- Devel - libvirt List Archives

[libvirt] virsh setmaxmem granularity for vSphere/ESX?
by Justin Clift 14 Jan '11

14 Jan '11

Hi Matthias, Do you know if the virsh "setmaxmem" has the same MB granularity as "setmem" (on vSphere/ESX)? Regards and best wishes, Justin Clift

1 1

[libvirt] [PATCH] docs: clarify that virsh setvcpus and setmem only work on active domains
by Justin Clift 13 Jan '11

13 Jan '11

Addresses BZ # 622534: https://bugzilla.redhat.com/show_bug.cgi?id=622534 --- tools/virsh.pod | 28 ++++++++++++++++++---------- 1 files changed, 18 insertions(+), 10 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 0e03d68..b4c6ff7 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -568,13 +568,16 @@ XEN_CREDIT scheduler and are now I<DEPRECATED>. =item B<setmem> I<domain-id> B<kilobytes> -Change the current memory allocation in the guest domain. This should take -effect immediately. The memory limit is specified in -kilobytes. +Change the current memory allocation in an B<active> guest domain. This +should take effect immediately. The memory limit is specified in kilobytes. For Xen, you can only adjust the memory of a running domain if the domain is paravirtualized or running the PV balloon driver. +B<Note>, this command only works on active guest domains. To change the +number of virtual CPUs in a inactive guest domain, use the virsh B<edit> +command to update the XML <memory> element. + =item B<setmaxmem> I<domain-id> B<kilobytes> Change the maximum memory allocation limit in the guest domain. This should @@ -593,24 +596,29 @@ QEMU/KVM supports I<--hard-limit>, I<--soft-limit>, and I<--swap-hard-limit>. =item B<setvcpus> I<domain-id> I<count> optional I<--maximum> I<--config> I<--live> -Change the number of virtual CPUs active in the guest domain. Note that -I<count> may be limited by host, hypervisor or limit coming from the -original description of domain. +Change the number of virtual CPUs active in an B<active> guest domain. + +The I<count> value may be limited by host, hypervisor or limit coming from +the original description of the guest domain. For Xen, you can only adjust the virtual CPUs of a running domain if the domain is paravirtualized. If I<--config> is specified, the change will only affect the next boot of a domain. If I<--live> is specified, the domain must be -running, and the change takes place immediately. Both flags may be -specified, if supported by the hypervisor. If neither flag is given, -then I<--live> is implied and it is up to the hypervisor whether -I<--config> is also implied. +running, and the change takes place immediately. Both I<--config> and +I<--live> flags may be specified, if supported by the hypervisor. If +neither flag is given, then I<--live> is implied and it is up to the +hypervisor whether I<--config> is also implied. If I<--maximum> is specified, then you must use I<--config> and avoid I<--live>; this flag controls the maximum limit of vcpus that can be hot-plugged the next time the domain is booted. +B<Note>, this command only works on active guest domains. To change the +number of virtual CPUs in a inactive guest domain, use the virsh B<edit> +command to update the XML <vcpu> element. + =item B<shutdown> I<domain-id> Gracefully shuts down a domain. This coordinates with the domain OS -- 1.7.3.2

3 14

[libvirt] esx driver: XML format for guest OS type/variant
by Jake Xu 13 Jan '11

13 Jan '11

Hi, I am trying to create a VM using the Python bindings of Libvirt. I can successfully create VM from a XML template, but I can't find any way to define the guest OS type/variant like CentOS 5.5 64bit for my VM. The native format converted from XML is always guestOS="other-64" - which doesn't tell us much about the guest operating system. I have looked at the C libvirt source code a bit, and it seems like libvirt does not support defining guest os type using XML description yet. Is there any way I can set the guest OS type for my VM? Thanks, Jake

6 23

[libvirt] [PATCH 0/7] security: Allow disabling security per VM
by Cole Robinson 13 Jan '11

13 Jan '11

Enabling a security driver in qemu.conf is currently all or nothing. The option to disable security on a per VM basis can be a useful debugging tool or work around for frustrated users. Patches 1-3 and 5-6 are prep and cleanup work. Patch 4 fixes an easily triggerable segfault when defining a domain in qemu. Patch 7 is the actual feature. Cole Robinson (7): tests: Add qemuxml2xml tests for <seclabel> handling security: Use virDomainSeclabelDefClear security: Add virSecurityIsSpecifiedDriver qemu: Fix segfault if defining a domain without <seclabel> domain: Handle seclabel model with an enum domain: Always validate seclabel model security: Allow disabling security on a per VM basis cfg.mk | 1 + docs/schemas/domain.rng | 13 ++- src/conf/domain_conf.c | 69 ++++++++++----- src/conf/domain_conf.h | 15 +++- src/libvirt_private.syms | 2 +- src/qemu/qemu_driver.c | 4 +- src/security/security_apparmor.c | 31 ++----- src/security/security_driver.c | 25 ++++++ src/security/security_driver.h | 3 + src/security/security_manager.c | 90 +++++++++++++------- src/security/security_selinux.c | 50 +++--------- tests/domainschematest | 2 +- .../qemuxml2xml-balloon-device-auto-out.xml | 25 ++++++ .../qemuxml2xml-channel-virtio-auto-out.xml | 54 ++++++++++++ .../qemuxml2xml-console-compat-auto-out.xml | 31 +++++++ .../qemuxml2xml-console-virtio-out.xml | 29 ++++++ .../qemuxml2xml-disk-scsi-device-auto-out.xml | 31 +++++++ .../qemuxml2xml-seclabel-dynamic-in.xml | 24 +++++ .../qemuxml2xml-seclabel-dynamic-out.xml | 21 +++++ .../qemuxml2xml-seclabel-model-none-in.xml | 21 +++++ .../qemuxml2xml-seclabel-model-none-out.xml | 21 +++++ .../qemuxml2xml-seclabel-static-in.xml | 24 +++++ .../qemuxml2xml-seclabel-static-out.xml | 23 +++++ .../qemuxml2xmlout-balloon-device-auto.xml | 25 ------ .../qemuxml2xmlout-channel-virtio-auto.xml | 54 ------------ .../qemuxml2xmlout-console-compat-auto.xml | 31 ------- .../qemuxml2xmlout-console-virtio.xml | 29 ------ .../qemuxml2xmlout-disk-scsi-device-auto.xml | 31 ------- tests/qemuxml2xmltest.c | 26 ++++-- 29 files changed, 501 insertions(+), 304 deletions(-) create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-balloon-device-auto-out.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-channel-virtio-auto-out.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-console-compat-auto-out.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-console-virtio-out.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-disk-scsi-device-auto-out.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-dynamic-in.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-dynamic-out.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-model-none-in.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-model-none-out.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-static-in.xml create mode 100644 tests/qemuxml2xmldata/qemuxml2xml-seclabel-static-out.xml delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-balloon-device-auto.xml delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-channel-virtio-auto.xml delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-console-compat-auto.xml delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-console-virtio.xml delete mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-scsi-device-auto.xml -- 1.7.3.2

3 23

[libvirt] [PATCH] Fix crash in SELinuxSecurityVerify
by Laine Stump 13 Jan '11

13 Jan '11

When attempting to edit a domain, libvirtd segfaulted in SELinuxSecurityVerify() on this line: if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { because secdef->model was NULL. Although I'm too tired to investigate in depth, I noticed that all the other functions in that file that do the same STREQ() will first check that def->seclabel.label is non-NULL, but this function doesn't. I also noticed that label *is* NULL in my case, so I tried adding that check to SELinuxSecurityVerify(), and the crash goes away. I have no idea if this is the correct fix, but it allowed me to continue my testing of a new (unrelated) feature. --- src/security/security_selinux.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index d06afde..b97ca4c 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -871,6 +871,10 @@ SELinuxSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainDefPtr def) { const virSecurityLabelDefPtr secdef = &def->seclabel; + + if (def->seclabel.label == NULL) + return 0; + if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("security label driver mismatch: " -- 1.7.3.4

4 6

[libvirt] [PATCH 0/6 v2] events: Add helpers for driver dispatching
by Cole Robinson 13 Jan '11

13 Jan '11

I noticed that there is quite a bit of code duplication among the drivers that support domain events. This patch series is an attempt to consolidate the shared logic. v2: 2 patches were applied Addressed Eric's comments: NONNULL tagging Use bool for isDispatching Move libvirt_private.syms earlier Add NULL check in StateFree Cole Robinson (6): domain_event: Add virDomainEventState structure domain_event: Add common domain event queue/flush helpers qemu: Use virDomainEventState helpers lxc: Use virDomainEventState helpers test: Use virDomainEventState helpers remote: Use virDomainEventState helpers cfg.mk | 1 + src/conf/domain_event.c | 166 ++++++++++++++++++++++++++++++++++++++----- src/conf/domain_event.h | 69 +++++++++++++++---- src/libvirt_private.syms | 6 ++ src/lxc/lxc_conf.h | 6 +-- src/lxc/lxc_driver.c | 76 ++++++-------------- src/qemu/qemu_conf.h | 6 +-- src/qemu/qemu_driver.c | 80 +++++++-------------- src/remote/remote_driver.c | 162 ++++++++++++++++-------------------------- src/test/test_driver.c | 104 ++++++++------------------- 10 files changed, 353 insertions(+), 323 deletions(-) -- 1.7.3.3

3 11

[libvirt] [PATCH] virFindFileInPath: only find executable non-directory
by Eric Blake 13 Jan '11

13 Jan '11

Without this patch, at least tests/daemon-conf (which sticks $builddir/src in the PATH) tries to execute the directory $builddir/src/qemu rather than the real /usr/bin/qemu binary. That was fine when qemu_capabilities silently ignored execution failure, but not so good once it is converted to use virCommand. * src/util/util.h (virFileExists): Adjust prototype. (virFileIsExecutable): New prototype. * src/util/util.c (virFindFileInPath): Reject non-executables and directories. Avoid huge stack allocation. (virFileExists): Use lighter-weight syscall. (virFileIsExecutable): New function. * src/libvirt_private.syms (util.h): Export new function. --- Questions: Should I be requiring S_ISREG, rather than !S_ISDIR (that is, should we be rejecting devices and sockets as non-exectuable)? Should I import the gnulib module euidaccess (and/or faccessat) for the access check? Using access(F_OK) is okay regardless of uid/gid, but access(X_OK) may have different answers than euidaccess(X_OK) when the effective uid/gid do not match the current uid/gid. However, dragging in the gnulib module will require adding an extra link library for some platforms (for example, Solaris needs -lgen), which means the change is more invasive as it will also affect Makefiles. src/libvirt_private.syms | 1 + src/util/util.c | 53 ++++++++++++++++++++++++++++++--------------- src/util/util.h | 7 +++-- 3 files changed, 40 insertions(+), 21 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 65911df..948bbe1 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -850,6 +850,7 @@ virFileDeletePid; virFileExists; virFileFindMountPoint; virFileHasSuffix; +virFileIsExecutable; virFileLinkPointsTo; virFileMakePath; virFileMatchesNameSuffix; diff --git a/src/util/util.c b/src/util/util.c index 60feb79..25e6185 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -1255,7 +1255,7 @@ int virFileResolveLink(const char *linkpath, } /* - * Finds a requested file in the PATH env. e.g.: + * Finds a requested executable file in the PATH env. e.g.: * "kvm-img" will return "/usr/bin/kvm-img" * * You must free the result @@ -1263,19 +1263,18 @@ int virFileResolveLink(const char *linkpath, char *virFindFileInPath(const char *file) { char *path; - char pathenv[PATH_MAX]; - char *penv = pathenv; + char *pathiter; char *pathseg; - char fullpath[PATH_MAX]; + char *fullpath = NULL; if (file == NULL) return NULL; /* if we are passed an absolute path (starting with /), return a - * copy of that path + * copy of that path, after validating that it is executable */ - if (file[0] == '/') { - if (virFileExists(file)) + if (IS_ABSOLUTE_FILE_NAME(file)) { + if (virFileIsExecutable(file)) return strdup(file); else return NULL; @@ -1284,27 +1283,45 @@ char *virFindFileInPath(const char *file) /* copy PATH env so we can tweak it */ path = getenv("PATH"); - if (path == NULL || virStrcpyStatic(pathenv, path) == NULL) + if (path == NULL || (path = strdup(path)) == NULL) return NULL; /* for each path segment, append the file to search for and test for * it. return it if found. */ - while ((pathseg = strsep(&penv, ":")) != NULL) { - snprintf(fullpath, PATH_MAX, "%s/%s", pathseg, file); - if (virFileExists(fullpath)) - return strdup(fullpath); + pathiter = path; + while ((pathseg = strsep(&pathiter, ":")) != NULL) { + if (virAsprintf(&fullpath, "%s/%s", pathseg, file) < 0 || + virFileIsExecutable(fullpath)) + break; + VIR_FREE(fullpath); } - return NULL; + VIR_FREE(path); + return fullpath; } -int virFileExists(const char *path) + +bool virFileExists(const char *path) { - struct stat st; + return access(path, F_OK) == 0; +} - if (stat(path, &st) >= 0) - return(1); - return(0); +/* Check that a file can be executed by the current user, and is not + * a directory. */ +bool +virFileIsExecutable(const char *file) +{ + struct stat sb; + + /* The existence of ACLs means that checking (sb.st_mode&0111) for + * executable bits may give false results; plus, access is + * lighter-weight than stat for a first pass filter. + * + * XXX: should this use gnulib's euidaccess module? + */ + return (access(file, X_OK) == 0 && + stat(file, &sb) == 0 && + !S_ISDIR(sb.st_mode)); } #ifndef WIN32 diff --git a/src/util/util.h b/src/util/util.h index 989962f..54c3058 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -1,8 +1,7 @@ - /* * utils.h: common, generic utility functions * - * Copyright (C) 2010 Red Hat, Inc. + * Copyright (C) 2010-2011 Red Hat, Inc. * Copyright (C) 2006, 2007 Binary Karma * Copyright (C) 2006 Shuveb Hussain * @@ -32,6 +31,7 @@ # include <sys/select.h> # include <sys/types.h> # include <stdarg.h> +# include <stdbool.h> # ifndef MIN # define MIN(a, b) ((a) < (b) ? (a) : (b)) @@ -120,7 +120,8 @@ int virFileResolveLink(const char *linkpath, char *virFindFileInPath(const char *file); -int virFileExists(const char *path); +bool virFileExists(const char *file); +bool virFileIsExecutable(const char *file); char *virFileSanitizePath(const char *path); -- 1.7.3.4

