- Devel - libvirt List Archives

[libvirt] On shutdown Destroy/Delete
by Stefan de Konink 20 Aug '08

20 Aug '08

Hi, I would really like to know how I can make a defined domain *gone* after shutdown :) (instead of it still be defined, after shutdown) Stefan

4 5

[libvirt] Use existing QEMU image with libvirt?
by Jun Koi 19 Aug '08

19 Aug '08

Hi, I have some existing QEMU images. Now I want to use it with libvirt/virsh. Is there any easy way to do that? I suppose that we need an XML file for each image, but dont want to craft them from scratch. Thanks, Jun

2 1

[libvirt] PATCH: Improve some remote driver error messages
by Daniel P. Berrange 19 Aug '08

19 Aug '08

Bug reports from users have shown diagnosing problems with the remote driver are quite tricky, so I've been looking at improving its error messages where possible. There's a number of places where we simply pass in strerror(errno) as the only data in virRaiseError. This doesn't let us narrow down just which call failed - we just get a generic message "Permission denied" or "Connection refused" with no clue what was being tried. This patch adds descriptive error messages whereever possible, fixes a place where we'd report an error to connect to IPv4 even if IPv6 succeeded, and adds some missing translations Before $ virsh --connect qemu:///system libvir: Remote error : Permission denied $ virsh --connect qemu+tcp:///system libvir: Remote error : Connection refused $ virsh --connect qemu+tcp://wibble/system libvir: Remote error : invalid argument in Name or service not known After $ ./src/virsh --connect qemu:///system libvir: Remote error : unable to connect to '/var/run/libvirt/libvirt-sock': Permission denied $ ./src/virsh --connect qemu+tcp:///system libvir: Remote error : unable to connect to 'localhost': Connection refused $ ./src/virsh --connect qemu+tcp://wibble/system libvir: Remote error : unable to resolve hostname 'wibble': Name or service not known Daniel Index: src/remote_internal.c =================================================================== RCS file: /data/cvs/libvirt/src/remote_internal.c,v retrieving revision 1.80 diff -u -r1.80 remote_internal.c --- src/remote_internal.c 26 Jun 2008 09:37:51 -0000 1.80 +++ src/remote_internal.c 19 Aug 2008 10:36:32 -0000 @@ -371,13 +371,12 @@ priv->hostname = strdup (uri->server ? uri->server : "localhost"); - if (!priv->hostname) { - error (NULL, VIR_ERR_NO_MEMORY, _("allocating priv->hostname")); - goto failed; - } + if (!priv->hostname) + goto out_of_memory; if (uri->user) { username = strdup (uri->user); - if (!username) goto out_of_memory; + if (!username) + goto out_of_memory; } /* Get the variables from the query string. @@ -491,12 +490,15 @@ // http://people.redhat.com/drepper/userapi-ipv6.html struct addrinfo *res, *r; struct addrinfo hints; + int saved_errno = EINVAL; memset (&hints, 0, sizeof hints); hints.ai_socktype = SOCK_STREAM; hints.ai_flags = AI_ADDRCONFIG; int e = getaddrinfo (priv->hostname, port, &hints, &res); if (e != 0) { - error (conn, VIR_ERR_INVALID_ARG, gai_strerror (e)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to resolve hostname '%s': %s"), + priv->hostname, gai_strerror (e)); goto failed; } @@ -516,7 +518,7 @@ priv->sock = socket (r->ai_family, SOCK_STREAM, 0); if (priv->sock == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (socket_errno ())); + saved_errno = socket_errno(); continue; } @@ -526,7 +528,7 @@ sizeof no_slow_start); if (connect (priv->sock, r->ai_addr, r->ai_addrlen) == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (socket_errno ())); + saved_errno = socket_errno(); close (priv->sock); continue; } @@ -545,6 +547,9 @@ } freeaddrinfo (res); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to connect to '%s': %s"), + priv->hostname, strerror (saved_errno)); goto failed; tcp_connected: @@ -563,23 +568,23 @@ uid_t uid = getuid(); if (!