- Devel - libvirt List Archives

[libvirt] 'stack smashing detected' in 1.2.18 (caused by virNetDevGFeatureAvailable)
by Brian Rak 05 Aug '15

05 Aug '15

I recently compiled 1.2.18 to start testing with it, and was getting this error on startup: *** stack smashing detected ***: libvirtd terminated ======= Backtrace: ========= /lib64/libc.so.6(__fortify_fail+0x37)[0x7fe1ac631527] /lib64/libc.so.6(__fortify_fail+0x0)[0x7fe1ac6314f0] //lib/libvirt.so.0(+0xa7927)[0x7fe1aeda2927] //lib/libvirt/connection-driver/libvirt_driver_nodedev.so(+0x947d)[0x7fe1958a047d] //lib/libvirt/connection-driver/libvirt_driver_nodedev.so(+0xa6c2)[0x7fe1958a16c2] //lib/libvirt/connection-driver/libvirt_driver_nodedev.so(+0xaf4e)[0x7fe1958a1f4e] //lib/libvirt.so.0(virStateInitialize+0xb8)[0x7fe1aee6d0a8] libvirtd(+0x15120)[0x7fe1afae6120] //lib/libvirt.so.0(+0xd4975)[0x7fe1aedcf975] /lib64/libpthread.so.0(+0x30316079d1)[0x7fe1ada8c9d1] /lib64/libc.so.6(clone+0x6d)[0x7fe1ac6178fd] (gdb) bt #0 0x00007ffff4a8f625 in raise () from /lib64/libc.so.6 #1 0x00007ffff4a90e05 in abort () from /lib64/libc.so.6 #2 0x00007ffff4acd537 in __libc_message () from /lib64/libc.so.6 #3 0x00007ffff4b5f527 in __fortify_fail () from /lib64/libc.so.6 #4 0x00007ffff4b5f4f0 in __stack_chk_fail () from /lib64/libc.so.6 #5 0x00007ffff72d0927 in virNetDevGetFeatures (ifname=<value optimized out>, out=<value optimized out>) at util/virnetdev.c:3200 #6 0x00007fffdddce47d in udevProcessNetworkInterface (device=0x7fffd4071f70, def=0x6) at node_device/node_device_udev.c:694 #7 udevGetDeviceDetails (device=0x7fffd4071f70, def=0x6) at node_device/node_device_udev.c:1272 #8 0x00007fffdddcf6c2 in udevAddOneDevice (device=0x7fffd4071f70) at node_device/node_device_udev.c:1394 #9 0x00007fffdddcff4e in udevProcessDeviceListEntry (privileged=<value optimized out>, callback=<value optimized out>, opaque=<value optimized out>) at node_device/node_device_udev.c:1433 #10 udevEnumerateDevices (privileged=<value optimized out>, callback=<value optimized out>, opaque=<value optimized out>) at node_device/node_device_udev.c:1463 #11 nodeStateInitialize (privileged=<value optimized out>, callback=<value optimized out>, opaque=<value optimized out>) at node_device/node_device_udev.c:1773 #12 0x00007ffff739b0a8 in virStateInitialize (privileged=true, callback=0x555555569070 <daemonInhibitCallback>, opaque=0x5555557f1db0) at libvirt.c:777 #13 0x0000555555569120 in daemonRunStateInit (opaque=<value optimized out>) at libvirtd.c:947 #14 0x00007ffff72fd975 in virThreadHelper (data=<value optimized out>) at util/virthread.c:206 #15 0x00007ffff5fba9d1 in start_thread () from /lib64/libpthread.so.0 #16 0x00007ffff4b458fd in clone () from /lib64/libc.so.6 In IRC, we tracked this down to this bit of code: g_cmd.cmd = ETHTOOL_GFEATURES; g_cmd.size = GFEATURES_SIZE; if (virNetDevGFeatureAvailable(ifname, &g_cmd)) ignore_value(virBitmapSetBit(*out, VIR_NET_DEV_FEAT_TXUDPTNL)); GFEATURES_SIZE is currently defined as 2, but this value needs to be higher in order to support newer kernels. It looks like this code was added in ac3ed2085fcbeecaf5aa347c0b1bffaf94fff293 ethtool calculates this value based on the number of supported features: http://lxr.free-electrons.com/source/net/core/ethtool.c#L55 I don't know enough about this to properly fix this, but raising GFEATURES_SIZE to 3 has fixed this issue for me (though, this will obviously need to go higher as more features get added) This crash was occurring on a CentOS 6 system, running a the ELRepo kernel-ml kernel. The stock CentOS 6 kernel (2.6.32) does not appear to have sufficient features available to trigger this.

1 0

[libvirt] [PATCH] qemu: Forbid image pre-creation for non-shared storage migration
by Peter Krempa 05 Aug '15

05 Aug '15

Libvirt doesn't reliably know the location of the backing chain when pre-creating images for non-shared migration. This isn't a problem for full copy, but incremental copy requires the information. Forbid pre-creating the image in cases where incremental migration is required. This limitation can perhaps be lifted once libvirt will fully support loading of backing chain information from the XML. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1249587 --- src/qemu/qemu_migration.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 458b269..ff89ab5 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1613,7 +1613,8 @@ qemuMigrationPrecreateStorage(virConnectPtr conn, virDomainObjPtr vm, qemuMigrationCookieNBDPtr nbd, size_t nmigrate_disks, - const char **migrate_disks) + const char **migrate_disks, + bool incremental) { int ret = -1; size_t i = 0; @@ -1644,6 +1645,13 @@ qemuMigrationPrecreateStorage(virConnectPtr conn, continue; } + if (incremental) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("pre-creation of storage targets for incremental " + "storage migration is not supported")); + goto cleanup; + } + VIR_DEBUG("Proceeding with disk source %s", NULLSTR(diskSrcPath)); if (qemuMigrationPrecreateDisk(conn, disk, nbd->disks[i].capacity) < 0) @@ -3339,7 +3347,8 @@ qemuMigrationPrepareAny(virQEMUDriverPtr driver, } if (qemuMigrationPrecreateStorage(dconn, driver, vm, mig->nbd, - nmigrate_disks, migrate_disks) < 0) + nmigrate_disks, migrate_disks, + !!(flags & VIR_MIGRATE_NON_SHARED_INC)) < 0) goto cleanup; if (qemuMigrationJobStart(driver, vm, QEMU_ASYNC_JOB_MIGRATION_IN) < 0) -- 2.4.5

2 2

[libvirt] [PATCH 0/5] domainRename API implementation
by Tomas Meszaros 05 Aug '15

05 Aug '15

This is an effort to implement domain rename API. Presented patch series consists of the following: virDomainRename API implementation for qemu, implementation of the virsh command domrename and the additional support code. The idea behind this endeavor is to provide convenient and safe way to rename a domain. Instead of the: virsh dumpxml domain > domain.xml (change domain name in domain.xml) virsh undefine domain virsh define domain.xml user can simply type: virsh domrename foo bar or call virDomainRename() API and domain "foo" will be renamed to "bar". We currently support only renaming inactive domains without snapshots. Renaming procedure takes care of domain log, config, guest agent path and should be able to recover in case of failure. I've been working on this functionality in collaboration with Michal Privoznik who is my mentor during the GSoC 2015. If you have any questions, ideas or criticism feel free to join the discussion. Tomas Meszaros (5): Introduce virDomainRename API virsh: Implement "domrename" command domain_conf: Introducde virDomainObjListRenameAddNew() & virDomainObjListRenameRemove() Introduce new VIR_DOMAIN_EVENT_DEFINED_RENAMED event qemu: Implement virDomainRename examples/object-events/event-test.c | 2 + include/libvirt/libvirt-domain.h | 3 + src/access/viraccessperm.c | 3 +- src/access/viraccessperm.h | 6 ++ src/conf/domain_conf.c | 35 ++++++++ src/conf/domain_conf.h | 5 ++ src/driver-hypervisor.h | 5 ++ src/libvirt-domain.c | 31 +++++++ src/libvirt_private.syms | 2 + src/libvirt_public.syms | 5 ++ src/qemu/qemu_driver.c | 172 ++++++++++++++++++++++++++++++++++++ src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 18 +++- src/remote_protocol-structs | 8 ++ tools/virsh-domain.c | 60 ++++++++++++- tools/virsh.pod | 7 ++ 16 files changed, 360 insertions(+), 3 deletions(-) -- 2.1.0

2 8

[libvirt] [PATCHv2 0/2] Added waiting for DAD to finish for bridge address.
by Maxim Perevedentsev 05 Aug '15

05 Aug '15

This is a fix for commit db488c79173b240459c7754f38c3c6af9b432970 dnsmasq main process which is relied on when waiting for DAD to complete exits without actually waiting for DAD. This is dnsmasq daemon's task. It seems to be a race that DAD finished before dnsmasq main process exited. The above commit needs the execution to block until DAD finishes for bridge IPv6 address because then it closes dummy tap device. Thus we need to ensure this ourselves. So we periodically poll the kernel using netlink and check whether there are any IPv6 addresses assigned to bridge which have 'tentative' state. After DAD is finished, execution continues. I guess that is what dnsmasq was assumed to do. We use netlink to dump information about existing IPv6 addresses. Netlink's response is a multi-part message. Unfortunately, the current implementation of virNetlink treats such messages as faulty and throws an error. So the patch 2/2 adds multi-part nelink response support. Update v2: fixed syntax. Maxim Perevedentsev (2): network: added waiting for DAD to finish for bridge address. Add support for multi-part netlink messages. src/network/bridge_driver.c | 113 +++++++++++++++++++++++++++++++++++++++++++- src/util/virnetlink.c | 4 +- 2 files changed, 115 insertions(+), 2 deletions(-) -- Sincerely, Maxim Perevedentsev

1 2

[libvirt] [PATCH] virsh: fix domfsinfo wrong output in quiet mode
by Luyao Huang 05 Aug '15

05 Aug '15

https://bugzilla.redhat.com/show_bug.cgi?id=1250287 When run domfsinfo in quiet mode, we cannot get any useful information (just get \n), this is because we didn't use vshPrint to print useful information. Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- tools/virsh-domain.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index a61656f..4988ba2 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -12848,10 +12848,10 @@ cmdDomFSInfo(vshControl *ctl, const vshCmd *cmd) _("Mountpoint"), _("Name"), _("Type"), _("Target")); vshPrintExtra(ctl, "-------------------------------------------------------------------\n"); for (i = 0; i < ret; i++) { - vshPrintExtra(ctl, "%-36s %-8s %-8s ", - info[i]->mountpoint, info[i]->name, info[i]->fstype); + vshPrint(ctl, "%-36s %-8s %-8s ", + info[i]->mountpoint, info[i]->name, info[i]->fstype); for (j = 0; j < info[i]->ndevAlias; j++) { - vshPrintExtra(ctl, "%s", info[i]->devAlias[j]); + vshPrint(ctl, "%s", info[i]->devAlias[j]); if (j != info[i]->ndevAlias - 1) vshPrint(ctl, ","); } -- 1.8.3.1

3 2

[libvirt] [PATCH] conf: Resolve Coverity FORWARD_NULL
by John Ferlan 05 Aug '15

05 Aug '15

The recent changes to perform SCSI device address checks during the post parse callbacks ran afoul of the Coverity checker since the changes assumed that the 'xmlopt' parameter to virDomainDeviceDefPostParse would be non NULL (commit id 'ca2cf74e87'); however, what was missed is there was an "if (xmlopt &&" check being made, so Coverity believed that it could be possible for a NULL 'xmlopt'. Checking the various calling paths seemingly disproves that. If called from virDomainDeviceDefParse, there were two other possible calls that would end up dereffing, so that path could not be NULL. If called via virDomainDefPostParseDeviceIterator via virDomainDefPostParse there are two callers (virDomainDefParseXML and qemuParseCommandLine) which deref xmlopt either directly or through another call. So I'm removing the check for non-NULL xmlopt. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- src/conf/domain_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 77a50c3..dd5ebd7 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4145,7 +4145,7 @@ virDomainDeviceDefPostParse(virDomainDeviceDefPtr dev, { int ret; - if (xmlopt && xmlopt->config.devicesPostParseCallback) { + if (xmlopt->config.devicesPostParseCallback) { ret = xmlopt->config.devicesPostParseCallback(dev, def, caps, xmlopt->config.priv); if (ret < 0) -- 2.1.0

