.7.5.rc3

3 4