2 7

[libvirt] [PATCH 0/5] Explicit boot device ordering
by Jiri Denemark 13 Jan '11

13 Jan '11

Currently, boot order can be specified per device class but there is no way to specify exact disk/NIC device to boot from. This patchset fixes that. There were two options suggested for how this should be modeled in domain XML: 1) <os> <boot target='net1'/> <boot target='net0'/> <boot target='hdc'/> <boot target='hdb'/> <os> Where target attributes would match /domain/devices/*/target@dev 2) Adding <boot order='n'/> elements into appropriate device elements. In addition to the two options Rich suggested a more compact variant of option 1. Per former discussion this patchset implements the second option. Jiri Denemark (5): conf: Move boot parsing into a separate function Introduce per-device boot element qemu: Refactor qemuCapsParsePCIDeviceStrs using virCommand qemu: Support per-device boot ordering tests: Add tests for per-device boot elements docs/formatcaps.html.in | 1 + docs/formatdomain.html.in | 41 +++++- docs/schemas/domain.rng | 20 +++- src/conf/capabilities.c | 3 +- src/conf/domain_conf.c | 148 ++++++++++++++------ src/conf/domain_conf.h | 2 + src/qemu/qemu_capabilities.c | 82 +++++++---- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 15 ++- src/qemu/qemu_command.h | 6 +- src/qemu/qemu_driver.c | 2 + src/qemu/qemu_hotplug.c | 8 +- .../qemuxml2argvdata/qemuxml2argv-boot-order.args | 1 + tests/qemuxml2argvdata/qemuxml2argv-boot-order.xml | 44 ++++++ tests/qemuxml2argvtest.c | 2 + tests/qemuxml2xmltest.c | 1 + 16 files changed, 291 insertions(+), 86 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-boot-order.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-boot-order.xml -- 1.7.4.rc1

2 7

[libvirt] [Patch v5 0/4] Add new feature into live migration
by Wen Congyang 13 Jan '11

13 Jan '11

If the memory of guest OS is changed constantly, the live migration can not be ended ever for ever. We can use the command 'virsh migrate-setmaxdowntime' to control the live migration. But the value of maxdowntime is diffcult to calculate because it depends on the transfer speed of network and constantly changing memroy size. We need a easy way to control the live migration. This patch set add the support of forcing guest to suspend at timeout. With this patch set, when we migrate the guest OS, we can specify a timeout. If the live migration timeouts, auto-suspend the guest OS, where the migration will complete offline. Test of this patchset on Linux: Env: a. The size of guest OS's memory: 1GB b. The transfer speed of network: about 100Mb/s c. The size of constantly changing memory: more than 900MB 1. migrate without timeout # virsh migrate --live RHEL6RC qemu+ssh://<dest IP>/system tcp://<dest IP>:49152 The migration does not end after 12 hours. 2. migrate with timeout(30 minutes): # virsh -t migrate --live --timeout 1800 RHEL6RC qemu+ssh://<dest IP>/system tcp:<dest IP>:49152 (Time: 1816768.066 ms) v5: - merge daemon/event.* and src/util/event.* - test event when builing without libvirtd v4: - move tools/timer.* into src/util/ directory v3: - use the existing virEventXXXTimeout() APT to implement timer - merge Add, Update, Delete into one single interface virSetTimeout() - start timer thread when initializing timer v2: - implement timer for Windows - implement dynamic timers Wen Congyang (4): move daemon/event.* into src/util/ directory test event when builing without libvirtd timer impl force guest to suspend at timeout cfg.mk | 1 + daemon/Makefile.am | 1 - daemon/event.c | 700 ---------------------------------------------- daemon/event.h | 134 --------- src/Makefile.am | 3 +- src/libvirt.c | 2 + src/libvirt_private.syms | 17 ++ src/util/event.c | 676 ++++++++++++++++++++++++++++++++++++++++++++- src/util/event.h | 106 +++++++ src/util/timer.c | 158 +++++++++++ src/util/timer.h | 34 +++ tests/Makefile.am | 6 +- tests/eventtest.c | 2 +- tools/Makefile.am | 1 - tools/console.c | 2 +- tools/virsh.c | 69 +++++- tools/virsh.pod | 4 + 17 files changed, 1069 insertions(+), 847 deletions(-) delete mode 100644 daemon/event.c delete mode 100644 daemon/event.h create mode 100644 src/util/timer.c create mode 100644 src/util/timer.h

2 6

[libvirt] [PATCH] build: restore mingw build
by Eric Blake 13 Jan '11

13 Jan '11

* bootstrap.conf (gnulib_modules): Add chmod. --- Pushing under the build-breaker rule; ./autobuild.sh failed to cross-compile to mingw due to commit d596c6d requiring chown(). The gnulib function is just an always-failing stub on mingw, but at least it lets things link again. bootstrap.conf | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index 282768b..1eb8f8f 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -1,6 +1,6 @@ # Bootstrap configuration. -# Copyright (C) 2010 Red Hat, Inc. +# Copyright (C) 2010-2011 Red Hat, Inc. # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public @@ -23,6 +23,7 @@ areadlink base64 c-ctype canonicalize-lgpl +chmod close connect configmake -- 1.7.3.4

1 2

[libvirt] [v3] qemu: Reject SDL graphic if it's not supported by qemu
by Osier Yang 13 Jan '11

13 Jan '11

If the emulator doesn't support SDL graphic, we should reject the use of SDL graphic xml with error messages, but not ignore it silently, and pretend things are fine. "-sdl" flag was exposed explicitly by qemu since 0.10.0, more detail: http://www.redhat.com/archives/libvir-list/2011-January/msg00442.html And we already have capability flag "QEMUD_CMD_FLAG_0_10", which could be used to prevent the patch affecting the older versions of QEMU. * src/qemu/qemu_command.c --- src/qemu/qemu_command.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index a0075a4..55fe249 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3568,6 +3568,14 @@ qemuBuildCommandLine(virConnectPtr conn, } } else if ((def->ngraphics == 1) && def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) { + if ((qemuCmdFlags & QEMUD_CMD_FLAG_0_10) && + !(qemuCmdFlags & QEMUD_CMD_FLAG_SDL)) { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("sdl not supported by '%s'"), + def->emulator); + goto error; + } + if (def->graphics[0]->data.sdl.xauth) virCommandAddEnvPair(cmd, "XAUTHORITY", def->graphics[0]->data.sdl.xauth); -- 1.7.3.2

2 2

[libvirt] [Patch v2 0/2] Some fixes about p2p migration
by Wen Congyang 13 Jan '11

13 Jan '11

When we migrate a guest from remote host to localhost by p2p, the libvirtd on remote host will be deadlock. This patch fixes a bug and we can avoid the deadlock with this patch. The steps to reproduce this bug: # virsh -c qemu+ssh://<remotehost IP>/system migrate --p2p <domain name> qemu+ssh:///system v2: - report error instead of changing the desturi as Daniel suggested - improve the documentation of desturi Wen Congyang (2): report error when specifying wrong desturi doc: improve the documentation of desturi src/libvirt.c | 17 +++++++++++++++++ tools/virsh.c | 2 +- tools/virsh.pod | 13 +++++++++++++ 3 files changed, 31 insertions(+), 1 deletions(-)

3 6

[libvirt] openvzReadNetworkConf:318 : out of memory
by Nathan Stratton 13 Jan '11

13 Jan '11

I have been working to get libvirt to work with openvz and kvm. I have had no issues with KVM but libvirt is hit or miss. Sometimes I get it to work, but most of the time I get back "out of memory". I have tried all recent versions of libvirt and vzctl from openvz. Any pointers? 17:52:31.974: debug : virConnectOpen:1425 : name=openvz:///system 17:52:31.974: debug : virEventRunOnce:593 : Poll on 12 handles 0x7f6394001420 timeout -1 17:52:31.974: debug : do_open:1204 : name "openvz:///system" to URI components: scheme openvz opaque (null) authority (null) server (null) user (null) port 0 path /system 17:52:31.974: debug : do_open:1242 : trying driver 0 (Test) ... 17:52:31.974: debug : do_open:1248 : driver 0 Test returned DECLINED 17:52:31.974: debug : do_open:1242 : trying driver 1 (Xen) ... 17:52:31.974: debug : do_open:1248 : driver 1 Xen returned DECLINED 17:52:31.974: debug : do_open:1242 : trying driver 2 (OPENVZ) ... 17:52:32.003: debug : virEventRunOnce:595 : Poll got 1 event 17:52:32.003: debug : virEventDispatchTimeouts:405 : Dispatch 3 17:52:32.003: debug : virEventDispatchHandles:450 : Dispatch 12 17:52:32.003: debug : virEventDispatchHandles:464 : i=0 w=1 17:52:32.003: debug : virEventDispatchHandles:464 : i=1 w=2 17:52:32.003: debug : virEventDispatchHandles:477 : Dispatch n=1 f=5 w=2 e=1 0x1cfa820 17:52:32.003: info : qemudDispatchSignalEvent:401 : Received unexpected signal 17 17:52:32.003: debug : virEventDispatchHandles:464 : i=2 w=3 17:52:32.003: debug : virEventDispatchHandles:464 : i=3 w=4 17:52:32.003: debug : virEventDispatchHandles:464 : i=4 w=5 17:52:32.003: debug : virEventDispatchHandles:464 : i=5 w=6 17:52:32.003: debug : virEventDispatchHandles:464 : i=6 w=7 17:52:32.003: debug : virEventDispatchHandles:464 : i=7 w=8 17:52:32.003: debug : virEventDispatchHandles:464 : i=8 w=9 17:52:32.003: debug : virEventDispatchHandles:464 : i=9 w=10 17:52:32.003: debug : virEventDispatchHandles:464 : i=10 w=11 17:52:32.003: debug : virEventDispatchHandles:464 : i=11 w=12 17:52:32.003: debug : virEventCleanupTimeouts:495 : Cleanup 3 17:52:32.003: debug : virEventCleanupHandles:536 : Cleanupo 12 17:52:32.006: error : openvzReadNetworkConf:318 : out of memory 17:52:32.009: error : openvzReadNetworkConf:318 : out of memory 17:52:32.013: error : openvzReadNetworkConf:318 : out of memory 17:52:32.016: error : openvzReadNetworkConf:318 : out of memory 17:52:32.020: error : openvzReadNetworkConf:318 : out of memory 17:52:32.023: error : openvzReadNetworkConf:318 : out of memory 17:52:32.027: error : openvzReadNetworkConf:318 : out of memory 17:52:32.030: error : openvzReadNetworkConf:318 : out of memory 17:52:32.034: error : openvzReadNetworkConf:318 : out of memory 17:52:32.037: error : openvzReadNetworkConf:318 : out of memory 17:52:32.041: error : openvzReadNetworkConf:318 : out of memory 17:52:32.044: error : openvzReadNetworkConf:318 : out of memory 17:52:32.048: error : openvzReadNetworkConf:318 : out of memory 17:52:32.051: error : openvzReadNetworkConf:318 : out of memory 17:52:32.055: error : openvzReadNetworkConf:318 : out of memory 17:52:32.058: error : openvzReadNetworkConf:318 : out of memory 17:52:32.062: error : openvzReadNetworkConf:318 : out of memory 17:52:32.062: error : openvzLoadDomains:534 : out of memory 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384009340 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384009340 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384007780 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384007780 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384005be0 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384005be0 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f63840080d0 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f63840080d0 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f63840089f0 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f63840089f0 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384006500 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384006500 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f63840049b0 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f63840049b0 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384004ef0 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384004ef0 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384008e80 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384008e80 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384006070 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384006070 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384007c10 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384007c10 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384006990 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384006990 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384006e20 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384006e20 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384005330 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384005330 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f63840072e0 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f63840072e0 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f6384005750 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f6384005750 17:52:32.062: debug : virDomainObjUnref:777 : obj=0x7f63840085f0 refs=0 17:52:32.062: debug : virDomainObjFree:753 : obj=0x7f63840085f0 17:52:32.062: debug : do_open:1248 : driver 2 OPENVZ returned ERROR 17:52:32.062: debug : virUnrefConnect:294 : unref connection 0x7f6384000bd0 1 17:52:32.062: debug : virReleaseConnect:249 : release connection 0x7f6384000bd0 libvir: OpenVZ error : out of memory ><> Nathan Stratton CTO, BlinkMind, Inc. nathan at robotics.net nathan at blinkmind.com http://www.robotics.net http://www.blinkmind.com