2 3

[libvirt] tc ingress rule of VM B disappear when reboot VM A
by ychen 05 Aug '15

05 Aug '15

hi: when I use openstack devstack to test QOS, wired phenomenon appeared, I set qos ingress rule in tapB, but when I reboot tapA, the ingress rule of tapB automatically removed, but the egress rule is still exist. Test enviroment: Linux: ubuntu 14.04.1 LTS kernel: 3.13.0-32-generic libvirt: 1.2.2 openstack: havana 1. use nova to create vm A and vm B. for the configuration of the libvirt xml, see the last paragraph in the end. 2. use tc cmd to create qos rule for vm A and vm B tc qdisc add dev tap3d0d2c4a-0b ingress //vmA tc qdisc add dev tap896d5066-69 ingress //vmB 3. then use cmd "sudo virsh destory 142a08db-6e25-4a03-be13-7073104b0745 " to first shutdown vm1 then I see ingress rule of vmB disappeared :( configurations: vmA:------------------------------------------- <domain type='qemu' id='15'> <name>instance-00000001</name> <uuid>142a08db-6e25-4a03-be13-7073104b0745</uuid> <memory unit='KiB'>524288</memory> <currentMemory unit='KiB'>524288</currentMemory> <vcpu placement='static'>1</vcpu> <resource> <partition>/machine</partition> </resource> <sysinfo type='smbios'> <system> <entry name='manufacturer'>OpenStack Foundation</entry> <entry name='product'>OpenStack Nova</entry> <entry name='version'>2013.2.3</entry> <entry name='serial'>5fd079ed-5bc3-45ed-8de5-8bf9b8533d82</entry> <entry name='uuid'>142a08db-6e25-4a03-be13-7073104b0745</entry> </system> </sysinfo> <os> <type arch='x86_64' machine='pc-i440fx-trusty'>hvm</type> <boot dev='hd'/> <smbios mode='sysinfo'/> </os> <features> <acpi/> <apic/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='none'/> <source file='/opt/stack/data/nova/instances/142a08db-6e25-4a03-be13-7073104b0745/disk'/> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> <controller type='usb' index='0'> <alias name='usb0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> <controller type='pci' index='0' model='pci-root'> <alias name='pci.0'/> </controller> <interface type='bridge'> <mac address='fa:16:3e:22:68:6a'/> <source bridge='br-int'/> <virtualport type='openvswitch'> <parameters interfaceid='3d0d2c4a-0b72-4f91-b393-413e0c5a335b'/> </virtualport> <target dev='tap3d0d2c4a-0b'/> <model type='virtio'/> <driver name='qemu'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <serial type='file'> <source path='/opt/stack/data/nova/instances/142a08db-6e25-4a03-be13-7073104b0745/console.log'/> <target port='0'/> <alias name='serial0'/> </serial> <serial type='pty'> <source path='/dev/pts/31'/> <target port='1'/> <alias name='serial1'/> </serial> <console type='file'> <source path='/opt/stack/data/nova/instances/142a08db-6e25-4a03-be13-7073104b0745/console.log'/> <target type='serial' port='0'/> <alias name='serial0'/> </console> <input type='tablet' bus='usb'> <alias name='input0'/> </input> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='vnc' port='5900' autoport='yes' listen='127.0.0.1' keymap='en-us'> <listen type='address' address='127.0.0.1'/> </graphics> <video> <model type='cirrus' vram='9216' heads='1'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <alias name='balloon0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </memballoon> </devices> <seclabel type='dynamic' model='apparmor' relabel='yes'> <label>libvirt-142a08db-6e25-4a03-be13-7073104b0745</label> <imagelabel>libvirt-142a08db-6e25-4a03-be13-7073104b0745</imagelabel> </seclabel> </domain> vmB:------------------------------------------- <domain type='qemu' id='13'> <name>instance-00000002</name> <uuid>fbd69f7b-83f1-45fe-818b-2021d5cb2e61</uuid> <memory unit='KiB'>524288</memory> <currentMemory unit='KiB'>524288</currentMemory> <vcpu placement='static'>1</vcpu> <resource> <partition>/machine</partition> </resource> <sysinfo type='smbios'> <system> <entry name='manufacturer'>OpenStack Foundation</entry> <entry name='product'>OpenStack Nova</entry> <entry name='version'>2013.2.3</entry> <entry name='serial'>5fd079ed-5bc3-45ed-8de5-8bf9b8533d82</entry> <entry name='uuid'>fbd69f7b-83f1-45fe-818b-2021d5cb2e61</entry> </system> </sysinfo> <os> <type arch='x86_64' machine='pc-i440fx-trusty'>hvm</type> <boot dev='hd'/> <smbios mode='sysinfo'/> </os> <features> <acpi/> <apic/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='none'/> <source file='/opt/stack/data/nova/instances/fbd69f7b-83f1-45fe-818b-2021d5cb2e61/disk'/> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> <controller type='usb' index='0'> <alias name='usb0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> <controller type='pci' index='0' model='pci-root'> <alias name='pci.0'/> </controller> <interface type='bridge'> <mac address='fa:16:3e:c0:43:88'/> <source bridge='br-int'/> <virtualport type='openvswitch'> <parameters interfaceid='896d5066-694d-4f15-9abe-f587439f279b'/> </virtualport> <target dev='tap896d5066-69'/> <model type='virtio'/> <driver name='qemu'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <serial type='file'> <source path='/opt/stack/data/nova/instances/fbd69f7b-83f1-45fe-818b-2021d5cb2e61/console.log'/> <target port='0'/> <alias name='serial0'/> </serial> <serial type='pty'> <source path='/dev/pts/32'/> <target port='1'/> <alias name='serial1'/> </serial> <console type='file'> <source path='/opt/stack/data/nova/instances/fbd69f7b-83f1-45fe-818b-2021d5cb2e61/console.log'/> <target type='serial' port='0'/> <alias name='serial0'/> </console> <input type='tablet' bus='usb'> <alias name='input0'/> </input> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='vnc' port='5901' autoport='yes' listen='127.0.0.1' keymap='en-us'> <listen type='address' address='127.0.0.1'/> </graphics> <video> <model type='cirrus' vram='9216' heads='1'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <alias name='balloon0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </memballoon> </devices> <seclabel type='dynamic' model='apparmor' relabel='yes'> <label>libvirt-fbd69f7b-83f1-45fe-818b-2021d5cb2e61</label> <imagelabel>libvirt-fbd69f7b-83f1-45fe-818b-2021d5cb2e61</imagelabel> </seclabel> </domain>

2 2

[libvirt] Libvirt error in Openstack Tempest attaching disk on arm64 system
by Clark Laughlin 04 Aug '15

04 Aug '15

I am running Openstack Tempest on an arm64 platform and am seeing some test failures related to attaching volumes to an instance. This is an example of the disk XML generated by one of the tests: <disk type="block" device="disk"><driver name="qemu" type="raw" cache="none"/<source dev="/dev/disk/by-path/ip-10.7.1.2:3260-iscsi-iqn.2010-10.org.openstack:volume-5a204339-80cb-4d06-aecf-2a8a2c970b0e-lun-1"/><target bus="virtio" dev="vdb"/><serial>5a204339-80cb-4d06-aecf-2a8a2c970b0e</serial></disk> The test is failing with the error "XML error: No PCI buses available". I am trying to find the relevent source locations for this functionality in either in the nova libvirt driver or in the libvirt source itself. I am not sure why I am getting an error about no PCI buses when the bus specified in the XML is "virtio". I would appreciate any pointers / help. Thank you, Clark L

3 3

[libvirt] [PATCH] examples: Add example polkit ACL rules
by Jiri Denemark 04 Aug '15

04 Aug '15

Creating ACL rules is not exactly easy and existing examples are pretty simple. This patch adds a somewhat complex example which defines three roles (user, operator, admin) with different permissions. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- Makefile.am | 2 +- configure.ac | 1 + examples/polkit/Makefile.am | 17 ++++++ examples/polkit/libvirt-acl.rules | 124 ++++++++++++++++++++++++++++++++++++++ libvirt.spec.in | 3 + 5 files changed, 146 insertions(+), 1 deletion(-) create mode 100644 examples/polkit/Makefile.am create mode 100644 examples/polkit/libvirt-acl.rules diff --git a/Makefile.am b/Makefile.am index 91b943b..d338d5a 100644 --- a/Makefile.am +++ b/Makefile.am @@ -23,7 +23,7 @@ SUBDIRS = . gnulib/lib include src daemon tools docs gnulib/tests \ tests po examples/object-events examples/hellolibvirt \ examples/dominfo examples/domsuspend examples/apparmor \ examples/xml/nwfilter examples/openauth examples/systemtap \ - tools/wireshark examples/dommigrate \ + tools/wireshark examples/dommigrate examples/polkit \ examples/lxcconvert examples/domtop ACLOCAL_AMFLAGS = -I m4 diff --git a/configure.ac b/configure.ac index 46c80ce..d506c28 100644 --- a/configure.ac +++ b/configure.ac @@ -2805,6 +2805,7 @@ AC_CONFIG_FILES([\ examples/systemtap/Makefile \ examples/xml/nwfilter/Makefile \ examples/lxcconvert/Makefile \ + examples/polkit/Makefile \ tools/wireshark/Makefile \ tools/wireshark/src/Makefile]) AC_OUTPUT diff --git a/examples/polkit/Makefile.am b/examples/polkit/Makefile.am new file mode 100644 index 0000000..4d213e8 --- /dev/null +++ b/examples/polkit/Makefile.am @@ -0,0 +1,17 @@ +## Copyright (C) 2015 Red Hat, Inc. +## +## This library is free software; you can redistribute it and/or +## modify it under the terms of the GNU Lesser General Public +## License as published by the Free Software Foundation; either +## version 2.1 of the License, or (at your option) any later version. +## +## This library is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +## Lesser General Public License for more details. +## +## You should have received a copy of the GNU Lesser General Public +## License along with this library. If not, see +## <http://www.gnu.org/licenses/>. + +EXTRA_DIST = libvirt-acl.rules diff --git a/examples/polkit/libvirt-acl.rules b/examples/polkit/libvirt-acl.rules new file mode 100644 index 0000000..6a93206 --- /dev/null +++ b/examples/polkit/libvirt-acl.rules @@ -0,0 +1,124 @@ +function Role(name) { + this.name = name; + + this.actions = []; + this.users = []; + this.groups = []; + + this.lookup = function(subject) { + if (this.users.indexOf(subject.user) >= 0) + return true; + + for (var i = 0; i < subject.groups.length; i++) { + if (this.groups.indexOf(subject.groups[i]) >= 0) + return true; + } + + return false; + }; + + this.lookupAction = function(action) { + action = action.id.replace("org.libvirt.api.", ""); + if (this.actions.indexOf(action) >= 0) + return true; + else + return false; + }; +} + + +/* Basic operations and monitoring. */ +var user = new Role("user"); +user.users = ["user1", "user2", "user3"]; +user.groups = ["group1", "group2"]; + +/* Same as users plus some privileged operations. */ +var operator = new Role("operator"); +operator.users = ["powerUser1", "powerUser2"]; +operator.groups = ["powerGroup1", "powerGroup2", "powerGroup3"]; + +/* Full access. */ +var admin = new Role("admin"); +admin.users = ["adminUser1"]; +admin.groups = ["adminGroup1"]; + + +user.actions = [ + "domain.core-dump", + "domain.fs-freeze", + "domain.fs-trim", + "domain.getattr", + "domain.hibernate", + "domain.init-control", + "domain.inject-nmi", + "domain.open-device", + "domain.open-graphics", + "domain.pm-control", + "domain.read", + "domain.reset", + "domain.save", + "domain.screenshot", + "domain.send-input", + "domain.send-signal", + "domain.set-password", + "domain.set-time", + "domain.snapshot", + "domain.start", + "domain.stop", + "domain.suspend" +]; +operator.actions = [ + "domain.delete", + "domain.migrate", + "domain.read-secure", + "domain.write", + "network.delete", + "network.getattr", + "network.read", + "network.save", + "network.start", + "network.stop", + "network.write", + "nwfilter.delete", + "nwfilter.getattr", + "nwfilter.read", + "nwfilter.save", + "nwfilter.write", + "secret.delete", + "secret.getattr", + "secret.read", + "secret.read-secure", + "secret.save", + "secret.write", + "storage-pool.refresh", + "storage-vol.create", + "storage-vol.data-read", + "storage-vol.data-write", + "storage-vol.delete", + "storage-vol.format", + "storage-vol.getattr", + "storage-vol.read", + "storage-vol.resize" +]; + +polkit.addRule(function(action, subject) { + if (action.id.indexOf("org.libvirt.api.") != 0) + return polkit.Result.NOT_HANDLED; + + if (admin.lookup(subject)) + return polkit.Result.YES; + + if (operator.lookupAction(action)) { + if (operator.lookup(subject)) + return polkit.Result.YES; + else + return polkit.Result.NO; + } else if (user.lookupAction(action)) { + if (operator.lookup(subject) || user.lookup(subject)) + return polkit.Result.YES; + else + return polkit.Result.NO; + } else { + return polkit.Result.NOT_HANDLED; + } +}); diff --git a/libvirt.spec.in b/libvirt.spec.in index 9a6139a..845efd2 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2039,6 +2039,9 @@ exit 0 %endif # ! %{with_driver_modules} %if %{with_network} + +%doc examples/polkit/*.rules + %files daemon-config-network %defattr(-, root, root) %dir %{_datadir}/libvirt/networks/ -- 2.5.0