(pw = getpwuid(uid))) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to lookup user '%d': %s"), + uid, strerror (errno)); goto failed; } if (asprintf (&sockname, "@%s" LIBVIRTD_USER_UNIX_SOCKET, pw->pw_dir) < 0) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; + sockname = NULL; + goto out_of_memory; } } else { if (flags & VIR_DRV_OPEN_REMOTE_RO) sockname = strdup (LIBVIRTD_PRIV_UNIX_SOCKET_RO); else sockname = strdup (LIBVIRTD_PRIV_UNIX_SOCKET); - if (sockname == NULL) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; - } + if (sockname == NULL) + goto out_of_memory; } } @@ -598,7 +603,9 @@ autostart_retry: priv->sock = socket (AF_UNIX, SOCK_STREAM, 0); if (priv->sock == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to create socket %s"), + strerror (errno)); goto failed; } if (connect (priv->sock, (struct sockaddr *) &addr, sizeof addr) == -1) { @@ -620,7 +627,9 @@ goto autostart_retry; } } - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to connect to '%s': %s"), + sockname, strerror (errno)); goto failed; } @@ -634,17 +643,13 @@ if (no_tty) nr_args += 5; /* For -T -o BatchMode=yes -e none */ command = command ? : strdup ("ssh"); - if (command == NULL) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; - } + if (command == NULL) + goto out_of_memory; // Generate the final command argv[] array. // ssh -p $port [-l $username] $hostname $netcat -U $sockname [NULL] - if (VIR_ALLOC_N(cmd_argv, nr_args) < 0) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; - } + if (VIR_ALLOC_N(cmd_argv, nr_args) < 0) + goto out_of_memory; j = 0; cmd_argv[j++] = strdup (command); @@ -667,12 +672,9 @@ cmd_argv[j++] = strdup (sockname ? sockname : LIBVIRTD_PRIV_UNIX_SOCKET); cmd_argv[j++] = 0; assert (j == nr_args); - for (j = 0; j < (nr_args-1); j++) { - if (cmd_argv[j] == NULL) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (ENOMEM)); - goto failed; - } - } + for (j = 0; j < (nr_args-1); j++) + if (cmd_argv[j] == NULL) + goto out_of_memory; } /*FALLTHROUGH*/ @@ -685,28 +687,38 @@ * to faff around with two file descriptors (a la 'pipe(2)'). */ if (socketpair (PF_UNIX, SOCK_STREAM, 0, sv) == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to create socket pair %s"), + strerror (errno)); goto failed; } pid = fork (); if (pid == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to fork external network transport: %s"), + strerror (errno)); goto failed; } else if (pid == 0) { /* Child. */ close (sv[0]); // Connect socket (sv[1]) to stdin/stdout. close (0); - if (dup (sv[1]) == -1) perror ("dup"); + if (dup (sv[1]) == -1) { + perror ("dup"); + _exit(1); + } close (1); - if (dup (sv[1]) == -1) perror ("dup"); + if (dup (sv[1]) == -1) { + perror ("dup"); + _exit(1); + } close (sv[1]); // Run the external process. if (!cmd_argv) { if (VIR_ALLOC_N(cmd_argv, 2) < 0) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; + perror("malloc"); + _exit(1); } cmd_argv[0] = command; cmd_argv[1] = 0; @@ -770,7 +782,7 @@ return retcode; out_of_memory: - error (NULL, VIR_ERR_NO_MEMORY, _("uri params")); + error (conn, VIR_ERR_NO_MEMORY, NULL); failed: /* Close the socket if we failed. */ @@ -882,10 +894,9 @@ { struct stat sb; if (stat(file, &sb) < 0) { - __virRaiseError (conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, - VIR_ERR_ERROR, LIBVIRT_CACERT, NULL, NULL, 0, 0, - _("Cannot access %s '%s': %s (%d)"), - type, file, strerror(errno), errno); + errorf(conn, VIR_ERR_RPC, + _("Cannot access %s '%s': %s (%d)"), + type, file, strerror(errno), errno); return -1; } return 0; @@ -905,7 +916,9 @@ /* X509 stuff */ err = gnutls_certificate_allocate_credentials (&x509_cred); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to allocate TLS credentials: %s"), + gnutls_strerror (err)); return -1; } @@ -923,7 +936,9 @@ gnutls_certificate_set_x509_trust_file (x509_cred, LIBVIRT_CACERT, GNUTLS_X509_FMT_PEM); if (err < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to load CA certificate: %s"), + gnutls_strerror (err)); return -1; } @@ -936,7 +951,9 @@ LIBVIRT_CLIENTKEY, GNUTLS_X509_FMT_PEM); if (err < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to load private key/certificate: %s"), + gnutls_strerror (err)); return -1; } @@ -963,21 +980,27 @@ */ err = gnutls_init (&session, GNUTLS_CLIENT); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to initialize TLS client: %s"), + gnutls_strerror (err)); return NULL; } /* Use default priorities */ err = gnutls_set_default_priority (session); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to set TLS algorithm priority: %s"), + gnutls_strerror (err)); return NULL; } err = gnutls_certificate_type_set_priority (session, cert_type_priority); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to set certificate priority: %s"), + gnutls_strerror (err)); return NULL; } @@ -985,7 +1008,9 @@ */ err = gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to set session credentials: %s"), + gnutls_strerror (err)); return NULL; } @@ -998,7 +1023,9 @@ if (err < 0) { if (err == GNUTLS_E_AGAIN || err == GNUTLS_E_INTERRUPTED) goto again; - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to complete TLS handshake: %s"), + gnutls_strerror (err)); return NULL; } @@ -1018,12 +1045,14 @@ if (len < 0 && len != GNUTLS_E_UNEXPECTED_PACKET_LENGTH) { if (len == GNUTLS_E_AGAIN || len == GNUTLS_E_INTERRUPTED) goto again_2; - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (len)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to complete TLS initialization: %s"), + gnutls_strerror (len)); return NULL; } if (len != 1 || buf[0] != '\1') { error (conn, VIR_ERR_RPC, - _("server verification (of our certificate or IP address) failed\n")); + _("server verification (of our certificate or IP address) failed\n")); return NULL; } @@ -1047,33 +1076,39 @@ time_t now; if ((ret = gnutls_certificate_verify_peers2 (session, &status)) < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (ret)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to verify server certificate: %s"), + gnutls_strerror (ret)); return -1; } if ((now = time(NULL)) == ((time_t)-1)) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("cannot get current time: %s"), + strerror (errno)); return -1; } if (status != 0) { - const char *reason = "Invalid certificate"; + const char *reason = _("Invalid certificate"); if (status & GNUTLS_CERT_INVALID) - reason = "The certificate is not trusted."; + reason = _("The certificate is not trusted."); if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) - reason = "The certificate hasn't got a known issuer."; + reason = _("The certificate hasn't got a known issuer."); if (status & GNUTLS_CERT_REVOKED) - reason = "The certificate has been revoked."; + reason = _("The certificate has been revoked."); #ifndef GNUTLS_1_0_COMPAT if (status & GNUTLS_CERT_INSECURE_ALGORITHM) - reason = "The certificate uses an insecure algorithm"; + reason = _("The certificate uses an insecure algorithm"); #endif - error (conn, VIR_ERR_RPC, reason); + errorf (conn, VIR_ERR_RPC, + _("server certificate failed validation: %s"), + reason); return -1; } @@ -1092,13 +1127,17 @@ ret = gnutls_x509_crt_init (&cert); if (ret < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (ret)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to initialize certificate: %s"), + gnutls_strerror (ret)); return -1; } ret = gnutls_x509_crt_import (cert, &certs[i], GNUTLS_X509_FMT_DER); if (ret < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (ret)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to import certificate: %s"), + gnutls_strerror (ret)); gnutls_x509_crt_deinit (cert); return -1; } @@ -1117,13 +1156,9 @@ if (i == 0) { if (!gnutls_x509_crt_check_hostname (cert, priv->hostname)) { - __virRaiseError - (conn, NULL, NULL, - VIR_FROM_REMOTE, VIR_ERR_RPC, - VIR_ERR_ERROR, priv->hostname, NULL, NULL, - 0, 0, - _("Certificate's owner does not match the hostname (%s)"), - priv->hostname); + errorf(conn, VIR_ERR_RPC, + _("Certificate's owner does not match the hostname (%s)"), + priv->hostname); gnutls_x509_crt_deinit (cert); return -1; } @@ -4721,8 +4756,9 @@ errmsg = __virErrorMsg (code, errorMessage); __virRaiseError (conn, NULL, NULL, VIR_FROM_REMOTE, - code, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, - "%s", errmsg); + code, VIR_ERR_ERROR, + errmsg, errorMessage, NULL, -1, -1, + errmsg, errorMessage); } /* For errors generated on the server side and sent back to us. */ -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