1 0

[libvirt] [PATCH] esx: Fix memory leak in HostSystem managed object free function
by Matthias Bolte 12 Jan '11

12 Jan '11

--- src/esx/esx_vi_types.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/esx/esx_vi_types.c b/src/esx/esx_vi_types.c index 4ee4110..f3df2b5 100644 --- a/src/esx/esx_vi_types.c +++ b/src/esx/esx_vi_types.c @@ -1806,6 +1806,7 @@ ESX_VI__TEMPLATE__FREE(HostSystem, VIR_FREE(item->name); /* HostSystem */ + esxVI_HostConfigManager_Free(&item->configManager); }) /* esxVI_HostSystem_Validate */ -- 1.7.0.4

2 2

[libvirt] [PATCH] docs: fix trivial typos in currentMemory description
by Justin Clift 12 Jan '11

12 Jan '11

--- Pushed this already as a trivial patch. docs/formatdomain.html.in | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index e9fcea1..99068ad 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -208,10 +208,10 @@ <dd>The maximum allocation of memory for the guest at boot time. The units for this value are kilobytes (i.e. blocks of 1024 bytes)</dd> <dt><code>currentMemory</code></dt> - <dd>The actual allocation of memory for the guest. This value + <dd>The actual allocation of memory for the guest. This value can be less than the maximum allocation, to allow for ballooning up the guests memory on the fly. If this is omitted, it defaults - to the same value as the <code>memory<code> element</dd> + to the same value as the <code>memory</code> element</dd> <dt><code>memoryBacking</code></dt> <dd>The optional <code>memoryBacking</code> element, may have an <code>hugepages</code> element set within it. This tells the -- 1.7.3.2

1 0

[libvirt] [PATCH] docs: reorder apps page alphabetically, plus add libguestfs entries
by Justin Clift 12 Jan '11

12 Jan '11

--- Temporary rendered version online here: http://justinclift.fedorapeople.org/libvirt_website/apps.html docs/apps.html.in | 133 +++++++++++++++++++++++++++++++---------------------- 1 files changed, 78 insertions(+), 55 deletions(-) diff --git a/docs/apps.html.in b/docs/apps.html.in index 8cbee17..9a8ffc0 100644 --- a/docs/apps.html.in +++ b/docs/apps.html.in @@ -23,27 +23,54 @@ <img src="madeWith.png" alt="Made with libvirt"/> </p> + <h2><a name="clientserver">Client/Server applications</a></h2> + + <dl> + <dt><a href="http://archipelproject.org">Archipel</a></dt> + <dd> + Archipel is a libvirt-based solution to manage and supervise virtual + machines. It uses XMPP for all communication. There is no web + service or custom protocol. You just need at least one XMPP server, + like eJabberd, to start playing with it. This allows Archipel to + work completely real time. You never have to refresh the user + interface, you'll be notified as soon as something happens. You can + even use your favorite chat clients to command your infrastructure. + </dd> + <dd> + Isn't it great to be able to open a chat conversation with your + virtual machine and say things like "How are you today?" or "Hey, + please reboot"? + </dd> + </dl> + <h2><a name="command">Command line tools</a></h2> <dl> + <dt><a href="http://libguestfs.org">guestfish</a></dt> + <dd> + Guestfish is an interactive shell and command-line tool for examining + and modifying virtual machine filesystems. It uses libvirt to find + guests and their associated disks. + </dd> <dt>virsh</dt> <dd> An interactive shell, and batch scriptable tool for performing management tasks on all libvirt managed domains, networks and storage. This is part of the libvirt core distribution. </dd> - <dt><a href="http://virt-manager.org/">virt-install</a></dt> - <dd> - Provides a way to provision new virtual machines from a - OS distribution install tree. It supports provisioning from - local CD images, and the network over NFS, HTTP and FTP. - </dd> <dt><a href="http://virt-manager.org/">virt-clone</a></dt> <dd> Allows the disk image(s) and configuration for an existing virtual machine to be cloned to form a new virtual machine. It automates copying of data across to new disk images, and - updates the UUID, Mac address and name in the configuration + updates the UUID, MAC address, and name in the configuration. + </dd> + <dt><a href="http://et.redhat.com/~rjones/virt-df/">virt-df</a></dt> + <dd> + Examine the utilization of each filesystem in a virtual machine + from the comfort of the host machine. This tool peeks into the + guest disks and determines how much space is used. It can cope + with common Linux filesystems and LVM volumes. </dd> <dt><a href="http://virt-manager.org/">virt-image</a></dt> <dd> @@ -53,12 +80,11 @@ into the domain XML format for execution under any libvirt hypervisor meeting the pre-requisites. </dd> - <dt><a href="http://et.redhat.com/~rjones/virt-df/">virt-df</a></dt> + <dt><a href="http://virt-manager.org/">virt-install</a></dt> <dd> - Examine the utilization of each filesystem in a virtual machine - from the comfort of the host machine. This tool peeks into the - guest disks and determines how much space is used. It can cope - with common Linux filesystems and LVM volumes. + Provides a way to provision new virtual machines from a + OS distribution install tree. It supports provisioning from + local CD images, and the network over NFS, HTTP and FTP. </dd> <dt><a href="http://et.redhat.com/~rjones/virt-top/">virt-top</a></dt> <dd> @@ -67,26 +93,6 @@ </dd> </dl> - <h2><a name="clientserver">Client/Server applications</a></h2> - - <dl> - <dt><a href="http://archipelproject.org">Archipel</a></dt> - <dd> - Archipel is a libvirt-based solution to manage and supervise virtual - machines. It uses XMPP for all communication. There is no web - service or custom protocol. You just need at least one XMPP server, - like eJabberd, to start playing with it. This allows Archipel to - work completely real time. You never have to refresh the user - interface, you'll be notified as soon as something happens. You can - even use your favorite chat clients to command your infrastructure. - </dd> - <dd> - Isn't it great to be able to open a chat conversation with your - virtual machine and say things like "How are you today?" or "Hey, - please reboot"? - </dd> - </dl> - <h2><a name="desktop">Desktop applications</a></h2> <dl> @@ -106,23 +112,20 @@ </dd> </dl> - <h2><a name="web">Web applications</a></h2> + <h2><a name="libraries">Libraries</a></h2> <dl> - <dt><a href="http://ovirt.org/">oVirt</a></dt> + <dt><a href="http://libguestfs.org">libguestfs</a></dt> <dd> - oVirt provides the ability to manage large numbers of virtual - machines across an entire data center of hosts. It integrates - with FreeIPA for Kerberos authentication, and in the future, - certificate management. + A library and set of tools for accessing and modifying virtual + machine disk images. It can be linked with C and C++ management + programs, and has bindings for Perl, Python, Ruby, Java, OCaml, + PHP, Haskell, and C#. </dd> - <dt><a href="http://community.abiquo.com/display/AbiCloud">AbiCloud</a></dt> <dd> - AbiCloud is an open source cloud platform manager which allows to - easily deploy a private cloud in your datacenter. One of the key - differences of AbiCloud is the web rich interface for managing the - infrastructure. You can deploy a new service just dragging and - dropping a VM. + Using its FUSE module, you can also mount guest filesystems on the + host, and there is a subproject to allow merging changes into the + Windows Registry in Windows guests. </dd> </dl> @@ -133,31 +136,31 @@ <dd> A tool for converting a physical machine into a virtual machine. It is a LiveCD which is booted on the machine to be converted. It collects - a little information from the user and then copies the disks over to + a little information from the user, then copies the disks over to a remote machine and defines the XML for a domain to run the guest. </dd> </dl> <h2><a name="monitoring">Monitoring plugins</a></h2> <dl> - <dt><a href="http://honk.sigxcpu.org/projects/libvirt/#munin">for munin</a></dt> - <dd> - The plugins provided by Guido Günther allow to monitor various things - like network and block I/O with - <a href="http://munin.projects.linpro.no/">Munin</a>. - </dd> <dt><a href="http://collectd.org/plugins/libvirt.shtml">for collectd</a></dt> <dd> The libvirt-plugin is part of <a href="http://collectd.org/">collectd</a> - and gather statistics about virtualized guests on a system. This + and gathers statistics about virtualized guests on a system. This way, you can collect CPU, network interface and block device usage for each guest without installing collectd on the guest systems. - or a full description of available please refer to the libvirt section - in the collectd.conf(5) manual page. + For a full description, please refer to the libvirt section in the + collectd.conf(5) manual page. + </dd> + <dt><a href="http://honk.sigxcpu.org/projects/libvirt/#munin">for munin</a></dt> + <dd> + The plugins provided by Guido Günther allow to monitor various things + like network and block I/O with + <a href="http://munin.projects.linpro.no/">Munin</a>. </dd> <dt><a href="http://et.redhat.com/~rjones/nagios-virt/">nagios-virt</a></dt> <dd> - Nagios-virt is a configuration tool for adding monitoring of your + Nagios-virt is a configuration tool to add monitoring of your virtualised domains to <a href="http://www.nagios.org/">Nagios</a>. You can use this tool to either set up a new Nagios installation for your Xen or QEMU/KVM guests, or to integrate with your existing Nagios @@ -165,5 +168,25 @@ </dd> </dl> + <h2><a name="web">Web applications</a></h2> + + <dl> + <dt><a href="http://community.abiquo.com/display/AbiCloud">AbiCloud</a></dt> + <dd> + AbiCloud is an open source cloud platform manager which allows to + easily deploy a private cloud in your datacenter. One of the key + differences of AbiCloud is the web rich interface for managing the + infrastructure. You can deploy a new service just dragging and + dropping a VM. + </dd> + <dt><a href="http://ovirt.org/">oVirt</a></dt> + <dd> + oVirt provides the ability to manage large numbers of virtual + machines across an entire data center of hosts. It integrates + with FreeIPA for Kerberos authentication, and in the future, + certificate management. + </dd> + </dl> + </body> </html> -- 1.7.3.2

2 2

[libvirt] [v2] qemu: Reject SDL graphic if it's not supported by qemu
by Osier Yang 12 Jan '11

12 Jan '11

If the emulator doesn't support SDL graphic, we should reject the use of SDL graphic xml with error messages, but not ignore it silently, and pretend things are fine. "-sdl" flag was exposed explicitly by qemu since 0.10.0, more detail: http://www.redhat.com/archives/libvir-list/2011-January/msg00442.html And we already have capability flag "QEMUD_CMD_FLAG_0_10", which could be used to prevent the patch affecting the older versions of QEMU. * src/qemu/qemu_command.c --- src/qemu/qemu_command.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index a0075a4..55fe249 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3568,6 +3568,14 @@ qemuBuildCommandLine(virConnectPtr conn, } } else if ((def->ngraphics == 1) && def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) { + if ((qemuCmdFlags & QEMUD_CMD_FLAG_0_10) && + !(qemuCmdFlags & QEMUD_CMD_FLAG_SDL)) { + qemuReportError(VIR_ERR_INTERNAL_ERROR, + _("sdl not supported by '%s'"), + def->emulator); + goto error; + } + if (def->graphics[0]->data.sdl.xauth) virCommandAddEnvPair(cmd, "XAUTHORITY", def->graphics[0]->data.sdl.xauth); -- 1.7.3.2