2 1

[libvirt] [PATCH] qemuProcessStart: Be tolerant to relabel errors for session mode
by Michal Privoznik 04 Aug '15

04 Aug '15

https://bugzilla.redhat.com/show_bug.cgi?id=1124841 When the daemon is running under unprivileged user, that is under qemu:///session, there are plenty of operations we can't do. What we can do is to go with best effort. One of such cases is relabeling domain resources (be it disks, sockets, regular files, etc.) during domain startup process. While we may successfully set DAC labels, we can be fairly certain that any attempt to change SELinux labels will fail. Therefore we should tolerate relabelling errors and just let qemu to try access the resources. If it fails, our error reporting system is strong enough to articulate the exact error to the user anyway. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_process.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 1c0c734..58ed631 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4856,8 +4856,13 @@ int qemuProcessStart(virConnectPtr conn, VIR_DEBUG("Setting domain security labels"); if (virSecurityManagerSetAllLabel(driver->securityManager, - vm->def, stdin_path) < 0) - goto cleanup; + vm->def, stdin_path) < 0) { + /* Be tolerant to relabel errors if we are running unprivileged. */ + if (virQEMUDriverIsPrivileged(driver)) + goto cleanup; + else + VIR_DEBUG("Ignoring relabel errors for unprivileged daemon"); + } /* Security manager labeled all devices, therefore * if any operation from now on fails and we goto cleanup, -- 2.3.6

3 3

[libvirt] mass create vm errors
by Vasiliy Tolstov 04 Aug '15

04 Aug '15

Hi again =). I have another problem then testing libvirt with massive vm start: 2015-07-18 08:25:21.687+0000: 36893: error : qemuMonitorIO:750 : internal error: early end of file from monitor: possible problem: 2015-07-18T08:25:21.586487Z qemu-system-x86_64: -vnc [::]:4,password: Failed to start VNC server: Failed to bind socket: Address already in use As i understand, when libvirt try to detect free port for vnc it fails, because another process already binds to it. How can i avoid this errors? Does it fixed in never libvirt releases? libvirt 1.216 qemu 2.4.0-rc0 -- Vasiliy Tolstov, e-mail: v.tolstov(a)selfip.ru

2 3

[libvirt] [PATCH 0/2] Adjustments for configuring volume lun device
by John Ferlan 04 Aug '15

04 Aug '15

Resolve a couple of issues regarding failures seen configuring a disk to be a type='volume' device='lun'. The doc patch just indicates that using an NPIV storage/source pool is a valid option. The second patch allows for a "clearer" error message to be reported. John Ferlan (2): docs: Add Fibre Channel NPIV supported option for volume lun config conf: Allow error reporting in virDomainDiskSourceIsBlockType docs/formatdomain.html.in | 6 ++++-- src/conf/domain_conf.c | 21 ++++++++++++++++++--- src/conf/domain_conf.h | 2 +- src/lxc/lxc_cgroup.c | 2 +- src/lxc/lxc_driver.c | 6 ++---- src/qemu/qemu_command.c | 5 +---- src/qemu/qemu_conf.c | 6 +++--- 7 files changed, 30 insertions(+), 18 deletions(-) -- 2.1.0

2 6

[libvirt] [PATCH] tests: extend workaround for gnutls private key loading failure
by Daniel P. Berrange 04 Aug '15

04 Aug '15

In gnutls 3.4.3 there is a regression in the loading of private keys via gnutls_x509_privkey_import. We already have a workaround to deal with failures on older gnutls, but the error code that the new gnutls returns is different. Extend the workaround so that is checks for GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE too. See also gnutls https://bugzilla.redhat.com/show_bug.cgi?id=1250020 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- tests/virnettlshelpers.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) Pushed as a build fix diff --git a/tests/virnettlshelpers.c b/tests/virnettlshelpers.c index 6e667d1..531d0b9 100644 --- a/tests/virnettlshelpers.c +++ b/tests/virnettlshelpers.c @@ -84,7 +84,8 @@ static gnutls_x509_privkey_t testTLSLoadKey(void) if ((err = gnutls_x509_privkey_import(key, &data, GNUTLS_X509_FMT_PEM)) < 0) { - if (err != GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR) { + if (err != GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR && + err != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { VIR_WARN("Failed to import key %s", gnutls_strerror(err)); abort(); } -- 2.4.3

1 0

[libvirt] [PATCH v2 0/3] Disable floppy disk for PowerPC VMs
by Kothapally Madhu Pavan 04 Aug '15

04 Aug '15

This is an attempt to fix: Libvirt BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1180486 Libvirt currently assumes ISA_based floppy disks to be available across all architectures and machine types. However, PowerPC Book 3S compatible ('ie pseries) virtual machines do not support Floppy disks. This patch series prevents libvirt from launching ppc64[le] -based 'pseries' VMs with floppy devices. This version of patch attempts to fulfill the coments of Andrea Bolognani and Jan Tomko on previous version of patch. --- Kothapally Madhu Pavan (3): Caps: Disable floppy disk for PowerPC VM Avoid starting a PowerPC VM with floppy disk test: Introduce test case to disallow floppy disk on pseries src/qemu/qemu_capabilities.c | 15 +++++-- src/qemu/qemu_command.c | 8 ++++ .../qemuxml2argv-disk-floppy-pseries.args | 6 +++ .../qemuxml2argv-disk-floppy-pseries.xml | 41 ++++++++++++++++++++ tests/qemuxml2argvtest.c | 1 5 files changed, 67 insertions(+), 4 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-floppy-pseries.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-floppy-pseries.xml -- Kothapally Madhu Pavan

3 6

[libvirt] [PATCH 00/13] Move generic virsh data to a separate module vsh
by Erik Skultety 04 Aug '15

04 Aug '15

The idea behind this is that in order to introduce virt-admin client (and later some commands/APIs), there are lots of methods in virsh that can be easily reused by other potential clients like command and command argument passing or error reporting. !!! IMPORTANT !!! These patches cannot be compiled separately, the series is split more or less logically into chunks only to be more readable by the reviewer. I started this at least 4 times from scratch and still haven't found a way that splitting virsh could be done with several independent applicable commits, rather than having one massive commit in the end. Erik Skultety (13): tools: Introduce new client generic module vsh vsh: Remove client specific data, only generic data are kept tools: apply s/vshX/virshX to all virsh specific data virsh: remove generic data, only client specific are kept virsh: Rename client specific methods in virsh.h vsh: vshControl now includes client private data and client specific progname vsh: Make use of introduced private data vsh: Introduce client hooks vsh: Make use of newly introduced client side hooks vsh: Introduce new global initializer vsh: Make separated generic methods public virsh: Introduce connection handler tools: Update makefile to include 'vsh' sources as well cfg.mk | 2 +- po/POTFILES.in | 3 +- tools/Makefile.am | 4 + tools/virsh-console.c | 13 +- tools/virsh-console.h | 8 +- tools/virsh-domain-monitor.c | 201 ++-- tools/virsh-domain-monitor.h | 4 +- tools/virsh-domain.c | 532 +++++---- tools/virsh-domain.h | 14 +- tools/virsh-edit.c | 8 +- tools/virsh-host.c | 131 ++- tools/virsh-interface.c | 80 +- tools/virsh-interface.h | 12 +- tools/virsh-network.c | 72 +- tools/virsh-network.h | 10 +- tools/virsh-nodedev.c | 37 +- tools/virsh-nwfilter.c | 33 +- tools/virsh-nwfilter.h | 10 +- tools/virsh-pool.c | 104 +- tools/virsh-pool.h | 10 +- tools/virsh-secret.c | 27 +- tools/virsh-snapshot.c | 75 +- tools/virsh-volume.c | 103 +- tools/virsh-volume.h | 14 +- tools/virsh.c | 2673 ++++-------------------------------------- tools/virsh.h | 481 +------- tools/vsh.c | 2332 ++++++++++++++++++++++++++++++++++++ tools/vsh.h | 489 ++++++++ 28 files changed, 3906 insertions(+), 3576 deletions(-) create mode 100644 tools/vsh.c create mode 100644 tools/vsh.h -- 1.9.3

3 20

[libvirt] libvirt 1.2.17 fails
by Jason Helfman 04 Aug '15

04 Aug '15

Hello All, I am getting build failures on the latest build, and it is currently blocking my commit of the update. Looks like xhtml, is a new build requirement. I added it to the list of dependencies, however it is failing to build within our build cluster. http://meatwad.mouf.net/rubick/poudriere/data/93i386-jgh/2015-07-27_15h41m2… (also attached for historical purposes) I am able to get this to build locally, but trying to distinguish what is different compared with a clean system. Here is the listing of files contained in the xhtml package: xhtml-1.0.20020801_4: /usr/local/share/xml/dtd/xhtml/catalog.xml /usr/local/share/xml/dtd/xhtml/xhtml-dcl.soc /usr/local/share/xml/dtd/xhtml/xhtml-lat1.ent /usr/local/share/xml/dtd/xhtml/xhtml-special.ent /usr/local/share/xml/dtd/xhtml/xhtml-symbol.ent /usr/local/share/xml/dtd/xhtml/xhtml.soc /usr/local/share/xml/dtd/xhtml/xhtml1-frameset.dtd /usr/local/share/xml/dtd/xhtml/xhtml1-strict.dtd /usr/local/share/xml/dtd/xhtml/xhtml1-transitional.dtd /usr/local/share/xml/dtd/xhtml/xhtml1.dcl Thanks in advance! Jason -- Jason Helfman | FreeBSD Committer jgh(a)FreeBSD.org | http://people.freebsd.org/~jgh | The Power to Serve

2 3

[libvirt] [PATCH v11 0/5] nodeinfo: Add support for subcores
by Andrea Bolognani 03 Aug '15

03 Aug '15

Only patch 1/5 has been updated, all the other patches are the same as v8: 2/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01045.html 3/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01048.html 4/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01049.html 5/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01050.html I'm including the full history below. Cheers. Changes in v11: * don't declare variables only used inside a code block guarded by #ifdef outside of said code block * use virBitmapNextSetBit() instead of going through all possible index values and calling virBitmapIsBitSet() for each one Changes in v10: * don't attempt to close a file that wasn't opened * report a detailed error to help with diagnosis Changes in v9: * take into account the fact that kvm might not be loaded or even installed Changes in v8: * shortened test names so that make dist doesn't stop working again Changes in v7: * rebased on top of master now that the series this one builds on have been merged Changes in v6: * updated to work on top of [PATCH v2 00/10] nodeinfo: Various cleanups Changes in v5: * streamlined the logic used to decide whether the subcore configuration is valid and moved it to a separate function * split the tests into separate commits for easier review and to hopefully avoid having trouble with the list due to the message size Changes in v4: * removed a printf() statement * fixed typo in a commit message Changes in v3: * the function to get the number of threads per subcore has been moved to the from virarch.c, which deals with architecture names only and is therefore not the right place to read host configuration, to nodeinfo.c where the rest of this stuff lives * said function has also been given a shorter name * the "valid subcore mode" boolean has been removed: threads_per_subcore will be a positive number if subcores should be taken into account, and if that's not the case (x86 host, tainted configuration) it will simply be zero, so now the code needs to keep track of a single variable instead of two * the test case has been renamed to be more descriptive * the test data has been cleaned up by removing all cpu/cpu*/node* links, which prevented 'make dist' from working due to recursive linking Andrea Bolognani (3): tests: Add subcores1 nodeinfo test tests: Add subcores2 nodeinfo test tests: Add subcores3 nodeinfo test Shivaprasad G Bhat (2): nodeinfo: Fix output on PPC64 KVM hosts tests: Prepare for subcore tests src/libvirt_private.syms | 1 + src/nodeinfo.c | 153 ++++++++++++++++++++- src/nodeinfo.h | 1 + tests/Makefile.am | 6 + [...] tests/nodeinfomock.c | 35 +++++ tests/nodeinfotest.c | 8 +- 1348 files changed, 2134 insertions(+), 6 deletions(-) [...] create mode 100644 tests/nodeinfomock.c -- 2.4.3