3 2

[libvirt] PATCH: Ensure errors are guarenteed reported in virConnectOpen
by Daniel P. Berrange 19 Aug '08

19 Aug '08

The virConnectOpen method is unfortuantely rather special. While there is a virConnect object available, the current rule is that drivers must report errors against the global error object, because upon failure no virConnect object will be returned to the caller. Unforatunately, despite frequent cleanups of code getting this wrong, I've just audited the remote driver and found another 20 or so places where its wrong. This is clearly not a sustainable approach to error reporting. The guarenteed correct solution is actually rather simple - Always report errors against the virConnect object, even in the driver open method - In the cleanup patch of do_open() in libvirt.c, if no global error is set, copy the error from the virConnect object's virError, into the global virError. With this in place we can change all the drivers back to always report against the error object, and thus cleanup some disgusting code like __virRaiseError (in_open ? NULL : conn, ... To just __virRaiseError (conn, ... Daniel Index: src/libvirt.c =================================================================== RCS file: /data/cvs/libvirt/src/libvirt.c,v retrieving revision 1.151 diff -u -r1.151 libvirt.c --- src/libvirt.c 18 Aug 2008 09:24:46 -0000 1.151 +++ src/libvirt.c 19 Aug 2008 10:29:51 -0000 @@ -735,10 +735,8 @@ name = "xen:///"; ret = virGetConnect(); - if (ret == NULL) { - virLibConnError(NULL, VIR_ERR_NO_MEMORY, _("allocating connection")); + if (ret == NULL) return NULL; - } uri = xmlParseURI (name); if (!uri) { @@ -839,7 +837,21 @@ failed: if (ret->driver) ret->driver->close (ret); if (uri) xmlFreeURI(uri); - virUnrefConnect(ret); + + /* If not global error was set, copy any error set + in the connection object we're about to dispose of */ + if (__lastErr.code == VIR_ERR_OK) { + memcpy(&__lastErr, &ret->err, sizeof(ret->err)); + memset(&ret->err, 0, sizeof(ret->err)); + } + + /* Still no error set, then raise a generic error */ + if (__lastErr.code == VIR_ERR_OK) + virLibConnError (NULL, VIR_ERR_INTERNAL_ERROR, + _("unable to open connection")); + + virUnrefConnect(ret); + return NULL; } -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

4 9

[libvirt] Libvirt XML description
by Dimitrios Kalogeras 19 Aug '08

19 Aug '08

Hi to all of you, I am trying to gather knowledge about the XML DTD of libvirt bu the http://libvirt.org/format.html does not provide any useful info. Can you point me somewhere else ? Cheers, Dimitris -- -- Dimitrios K. Kalogeras Electrical Engineer, Ph.D. Network Engineer NTUA/GR-Net Network Management Center _____________________________________ icq: 11887484 voice: +30-210-772 1863 fax: +30-210-772 1866 e-mail: D.Kalogeras(a)noc.ntua.gr pub 1024D/0E421B50 2007-01-17 [expires: 2008-01-17] Dimitrios Kalogeras (dkalo) <D.Kalogeras(a)noc.ntua.gr> Key fingerprint = F8C8 7B67 74A4 1F82 CDDF 8554 E1EF 7FAE 0E42 1B50 PGP-KEY: http://ajax.noc.ntua.gr/~dkalo/dkalo_pgp.txt