2 2

[libvirt] Best final spot for the in depth libvirt user docs?
by Justin Clift 12 Jan '11

12 Jan '11

Hi Richard, Tidying things up in regards to some of the documentation, and it's probably time to move the in depth content from the libvirt.org wiki, to it's final resting spot(s?). Do you reckon these would be better moved to the virt-tools.org site, or the libvirt.org site? SSH Setup (concepts, tasks, further reading) http://wiki.libvirt.org/page/SSHSetup SSH Setup with PolicyKit (tasks and further reading) http://wiki.libvirt.org/page/SSHPolicyKitSetup TLS Setup (concepts, tasks, further reading) http://wiki.libvirt.org/page/TLSSetup VNC TLS Setup (tasks) http://wiki.libvirt.org/page/VNCTLSSetup Virtual Networking (concepts) http://wiki.libvirt.org/page/VirtualNetworking Possibly this one too, but it's not 100% yet, and doesn't have matching ones for the other Virtual Networking modes (Routed and Isolated): NAT Virtual Network setup with Virt-Manager (tasks) http://wiki.libvirt.org/page/TaskNATSetupVirtManager ? Regards and best wishes, Justin Clift

3 3

[libvirt] compressing .git/ can save 15%
by Jim Meyering 12 Jan '11

12 Jan '11

Hi DV, I ran this on a fresh clone of libvirt: $ du -sh .git; git gc --aggressive; du -sh .git 54M .git ... 45M .git I propose to do the same thing on the server, libvirt.org. It's not a big deal, but decreased bandwidth wouldn't hurt, and the slightly smaller on-disk repository makes even local git tools feel a little snappier. It's worth doing for all git repositories. As far as I know, no one stores anything useful as "unlinked" commits on the server (they would be removed by the above), so there is no down-side to doing this. In fact, "man git-gc" recommends to run git gc --aggressive "every few hundred changesets or so". Adding a cron job to do it every few weeks would be nice (e.g., Sunday at 4am local). Let me know and I'll do it via my account.

2 4

[libvirt] tests/daemon-conf bug
by Eric Blake 12 Jan '11

12 Jan '11

Right now, the daemon-conf test fires up an instance of libvirtd, but that instance tries to probe the installed location of cpu_map.xml rather than an in-tree location, which means the test is liable to fail if run on a just built but uninstalled binary: I/O warning : failed to load external entity "/usr/local/share/libvirt/cpu_map.xml" 17:10:50.357: 14549: warning : qemuCapsInit:774 : Failed to get host CPU I'm not sure how to go about isolating the test from the installation directory, since libvirtd currently doesn't have any way (either via command line argument or via the temp.conf file) to override the preferred location of other files such as cpu_map.xml. Maybe a new libvirtd.conf entry is called for, which defaults to the installation location, but which daemon-conf munges to the in-tree location before passing --conf-file to the libvirtd instance. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

2 1

[libvirt] [PATCH] qemu: Reject SDL graphic if it's not supported by qemu
by Osier Yang 12 Jan '11

12 Jan '11

If the emulator doesn't support SDL graphic, we should reject the use of SDL graphic xml with error messages, but not ignore it silently. * src/qemu/qemu_command.c --- src/qemu/qemu_command.c | 12 +++++++++--- 1 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 7dd8e03..cf4ae01 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3567,6 +3567,14 @@ qemuBuildCommandLine(virConnectPtr conn, } } else if ((def->ngraphics == 1) && def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) { + if (!(qemuCmdFlags & QEMUD_CMD_FLAG_SDL)) { + qemuReportError(VIR_ERR_INTERNAL_ERROR, + _("sdl not supported by '%s'"), + def->emulator); + + goto error; + } + if (def->graphics[0]->data.sdl.xauth) virCommandAddEnvPair(cmd, "XAUTHORITY", def->graphics[0]->data.sdl.xauth); @@ -3586,9 +3594,7 @@ qemuBuildCommandLine(virConnectPtr conn, /* New QEMU has this flag to let us explicitly ask for * SDL graphics. This is better than relying on the * default, since the default changes :-( */ - if (qemuCmdFlags & QEMUD_CMD_FLAG_SDL) - virCommandAddArg(cmd, "-sdl"); - + virCommandAddArg(cmd, "-sdl"); } else if ((def->ngraphics == 1) && def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SPICE) { virBuffer opt = VIR_BUFFER_INITIALIZER; -- 1.7.3.2

5 12

[libvirt] [PATCH 1/2] Add a parameter to virThreadPoolSendJob() to let the caller decide whether to wait for the job to complete
by Hu Tao 12 Jan '11

12 Jan '11

--- src/qemu/qemu_driver.c | 2 +- src/util/threadpool.c | 19 ++++++++++++++++++- src/util/threadpool.h | 3 ++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 924446f..aa2e805 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -665,7 +665,7 @@ qemuHandleDomainWatchdog(qemuMonitorPtr mon ATTRIBUTE_UNUSED, if (VIR_ALLOC(wdEvent) == 0) { wdEvent->action = VIR_DOMAIN_WATCHDOG_ACTION_DUMP; wdEvent->vm = vm; - ignore_value(virThreadPoolSendJob(driver->workerPool, wdEvent)); + ignore_value(virThreadPoolSendJob(driver->workerPool, wdEvent, false)); } else virReportOOMError(); } diff --git a/src/util/threadpool.c b/src/util/threadpool.c index 1213862..07f2fcf 100644 --- a/src/util/threadpool.c +++ b/src/util/threadpool.c @@ -42,6 +42,7 @@ struct _virThreadPoolJob { virThreadPoolJobPtr next; void *data; + virCondPtr complete; }; typedef struct _virThreadPoolJobList virThreadPoolJobList; @@ -73,6 +74,7 @@ struct _virThreadPool { static void virThreadPoolWorker(void *opaque) { virThreadPoolPtr pool = opaque; + virCondPtr complete; virMutexLock(&pool->mutex); @@ -97,9 +99,12 @@ static void virThreadPoolWorker(void *opaque) pool->jobList.tail = &pool->jobList.head; virMutexUnlock(&pool->mutex); + complete = job->complete; (pool->jobFunc)(job->data, pool->jobOpaque); VIR_FREE(job); virMutexLock(&pool->mutex); + if (complete) + virCondSignal(complete); } out: @@ -188,9 +193,14 @@ void virThreadPoolFree(virThreadPoolPtr pool) } int virThreadPoolSendJob(virThreadPoolPtr pool, - void *jobData) + void *jobData, + bool waitForCompletion) { virThreadPoolJobPtr job; + virCond complete; + + if (waitForCompletion && virCondInit(&complete) < 0) + return -1; virMutexLock(&pool->mutex); if (pool->quit) @@ -219,10 +229,17 @@ int virThreadPoolSendJob(virThreadPoolPtr pool, job->data = jobData; job->next = NULL; + job->complete = NULL; *pool->jobList.tail = job; pool->jobList.tail = &(*pool->jobList.tail)->next; virCondSignal(&pool->cond); + + if (waitForCompletion) { + job->complete = &complete; + virCondWait(&complete, &pool->mutex); + } + virMutexUnlock(&pool->mutex); return 0; diff --git a/src/util/threadpool.h b/src/util/threadpool.h index 5714b0b..6f763dc 100644 --- a/src/util/threadpool.h +++ b/src/util/threadpool.h @@ -41,7 +41,8 @@ virThreadPoolPtr virThreadPoolNew(size_t minWorkers, void virThreadPoolFree(virThreadPoolPtr pool); int virThreadPoolSendJob(virThreadPoolPtr pool, - void *jobdata) ATTRIBUTE_NONNULL(1) + void *jobdata, + bool waitForCompletion) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_RETURN_CHECK; -- 1.7.3.1 -- Thanks, Hu Tao

3 10

[libvirt] [PATCH] pass correct uri to source host when we do p2p migration
by Wen Congyang 12 Jan '11

12 Jan '11

When we migrate a guest from remote host to localhost by p2p, the libvirtd on remote host will be deadlock. This patch fixes a bug and we can avoid the deadlock with this patch. The steps to reproduce this bug: # virsh -c qemu+ssh://<remotehost IP>/system migrate --p2p <domain name> qemu+ssh:///system We connect dest host(qemu+ssh:///system) on source host, and the uri we pass to source host is qemu+ssh:///system. And then we connect a wrong dest host. Signed-off-by: Wen Congyang <wency(a)cn.fujitsu.com> --- src/libvirt.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 51 insertions(+), 2 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index ee2495a..81a1bf8 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -3533,22 +3533,71 @@ virDomainMigratePeer2Peer (virDomainPtr domain, const char *uri, unsigned long bandwidth) { + xmlURIPtr tempxmluri = NULL; + char * tempuri = NULL; + int ret = -1; + char * hostname = NULL; + if (!domain->conn->driver->domainMigratePerform) { virLibConnError (domain->conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); virDispatchError(domain->conn); return -1; } + tempxmluri = xmlParseURI(uri); + if (!tempxmluri) { + virLibConnError (domain->conn, VIR_ERR_INVALID_ARG, __FUNCTION__); + virDispatchError(domain->conn); + goto out; + } + if (tempxmluri->server) { + tempuri = uri; + } else { + /* + * The uri will be passed to source host. If user inputs qemu:///system, + * the dest host is localhost. But we connect the dest host on source + * host(a remote host). So we should pass qemu://<dest hostname>/system + * to the source host. + */ + hostname = virGetHostname(NULL); + if (!hostname) { + virDispatchError(domain->conn); + goto out; + } + + if (STRPREFIX(hostname, "localhost")) { + virLibConnError(domain->conn, VIR_ERR_INTERNAL_ERROR, + _("hostname on destination resolved to localhost, but migration requires an FQDN")); + virDispatchError(domain->conn); + goto out; + } + + tempxmluri->server = hostname; + tempuri = strdup((char *)xmlSaveUri(tempxmluri)); + if (!tempuri) { + virReportOOMError(); + virDispatchError(domain->conn); + goto out; + } + } + /* Perform the migration. The driver isn't supposed to return * until the migration is complete. */ - return domain->conn->driver->domainMigratePerform(domain, + ret = domain->conn->driver->domainMigratePerform(domain, NULL, /* cookie */ 0, /* cookielen */ - uri, + tempuri, flags, dname, bandwidth); + +out: + VIR_FREE(hostname); + if (tempuri && tempuri != uri) + VIR_FREE(tempuri); + + return ret; } -- 1.7.1

3 5

[libvirt] [PATCH] docs: add entry for archipel to the apps page
by Justin Clift 11 Jan '11

11 Jan '11

--- docs/apps.html.in | 22 +++++++++++++++++++++- 1 files changed, 21 insertions(+), 1 deletions(-) diff --git a/docs/apps.html.in b/docs/apps.html.in index 792c145..d4e74bb 100644 --- a/docs/apps.html.in +++ b/docs/apps.html.in @@ -67,6 +67,26 @@ </dd> </dl> + <h2><a name="clientserver">Client/Server applications</a></h2> + + <dl> + <dt><a href="http://archipelproject.org">Archipel</a></dt> + <dd> + Archipel is a libvirt-based solution to manage and supervise virtual + machines. It uses XMPP for all communication. There is no web + service or custom protocol. You just need at least one XMPP server, + like eJabberd, to start playing with it. This allows Archipel to + work completely real time. You never have to refresh the user + interface, you'll be notified as soon as something happens. You can + even use your favorite chat clients to command your infrastructure. + </dd> + <dd> + Isn't it great to be able to open a chat conversation with your + virtual machine and say things like "How are you today?" or "Hey, + please reboot"? + </dd> + </dl> + <h2><a name="desktop">Desktop applications</a></h2> <dl> @@ -122,7 +142,7 @@ <dl> <dt><a href="http://honk.sigxcpu.org/projects/libvirt/#munin">for munin</a></dt> <dd> - The plugins provided by Guido Günther allow to monitor various things + The plugins provided by Guido G√ºnther allow to monitor various things like network and block I/O with <a href="http://munin.projects.linpro.no/">Munin</a>. </dd> -- 1.7.3.2

2 5

[libvirt] [PATCH] docs: use xml entity encoding for extended character last name
by Justin Clift 11 Jan '11