2 3

[libvirt] [PATCH] nodeinfo: Fix build failure when KVM headers are not available
by Andrea Bolognani 03 Aug '15

03 Aug '15

Compiler error: ../../src/nodeinfo.c: In function 'nodeGetThreadsPerSubcore': ../../src/nodeinfo.c:2393: error: label 'out' defined but not used [-Wunused-label] ../../src/nodeinfo.c:2352: error: unused parameter 'arch' [-Wunused-parameter] --- src/nodeinfo.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 7da055c..6ccada5 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -2341,6 +2341,8 @@ nodeAllocPages(unsigned int npages, return ret; } +#if HAVE_LINUX_KVM_H && defined(KVM_CAP_PPC_SMT) + /* Get the number of threads per subcore. * * This will be 2, 4 or 8 on POWER hosts, depending on the current @@ -2352,8 +2354,6 @@ int nodeGetThreadsPerSubcore(virArch arch) { int threads_per_subcore = 0; - -#if HAVE_LINUX_KVM_H && defined(KVM_CAP_PPC_SMT) const char *kvmpath = "/dev/kvm"; int kvmfd; @@ -2388,8 +2388,19 @@ nodeGetThreadsPerSubcore(virArch arch) VIR_FORCE_CLOSE(kvmfd); } -#endif /* HAVE_LINUX_KVM_H && defined(KVM_CAP_PPC_SMT) */ out: return threads_per_subcore; } + +#else + +/* Fallback for nodeGetThreadsPerSubcore() used when KVM headers + * are not available on the system */ +int +nodeGetThreadsPerSubcore(virArch arch ATTRIBUTE_UNUSED) +{ + return 0; +} + +#endif /* HAVE_LINUX_KVM_H && defined(KVM_CAP_PPC_SMT) */ -- 2.4.3

2 1

[libvirt] [PATCH] qemu: Remove double unlock for domains
by Martin Kletzander 03 Aug '15

03 Aug '15

The virDomainObjListRemove() function unlocks a domain that it's given due to legacy code. And because of that code, which should be refactored, that last virObjectUnlock() cannot be just removed. So instead, lock it right back for qemu for now. All calls to qemuDomainRemoveInactive() are followed by code that unlocks the domain again, plus the domain should be locked during qemuDomainObjEndJob(), so the right place to lock it is right after virDomainObjListRemove(). The only place where this would cause a problem is the autodestroy callback, so we need to get another reference there and uref+unlock it afterwards. Luckily, returning NULL from that function doesn't mean an error, and only means that it doesn't need to be unlocked anymore. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_domain.c | 7 +++++++ src/qemu/qemu_process.c | 7 ++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 8b050a043995..d6d723112638 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -2593,6 +2593,13 @@ qemuDomainRemoveInactive(virQEMUDriverPtr driver, virObjectRef(vm); virDomainObjListRemove(driver->domains, vm); + /* + * virDomainObjListRemove() leaves the domain unlocked so it can + * be unref'd for other drivers that depend on that, but we still + * need to reset a job and we have a reference from the API that + * called this function. So we need to lock it back. + */ + virObjectLock(vm); virObjectUnref(cfg); if (haveJob) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 1c0c734c3811..df38dacdca92 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -5696,6 +5696,8 @@ qemuProcessAutoDestroy(virDomainObjPtr dom, VIR_DEBUG("vm=%s, conn=%p", dom->def->name, conn); + virObjectRef(dom); + if (priv->job.asyncJob) { VIR_DEBUG("vm=%s has long-term job active, cancelling", dom->def->name); @@ -5718,15 +5720,14 @@ qemuProcessAutoDestroy(virDomainObjPtr dom, qemuDomainObjEndJob(driver, dom); - if (!dom->persistent) { + if (!dom->persistent) qemuDomainRemoveInactive(driver, dom); - dom = NULL; - } if (event) qemuDomainEventQueue(driver, event); cleanup: + virDomainObjEndAPI(&dom); return dom; } -- 2.4.5

2 5

[libvirt] [PATCH 0/2] qemu: Improve memory alignment handling and fix upcoming powerpc
by Peter Krempa 03 Aug '15

03 Aug '15

Peter Krempa (2): qemu: Make memory alignment helper more universal qemu: ppc64: Align memory sizes to 256MiB src/qemu/qemu_domain.c | 33 ++++++++++++++++------ src/qemu/qemu_domain.h | 3 +- src/qemu/qemu_hotplug.c | 4 +-- .../qemuxml2argv-pseries-cpu-compat.args | 2 +- 4 files changed, 30 insertions(+), 12 deletions(-) -- 2.4.5

2 5

[libvirt] ambiguous ret of qemuDomainDetachVirtioDiskDevice
by zhang bo 03 Aug '15

03 Aug '15

static int qemuDomainDetachVirtioDiskDevice(virQEMUDriverPtr driver, virDomainObjPtr vm, virDomainDiskDefPtr detach) { ....... rc = qemuDomainWaitForDeviceRemoval(vm); if (rc == 0 || rc == 1) ret = qemuDomainRemoveDiskDevice(driver, vm, detach); else ret = 0; /*the return value of 2 is dismissed here, which refers to ETIMEOUT.*/ ........ } ------------------------------------ If it timeouts when qemu tries to del the device, the return value would be modified from 2 to 0 in function qemuDomainDetachVirtioDiskDevice(), which means that, the users would be misleaded that the device has been deleted, however, the device maybe probably failed to be detached after timeout and still in use. That is to say, the function qemuDomainDetachVirtioDiskDevice()'s return value is ambiguous when it's 0, maybe successful, or timeout. Will it be better to pass ETIMEOUT to user? or any other advises? for example, let users themselves dumpxml the guest to check whether the device has been actually detached or not? -- Oscar oscar.zhangbo(a)huawei.com