5 5

[libvirt] fail to connect via ssh
by MINAI Katsuhito 19 Aug '08

19 Aug '08

Hi all, I have built libvirt by http://libvirt.org/sources/libvirt-0.4.4.tar.gz on fedora 9 as follows. $ tar zxf libvirt-cvs-snapshot.tar.gz $ cd libvirt-0.4.4 $ ./configure --without-xen $ make However, virsh failed to connect via SSH to remote server. How can I fix the problem? $ ./src/virsh -c xen+ssh://root@server list root@server's password: libvir: Remote error : socket closed unexpectedly error: failed to connect to the hypervisor Thanks, Minai

1 1

[libvirt] [patch] remove duplicate call of virInitialize()
by Nguyen Anh Quynh 18 Aug '08

18 Aug '08

Hi, This patch removes the redundant call to virInitialize() inside __virStateInitialize(). Thanks, Quynh

2 1

[libvirt] virt-install and custom distros
by Kay Williams 15 Aug '08

15 Aug '08

We have an application that builds custom distributions based on RHEL, CentOS or Fedora. We would like to install these over the network using virt-install, but we've run into an issue with the distro check logic. Specifically, virt-install fails unless it finds a string "Red Hat Enterprise Linux", "Fedora" or "CentOS" within the family field of the .treeinfo file. Our application currently sets the family field to the user-provided distro name (see below). We have avoided using the base distro name given trademark concerns. [general] family = <user provided value> variant = <user provided value> We can get virt-install to pass the distro check by setting the family name to one of the accepted values, e.g. [general] family = Fedora variant = [user provided distro name] Is this the expected/desired use for the family and variant fields? Or is there another approach we should consider? Thanks, Kay

2 1

[libvirt] [PATCH] Fix serial console telnet protocol support
by Mark McLoughlin 15 Aug '08

15 Aug '08

With e.g.: <serial type='tcp'> <source mode='bind' host='127.0.0.1' service='4444'/> <protocol type='telnet'/> <target port='0'/> </serial> You currently get: Unknown option: listen qemu: could not open serial device 'telnet:127.0.0.1:4444,listen' With the telnet protocol, qemu expects "server" as an option rather than "listen". Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/qemu_conf.c =================================================================== --- libvirt.orig/src/qemu_conf.c 2008-08-13 18:14:34.000000000 +0100 +++ libvirt/src/qemu_conf.c 2008-08-13 18:35:20.000000000 +0100 @@ -685,12 +685,19 @@ break; case VIR_DOMAIN_CHR_TYPE_TCP: - if (snprintf(buf, buflen, "%s:%s:%s%s", - dev->data.tcp.protocol == VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET ? "telnet" : "tcp", - dev->data.tcp.host, - dev->data.tcp.service, - dev->data.tcp.listen ? ",listen" : "") >= buflen) - return -1; + if (dev->data.tcp.protocol == VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET) { + if (snprintf(buf, buflen, "telnet:%s:%s%s", + dev->data.tcp.host, + dev->data.tcp.service, + dev->data.tcp.listen ? ",server" : "") >= buflen) + return -1; + } else { + if (snprintf(buf, buflen, "tcp:%s:%s%s", + dev->data.tcp.host, + dev->data.tcp.service, + dev->data.tcp.listen ? ",listen" : "") >= buflen) + return -1; + } break; case VIR_DOMAIN_CHR_TYPE_UNIX:

3 4

[libvirt] [ANNOUNCE][RFC] sVirt: Integrating SELinux and Linux-based virtualization
by James Morris 15 Aug '08