11 Jan '11

--- This fixes the busted appearance on libvirt.org. Already pushed under the trivial rule. docs/apps.html.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/apps.html.in b/docs/apps.html.in index 792c145..2ffb087 100644 --- a/docs/apps.html.in +++ b/docs/apps.html.in @@ -122,7 +122,7 @@ <dl> <dt><a href="http://honk.sigxcpu.org/projects/libvirt/#munin">for munin</a></dt> <dd> - The plugins provided by Guido Günther allow to monitor various things + The plugins provided by Guido Günther allow to monitor various things like network and block I/O with <a href="http://munin.projects.linpro.no/">Munin</a>. </dd> -- 1.7.3.2

1 1

[libvirt] [PATCH] vbox: Silently ignore missing registry key on Windows
by Matthias Bolte 11 Jan '11

11 Jan '11

Don't report an error when the VirtualBox registry key is missing, as this just indicates that VirtualBox is not installed in general. This matches the behavior of the XPCOM glue that silently ignores a missing VBoxXPCOMC.so. --- src/vbox/vbox_MSCOMGlue.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/src/vbox/vbox_MSCOMGlue.c b/src/vbox/vbox_MSCOMGlue.c index e6a886f..be0ec34 100644 --- a/src/vbox/vbox_MSCOMGlue.c +++ b/src/vbox/vbox_MSCOMGlue.c @@ -356,8 +356,6 @@ vboxLookupVersionInRegistry(void) status = RegOpenKeyEx(HKEY_LOCAL_MACHINE, keyName, 0, KEY_READ, &key); if (status != ERROR_SUCCESS) { - VIR_ERROR(_("Could not open registry key '%s' nor '%s'"), - VBOX_REGKEY_ORACLE, VBOX_REGKEY_SUN); return -1; } } -- 1.7.0.4

3 3

[libvirt] Docs team task: Update main docs.html page with index of all pages
by Justin Clift 11 Jan '11

11 Jan '11

Hi Anthony, (Following up from previous email, but CC'ing the libvirt team this time as some of the guys might have input/ideas/etc.) I'm thinking the very best thing you can do is get our "Docs" landing page under control for the main site: http://libvirt.org/docs.html It's very blank, relying on people to realise that everything is accessible on the left hand menu bar instead. :( What it should contain is an index to all of the main documentation pieces, so people can click directly from there. Some sort of menu structure will be needed (up to you, try things out). The way the website works, is that it's actually part of the libvirt source code. The "docs" directory in the source code is effectively the website. When people update the docs directory in the git repository, there's a cronjob on the libvirt.org server that rebuilds the live website. So, first things first, you'll need to make sure you have the "xhtml1-dtds" package installed. It's in the main CentOS repositories, so yum should know it automatically. Then you'll need to get the main libvirt source code from git: $ git clone git://libvirt.org/libvirt.git Cloning into libvirt... remote: Counting objects: 50501, done. remote: Compressing objects: 100% (8276/8276), done. remote: Total 50501 (delta 42262), reused 50237 (delta 42087) Receiving objects: 100% (50501/50501), 52.13 MiB | 165 KiB/s, done. Resolving deltas: 100% (42262/42262), done. $ ls -la total 0 drwxr-xr-x 3 user staff 102 8 Jan 21:47 . drwxr-xr-x@ 22 user staff 748 8 Jan 21:47 .. drwxr-xr-x 65 user staff 2210 8 Jan 21:55 libvirt (For me, on the opposite side of the world to the main libvirt.org server, this takes a while. Several minutes. Subsequent operations are much faster.) Then change into the newly created "libvirt" subdirectory, and run the "autogen.sh" command. This prepares the entire libvirt source code for compiling locally, including the website docs (which you'll need). $ ./autogen.sh (this will configure itself if all the needed utils are installed, or it might barf if somethings missing. It should proactively let you know if there's else that needs installing) Once the autogen.sh has finished, run "make". If you have a multi-core processor, run it as a parallel make using the -j option: $ make -j 5 Parallel makes are a *bunch* faster than just using a single core. The # to use is the number of cores in the box, plus one. (ie use -j 3 on a dual core, use -j 9 on a 8 core box, etc) If you open your browser, there should be in "index.html" file in the docs directory. Open that. Voila, it's the website. :) So, the file you need to update is the docs/docs.html.in one. When you make changes to it, run the "make" command again. That'll process it, converting it from docs.html.in, to docs.html. As you're trying things out and getting it right, feel free to copy the generated output to some temporary spot on the web then post the URL for comment/feedback/suggestions/etc. (I do this fairly often too) When you reckon it's all good and ready for inclusion, I'll give you the steps for generating a patch file and posting it. It's pretty simple. :) How's that so far? Regards and best wishes, Justin Clift

3 9

[libvirt] [PATCH] qemu: sound: Support intel 'hda' model
by Cole Robinson 11 Jan '11

11 Jan '11

In QEMU, the card itself is a PCI device, but it requires -device hda-output in order to actually get sound to the host. AIUI this is just HDA configuration and does not require stable addressing, so is not presently represented in the XML. Additionally, qemu supports audio input with '-device hda-duplex', however that provides guests access to the host's microphone, so probably isn't what we want by default. --- docs/formatdomain.html.in | 5 +++-- docs/schemas/domain.rng | 1 + src/conf/domain_conf.c | 3 ++- src/conf/domain_conf.h | 1 + src/qemu/qemu_command.c | 14 +++++++++++++- .../qemuxml2argv-sound-device.args | 2 +- .../qemuxml2argvdata/qemuxml2argv-sound-device.xml | 1 + tests/qemuxml2argvdata/qemuxml2argv-sound.args | 2 +- tests/qemuxml2argvdata/qemuxml2argv-sound.xml | 1 + 9 files changed, 24 insertions(+), 6 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index e9fcea1..8c43b74 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1663,8 +1663,9 @@ qemu-kvm -net nic,model=? /dev/null The <code>sound</code> element has one mandatory attribute, <code>model</code>, which specifies what real sound device is emulated. Valid values are specific to the underlying hypervisor, though typical - choices are 'es1370', 'sb16', and 'ac97' - (<span class="since">'ac97' only since 0.6.0</span>) + choices are 'es1370', 'sb16', 'ac97', and 'hda' + (<span class="since"> + 'ac97' only since 0.6.0, 'hda' only since 0.8.8</span>) </dd> </dl> diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index a524e4b..491a5a5 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -1489,6 +1489,7 @@ <value>es1370</value> <value>pcspk</value> <value>ac97</value> + <value>hda</value> </choice> </attribute> <optional> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index c857a89..992435d 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -225,7 +225,8 @@ VIR_ENUM_IMPL(virDomainSoundModel, VIR_DOMAIN_SOUND_MODEL_LAST, "sb16", "es1370", "pcspk", - "ac97") + "ac97", + "hda") VIR_ENUM_IMPL(virDomainMemballoonModel, VIR_DOMAIN_MEMBALLOON_MODEL_LAST, "virtio", diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index a459a22..d5ff9f3 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -458,6 +458,7 @@ enum virDomainSoundModel { VIR_DOMAIN_SOUND_MODEL_ES1370, VIR_DOMAIN_SOUND_MODEL_PCSPK, VIR_DOMAIN_SOUND_MODEL_AC97, + VIR_DOMAIN_SOUND_MODEL_HDA, VIR_DOMAIN_SOUND_MODEL_LAST }; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 7dd8e03..2030455 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1726,11 +1726,13 @@ qemuBuildSoundDevStr(virDomainSoundDefPtr sound) goto error; } - /* Hack for 2 wierdly unusal devices name in QEMU */ + /* Hack for wierdly unusal devices name in QEMU */ if (STREQ(model, "es1370")) model = "ES1370"; else if (STREQ(model, "ac97")) model = "AC97"; + else if (STREQ(model, "hda")) + model = "intel-hda"; virBufferVSprintf(&buf, "%s", model); virBufferVSprintf(&buf, ",id=%s", sound->info.alias); @@ -3750,6 +3752,14 @@ qemuBuildCommandLine(virConnectPtr conn, goto error; virCommandAddArg(cmd, str); + + if (sound->model == VIR_DOMAIN_SOUND_MODEL_HDA) { + /* This is just an HDA codec, so doesn't require + * stable addressing AIUI */ + virCommandAddArgList(cmd, + "-device", "hda-output", NULL); + } + VIR_FREE(str); } } @@ -5529,6 +5539,8 @@ virDomainDefPtr qemuParseCommandLine(virCapsPtr caps, type = VIR_DOMAIN_SOUND_MODEL_ES1370; } else if (STRPREFIX(start, "ac97")) { type = VIR_DOMAIN_SOUND_MODEL_AC97; + } else if (STRPREFIX(start, "hda")) { + type = VIR_DOMAIN_SOUND_MODEL_HDA; } if (type != -1) { diff --git a/tests/qemuxml2argvdata/qemuxml2argv-sound-device.args b/tests/qemuxml2argvdata/qemuxml2argv-sound-device.args index 6b2e697..6cd4b4a 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-sound-device.args +++ b/tests/qemuxml2argvdata/qemuxml2argv-sound-device.args @@ -1 +1 @@ -LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -nodefconfig -nodefaults -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -usb -soundhw pcspk -device ES1370,id=sound1,bus=pci.0,addr=0x2 -device sb16,id=sound2 -device AC97,id=sound3,bus=pci.0,addr=0x3 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4 +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -nodefconfig -nodefaults -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -usb -soundhw pcspk -device ES1370,id=sound1,bus=pci.0,addr=0x2 -device sb16,id=sound2 -device AC97,id=sound3,bus=pci.0,addr=0x3 -device intel-hda,id=sound4,bus=pci.0,addr=0x4 -device hda-output -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-sound-device.xml b/tests/qemuxml2argvdata/qemuxml2argv-sound-device.xml index c725346..f48c61e 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-sound-device.xml +++ b/tests/qemuxml2argvdata/qemuxml2argv-sound-device.xml @@ -22,6 +22,7 @@ <sound model='es1370'/> <sound model='sb16'/> <sound model='ac97'/> + <sound model='hda'/> <memballoon model='virtio'/> </devices> </domain> diff --git a/tests/qemuxml2argvdata/qemuxml2argv-sound.args b/tests/qemuxml2argvdata/qemuxml2argv-sound.args index 8cb2da2..0db62c3 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-sound.args +++ b/tests/qemuxml2argvdata/qemuxml2argv-sound.args @@ -1 +1 @@ -LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -net none -serial none -parallel none -usb -soundhw pcspk,es1370,sb16,ac97 +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -net none -serial none -parallel none -usb -soundhw pcspk,es1370,sb16,ac97,hda diff --git a/tests/qemuxml2argvdata/qemuxml2argv-sound.xml b/tests/qemuxml2argvdata/qemuxml2argv-sound.xml index d34e0b3..c713d05 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-sound.xml +++ b/tests/qemuxml2argvdata/qemuxml2argv-sound.xml @@ -24,6 +24,7 @@ <sound model='es1370'/> <sound model='sb16'/> <sound model='ac97'/> + <sound model='hda'/> <memballoon model='virtio'/> </devices> </domain> -- 1.7.3.3

4 12

[libvirt] [PATCH] Watchdog IB700 is not a PCI device (RHBZ#667091).
by Richard W.M. Jones 11 Jan '11

11 Jan '11

-- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://et.redhat.com/~rjones/virt-df/

2 1

[libvirt] [RFC] Explicit boot device ordering
by Jiri Denemark 11 Jan '11

11 Jan '11

Hi, I'm working on $SUBJ and I can't decide on XML representation of that. The goal is to let users specify an ordered list of devices to boot from, e.g., 2nd NIC, 1st NIC, 1st CD-ROM, 2nd IDE disk. We already have boot elements in /domain/os so we could make use of them or we could add a boot element inside device elements. So for the first case, we could have something like <os> <boot target='net1'/> <boot target='net0'/> <boot target='hdc'/> <boot target='hdb'/> <os> Where target attributes would match /domain/devices/*/target@dev For the second case, appropriate devices would contain <boot order='n'/> elements. Personally I like the first option more since it is very easy to change boot order in that case and the whole boot list is co-located at a single place in domain XML. Do you feel the same or do you even have a better solution in your mind? Jirka

3 3

[libvirt] [PATCH] network: plug unininitialized read found by valgrind
by Eric Blake 11 Jan '11