2 4

[libvirt] Release of libvirt-1.2.18
by Daniel Veillard 03 Aug '15

03 Aug '15

It's out ! Tagged in git and with signed tarball and rpms on the server at the usual place: ftp://libvirt.org/libvirt/ I also made a libvirt-python release found at: ftp://libvirt.org/libvirt/python/ This is a rather small size release, the libxl support for dom0 being the main feature from an user POV, but there is as usual a number of bug fixes and improvements across the code: Features: Documentation: - fix typo in qemu_monitor (Cao jin) - docs: bhyve: document clock configuration (Roman Bogorodskiy) - viraccessperm.h: Fix some typos (Michal Privoznik) - docs: Document how libvirt handles companion controllers (Martin Kletzander) - daemonRunStateInit: Fix a typo on a comment (Michal Privoznik) Portability: - netdev: fix build on FreeBSD (Roman Bogorodskiy) - spec: Fix polkit dep on F23 (Cole Robinson) - nodeinfo: fix build on FreeBSD (Roman Bogorodskiy) - Escape left brace as new perl suggests (Martin Kletzander) Bug Fixes: - qemu: Do not reset labels when migration fails (Jiri Denemark) - qemu: Reject migration with memory-hotplug if destination doesn't support it (Peter Krempa) - Load nbd module before running qemu-nbd (Cédric Bosdonnat) - lxc: Don't accidentaly reset autostart flag in virLXCProcessCleanup (Peter Krempa) - remote: fix typo in remoteDomainOpenGraphicsFD (Daniel P. Berrange) - qemu: Check for iotune_max support properly (Martin Kletzander) - Renamed deconfigured-cpus to allow make dist (Daniel Veillard) - storage: allow zero capacity with non-backing file to be created (Chris J Arges) - nodeinfo: Check for SYSFS_INFINIBAND_DIR before open (John Ferlan) - qemu: fix the error cover issue in SetMemoryParameters (Luyao Huang) - nodeinfo: Fix nodeGetCPUBitmap()'s fallback code path (Andrea Bolognani) - tests: Restore links in deconfigured-cpus nodeinfo test (Andrea Bolognani) - cgroup: Drop resource partition from virSystemdMakeScopeName (Peter Krempa) - qemu: Reject updating unsupported disk information (Martin Kletzander) - storage: Fix pool building when directory already exists (Christophe Fergeau) - rpc: ensure daemon is spawn even if dead socket exists (Daniel P. Berrange) - rbd: Return error from rbd_create for message processing (John Ferlan) - qemuMigrationRun: Don't leak @fd (Michal Privoznik) - Fix qemu-nbd cleanup crashes (Cédric Bosdonnat) - network: Add another collision check into networkCheckRouteCollision (Martin Kletzander) - nodeinfo: fix to parse present cpus rather than possible cpus (Kothapally Madhu Pavan) - libxl: set dom0 state to running (Jim Fehlig) - rpc: Rework timerActive logic in daemon (Martin Kletzander) - qemu: Check duplicate WWNs also for hotplugged disks (Peter Krempa) - Fix cloning of raw, sparse volumes (Prerna Saxena) - qemu: don't use initialized ret in qemuRemoveSharedDevice (Guido Günther) - qemu: report error for non-existing disk in blockjobinfo (Luyao Huang) - conf: Don't allow duplicated target names regardless of bus (John Ferlan) - storage: Revert volume obj list updating after volume creation (4749d82a) (Erik Skultety) - qemu: Fix integer/boolean logic in qemuSetUnprivSGIO (John Ferlan) - qemu: report error when shmem has an invalid address (Luyao Huang) - qemu: Auto assign pci addresses for shared memory devices (Luyao Huang) - vz: use PRL_USE_VNET_NAME_FOR_BRIDGE_NAME (Maxim Nestratov) - Explicitly format the isa-fdc controller for newer q35 machines (Ján Tomko) - virt-aa-helper: add unix channels for nserials as well (Serge Hallyn) - storage: Fix regression in storagePoolUpdateAllState (Erik Skultety) - better patch for the XSS search issue (Daniel Veillard) - Avoid XSS vulnerability on the search engine (Daniel Veillard) - vz: fix SDK event dispatching (Nikolay Shirokovskiy) - util: Avoid Coverity FORWARD_NULL (John Ferlan) - virsh: report error if vcpu number exceed the guest maxvcpu number (Luyao Huang) - virt-aa-helper: Fix permissions for vhost-user socket files (Michal Dubiel) Improvements: - qemu: Properly check for incoming migration job (Jiri Denemark) - Fix syntax-check: missing "%s" (Cédric Bosdonnat) - qemu: Adjust VM id allocation (Erik Skultety) - admin: Tiny cleanups (Martin Kletzander) - tests: Finish rename of the long nodeinfo test case (Martin Kletzander) - conf: add virDomainControllerDefNew() (Laine Stump) - qemu: reorganize loop in qemuDomainAssignPCIAddresses (Laine Stump) - conf: pay attention to bus minSlot/maxSlot when autoassigning PCI addresses (Laine Stump) - tests: add vol-qcow2-zerocapacity test to storagevolxml2argvtest (Chris J Arges) - Revert "qemu: Use heads parameter for QXL driver" (Martin Kletzander) - test: introduce a function in test driver to check get vcpupin info (Luyao Huang) - conf: reorganize virNetworkDHCPDefParseXML (Laine Stump) - nodeinfo: Check for errors when reading core_id (Andrea Bolognani) - bhyve: add UTC clock support (Roman Bogorodskiy) - configure: clarify rationale for checking pkcheck (Daniel P. Berrange) - nodeinfo: Calculate present and online CPUs only once (Andrea Bolognani) - nodeinfo: Use a bitmap to keep track of node CPUs (Andrea Bolognani) - nodeinfo: Use nodeGetOnlineCPUBitmap() when parsing node (Andrea Bolognani) - nodeinfo: Phase out cpu_set_t usage (Andrea Bolognani) - nodeinfo: Rename nodeGetCPUBitmap() to nodeGetOnlineCPUBitmap() (Andrea Bolognani) - nodeinfo: Remove out parameter from nodeGetCPUBitmap() (Andrea Bolognani) - nodeinfo: Add old kernel compatibility to nodeGetPresentCPUBitmap() (Andrea Bolognani) - nodeinfo: Rename linuxParseCPUmax() to linuxParseCPUCount() (Andrea Bolognani) - nodeinfo: Introduce linuxGetCPUOnlinePath() (Andrea Bolognani) - nodeinfo: Introduce linuxGetCPUGlobalPath() (Andrea Bolognani) - nodeinfo: Add nodeGetPresentCPUBitmap() to libvirt_private.syms (Andrea Bolognani) - virsh: Refactor block job waiting in cmdBlockCopy (Peter Krempa) - virsh: Refactor block job waiting in cmdBlockCommit (Peter Krempa) - virsh: Refactor block job waiting in cmdBlockPull (Peter Krempa) - qemu: Update state of block job to READY only if it actually is ready (Peter Krempa) - virsh: Refactor argument handling in cmdBlockPull (Peter Krempa) - virsh: Refactor argument handling in cmdBlockCopy (Peter Krempa) - virsh: Refactor argument checking in cmdBlockCommit (Peter Krempa) - virsh: Kill blockJobImpl by moving the final impl into cmdBlockCommit (Peter Krempa) - virsh: Split out block pull implementation from blockJobImpl (Peter Krempa) - virsh: block job: separate abort from blockJobImpl (Peter Krempa) - virsh: blockjob: Split out vshBlockJobSetSpeed from blockJobImpl (Peter Krempa) - virsh: cmdBlockJob: Switch to declarative flag interlocking (Peter Krempa) - virsh: blockjob: Extract block job info code into a separate function (Peter Krempa) - nodedev: add RDMA and tx-udp_tnl-segmentation NIC capabilities (Moshe Levi) - qemu: Use heads parameter for QXL driver (Frediano Ziglio) - rbd: Use RBD format 2 by default when creating images. (Wido den Hollander) - virsh: Don't output node frequency if unknown (Martin Kletzander) - qemu: Test for virtio-9p-ccw support (Boris Fiuczynski) - qemu: Make virtio-9p-ccw the default for s390-ccw-virtio machines (Boris Fiuczynski) - qemu: Support for virtio-9p-ccw (Boris Fiuczynski) - virsh: Teach cmdFreepages to work with lxc driver (Michal Privoznik) - cmdVcpuPin: Remove dead code (Michal Privoznik) - lxc: wait for nbd device to be up to get its PIDs (Cédric Bosdonnat) - nodeinfo: Formatting changes (Andrea Bolognani) - nodeinfo: Make sysfs_prefix usage more consistent (Andrea Bolognani) - qemu: process: Improve update of maximum balloon state at startup (Peter Krempa) - qemuDomainSetNumaParamsLive: Check for NUMA mode more wisely (Michal Privoznik) - conf: Add getter for network routes (Martin Kletzander) - tests: Add nodeinfo test for non-present CPUs (Andrea Bolognani) - nodeinfo: Add sysfs_prefix to nodeGetMemoryStats (John Ferlan) - nodeinfo: Add sysfs_prefix to nodeCapsInitNUMA (John Ferlan) - nodeinfo: Add sysfs_prefix to nodeGetInfo (John Ferlan) - nodeinfo: Add sysfs_prefix to nodeGetCPUMap (John Ferlan) - nodeinfo: Add sysfs_prefix to nodeGetCPUBitmap (John Ferlan) - nodeinfo: Add sysfs_prefix to nodeGetPresentCPUBitmap (John Ferlan) - nodeinfo: Add sysfs_prefix to nodeGetCPUCount (John Ferlan) - nodeinfo: Introduce local linuxGetCPUPresentPath (John Ferlan) - virt-driver-vz: Require parallels-7.0.22 at least (Michal Privoznik) - configure: Move Virtuozzo checks to a specific module (Michal Privoznik) - qemuProcessHandleMigrationStatus: Update migration status more frequently (Michal Privoznik) - vz: fix cleanup of nets of bridged type (Dmitry Guryanov) - qemu: Use error from Finish instead of "unexpectedly failed" (Jiri Denemark) - qemu: Don't report false error from MigrateFinish (Jiri Denemark) - qemu: Remember incoming migration errors (Jiri Denemark) - Introduce virErrorCopyNew (Jiri Denemark) - Introduce virHashAtomic (Jiri Denemark) - cpu: Add support for MPX and AVX512 Intel features (Jiri Denemark) - virt-aa-helper: add DomainGuest to mockup caps (Cédric Bosdonnat) - virt-aa-helper: rename ctl->hvm to ctl->os (Cédric Bosdonnat) - Get more libvirt errors from virt-aa-helper (Cédric Bosdonnat) - virt-aa-helper: fix rules for paths with trailing slash (Cédric Bosdonnat) - rpc: Add virNetDaemonHasClients (Martin Kletzander) - Rewrite allocation tracking when cloning volumes (Ján Tomko) - qemu: Drop LFs at the end of error from QEMU log (Jiri Denemark) - qemu: Log all arguments of qemuProcessStart (Jiri Denemark) - qemu: Wait for migration events on domain condition (Jiri Denemark) - qemu: Update migration state according to MIGRATION event (Jiri Denemark) - qemuDomainGetJobStatsInternal: Support migration events (Jiri Denemark) - qemu: Enable migration events on QMP monitor (Jiri Denemark) - qemu_monitor: Wire up MIGRATION event (Jiri Denemark) - qemu_hotplug: try harder to eject media (Pavel Hrdina) - monitor: detect that eject fails because the tray is locked (Pavel Hrdina) - virDomainObjSignal: drop this function (Pavel Hrdina) - virCondWaitUntil: add another return value (Pavel Hrdina) - qemu: Refactor qemuSetUnprivSGIO return values (John Ferlan) - qemu: Inline qemuGetHostdevPath (John Ferlan) - qemu: Refactor qemuCheckSharedDisk to create qemuCheckUnprivSGIO (John Ferlan) - libxl: rework setting the state of virDomainObj (Jim Fehlig) - libxl: support dom0 (Jim Fehlig) - qemu: Introduce qemuGetHostdevPath (John Ferlan) - qemu: Introduce qemuIsSharedHostdev (John Ferlan) - docs: Clarify unprivileged sgio feature (John Ferlan) - conf: use virDomainChrSourceDef to save server path (Luyao Huang) - qemu: Refactor creation of shared memory device commandline (Luyao Huang) - qemu: Assign IDs for shared memory devices (Luyao Huang) - Separate isa-fdc options generation (Ján Tomko) - Add support for portable-rpcgen from portablexdr library (Pavel Fedin) - Remove explicit enum from protocol structures (Pavel Fedin) - util: bitmap: Don't alloc overly large binary bitmaps (Peter Krempa) - vz: Use virBitmapToDataBuf instead of virBitmapToData in vzDomainGetVcpus (Peter Krempa) - vz: Remove dead code from vzDomainGetVcpus (Peter Krempa) - qemu: move the guest status check before agent config and status check (Luyao Huang) - qemu: remove deadcode in qemuDomain{HelperGetVcpus|GetIOThreadsLive} (Luyao Huang) - vz: assign static IPs and default gateways for network adapter (Mikhail Feoktistov) - vz: fix building capabilities (Dmitry Guryanov) - qemu_driver: live/config checks cleanup (Pavel Hrdina) - Post-release version bump to 1.2.18 (Michal Privoznik) - cpu_map.xml: Expand Opteron_G4 CPU model (Jiri Denemark) - cpu_map.xml: Expand Opteron_G2 CPU model (Jiri Denemark) - cpu_map.xml: Expand Opteron_G1 CPU model (Jiri Denemark) - cpu_map.xml: Expand Broadwell-noTSX CPU model (Jiri Denemark) - cpu_map.xml: Expand Haswell-noTSX CPU model (Jiri Denemark) - cpu_map.xml: Expand SandyBridge CPU model (Jiri Denemark) - cpu_map.xml: Expand Westmere CPU model (Jiri Denemark) - cpu_map.xml: Expand Nehalem CPU model (Jiri Denemark) - cpu_map.xml: Expand Penryn CPU model (Jiri Denemark) - cpu_map.xml: Expand Conroe CPU model (Jiri Denemark) - cpu_map.xml: Expand kvm64 CPU model (Jiri Denemark) - cpu_map.xml: Expand cpu64-rhel5 CPU model (Jiri Denemark) - cpu_map.xml: Expand kvm32 CPU model (Jiri Denemark) - cpu_map.xml: Expand qemu32 CPU model (Jiri Denemark) - cpu_map.xml: Expand n270 CPU model (Jiri Denemark) - cpu_map.xml: Expand coreduo CPU model (Jiri Denemark) - cpu_map.xml: Expand pentiumpro CPU model (Jiri Denemark) - cpu_map.xml: Expand pentium2 CPU model (Jiri Denemark) - cpu_map.xml: Expand pentium CPU model (Jiri Denemark) - cpu_map.xml: Expand 486 CPU model (Jiri Denemark) - cpu_map.xml: Sort features in x86 CPU models (Jiri Denemark) Thanks everybody who helped make that release, with patches, ideas, bug reports, documentation, etc ... Enjoy, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH v2] rpc: Remove keepalive_required option
by Martin Kletzander 03 Aug '15