15 Aug '08

This is to announce the formation of the sVirt project, which aims to integrate SELinux and Linux-based virtualization (KVM et al). The idea has been discussed a few times over the last year or so, and in recent weeks, a few Fedora folk (such as Dan Walsh, Daniel Berrange and myself) have put together some requirements and had some preliminary technical discussions. The requirements document and initital technical considerations are included below inline for review and discussion. In a nutshell, we'd like to be able to apply distinct security labels to individual VM instances and their resources, so that they can be isolated from each other via MAC policy. We want this to "just work" when configuring and managing VMs via the libvirt toolchain, e.g. provide a simple option during VM creation to make the VM "isolated", and have the toolchain do all the labeling and policy configuration behind the scenes. Greater detail may be found in the requirements document. If you wish to contribute, please reply to this email with any enhancements to the requirements, technical ideas, issues etc. I'd suggest joining the libvir-list (in the to: line) if not already on it, as that is where the integration work is expected to happen. There's also a wiki page: http://selinuxproject.org/page/SVirt ------------------------------------------------------------------------ 11 Aug 2008 sVirt: Integration of SELinux and Linux-based Virtualization Requirements and Design Considerations v1.0 1. Introduction This document establishes a set of functional and technical requirements for integrating SELinux with Linux-based virtualization (i.e. Linux-as-hypervisor schemes such as KVM/Qemu amd lguest). Note that non-Linux hypervisor models such as Xen are not covered explicitly in this document, although may be afforded some MAC coverage due to shared infrastructure (e.g. libvirt). Non-Linux hypervisor models may considered further at a later stage. Also, while this document focuses on SELinux as the MAC scheme, consideration should be given to ensuring support for other label-based MAC schemes. 1.1 Rationale With increased use of virtualization, one security benefit of physically separated systems -- strong isolation -- is reduced, an issue which may be ameliorated with the application of Mandatory Access Control (MAC) security in the host system. Integration of MAC with virtualization will also help increase the overall robustness and security assurance of both host and guest systems. Many threats arising from flaws in the VM environment, or misconfiguration, may be mitigated through tighter isolation and specific MAC policy enforcement. By incorporating MAC support into the virtualization toolchain and documentation, users will also be able to make more use of the MAC security capabilities provided by the OS. 1.2 Use-cases The following use-cases have been identified: o Providing virtualized services with a level of isolation similar to that previously afforded by physical separation. o Increased protection of the host from untrusted VM guests (e.g. for VM hosting providers, grid/cloud servers etc.). o Increased protection of VM guests from each other in the event of host flaws or misconfiguration. Some protection may also be provided against a compromised host. o Consolidating access to multiple networks which require strong isolation from each other (e.g. military, government, corporate extranets, internal "Chinese wall" separation etc.) o Strongly isolating desktop applications by running them in separately labeled VMs (e.g. online banking in one VM and World of Warcraft in another; opening untrusted office documents in an isolated VM for view/print only). o Forensic analysis of disk images, binaries, browser scripts etc. in a highly isolated VM, protecting both the host system and the integrity of the components under analysis. o Isolated test environments, preventing e.g. simulated trades from entering a production system, leakage of sensitive customer data to internal networks etc. o General ability to specify a wide range of high-level security goals for virtualization through flexible MAC policy. 2. Current Situation SELinux is already able to provide general MAC protection to Linux-based virtualization, such as protecting the integrity and confidentiality of disk images and providing strong isolation of Linux hypervisor processes from the rest of the system. There is, however, no explicit support for Linux-based virtualization in SELinux, and all VMs currently run in the same security context. Thus, there is no MAC isolation applied between VMs. 3. Functional Security Requirements 3.1 Strong isolation between active VMs Running different VMs with different MAC labels allows stronger isolation between VMs, reducing risks arising from flaws in or misconfiguration of the VM environment. For example, the threat of a rogue VM exploiting a flaw in KVM could be greatly reduced if it is isolated from other VMs by MAC security policy. 