11 Jan '11

* src/util/network.c (virSocketAddrMask): Zero out port, so that iptables can initialize just the netmask, then call virSocketFormatAddr without an uninitialized read in getnameinfo. --- I'm not sure if this is the best patch; an alternative would be to call memset(network,0,sizeof network) in iptablesFormatNetwork prior to virSocketAddrMaskByPrefix. But with this patch in place, valgrind no longer complained about: ==31478== Use of uninitialised value of size 8 ==31478== at 0x3021643DAB: _itoa_word (in /lib64/libc-2.12.so) ==31478== by 0x3021644E74: vfprintf (in /lib64/libc-2.12.so) ==31478== by 0x302166EFB1: vsnprintf (in /lib64/libc-2.12.so) ==31478== by 0x302164F022: snprintf (in /lib64/libc-2.12.so) ==31478== by 0x3021705135: getnameinfo (in /lib64/libc-2.12.so) ==31478== by 0x4E4FE00: virSocketFormatAddrFull (network.c:194) ==31478== by 0x4E4FCAE: virSocketFormatAddr (network.c:152) ==31478== by 0x4E43688: iptablesFormatNetwork (iptables.c:307) ==31478== by 0x4E43FDE: iptablesForwardMasquerade (iptables.c:761) ==31478== by 0x4E44392: iptablesRemoveForwardMasquerade (iptables.c:863) ==31478== by 0x4A8BEF: networkRemoveMasqueradingIptablesRules (bridge_driver.c:893) ==31478== by 0x4A9BCA: networkRemoveIpSpecificIptablesRules (bridge_driver.c:1244) ==31478== Uninitialised value was created by a stack allocation ==31478== at 0x4E43570: iptablesFormatNetwork (iptables.c:289) So I'm assuming that the uninitialized read was due to gethostname looking at the port field which was still filled with uninitialized stack data. src/util/network.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/src/util/network.c b/src/util/network.c index a7e7423..33028aa 100644 --- a/src/util/network.c +++ b/src/util/network.c @@ -1,7 +1,7 @@ /* * network.c: network helper APIs for libvirt * - * Copyright (C) 2009-2010 Red Hat, Inc. + * Copyright (C) 2009-2011 Red Hat, Inc. * * See COPYING.LIB for the License of this software * @@ -291,6 +291,7 @@ int virSocketAddrIsNetmask(virSocketAddrPtr netmask) { * virSocketAddrMask: * @addr: address that needs to be masked * @netmask: the netmask address + * @network: where to store the result, can be same as @addr * * Mask off the host bits of @addr according to @netmask, turning it * into a network address. @@ -311,6 +312,7 @@ virSocketAddrMask(const virSocketAddrPtr addr, network->data.inet4.sin_addr.s_addr = (addr->data.inet4.sin_addr.s_addr & netmask->data.inet4.sin_addr.s_addr); + network->data.inet4.sin_port = 0; network->data.stor.ss_family = AF_INET; network->len = addr->len; return 0; @@ -322,6 +324,7 @@ virSocketAddrMask(const virSocketAddrPtr addr, = (addr->data.inet6.sin6_addr.s6_addr[ii] & netmask->data.inet6.sin6_addr.s6_addr[ii]); } + network->data.inet6.sin6_port = 0; network->data.stor.ss_family = AF_INET6; network->len = addr->len; return 0; @@ -334,6 +337,7 @@ virSocketAddrMask(const virSocketAddrPtr addr, * virSocketAddrMaskByPrefix: * @addr: address that needs to be masked * @prefix: prefix (# of 1 bits) of netmask to apply + * @network: where to store the result, can be same as @addr * * Mask off the host bits of @addr according to @prefix, turning it * into a network address. -- 1.7.3.4

3 3

[libvirt] [PATCH] network: plug memory leak
by Eric Blake 11 Jan '11

11 Jan '11

* src/conf/network_conf.c (virNetworkDefParseXML): Release ipNodes. --- Another memleak found by valgrind; shown with additional context to make review easier. src/conf/network_conf.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index abe91b5..28a3ee8 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -1,22 +1,22 @@ /* * network_conf.c: network XML handling * - * Copyright (C) 2006-2010 Red Hat, Inc. + * Copyright (C) 2006-2011 Red Hat, Inc. * Copyright (C) 2006-2008 Daniel P. Berrange * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * * Author: Daniel P. Berrange <berrange(a)redhat.com> */ @@ -631,67 +631,69 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt) nIps = virXPathNodeSet("./ip", ctxt, &ipNodes); if (nIps > 0) { int ii; /* allocate array to hold all the addrs */ if (VIR_ALLOC_N(def->ips, nIps) < 0) { virReportOOMError(); goto error; } /* parse each addr */ for (ii = 0; ii < nIps; ii++) { int ret = virNetworkIPParseXML(def->name, &def->ips[ii], ipNodes[ii], ctxt); if (ret < 0) goto error; def->nips++; } } + VIR_FREE(ipNodes); /* IPv4 forwarding setup */ if (virXPathBoolean("count(./forward) > 0", ctxt)) { if (def->nips == 0) { virNetworkReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Forwarding requested, but no IP address provided")); goto error; } tmp = virXPathString("string(./forward[1]/@mode)", ctxt); if (tmp) { if ((def->forwardType = virNetworkForwardTypeFromString(tmp)) < 0) { virNetworkReportError(VIR_ERR_INTERNAL_ERROR, _("unknown forwarding type '%s'"), tmp); VIR_FREE(tmp); goto error; } VIR_FREE(tmp); } else { def->forwardType = VIR_NETWORK_FORWARD_NAT; } def->forwardDev = virXPathString("string(./forward[1]/@dev)", ctxt); } else { def->forwardType = VIR_NETWORK_FORWARD_NONE; } return def; error: virNetworkDefFree(def); + VIR_FREE(ipNodes); return NULL; } static virNetworkDefPtr virNetworkDefParse(const char *xmlStr, const char *filename) { xmlDocPtr xml; virNetworkDefPtr def = NULL; if ((xml = virXMLParse(filename, xmlStr, "network.xml"))) { def = virNetworkDefParseNode(xml, xmlDocGetRootElement(xml)); xmlFreeDoc(xml); } return def; } -- 1.7.3.4

3 3

[libvirt] [PATCH] cpu: plug memory leak
by Eric Blake 11 Jan '11

11 Jan '11

* src/cpu/cpu_x86.c (x86ModelLoad): Free data before overwriting. --- Yet another valgrind finding; 320 bytes per domain XML parse. src/cpu/cpu_x86.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index df1e431..ae8e5e7 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1,7 +1,7 @@ /* * cpu_x86.c: CPU driver for CPUs with x86 compatible CPUID instruction * - * Copyright (C) 2009-2010 Red Hat, Inc. + * Copyright (C) 2009-2011 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -973,6 +973,7 @@ x86ModelLoad(xmlXPathContextPtr ctxt, VIR_FREE(name); model->vendor = ancestor->vendor; + x86DataFree(model->data); if (!(model->data = x86DataCopy(ancestor->data))) goto no_memory; } -- 1.7.3.4

2 2

[libvirt] [RFC] Live disk snapshot API
by Jiri Denemark 11 Jan '11

11 Jan '11

Hi all. Purpose of this API is to help with making host-side backups of running domains without having to suspend them until backup finishes. The API can be used to create a consistent snapshot of a disk assigned to a domain, which can be later used for making backups. For better consistency, libvirt will try to notify the domain to make data on disk consistent. Guest agent is needed for this to work and libvirt will talk with it using hypervisor API or directly. Libvirt already provides snapshot support with virDomainSnapshot* APIs but they serve a bit different purpose. Domain snapshots consist of current state of all disks and runtime state (if the domain is running) taken at the same time. Since memory is also saved, domain snapshot creation can take some time during which the domain may need to be suspended. The main benefit of these APIs is that they can be used to create checkpoints of a domain in a known good state to which the domain can later be reverted. Disk snapshot API needs to be general and flexible enough to support various storage and snapshot methods. Examples of what can be used for creating disk snapshots are: QEMU qcow2 snapshots, LVM snapshots, filesystems with snapshot support (btrfs, zfs, ...), enterprise storage. Moreover, method used to create disk snapshot does not have to be determined by disk type. One can have a qcow2 disk stored on btrfs inside lvm logical volume; snapshot of such disk can be done at any of the three levels. Hypervisor support: QEMU supports snapshot_blkdev monitor command for creating qcow2 snapshots. VMware does not seem to support per-device snapshots, only per-VM snapshot without memory. VirtualBox provides IMedium::createDiffStorage(), IMedium::mergeTo() for per-device snapshots but they do not seem to work on disks in use. However, full support from hypervisors is not strictly required since snapshots can be done outside of them although at a possible cost of losing consistency. As different snapshot methods may require different input data, new diskSnapshot XML element is introduced to describe disk snapshot method: <diskSnapshot method='qemu|lvm|btrfs|...'>  </diskSnapshot> For qemu method, the element can be very simple: <diskSnapshot method='qemu'/> For lvm, logical volume device needs to be specified in case it is not the same as disk to be snapshotted: <diskSnapshot method='lvm'> <device path='/dev/vg/lv4'/> </diskSnapshot> Enterprise storage would need their own ways of identifying volumes to be snapshotted. The diskSnapshot element can be used inside disk element in domain XML: <domain ...> ... <devices> ... <disk ...> ... <diskSnapshot ...> ... </diskSnapshot> </disk> </devices> </domain> The "disk" part of "diskSnapshot" element name may seem to be redundant but I wanted to avoid confusion with snapshot XML element used for domain snapshots. Existing virDomainUpdateDevice API can be used to alter snapshot method on existing disk devices. To create a snapshot of a disk, the following API is introduced: int virDomainDiskSnapshotCreate(virDomainPtr domain, const char *disk, const char *method, const char *name, char **modifiedDisk, char **backupSource, unsigned int flags); @domain pointer to domain object @disk XML definition of the disk to snapshot @method optional <diskSnapshot> XML element overriding the one from <disk> element; if none of them is specified, default method according to disk type (and pool) is used; e.g., qcow disk => qemu method; logical volume in LVM pool => lvm method @name snapshot name @modifiedDisk place where to store modified XML description of the disk which the domain is now using; NULL is stored if domain is still using the original disk (snapshot was created separately) @backupSource place where to store 'source' element from disk XML describing the disk which can be used to take backups of 'disk' (i.e., read-only and immutable snapshot); it might either be the same as provided in 'disk' or something else (depending on method/implementation used); e.g., for qemu method, the element describes previous disk source; lvm creates a new device for snapshot and keeps writing into the original device @flags OR'ed set of flags: - VIR_DOMAIN_DISK_SNAPSHOT_QUIESCE_REQUIRED -- if no guest agent is running/answering requests for consistent disk state, fail the API; otherwise, the snapshot will be done regardless I have a slight feeling that the API is a bit over-engineered but I'm not entirely sure if it can be simplified and still provide the flexibility and future-compatibility. I have this feeling especially about backupSource output parameter which might possibly replaced with a simple char * (eventually returned directly by the API instead of int) containing file/device path. Another think which is not strictly needed is modifiedDisk. The caller can ask for domain XML and look the device there if needed but that would be quite complicated. Thus returning it from this API seemed useful and logical too, since the API is possibly changing disk XML and it make sense to return the changes. Deleting/merging snapshots previously created by virDomainDiskSnapshotCreate is not covered by this proposal and will need to be added in the future to complete disk snapshot support. Jirka

4 5

[libvirt] [PATCH] docs: updated memtune info again in virsh command reference
by Justin Clift 10 Jan '11

10 Jan '11

1 1

[libvirt] [PATCH] python: Use PyCapsule API if available
by Cole Robinson 10 Jan '11