03 Aug '15

Since its introduction in 2011 (particularly in commit f4324e329275), the option doesn't work. It just effectively disables all incoming connections. That's because the client private data that contain the 'keepalive_supported' boolean, are initialized to zeroes so the bool is false and the only other place where the bool is used is when checking whether the client supports keepalive. Thus, according to the server, no client supports keepalive. Removing this instead of fixing it is better because a) apparently nobody ever tried it since 2011 (4 years without one month) and b) we cannot know whether the client supports keepalive until we get a ping or pong keepalive packet. And that won't happen untile after we dispatched the ConnectOpen call. Another two reasons would be c) the keepalive_required was tracked on the server level, but keepalive_supported was in private data of the client as well as the check that was made in the remote layer, thus making all other instances of virNetServer miss this feature unless they all implemented it for themselves and d) we can always add it back in case there is a request and a use-case for it. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- v2: - Added a new daemontest file with current input/output. daemon/libvirtd-config.c | 4 ---- daemon/libvirtd-config.h | 2 -- daemon/libvirtd.aug | 2 -- daemon/libvirtd.c | 2 -- daemon/libvirtd.conf | 7 ------ daemon/libvirtd.h | 1 - daemon/remote.c | 8 +------ daemon/test_libvirtd.aug.in | 2 -- src/libvirt_remote.syms | 1 - src/locking/lock_daemon.c | 2 +- src/lxc/lxc_controller.c | 2 +- src/rpc/virnetserver.c | 25 +--------------------- src/rpc/virnetserver.h | 3 --- ....json => input-data-no-keepalive-required.json} | 2 -- .../virnetdaemondata/output-data-admin-nomdns.json | 2 -- .../virnetdaemondata/output-data-anon-clients.json | 1 - .../output-data-initial-nomdns.json | 1 - tests/virnetdaemondata/output-data-initial.json | 1 - ...json => output-data-no-keepalive-required.json} | 2 -- tests/virnetdaemontest.c | 2 +- 20 files changed, 5 insertions(+), 67 deletions(-) copy tests/virnetdaemondata/{input-data-admin-nomdns.json => input-data-no-keepalive-required.json} (96%) copy tests/virnetdaemondata/{input-data-admin-nomdns.json => output-data-no-keepalive-required.json} (96%) diff --git a/daemon/libvirtd-config.c b/daemon/libvirtd-config.c index 10dcc423d2db..c31c8b2e9ab5 100644 --- a/daemon/libvirtd-config.c +++ b/daemon/libvirtd-config.c @@ -292,7 +292,6 @@ daemonConfigNew(bool privileged ATTRIBUTE_UNUSED) data->keepalive_interval = 5; data->keepalive_count = 5; - data->keepalive_required = 0; data->admin_min_workers = 5; data->admin_max_workers = 20; @@ -302,7 +301,6 @@ daemonConfigNew(bool privileged ATTRIBUTE_UNUSED) data->admin_keepalive_interval = 5; data->admin_keepalive_count = 5; - data->admin_keepalive_required = 0; localhost = virGetHostname(); if (localhost == NULL) { @@ -471,11 +469,9 @@ daemonConfigLoadOptions(struct daemonConfig *data, GET_CONF_INT(conf, filename, keepalive_interval); GET_CONF_UINT(conf, filename, keepalive_count); - GET_CONF_UINT(conf, filename, keepalive_required); GET_CONF_INT(conf, filename, admin_keepalive_interval); GET_CONF_UINT(conf, filename, admin_keepalive_count); - GET_CONF_UINT(conf, filename, admin_keepalive_required); return 0; diff --git a/daemon/libvirtd-config.h b/daemon/libvirtd-config.h index 9cdae1a0cb59..3e1971d67f05 100644 --- a/daemon/libvirtd-config.h +++ b/daemon/libvirtd-config.h @@ -81,7 +81,6 @@ struct daemonConfig { int keepalive_interval; unsigned int keepalive_count; - int keepalive_required; int admin_min_workers; int admin_max_workers; @@ -91,7 +90,6 @@ struct daemonConfig { int admin_keepalive_interval; unsigned int admin_keepalive_count; - int admin_keepalive_required; }; diff --git a/daemon/libvirtd.aug b/daemon/libvirtd.aug index a70aa1dddf90..7c7992dd0568 100644 --- a/daemon/libvirtd.aug +++ b/daemon/libvirtd.aug @@ -79,11 +79,9 @@ module Libvirtd = let keepalive_entry = int_entry "keepalive_interval" | int_entry "keepalive_count" - | bool_entry "keepalive_required" let admin_keepalive_entry = int_entry "admin_keepalive_interval" | int_entry "admin_keepalive_count" - | bool_entry "admin_keepalive_required" let misc_entry = str_entry "host_uuid" diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 71db4a042c7f..250094bd21dd 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -1389,7 +1389,6 @@ int main(int argc, char **argv) { config->max_anonymous_clients, config->keepalive_interval, config->keepalive_count, - !!config->keepalive_required, config->mdns_adv ? config->mdns_name : NULL, remoteClientInitHook, NULL, @@ -1464,7 +1463,6 @@ int main(int argc, char **argv) { 0, config->admin_keepalive_interval, config->admin_keepalive_count, - !!config->admin_keepalive_required, NULL, remoteAdmClientInitHook, NULL, diff --git a/daemon/libvirtd.conf b/daemon/libvirtd.conf index ac06cdd79103..cd990b28f744 100644 --- a/daemon/libvirtd.conf +++ b/daemon/libvirtd.conf @@ -440,14 +440,7 @@ # #keepalive_interval = 5 #keepalive_count = 5 -# -# If set to 1, libvirtd will refuse to talk to clients that do not -# support keepalive protocol. Defaults to 0. -# -#keepalive_required = 1 # Keepalive settings for the admin interface #admin_keepalive_interval = 5 #admin_keepalive_count = 5 -# -#admin_keepalive_required = 1 diff --git a/daemon/libvirtd.h b/daemon/libvirtd.h index 8c1a904893ab..efd4823ae18e 100644 --- a/daemon/libvirtd.h +++ b/daemon/libvirtd.h @@ -72,7 +72,6 @@ struct daemonClientPrivate { virConnectPtr conn; daemonClientStreamPtr streams; - bool keepalive_supported; }; /* Separate private data for admin connection */ diff --git a/daemon/remote.c b/daemon/remote.c index e9e2dcae80e0..3a3eb0913088 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -1290,7 +1290,7 @@ void *remoteClientInitHook(virNetServerClientPtr client, /*----- Functions. -----*/ static int -remoteDispatchConnectOpen(virNetServerPtr server, +remoteDispatchConnectOpen(virNetServerPtr server ATTRIBUTE_UNUSED, virNetServerClientPtr client, virNetMessagePtr msg ATTRIBUTE_UNUSED, virNetMessageErrorPtr rerr, @@ -1309,12 +1309,6 @@ remoteDispatchConnectOpen(virNetServerPtr server, goto cleanup; } - if (virNetServerKeepAliveRequired(server) && !priv->keepalive_supported) { - virReportError(VIR_ERR_OPERATION_FAILED, "%s", - _("keepalive support is required to connect")); - goto cleanup; - } - name = args->name ? *args->name : NULL; /* If this connection arrived on a readonly socket, force diff --git a/daemon/test_libvirtd.aug.in b/daemon/test_libvirtd.aug.in index 4921cbfb86b3..3c29aac9747f 100644 --- a/daemon/test_libvirtd.aug.in +++ b/daemon/test_libvirtd.aug.in @@ -57,7 +57,5 @@ module Test_libvirtd = { "host_uuid" = "00000000-0000-0000-0000-000000000000" } { "keepalive_interval" = "5" } { "keepalive_count" = "5" } - { "keepalive_required" = "1" } { "admin_keepalive_interval" = "5" } { "admin_keepalive_count" = "5" } - { "admin_keepalive_required" = "1" } diff --git a/src/libvirt_remote.syms b/src/libvirt_remote.syms index 6bfdcfa819bf..90a453c8be9c 100644 --- a/src/libvirt_remote.syms +++ b/src/libvirt_remote.syms @@ -101,7 +101,6 @@ virNetServerAddProgram; virNetServerAddService; virNetServerClose; virNetServerHasClients; -virNetServerKeepAliveRequired; virNetServerNew; virNetServerNewPostExecRestart; virNetServerPreExecRestart; diff --git a/src/locking/lock_daemon.c b/src/locking/lock_daemon.c index ecbe03a4c154..c03502459acd 100644 --- a/src/locking/lock_daemon.c +++ b/src/locking/lock_daemon.c @@ -151,7 +151,7 @@ virLockDaemonNew(virLockDaemonConfigPtr config, bool privileged) if (!(lockd->srv = virNetServerNew(1, 1, 0, config->max_clients, config->max_clients, -1, 0, - false, NULL, + NULL, virLockDaemonClientNew, virLockDaemonClientPreExecRestart, virLockDaemonClientFree, diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index 110a55662be0..48a3597ed274 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -925,7 +925,7 @@ static int virLXCControllerSetupServer(virLXCControllerPtr ctrl) return -1; if (!(srv = virNetServerNew(0, 0, 0, 1, - 0, -1, 0, false, + 0, -1, 0, NULL, virLXCControllerClientPrivateNew, NULL, diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index 60a9714f6096..80b5588bf3c9 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -69,7 +69,6 @@ struct _virNetServer { int keepaliveInterval; unsigned int keepaliveCount; - bool keepaliveRequired; #ifdef WITH_GNUTLS virNetTLSContextPtr tls; @@ -312,7 +311,6 @@ virNetServerPtr virNetServerNew(size_t min_workers, size_t max_anonymous_clients, int keepaliveInterval, unsigned int keepaliveCount, - bool keepaliveRequired, const char *mdnsGroupName, virNetServerClientPrivNew clientPrivNew, virNetServerClientPrivPreExecRestart clientPrivPreExecRestart, @@ -338,7 +336,6 @@ virNetServerPtr virNetServerNew(size_t min_workers, srv->nclients_unauth_max = max_anonymous_clients; srv->keepaliveInterval = keepaliveInterval; srv->keepaliveCount = keepaliveCount; - srv->keepaliveRequired = keepaliveRequired; srv->clientPrivNew = clientPrivNew; srv->clientPrivPreExecRestart = clientPrivPreExecRestart; srv->clientPrivFree = clientPrivFree; @@ -380,7 +377,6 @@ virNetServerPtr virNetServerNewPostExecRestart(virJSONValuePtr object, unsigned int max_anonymous_clients; unsigned int keepaliveInterval; unsigned int keepaliveCount; - bool keepaliveRequired; const char *mdnsGroupName = NULL; if (virJSONValueObjectGetNumberUint(object, "min_workers", &min_workers) < 0) { @@ -423,11 +419,6 @@ virNetServerPtr virNetServerNewPostExecRestart(virJSONValuePtr object, _("Missing keepaliveCount data in JSON document")); goto error; } - if (virJSONValueObjectGetBoolean(object, "keepaliveRequired", &keepaliveRequired) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Missing keepaliveRequired data in JSON document")); - goto error; - } if (virJSONValueObjectHasKey(object, "mdnsGroupName") && (!(mdnsGroupName = virJSONValueObjectGetString(object, "mdnsGroupName")))) { @@ -440,7 +431,7 @@ virNetServerPtr virNetServerNewPostExecRestart(virJSONValuePtr object, priority_workers, max_clients, max_anonymous_clients, keepaliveInterval, keepaliveCount, - keepaliveRequired, mdnsGroupName, + mdnsGroupName, clientPrivNew, clientPrivPreExecRestart, clientPrivFree, clientPrivOpaque))) goto error; @@ -573,11 +564,6 @@ virJSONValuePtr virNetServerPreExecRestart(virNetServerPtr srv) _("Cannot set keepaliveCount data in JSON document")); goto error; } - if (virJSONValueObjectAppendBoolean(object, "keepaliveRequired", srv->keepaliveRequired) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Cannot set keepaliveRequired data in JSON document")); - goto error; - } if (srv->mdnsGroupName && virJSONValueObjectAppendString(object, "mdnsGroupName", srv->mdnsGroupName) < 0) { @@ -786,15 +772,6 @@ void virNetServerClose(virNetServerPtr srv) virObjectUnlock(srv); } -bool virNetServerKeepAliveRequired(virNetServerPtr srv) -{ - bool required; - virObjectLock(srv); - required = srv->keepaliveRequired; - virObjectUnlock(srv); - return required; -} - static inline size_t virNetServerTrackPendingAuthLocked(virNetServerPtr srv) { diff --git a/src/rpc/virnetserver.h b/src/rpc/virnetserver.h index 0e16e8fb1bf0..89d8db9b9ee4 100644 --- a/src/rpc/virnetserver.h +++ b/src/rpc/virnetserver.h @@ -41,7 +41,6 @@ virNetServerPtr virNetServerNew(size_t min_workers, size_t max_anonymous_clients, int keepaliveInterval, unsigned int keepaliveCount, - bool keepaliveRequired, const char *mdnsGroupName, virNetServerClientPrivNew clientPrivNew, virNetServerClientPrivPreExecRestart clientPrivPreExecRestart, @@ -74,8 +73,6 @@ int virNetServerSetTLSContext(virNetServerPtr srv, virNetTLSContextPtr tls); # endif -bool virNetServerKeepAliveRequired(virNetServerPtr srv); - size_t virNetServerTrackPendingAuth(virNetServerPtr srv); size_t virNetServerTrackCompletedAuth(virNetServerPtr srv); diff --git a/tests/virnetdaemondata/input-data-admin-nomdns.json b/tests/virnetdaemondata/input-data-no-keepalive-required.json similarity index 96% copy from tests/virnetdaemondata/input-data-admin-nomdns.json copy to tests/virnetdaemondata/input-data-no-keepalive-required.json index 59bc4714a60b..b5e4dc8e0391 100644 --- a/tests/virnetdaemondata/input-data-admin-nomdns.json +++ b/tests/virnetdaemondata/input-data-no-keepalive-required.json @@ -7,7 +7,6 @@ "max_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, @@ -68,7 +67,6 @@ "max_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, diff --git a/tests/virnetdaemondata/output-data-admin-nomdns.json b/tests/virnetdaemondata/output-data-admin-nomdns.json index 5df71a0d88c8..a814aeb80614 100644 --- a/tests/virnetdaemondata/output-data-admin-nomdns.json +++ b/tests/virnetdaemondata/output-data-admin-nomdns.json @@ -8,7 +8,6 @@ "max_anonymous_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, @@ -70,7 +69,6 @@ "max_anonymous_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, diff --git a/tests/virnetdaemondata/output-data-anon-clients.json b/tests/virnetdaemondata/output-data-anon-clients.json index 4e4332691aa7..05fc0ae00d3f 100644 --- a/tests/virnetdaemondata/output-data-anon-clients.json +++ b/tests/virnetdaemondata/output-data-anon-clients.json @@ -8,7 +8,6 @@ "max_anonymous_clients": 10, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, diff --git a/tests/virnetdaemondata/output-data-initial-nomdns.json b/tests/virnetdaemondata/output-data-initial-nomdns.json index bef54bf94ad5..400e47bc9463 100644 --- a/tests/virnetdaemondata/output-data-initial-nomdns.json +++ b/tests/virnetdaemondata/output-data-initial-nomdns.json @@ -8,7 +8,6 @@ "max_anonymous_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, diff --git a/tests/virnetdaemondata/output-data-initial.json b/tests/virnetdaemondata/output-data-initial.json index 9afa791d91fc..e875cffe5c01 100644 --- a/tests/virnetdaemondata/output-data-initial.json +++ b/tests/virnetdaemondata/output-data-initial.json @@ -8,7 +8,6 @@ "max_anonymous_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "mdnsGroupName": "libvirtTest", "services": [ { diff --git a/tests/virnetdaemondata/input-data-admin-nomdns.json b/tests/virnetdaemondata/output-data-no-keepalive-required.json similarity index 96% copy from tests/virnetdaemondata/input-data-admin-nomdns.json copy to tests/virnetdaemondata/output-data-no-keepalive-required.json index 59bc4714a60b..b5e4dc8e0391 100644 --- a/tests/virnetdaemondata/input-data-admin-nomdns.json +++ b/tests/virnetdaemondata/output-data-no-keepalive-required.json @@ -7,7 +7,6 @@ "max_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, @@ -68,7 +67,6 @@ "max_clients": 100, "keepaliveInterval": 120, "keepaliveCount": 5, - "keepaliveRequired": true, "services": [ { "auth": 0, diff --git a/tests/virnetdaemontest.c b/tests/virnetdaemontest.c index ef45018f5873..fb8a6c0c0ec5 100644 --- a/tests/virnetdaemontest.c +++ b/tests/virnetdaemontest.c @@ -50,7 +50,7 @@ testCreateServer(const char *host, int family) } if (!(srv = virNetServerNew(10, 50, 5, 100, 10, - 120, 5, true, + 120, 5, mdns_group, NULL, NULL, -- 2.5.0