3.2 Improved control over access to VM resources Distinct MAC labeling of resources belonging to VMs (disk images, disk partitions etc.) binds VM instances to those resources, ensuring that VMs can only access their own resources. This can protect the VM from invalid VM resources; and protect VM resources from flawed or misconfigured VMs. 3.3 Improved control over access to shared resources Where VMs may share resources (e.g. miscellaneous devices, virtual networking, read-only disk images etc.), fine-grained MAC policy may be specified to control information flow between VMs. 3.4 Fine-grained interaction with the host With distinct labeling of VMs and their resources, interactions with host entities on a per-VM basis may then be controlled by MAC policy. An example of this would be to safely allow different users on the host to administer different VMs. Configuration of this could be managed via the RBAC scheme integrated with SELinux. 3.5 Coarse MAC containment of VMs High-level security constraints may be applied to different VMs, to allow simplified lock-down of the overall system. For example, a VM may be restricted so that it cannot transmit TCP traffic on port 25 via virtual networking (i.e. the guest cannot be used as a spam bot even if it is compromised via a rootkit). 3.6 Leverage general MAC architecture As MAC is extended to the desktop, it will be possible to apply uniform MAC policy to the OS, desktop and Linux-based virtualization components. This will provide a basis for a variety of sophisticated security applications such as a virtualized MLS desktop with different windows running VMs at different security levels. 4. Design Considerations 4.1 Consensus in preliminary discussion appears to be that adding MAC to libvirt will be the most effective approach. Support may then be extended to virsh, virt-manager, oVirt etc. 4.2 Initially, sVirt should "just work" as a means to isolate VMs, with minimal administrative interaction. e.g. an option is added to virt-manager which allows a VM to be designated as "isolated", and from then on, it is automatically run in a separate security context, with policy etc. being generated and managed by libvirt. 4.3 We need to consider very carefully exactly how VMs will be launched and controlled e.g. overall security ultimately must be enforced by the host kernel, even though VM launch will be initially controlled by host userspace. 4.4 We need to consider overall management of labeling both locally and in distributed environments (e.g. oVirt), as well as situations where VMs may be migrated between systems, backed up etc. One possible approach may be to represent the security label as the UUID of the guest and then translate that to locally meaningful values as needed. 4.5 MAC controls/policy will need to be considered for any control planes (e.g. /dev/kvm). 4.6 We need to ensure that we have high-level management tools available from the start, avoiding past mistakes with SELinux where we dropped a bunch of complicated pieces in the user's lap. All aspects of sVirt must be managed by the via the virt tools and only present high-level abstractions to the user (and then, only if essential). 4.7 As sVirt involves creating and managing arbitrary numbers of security labels, we will need to address the effects of label space explosion and resulting complexity. Possible approaches already discussed include: - SELinux RBAC or IBAC mechanisms. - MCS labels. This has the possible advantage of not requiring any policy changes for simple isolation: just have a general policy which applies to all MCS labels, and possibly customize behavior via the type. e.g. system_u:object_r:virt_image_t:c1 ^ ^ type mcs label 'c0' = isolated inactive VM image/device. 'cN' = dynamically assigned MCS label for active VM, bound to the UUID, and translated via MCS translation file. i.e. a user running ls -Z or ps -Z will see the UUID instead of cN. 'virt_image_t' = standard VM which is also isolated if an MCS label is present. 'virt_image_nonet_t' = VM with no network access at all. etc. So, MCS is used to enforce VM isolation, Type is used to enforce general security behavior. We can then provide a high-level GUI interface for selecting this behavior without the admin knowing anything about SELinux. Note: proof of concept testing has been performed using MCS labels, which appears to be workable at this stage. - Utilize the new hierarchical types being proposed upstream by NEC. (No analysis done yet). 4.8 Accessing images via shared storage will present challenges as we do not yet have labeling for networked filesystems. 4.9 We must ensure that any MAC support integrated into libvirt is readily debuggable. e.g. hook into auditsp to actively process policy violations and handle them via the virt toolchain; also develop good setroubleshoot plugins. 4.10 {lib}semanage needs performance optimization work to reduce impact on the virt toolchain. ------------------------------------------------------------------------

7 17