10 Jan '11

On Fedore 14, virt-manager spews a bunch of warnings to the console: /usr/lib64/python2.7/site-packages/libvirt.py:1781: PendingDeprecationWarning: The CObject type is marked Pending Deprecation in Python 2.7. Please use capsule objects instead. Have libvirt use the capsule API if available. I've verified this compiles fine on older python (2.6 in RHEL6 which doesn't have capsules), and virt-manager seems to function fine. --- python/typewrappers.c | 89 +++++++++++++++++++++++++++--------------------- 1 files changed, 50 insertions(+), 39 deletions(-) diff --git a/python/typewrappers.c b/python/typewrappers.c index 733aa20..e39d3cd 100644 --- a/python/typewrappers.c +++ b/python/typewrappers.c @@ -16,6 +16,26 @@ #include "typewrappers.h" +#ifndef Py_CAPSULE_H +typedef void(*PyCapsule_Destructor)(void *, void *); +#endif + +static PyObject * +libvirt_buildPyObject(void *cobj, + const char *name, + PyCapsule_Destructor destr) +{ + PyObject *ret; + +#ifdef Py_CAPSULE_H + ret = PyCapsule_New(cobj, name, destr); +#else + ret = PyCObject_FromVoidPtrAndDesc(cobj, (void *) name, destr); +#endif /* _TEST_CAPSULE */ + + return ret; +} + PyObject * libvirt_intWrap(int val) { @@ -105,9 +125,8 @@ libvirt_virDomainPtrWrap(virDomainPtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virDomainPtr", - NULL); + + ret = libvirt_buildPyObject(node, "virDomainPtr", NULL); return (ret); } @@ -120,9 +139,8 @@ libvirt_virNetworkPtrWrap(virNetworkPtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virNetworkPtr", - NULL); + + ret = libvirt_buildPyObject(node, "virNetworkPtr", NULL); return (ret); } @@ -135,9 +153,8 @@ libvirt_virInterfacePtrWrap(virInterfacePtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virInterfacePtr", - NULL); + + ret = libvirt_buildPyObject(node, "virInterfacePtr", NULL); return (ret); } @@ -150,9 +167,8 @@ libvirt_virStoragePoolPtrWrap(virStoragePoolPtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virStoragePoolPtr", - NULL); + + ret = libvirt_buildPyObject(node, "virStoragePoolPtr", NULL); return (ret); } @@ -165,9 +181,8 @@ libvirt_virStorageVolPtrWrap(virStorageVolPtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virStorageVolPtr", - NULL); + + ret = libvirt_buildPyObject(node, "virStorageVolPtr", NULL); return (ret); } @@ -180,9 +195,8 @@ libvirt_virConnectPtrWrap(virConnectPtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virConnectPtr", - NULL); + + ret = libvirt_buildPyObject(node, "virConnectPtr", NULL); return (ret); } @@ -195,9 +209,8 @@ libvirt_virNodeDevicePtrWrap(virNodeDevicePtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virNodeDevicePtr", - NULL); + + ret = libvirt_buildPyObject(node, "virNodeDevicePtr", NULL); return (ret); } @@ -210,7 +223,8 @@ libvirt_virSecretPtrWrap(virSecretPtr node) Py_INCREF(Py_None); return Py_None; } - ret = PyCObject_FromVoidPtrAndDesc(node, (char *) "virSecretPtr", NULL); + + ret = libvirt_buildPyObject(node, "virSecretPtr", NULL); return (ret); } @@ -223,7 +237,8 @@ libvirt_virNWFilterPtrWrap(virNWFilterPtr node) Py_INCREF(Py_None); return Py_None; } - ret = PyCObject_FromVoidPtrAndDesc(node, (char *) "virNWFilterPtr", NULL); + + ret = libvirt_buildPyObject(node, "virNWFilterPtr", NULL); return (ret); } @@ -236,7 +251,8 @@ libvirt_virStreamPtrWrap(virStreamPtr node) Py_INCREF(Py_None); return Py_None; } - ret = PyCObject_FromVoidPtrAndDesc(node, (char *) "virStreamPtr", NULL); + + ret = libvirt_buildPyObject(node, "virStreamPtr", NULL); return (ret); } @@ -249,9 +265,8 @@ libvirt_virDomainSnapshotPtrWrap(virDomainSnapshotPtr node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virDomainSnapshotPtr", - NULL); + + ret = libvirt_buildPyObject(node, "virDomainSnapshotPtr", NULL); return (ret); } @@ -265,9 +280,8 @@ libvirt_virEventHandleCallbackWrap(virEventHandleCallback node) printf("%s: WARNING - Wrapping None\n", __func__); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virEventHandleCallback", - NULL); + + ret = libvirt_buildPyObject(node, "virEventHandleCallback", NULL); return (ret); } @@ -281,9 +295,8 @@ libvirt_virEventTimeoutCallbackWrap(virEventTimeoutCallback node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virEventTimeoutCallback", - NULL); + + ret = libvirt_buildPyObject(node, "virEventTimeoutCallback", NULL); return (ret); } @@ -296,9 +309,8 @@ libvirt_virFreeCallbackWrap(virFreeCallback node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "virFreeCallback", - NULL); + + ret = libvirt_buildPyObject(node, "virFreeCallback", NULL); return (ret); } @@ -311,8 +323,7 @@ libvirt_virVoidPtrWrap(void* node) Py_INCREF(Py_None); return (Py_None); } - ret = - PyCObject_FromVoidPtrAndDesc((void *) node, (char *) "void*", - NULL); + + ret = libvirt_buildPyObject(node, "void*", NULL); return (ret); } -- 1.7.3.2

2 3

[libvirt] Need a better word than "allocated" or "ascertained"
by Justin Clift 10 Jan '11

10 Jan '11

Hi us, Quick question... the virsh "memtune" command has a parameter called "--soft-limit". The draft description for it, for the virsh command reference, is: Minimum memory allocated to the guest domain during contention, in kilobytes. QEMU and LXC only. http://justinclift.fedorapeople.org/virshcmdref/sect-memtune.html But, Nikunj has pointed out the word "allocated" here isn't correct. His initial suggestion is to use "ascertained" instead, but that doesn't sound at all right to me: Minimum memory ascertained to the guest domain during contention, in kilobytes. QEMU and LXC only. "Ascertained" doesn't really make sense to me in this context. Wondering if anyone has better suggestions? :) Regards and best wishes, Justin Clift

5 15

[libvirt] [PATCH 0/8] events: Add helpers for driver dispatching
by Cole Robinson 10 Jan '11

10 Jan '11

I noticed that there is quite a bit of code duplication among the drivers that support domain events. This patch series is an attempt to consolidate the shared logic. Patch #1 is the bugfix for https://bugzilla.redhat.com/show_bug.cgi?id=624252 which started me down this path. It can be applied independently of the refactoring if need be. Thanks, Cole Cole Robinson (8): remote: Don't lose track of events when callbacks are slow event-test: Simplify debug on/off domain_event: Add virDomainEventState structure domain_event: Add common domain event queue/flush helpers qemu: Use virDomainEventState helpers lxc: Use virDomainEventState helpers test: Use virDomainEventState helpers remote: Use virDomainEventState helpers examples/domain-events/events-python/event-test.py | 37 +++-- src/conf/domain_event.c | 163 +++++++++++++++++--- src/conf/domain_event.h | 64 ++++++-- src/libvirt_private.syms | 6 + src/lxc/lxc_conf.h | 6 +- src/lxc/lxc_driver.c | 76 +++------ src/qemu/qemu_conf.h | 6 +- src/qemu/qemu_driver.c | 80 +++------- src/remote/remote_driver.c | 162 ++++++++------------ src/test/test_driver.c | 104 ++++--------- 10 files changed, 363 insertions(+), 341 deletions(-) -- 1.7.3.3

2 18

[libvirt] [PATCH] qemu: Allow serving VNC over a unix domain socket
by Cole Robinson 10 Jan '11

10 Jan '11

QEMU supports serving VNC over a unix domain socket rather than traditional TCP host/port. This is specified with: <graphics type='vnc' socket='/foo/bar/baz'/> Currently not hooked up with the security driver, I'll wait for Dan's big reorg. I also have a virtinst/virt-manager patch queued locally to handle this change. To be useful, we probably want a qemu.conf option to use sockets as the default VNC method, so VMs without hardcoded listen addresses will magically start up serving over a socket in /var/lib/libvirt/qemu. This provides better security access control than VNC listening on 127.0.0.1, but will cause issues with tools that rely on the lax security (virt-manager in fedora runs as regular user by default, and wouldn't be able to access a socket owned by 'qemu' or 'root'). --- docs/formatdomain.html.in | 6 ++- docs/schemas/domain.rng | 5 ++ src/conf/domain_conf.c | 30 +++++++---- src/conf/domain_conf.h | 1 + src/qemu/qemu_command.c | 52 +++++++++++++------- src/qemu/qemu_driver.c | 1 + tests/qemuargv2xmltest.c | 1 + .../qemuxml2argv-graphics-vnc-socket.args | 1 + .../qemuxml2argv-graphics-vnc-socket.xml | 30 +++++++++++ tests/qemuxml2argvtest.c | 1 + 10 files changed, 98 insertions(+), 30 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.xml diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index e9fcea1..fbcff0b 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1153,7 +1153,11 @@ qemu-kvm -net nic,model=? /dev/null in clear text. The <code>keymap</code> attribute specifies the keymap to use. It is possible to set a limit on the validity of the password be giving an timestamp <code>passwdValidTo='2010-04-09T15:51:00'</code> - assumed to be in UTC. NB, this may not be supported by all hypervisors. + assumed to be in UTC. NB, this may not be supported by all hypervisors.<br> + <br> + Rather than using listen/port, QEMU supports a <code>socket</code> + attribute for listening on a unix domain socket path. + <span class="since">Since 0.8.8</span> </dd> <dt><code>"spice"</code></dt> <dd> diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index a524e4b..554a39f 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -1116,6 +1116,11 @@ </attribute> </optional> <optional> + <attribute name="socket"> + <ref name="absFilePath"/> + </attribute> + </optional> + <optional> <attribute name="passwd"> <text/> </attribute> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index c857a89..aec23aa 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -471,6 +471,7 @@ void virDomainGraphicsDefFree(virDomainGraphicsDefPtr def) switch (def->type) { case VIR_DOMAIN_GRAPHICS_TYPE_VNC: VIR_FREE(def->data.vnc.listenAddr); + VIR_FREE(def->data.vnc.socket); VIR_FREE(def->data.vnc.keymap); virDomainGraphicsAuthDefClear(&def->data.vnc.auth); break; @@ -3349,6 +3350,7 @@ virDomainGraphicsDefParseXML(xmlNodePtr node, int flags) { } def->data.vnc.listenAddr = virXMLPropString(node, "listen"); + def->data.vnc.socket = virXMLPropString(node, "socket"); def->data.vnc.keymap = virXMLPropString(node, "keymap"); if (virDomainGraphicsAuthDefParseXML(node, &def->data.vnc.auth) < 0) @@ -6844,19 +6846,25 @@ virDomainGraphicsDefFormat(virBufferPtr buf, switch (def->type) { case VIR_DOMAIN_GRAPHICS_TYPE_VNC: - if (def->data.vnc.port && - (!def->data.vnc.autoport || !(flags & VIR_DOMAIN_XML_INACTIVE))) - virBufferVSprintf(buf, " port='%d'", - def->data.vnc.port); - else if (def->data.vnc.autoport) - virBufferAddLit(buf, " port='-1'"); + if (def->data.vnc.socket) { + if (def->data.vnc.socket) + virBufferVSprintf(buf, " socket='%s'", + def->data.vnc.socket); + } else { + if (def->data.vnc.port && + (!def->data.vnc.autoport || !(flags & VIR_DOMAIN_XML_INACTIVE))) + virBufferVSprintf(buf, " port='%d'", + def->data.vnc.port); + else if (def->data.vnc.autoport) + virBufferAddLit(buf, " port='-1'"); - virBufferVSprintf(buf, " autoport='%s'", - def->data.vnc.autoport ? "yes" : "no"); + virBufferVSprintf(buf, " autoport='%s'", + def->data.vnc.autoport ? "yes" : "no"); - if (def->data.vnc.listenAddr) - virBufferVSprintf(buf, " listen='%s'", - def->data.vnc.listenAddr); + if (def->data.vnc.listenAddr) + virBufferVSprintf(buf, " listen='%s'", + def->data.vnc.listenAddr); + } if (def->data.vnc.keymap) virBufferEscapeString(buf, " keymap='%s'", diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index a459a22..684fc7d 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -574,6 +574,7 @@ struct _virDomainGraphicsDef { unsigned int autoport :1; char *listenAddr; char *keymap; + char *socket; virDomainGraphicsAuthDef auth; } vnc; struct { diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 7dd8e03..c0fd00b 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3511,7 +3511,11 @@ qemuBuildCommandLine(virConnectPtr conn, def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC) { virBuffer opt = VIR_BUFFER_INITIALIZER; - if (qemuCmdFlags & QEMUD_CMD_FLAG_VNC_COLON) { + if (def->graphics[0]->data.vnc.socket) { + virBufferVSprintf(&opt, "unix:%s", + def->graphics[0]->data.vnc.socket); + + } else if (qemuCmdFlags & QEMUD_CMD_FLAG_VNC_COLON) { if (def->graphics[0]->data.vnc.listenAddr) virBufferAdd(&opt, def->graphics[0]->data.vnc.listenAddr, -1); else if (driver->vncListen) @@ -3520,6 +3524,12 @@ qemuBuildCommandLine(virConnectPtr conn, virBufferVSprintf(&opt, ":%d", def->graphics[0]->data.vnc.port - 5900); + } else { + virBufferVSprintf(&opt, "%d", + def->graphics[0]->data.vnc.port - 5900); + } + + if (qemuCmdFlags & QEMUD_CMD_FLAG_VNC_COLON) { if (def->graphics[0]->data.vnc.auth.passwd || driver->vncPassword) virBufferAddLit(&opt, ",password"); @@ -3544,9 +3554,6 @@ qemuBuildCommandLine(virConnectPtr conn, /* TODO: Support ACLs later */ } - } else { - virBufferVSprintf(&opt, "%d", - def->graphics[0]->data.vnc.port - 5900); } virCommandAddArg(cmd, "-vnc"); @@ -5174,24 +5181,33 @@ virDomainDefPtr qemuParseCommandLine(virCapsPtr caps, goto no_memory; vnc->type = VIR_DOMAIN_GRAPHICS_TYPE_VNC; - tmp = strchr(val, ':'); - if (tmp) { - char *opts; - if (virStrToLong_i(tmp+1, &opts, 10, &vnc->data.vnc.port) < 0) { - VIR_FREE(vnc); - qemuReportError(VIR_ERR_INTERNAL_ERROR, \ - _("cannot parse VNC port '%s'"), tmp+1); - goto error; - } - vnc->data.vnc.listenAddr = strndup(val, tmp-val); - if (!vnc->data.vnc.listenAddr) { + if (STRPREFIX(val, "unix:")) { + vnc->data.vnc.socket = strdup(val + 5); + if (!vnc->data.vnc.socket) { VIR_FREE(vnc); goto no_memory; } - vnc->data.vnc.port += 5900; - vnc->data.vnc.autoport = 0; } else { - vnc->data.vnc.autoport = 1; + tmp = strchr(val, ':'); + if (tmp) { + char *opts; + if (virStrToLong_i(tmp+1, &opts, 10, + &vnc->data.vnc.port) < 0) { + VIR_FREE(vnc); + qemuReportError(VIR_ERR_INTERNAL_ERROR, + _("cannot parse VNC port '%s'"), tmp+1); + goto error; + } + vnc->data.vnc.listenAddr = strndup(val, tmp-val); + if (!vnc->data.vnc.listenAddr) { + VIR_FREE(vnc); + goto no_memory; + } + vnc->data.vnc.port += 5900; + vnc->data.vnc.autoport = 0; + } else { + vnc->data.vnc.autoport = 1; + } } if (VIR_REALLOC_N(def->graphics, def->ngraphics+1) < 0) { diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index e915705..0f2e3b2 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -2684,6 +2684,7 @@ static int qemudStartVMDaemon(virConnectPtr conn, if (vm->def->ngraphics == 1) { if (vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && + !vm->def->graphics[0]->data.vnc.socket && vm->def->graphics[0]->data.vnc.autoport) { int port = qemudNextFreePort(driver, QEMU_VNC_PORT_MIN); if (port < 0) { diff --git a/tests/qemuargv2xmltest.c b/tests/qemuargv2xmltest.c index 8338af3..7499ba0 100644 --- a/tests/qemuargv2xmltest.c +++ b/tests/qemuargv2xmltest.c @@ -178,6 +178,7 @@ mymain(int argc, char **argv) DO_TEST("disk-drive-network-sheepdog"); DO_TEST("disk-usb"); DO_TEST("graphics-vnc"); + DO_TEST("graphics-vnc-socket"); driver.vncSASL = 1; driver.vncSASLdir = strdup("/root/.sasl2"); diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.args new file mode 100644 index 0000000..055c562 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.args @@ -0,0 +1 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none /usr/bin/qemu -S -M pc -m 214 -smp 1 -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -net none -serial none -parallel none -usb -vnc unix:/tmp/foo.socket diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.xml new file mode 100644 index 0000000..d6ad72b --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket.xml @@ -0,0 +1,30 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>219200</memory> + <currentMemory>219200</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' unit='0'/> + </disk> + <controller type='ide' index='0'/> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' socket='/tmp/foo.socket'/> + <video> + <model type='cirrus' vram='9216' heads='1'/> + </video> + <memballoon model='virtio'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 6760f67..8a1d5f7 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -316,6 +316,7 @@ mymain(int argc, char **argv) DO_TEST("disk-scsi-device-auto", QEMUD_CMD_FLAG_DRIVE | QEMUD_CMD_FLAG_DEVICE | QEMUD_CMD_FLAG_NODEFCONFIG, false); DO_TEST("graphics-vnc", 0, false); + DO_TEST("graphics-vnc-socket", 0, false); driver.vncSASL = 1; driver.vncSASLdir = strdup("/root/.sasl2"); -- 1.7.3.3