2 3

[libvirt] [python PATCH] Check return value of PyList_Append
by Jiri Denemark 03 Aug '15

03 Aug '15

libvirt_virDomainGetSecurityLabelList called PyList_Append without checking its return value. While looking at it I noticed the function did not properly check several other return values either so I fixed them all. https://bugzilla.redhat.com/show_bug.cgi?id=1249511 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- libvirt-override.c | 46 ++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 8 deletions(-) diff --git a/libvirt-override.c b/libvirt-override.c index 45c8afc..95061e8 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -3142,32 +3142,62 @@ libvirt_virDomainGetSecurityLabel(PyObject *self ATTRIBUTE_UNUSED, PyObject *arg #if LIBVIR_CHECK_VERSION(0, 10, 0) static PyObject * -libvirt_virDomainGetSecurityLabelList(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { +libvirt_virDomainGetSecurityLabelList(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) +{ PyObject *py_retval; int c_retval; virDomainPtr dom; PyObject *pyobj_dom; - virSecurityLabel *labels; + virSecurityLabel *labels = NULL; size_t i; if (!PyArg_ParseTuple(args, (char *)"O:virDomainGetSecurityLabel", &pyobj_dom)) return NULL; + dom = (virDomainPtr) PyvirDomain_Get(pyobj_dom); LIBVIRT_BEGIN_ALLOW_THREADS; c_retval = virDomainGetSecurityLabelList(dom, &labels); LIBVIRT_END_ALLOW_THREADS; + if (c_retval < 0) return VIR_PY_NONE; - py_retval = PyList_New(0); + + if (!(py_retval = PyList_New(0))) + goto error; + for (i = 0 ; i < c_retval ; i++) { - PyObject *entry = PyList_New(2); - PyList_SetItem(entry, 0, libvirt_constcharPtrWrap(&labels[i].label[0])); - PyList_SetItem(entry, 1, libvirt_boolWrap(labels[i].enforcing)); - PyList_Append(py_retval, entry); + PyObject *entry; + PyObject *value; + + if (!(entry = PyList_New(2)) || + PyList_Append(py_retval, entry) < 0) { + Py_XDECREF(entry); + goto error; + } + + if (!(value = libvirt_constcharPtrWrap(&labels[i].label[0])) || + PyList_SetItem(entry, 0, value) < 0) { + Py_XDECREF(value); + goto error; + } + + if (!(value = libvirt_boolWrap(labels[i].enforcing)) || + PyList_SetItem(entry, 1, value) < 0) { + Py_XDECREF(value); + goto error; + } } - free(labels); + + cleanup: + VIR_FREE(labels); return py_retval; + + error: + Py_XDECREF(py_retval); + py_retval = NULL; + goto cleanup; } #endif /* LIBVIR_CHECK_VERSION(0, 10, 0) */ -- 2.5.0

2 1

[libvirt] [PATCH] lxc: Add option to inherit namespace from a name container or a pid or a netns
by ik.nitk 03 Aug '15

03 Aug '15

lxc / docker containers gives option to inherit the namespaces. Example lxc-start has option [ --share-[net|ipc|uts] name|pid ] where --share-net name|pid means Inherit a network namespace from a name container or a pid. This patch tries to add the similar option to libvirt lxc. So to inherit namespace from name container c2. add this into xml. <lxc:namespace> <sharenet type='name' value='c2'/> </lxc:namespace> And to inherit namespace from a pid. add this into xml. <lxc:namespace> <sharenet type='pid' value='10245'/> </lxc:namespace> And to inherit namespace from a netns. add this into xml. <lxc:namespace> <sharenet type='netns' value='red'/> </lxc:namespace> Similar options for ipc/uts. <shareipc /> , <shareuts /> The reasong lxc xml namespace is added because this feature is very specific to lxc. Therfore wanted to keep it seperated from actual libvirt xml domain. So the final vrish xml file would look like <domain type='lxc' xmlns:lxc='http://libvirt.org/schemas/domain/lxc/1.0'> <name>cn-03</name> <memory>327680</memory> <os> <type>exe</type> <init>/sbin/init</init> </os> <lxc:namespace> <sharenet type='netns' value='red'/> </lxc:namespace> <vcpu>1</vcpu> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/lib/libvirt/libvirt_lxc</emulator> <filesystem type='mount'> <source dir='/var/lib/lxc/u1/rootfs'/> <target dir='/'/> </filesystem> <console type='pty'/> </devices> </domain> -imran --- src/Makefile.am | 5 +- src/lxc/lxc_conf.c | 2 +- src/lxc/lxc_conf.h | 23 +++++ src/lxc/lxc_container.c | 191 ++++++++++++++++++++++++++++++++++-- src/lxc/lxc_domain.c | 254 +++++++++++++++++++++++++++++++++++++++++++++++- src/lxc/lxc_domain.h | 1 + 6 files changed, 463 insertions(+), 13 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 579421d..1a78fde 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1293,7 +1293,8 @@ libvirt_driver_lxc_impl_la_CFLAGS = \ -I$(srcdir)/access \ -I$(srcdir)/conf \ $(AM_CFLAGS) -libvirt_driver_lxc_impl_la_LIBADD = $(CAPNG_LIBS) $(LIBNL_LIBS) $(FUSE_LIBS) +libvirt_driver_lxc_impl_la_LIBADD = $(CAPNG_LIBS) $(LIBNL_LIBS) $(LIBXML_LIBS) $(FUSE_LIBS) +libvirt_driver_lxc_impl_la_LDFLAGS = libvirt-lxc.la if WITH_BLKID libvirt_driver_lxc_impl_la_CFLAGS += $(BLKID_CFLAGS) libvirt_driver_lxc_impl_la_LIBADD += $(BLKID_LIBS) @@ -2652,6 +2653,8 @@ libvirt_lxc_LDADD = \ libvirt-net-rpc.la \ libvirt_security_manager.la \ libvirt_conf.la \ + libvirt.la \ + libvirt-lxc.la \ libvirt_util.la \ ../gnulib/lib/libgnu.la if WITH_DTRACE_PROBES diff --git a/src/lxc/lxc_conf.c b/src/lxc/lxc_conf.c index c393cb5..96a0f47 100644 --- a/src/lxc/lxc_conf.c +++ b/src/lxc/lxc_conf.c @@ -213,7 +213,7 @@ lxcDomainXMLConfInit(void) { return virDomainXMLOptionNew(&virLXCDriverDomainDefParserConfig, &virLXCDriverPrivateDataCallbacks, - NULL); + &virLXCDriverDomainXMLNamespace); } diff --git a/src/lxc/lxc_conf.h b/src/lxc/lxc_conf.h index 8340b1f..59002e5 100644 --- a/src/lxc/lxc_conf.h +++ b/src/lxc/lxc_conf.h @@ -67,6 +67,29 @@ struct _virLXCDriverConfig { bool securityRequireConfined; }; + +typedef enum { + VIR_DOMAIN_NAMESPACE_SHARENET = 0, + VIR_DOMAIN_NAMESPACE_SHAREIPC, + VIR_DOMAIN_NAMESPACE_SHAREUTS, + VIR_DOMAIN_NAMESPACE_LAST, +} virDomainNamespace; + +struct ns_info { + const char *proc_name; + int clone_flag; +}; + +extern const struct ns_info ns_info[VIR_DOMAIN_NAMESPACE_LAST]; + +typedef struct _lxcDomainDef lxcDomainDef; +typedef lxcDomainDef *lxcDomainDefPtr; +struct _lxcDomainDef { + int ns_inherit_fd[VIR_DOMAIN_NAMESPACE_LAST]; + char *ns_type[VIR_DOMAIN_NAMESPACE_LAST]; + char *ns_val[VIR_DOMAIN_NAMESPACE_LAST]; +}; + struct _virLXCDriver { virMutex lock; diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 9a9ae5c..a9a7ba0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -25,8 +25,8 @@ */ #include <config.h> - #include <fcntl.h> +#include <sched.h> #include <limits.h> #include <stdlib.h> #include <stdio.h> @@ -38,7 +38,6 @@ #include <mntent.h> #include <sys/reboot.h> #include <linux/reboot.h> - /* Yes, we want linux private one, for _syscall2() macro */ #include <linux/unistd.h> @@ -99,6 +98,50 @@ VIR_LOG_INIT("lxc.lxc_container"); typedef char lxc_message_t; #define LXC_CONTINUE_MSG 'c' +#ifdef __linux__ +/* + * Workaround older glibc. While kernel may support the setns + * syscall, the glibc wrapper might not exist. If that's the + * case, use our own. + */ +# ifndef __NR_setns +# if defined(__x86_64__) +# define __NR_setns 308 +# elif defined(__i386__) +# define __NR_setns 346 +# elif defined(__arm__) +# define __NR_setns 375 +# elif defined(__aarch64__) +# define __NR_setns 375 +# elif defined(__powerpc__) +# define __NR_setns 350 +# elif defined(__s390__) +# define __NR_setns 339 +# endif +# endif + +# ifndef HAVE_SETNS +# if defined(__NR_setns) +# include <sys/syscall.h> + +static inline int setns(int fd, int nstype) +{ + return syscall(__NR_setns, fd, nstype); +} +# else /* !__NR_setns */ +# error Please determine the syscall number for setns on your architecture +# endif +# endif +#else /* !__linux__ */ +static inline int setns(int fd ATTRIBUTE_UNUSED, int nstype ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Namespaces are not supported on this platform.")); + return -1; +} +#endif + + typedef struct __lxc_child_argv lxc_child_argv_t; struct __lxc_child_argv { virDomainDefPtr config; @@ -2233,7 +2276,6 @@ static int lxcContainerChild(void *data) vmDef->os.init); goto cleanup; } - /* rename and enable interfaces */ if (lxcContainerRenameAndEnableInterfaces(vmDef, argv->nveths, @@ -2321,6 +2363,99 @@ virArch lxcContainerGetAlt32bitArch(virArch arch) return VIR_ARCH_NONE; } +/* Used only for containers,same as the one defined in + * domain_conf.c. But used locally + */ +static const struct ns_info ns_info_local[VIR_DOMAIN_NAMESPACE_LAST] = { + [VIR_DOMAIN_NAMESPACE_SHARENET] = {"net", CLONE_NEWNET}, + [VIR_DOMAIN_NAMESPACE_SHAREIPC] = {"ipc", CLONE_NEWIPC}, + [VIR_DOMAIN_NAMESPACE_SHAREUTS] = {"uts", CLONE_NEWUTS} +}; + + +static void close_ns(int ns_fd[VIR_DOMAIN_NAMESPACE_LAST]) +{ + int i; + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + if (ns_fd[i] > -1) { + if (VIR_CLOSE(ns_fd[i]) < 0) + virReportSystemError(errno, "%s", _("failed to close file")); + ns_fd[i] = -1; + } + } +} + + +/** + * lxcPreserve_ns: + * @ns_fd: array to store current namespace + * @clone_flags: namespaces that need to be preserved + */ +static int lxcPreserve_ns(int ns_fd[VIR_DOMAIN_NAMESPACE_LAST], int clone_flags) +{ + int i, saved_errno; + char *path = NULL; + + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) + ns_fd[i] = -1; + + if (access("/proc/self/ns", X_OK)) { + virReportSystemError(errno, "%s", + _("Kernel does not support attach; preserve_ns ignored")); + return 0; + } + + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + if ((clone_flags & ns_info_local[i].clone_flag) == 0) + continue; + if (virAsprintf(&path, "/proc/self/ns/%s", + ns_info_local[i].proc_name) < 0) + goto error; + ns_fd[i] = open(path, O_RDONLY | O_CLOEXEC); + if (ns_fd[i] < 0) + goto error; + } + VIR_FREE(path); + return 0; + error: + saved_errno = errno; + close_ns(ns_fd); + errno = saved_errno; + VIR_FREE(path); + virReportSystemError(errno, _("failed to open '%s'"), path); + return -1; +} + +/** + * lxcAttach_ns: + * @ns_fd: array of namespaces to attach + */ +static int lxcAttach_ns(const int ns_fd[VIR_DOMAIN_NAMESPACE_LAST]) +{ + int i; + + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + if (ns_fd[i] < 0) + continue; + VIR_DEBUG("Setting into namespace\n"); + + /* We get EINVAL if new NS is same as the current + * NS, or if the fd namespace doesn't match the + * type passed to setns()'s second param. Since we + * pass 0, we know the EINVAL is harmless + */ + if (setns(ns_fd[i], 0) < 0 && + errno != EINVAL) + goto error; + } + return 0; + + error: + virReportSystemError(errno, _("failed to set namespace '%s'") + , ns_info_local[i].proc_name); + return -1; +} + /** * lxcContainerStart: @@ -2346,9 +2481,12 @@ int lxcContainerStart(virDomainDefPtr def, char **ttyPaths) { pid_t pid; - int cflags; + int cflags, i; int stacksize = getpagesize() * 4; char *stack, *stacktop; + int saved_ns_fd[VIR_DOMAIN_NAMESPACE_LAST]; + int preserve_mask = 0; + lxcDomainDefPtr lxcDef; lxc_child_argv_t args = { .config = def, .securityDriver = securityDriver, @@ -2368,7 +2506,14 @@ int lxcContainerStart(virDomainDefPtr def, stacktop = stack + stacksize; - cflags = CLONE_NEWPID|CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC|SIGCHLD; + lxcDef = def->namespaceData; + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) + if (lxcDef && lxcDef->ns_inherit_fd[i] != -1) + preserve_mask |= ns_info_local[i].clone_flag; + + + + cflags = CLONE_NEWPID|CLONE_NEWNS|SIGCHLD; if (userns_required(def)) { if (userns_supported()) { @@ -2381,10 +2526,36 @@ int lxcContainerStart(virDomainDefPtr def, return -1; } } + if (!lxcDef || (lxcDef && lxcDef->ns_inherit_fd[VIR_DOMAIN_NAMESPACE_SHARENET] == -1)) { + if (lxcNeedNetworkNamespace(def)) { + VIR_DEBUG("Enable network namespaces"); + cflags |= CLONE_NEWNET; + } + } else { + VIR_DEBUG("Inheriting a net namespace"); + } - if (lxcNeedNetworkNamespace(def)) { - VIR_DEBUG("Enable network namespaces"); - cflags |= CLONE_NEWNET; + if (!lxcDef || (lxcDef && lxcDef->ns_inherit_fd[VIR_DOMAIN_NAMESPACE_SHAREIPC] == -1)) { + cflags |= CLONE_NEWIPC; + } else { + VIR_DEBUG("Inheriting an IPC namespace"); + } + + if (!lxcDef || (lxcDef && lxcDef->ns_inherit_fd[VIR_DOMAIN_NAMESPACE_SHAREUTS] == -1)) { + cflags |= CLONE_NEWUTS; + } else { + VIR_DEBUG("Inheriting a UTS namespace"); + } + + if (lxcDef && lxcPreserve_ns(saved_ns_fd, preserve_mask) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to preserve the namespace")); + return -1; + } + if (lxcDef && lxcAttach_ns(lxcDef->ns_inherit_fd) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to attach the namespace")); + return -1; } VIR_DEBUG("Cloning container init process"); @@ -2397,6 +2568,10 @@ int lxcContainerStart(virDomainDefPtr def, _("Failed to run clone container")); return -1; } + if (lxcDef && lxcAttach_ns(saved_ns_fd)) { + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to restore saved namespaces")); + } return pid; } diff --git a/src/lxc/lxc_domain.c b/src/lxc/lxc_domain.c index c2180cb..6e4a19a 100644 --- a/src/lxc/lxc_domain.c +++ b/src/lxc/lxc_domain.c @@ -20,14 +20,18 @@ */ #include <config.h> - #include "lxc_domain.h" - #include "viralloc.h" #include "virlog.h" #include "virerror.h" +#include <fcntl.h> +#include <libxml/xpathInternals.h> +#include "virstring.h" +#include "virutil.h" +#include "virfile.h" #define VIR_FROM_THIS VIR_FROM_LXC +#define LXC_NAMESPACE_HREF "http://libvirt.org/schemas/domain/lxc/1.0" VIR_LOG_INIT("lxc.lxc_domain"); @@ -41,6 +45,251 @@ static void *virLXCDomainObjPrivateAlloc(void) return priv; } + +static int open_ns(const char *nnsname_pid, const char *ns_proc_name) +{ + int fd = -1; + virDomainPtr dom = NULL; + virConnectPtr conn = NULL; + pid_t pid; + int nfdlist; + int *fdlist; + char *path = NULL; + char *eptr; + pid = strtol(nnsname_pid, &eptr, 10); + if (*eptr != '\0' || pid < 1) { + /* check if the domain is running, then set the namespaces + * to that container + */ + size_t i = 0; + const char *ns[] = { "user", "ipc", "uts", "net", "pid", "mnt" }; + conn = virConnectOpen("lxc:///"); + if (!conn) + goto cleanup; + dom = virDomainLookupByName(conn, nnsname_pid); + if (!dom) + goto cleanup; + if ((nfdlist = virDomainLxcOpenNamespace(dom, &fdlist, 0)) < 0) + goto cleanup; + /* Internally above function calls virProcessGetNamespaces + * function which opens ns + * in the order { "user", "ipc", "uts", "net", "pid", "mnt" } + */ + for (i = 0; i < ARRAY_CARDINALITY(ns); i++) { + if (STREQ(ns[i], ns_proc_name)) { + fd = fdlist[i]; + break; + } + } + if (nfdlist > 0) + VIR_FREE(fdlist); + } else { + if (virAsprintf(&path, "/proc/%d/ns/%s", pid, ns_proc_name) < 0) + goto cleanup; + fd = open(path, O_RDONLY); + } +cleanup: + if (dom) + virDomainFree(dom); + VIR_FREE(path); + (fd < 0)? VIR_ERROR( + _("failed to open ns %s"), nnsname_pid): + VIR_DEBUG("OPENED NAMESPACE : fd %d\n", fd); + return fd; +} + + +/* Used only for containers */ +const struct ns_info ns_info[VIR_DOMAIN_NAMESPACE_LAST] = { + [VIR_DOMAIN_NAMESPACE_SHARENET] = {"net", CLONE_NEWNET}, + [VIR_DOMAIN_NAMESPACE_SHAREIPC] = {"ipc", CLONE_NEWIPC}, + [VIR_DOMAIN_NAMESPACE_SHAREUTS] = {"uts", CLONE_NEWUTS} +}; + +VIR_ENUM_DECL(virDomainNamespace) +VIR_ENUM_IMPL(virDomainNamespace, VIR_DOMAIN_NAMESPACE_LAST, + N_("sharenet"), + N_("shareipc"), + N_("shareuts")) + +static void +lxcDomainDefNamespaceFree(void *nsdata) +{ + int j; + lxcDomainDefPtr lxcDef = nsdata; + for (j = 0; j < VIR_DOMAIN_NAMESPACE_LAST; j++) { + if (lxcDef->ns_inherit_fd[j] > 0) { + VIR_FREE(lxcDef->ns_type); + VIR_FREE(lxcDef->ns_val); +#if 0 + if (VIR_CLOSE(lxcDef->ns_inherit_fd[j]) < 0) + virReportSystemError(errno, "%s", _("failed to close file")); +#endif + } + } + VIR_FREE(nsdata); +} + +static int +lxcDomainDefNamespaceParse(xmlDocPtr xml ATTRIBUTE_UNUSED, + xmlNodePtr root ATTRIBUTE_UNUSED, + xmlXPathContextPtr ctxt, + void **data) +{ + lxcDomainDefPtr lxcDef = NULL; + xmlNodePtr *nodes = NULL; + bool uses_lxc_ns = false; + xmlNodePtr node; + int feature; + int n; + char *tmp = NULL; + size_t i; + pid_t fd = -1; + + if (xmlXPathRegisterNs(ctxt, BAD_CAST "lxc", BAD_CAST LXC_NAMESPACE_HREF) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to register xml namespace '%s'"), + LXC_NAMESPACE_HREF); + return -1; + } + + if (VIR_ALLOC(lxcDef) < 0) + return -1; + + /* Init ns_herit_fd for namespaces */ + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + lxcDef->ns_inherit_fd[i] = -1; + lxcDef->ns_type[i] = NULL; + lxcDef->ns_val[i] = NULL; + } + + node = ctxt->node; + if ((n = virXPathNodeSet("./lxc:namespace/*", ctxt, &nodes)) < 0) + goto error; + uses_lxc_ns |= n > 0; + + for (i = 0; i < n; i++) { + feature = + virDomainNamespaceTypeFromString((const char *) nodes[i]->name); + if (feature < 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported Namespace feature: %s"), + nodes[i]->name); + goto error; + } + + ctxt->node = nodes[i]; + + switch ((virDomainNamespace) feature) { + case VIR_DOMAIN_NAMESPACE_SHARENET: + case VIR_DOMAIN_NAMESPACE_SHAREIPC: + case VIR_DOMAIN_NAMESPACE_SHAREUTS: + { + tmp = virXMLPropString(nodes[i], "type"); + if (tmp == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("No lxc environment type specified")); + goto error; + } + /* save the tmp so that its needed while writing to xml */ + lxcDef->ns_type[feature] = tmp; + tmp = virXMLPropString(nodes[i], "value"); + if (tmp == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("No lxc environment type specified")); + goto error; + } + lxcDef->ns_val[feature] = tmp; + /*netns option is only for VIR_DOMAIN_NAMESPACE_SHARENET*/ + if (STREQ("netns", lxcDef->ns_type[VIR_DOMAIN_NAMESPACE_SHARENET])) { + char *path = NULL; + if (virAsprintf(&path, "/var/run/netns/%s", tmp) < 0) + goto error; + fd = open(path, O_RDONLY); + VIR_FREE(path); + } else { + fd = open_ns(tmp, ns_info[feature].proc_name); + if (fd < 0) { + virReportError(VIR_ERR_XML_ERROR, + _("unable to open %s namespace for " + "namespace feature '%s'"), tmp, + nodes[i]->name); + goto error; + } + } + lxcDef->ns_inherit_fd[feature] = fd; + } + break; + case VIR_DOMAIN_NAMESPACE_LAST: + break; + } + } + VIR_FREE(nodes); + ctxt->node = node; + if (uses_lxc_ns) + *data = lxcDef; + else + VIR_FREE(lxcDef); + return 0; + error: + VIR_FREE(nodes); + lxcDomainDefNamespaceFree(lxcDef); + return -1; +} + + +static int +lxcDomainDefNamespaceFormatXML(virBufferPtr buf, + void *nsdata) +{ + lxcDomainDefPtr lxcDef = nsdata; + size_t j; + + if (!lxcDef) + return 0; + + virBufferAddLit(buf, "<lxc:namespace>\n"); + virBufferAdjustIndent(buf, 2); + + for (j = 0; j < VIR_DOMAIN_NAMESPACE_LAST; j++) { + switch ((virDomainNamespace) j) { + case VIR_DOMAIN_NAMESPACE_SHAREIPC: + case VIR_DOMAIN_NAMESPACE_SHAREUTS: + case VIR_DOMAIN_NAMESPACE_SHARENET: + { + if (lxcDef->ns_inherit_fd[j] > 0) { + virBufferAsprintf(buf, "<%s type='%s' value='%s'/>\n", + virDomainNamespaceTypeToString(j), + lxcDef->ns_type[j], + lxcDef->ns_val[j]); + } + } + break; + case VIR_DOMAIN_NAMESPACE_LAST: + break; + } + } + + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</lxc:namespace>\n"); + return 0; +} + +static const char * +lxcDomainDefNamespaceHref(void) +{ + return "xmlns:lxc='" LXC_NAMESPACE_HREF "'"; +} + + +virDomainXMLNamespace virLXCDriverDomainXMLNamespace = { + .parse = lxcDomainDefNamespaceParse, + .free = lxcDomainDefNamespaceFree, + .format = lxcDomainDefNamespaceFormatXML, + .href = lxcDomainDefNamespaceHref, +}; + + static void virLXCDomainObjPrivateFree(void *data) { virLXCDomainObjPrivatePtr priv = data; @@ -73,7 +322,6 @@ static int virLXCDomainObjPrivateXMLParse(xmlXPathContextPtr ctxt, void *data) } else { priv->initpid = thepid; } - return 0; } diff --git a/src/lxc/lxc_domain.h b/src/lxc/lxc_domain.h index 751aece..25df999 100644 --- a/src/lxc/lxc_domain.h +++ b/src/lxc/lxc_domain.h @@ -41,6 +41,7 @@ struct _virLXCDomainObjPrivate { virCgroupPtr cgroup; }; +extern virDomainXMLNamespace virLXCDriverDomainXMLNamespace; extern virDomainXMLPrivateDataCallbacks virLXCDriverPrivateDataCallbacks; extern virDomainDefParserConfig virLXCDriverDomainDefParserConfig; -- 1.9.1

4 8