3 3

[libvirt] [PATCH] conf: Report error if invalid type specified for character device
by Osier Yang 10 Jan '11

10 Jan '11

If invalid type is specified, e.g. <serial type='foo'> <target port='0'/> </serial> We replace 'foo' with "null" type implicitly, without reporting an error message to tell the user, and "start" or "edit" the domain will be success. It's not good to guess what the user wants, This patch is to fix the problem. * src/conf/domain_conf.c --- src/conf/domain_conf.c | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index c857a89..b4df38c 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2821,10 +2821,14 @@ virDomainChrDefParseXML(virCapsPtr caps, } type = virXMLPropString(node, "type"); - if (type == NULL) + if (type == NULL) { def->type = VIR_DOMAIN_CHR_TYPE_PTY; - else if ((def->type = virDomainChrTypeFromString(type)) < 0) - def->type = VIR_DOMAIN_CHR_TYPE_NULL; + } else if ((def->type = virDomainChrTypeFromString(type)) < 0) { + virDomainReportError(VIR_ERR_XML_ERROR, + _("unknown type presented to host for character device: %s"), + type); + goto error; + } nodeName = (const char *) node->name; if ((def->deviceType = virDomainChrDeviceTypeFromString(nodeName)) < 0) { -- 1.7.3.2

2 1

[libvirt] VirtualBox error message displayed on windows
by Justin Clift 10 Jan '11

10 Jan '11

Hi Matthias, Just came across an interesting (non fatal) bug with the new VirtualBox code on windows. When starting virsh on a windows system that *doesn't* have VirtualBox installed, virsh prints an error to the users terminal about missing VirtualBox registry keys, then continues on with it's intended operation. (screenshot attached) It's not a killer, but the error makes no sense in context when I'm (for example) trying to connect to a remote qemu box. Heh. Feel inclined to write a patch for it? Regards and best wishes, Justin Clift

2 2

[libvirt] [PATCH] Basic support for VDE networking
by Renzo Davoli 10 Jan '11

10 Jan '11

I have seen several messages asking for VDE networking support. There is an item also in your todo web page. http://libvirt.org/todo.html I have developed a patch to provide a basic support for VDE. It defines and manages the syntax: <domain ....> <device> <interface type='vde'> ... <switch path='/tmp/vde.ctl'/> </interface> </device> </domain> the switch tag can be omitted: vde uses the default switch. I have tested the qemu/kvm support. user-mode linux support is included but not tested yet. libvirt vde support for virtualbox has not been coded yet (virtualbox itself supports vde). The patch is against libvirt-0.8.7. renzo (designer/developer of VDE, university of bologna, wiki.virtualsquare.org) (I have not subscribed the ML, please Cc: to me your reply messages) Signed-off-by: Renzo Davoli <renzo(a)cs.unibo.it> --- --- a/src/lxc/lxc_driver.c 2011-01-10 11:49:49.000000000 +0100 +++ b/src/lxc/lxc_driver.c 2011-01-10 11:50:03.000000000 +0100 @@ -1083,6 +1083,7 @@ case VIR_DOMAIN_NET_TYPE_INTERNAL: case VIR_DOMAIN_NET_TYPE_DIRECT: case VIR_DOMAIN_NET_TYPE_LAST: + case VIR_DOMAIN_NET_TYPE_VDE: break; } --- a/src/uml/uml_conf.c 2011-01-10 12:03:54.000000000 +0100 +++ b/src/uml/uml_conf.c 2011-01-10 13:26:08.000000000 +0100 @@ -269,6 +269,14 @@ virBufferVSprintf(&buf, "tuntap,%s", def->ifname); break; + case VIR_DOMAIN_NET_TYPE_VDE: + /* ethNNN=vde,vde_switch,macaddr,port,group,mode,description */ + if (def->data.vde.vdeswitch) { + virBufferVSprintf(&buf, "vde,%s", def->data.vde.vdeswitch); + } else + virBufferAddLit(&buf, "vde"); + break; + case VIR_DOMAIN_NET_TYPE_INTERNAL: umlReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("internal networking type not supported")); --- a/src/conf/domain_conf.h 2011-01-10 11:41:07.000000000 +0100 +++ b/src/conf/domain_conf.h 2011-01-10 13:21:08.000000000 +0100 @@ -288,6 +288,7 @@ VIR_DOMAIN_NET_TYPE_BRIDGE, VIR_DOMAIN_NET_TYPE_INTERNAL, VIR_DOMAIN_NET_TYPE_DIRECT, + VIR_DOMAIN_NET_TYPE_VDE, VIR_DOMAIN_NET_TYPE_LAST, }; @@ -336,6 +337,9 @@ int mode; virVirtualPortProfileParams virtPortProfile; } direct; + struct { + char *vdeswitch; + } vde; } data; char *ifname; virDomainDeviceInfo info; --- a/src/conf/domain_conf.c 2011-01-10 11:42:04.000000000 +0100 +++ b/src/conf/domain_conf.c 2011-01-10 14:49:46.000000000 +0100 @@ -182,7 +182,8 @@ "network", "bridge", "internal", - "direct") + "direct", + "vde") VIR_ENUM_IMPL(virDomainChrChannelTarget, VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_LAST, @@ -598,6 +599,10 @@ VIR_FREE(def->data.direct.linkdev); break; + case VIR_DOMAIN_NET_TYPE_VDE: + VIR_FREE(def->data.vde.vdeswitch); + break; + case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_LAST: break; @@ -2293,6 +2298,7 @@ char *internal = NULL; char *devaddr = NULL; char *mode = NULL; + char *vdeswitch = NULL; virNWFilterHashTablePtr filterparams = NULL; virVirtualPortProfileParams virtPort; bool virtPortParsed = false; @@ -2379,7 +2385,11 @@ xmlStrEqual(cur->name, BAD_CAST "state")) { /* Legacy back-compat. Don't add any more attributes here */ devaddr = virXMLPropString(cur, "devaddr"); - } + } else if ((vdeswitch == NULL) && + def->type == VIR_DOMAIN_NET_TYPE_VDE && + xmlStrEqual(cur->name, BAD_CAST "switch")) { + vdeswitch = virXMLPropString(cur, "path"); + } } cur = cur->next; } @@ -2529,6 +2539,11 @@ break; + case VIR_DOMAIN_NET_TYPE_VDE: + def->data.vde.vdeswitch = vdeswitch; + vdeswitch = NULL; + break; + case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_LAST: break; @@ -6263,6 +6278,12 @@ " "); break; + case VIR_DOMAIN_NET_TYPE_VDE: + if (def->data.vde.vdeswitch) + virBufferEscapeString(buf, " <switch path='%s'/>\n", + def->data.vde.vdeswitch); + break; + case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_LAST: break; --- a/src/qemu/qemu_command.c 2011-01-10 13:11:17.000000000 +0100 +++ b/src/qemu/qemu_command.c 2011-01-10 13:26:28.000000000 +0100 @@ -1602,12 +1602,21 @@ case VIR_DOMAIN_NET_TYPE_BRIDGE: case VIR_DOMAIN_NET_TYPE_INTERNAL: case VIR_DOMAIN_NET_TYPE_DIRECT: + case VIR_DOMAIN_NET_TYPE_VDE: case VIR_DOMAIN_NET_TYPE_LAST: break; } type_sep = ','; break; + case VIR_DOMAIN_NET_TYPE_VDE: + virBufferAddLit(&buf, "vde"); + if (net->data.vde.vdeswitch) + virBufferVSprintf(&buf, "%csock=%s", + type_sep, + net->data.vde.vdeswitch); + break; + case VIR_DOMAIN_NET_TYPE_USER: default: virBufferAddLit(&buf, "user");

1 0

[libvirt] [PATCH] daemon: Fix core dumps if unix_sock_group is set
by Jiri Denemark 10 Jan '11

10 Jan '11

Setting unix_sock_group to something else than default "root" in /etc/libvirt/libvirtd.conf prevents system libvirtd from dumping core on crash. This is because we used setgid(unix_sock_group) before binding to /var/run/libvirt/libvirt-sock* and setgid() back to original group. However, if a process changes its effective or filesystem group ID, it will be forbidden from leaving core dumps unless fs.suid_dumpable sysctl is set to something else then 0 (and it is 0 by default). Changing socket's group ownership after bind works better. And we can do so without introducing a race condition since we loosen access rights by changing the group from root to something else. --- daemon/libvirtd.c | 17 ++++++++--------- 1 files changed, 8 insertions(+), 9 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 2df9337..b1539b1 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -542,7 +542,6 @@ static int qemudListenUnix(struct qemud_server *server, char *path, int readonly, int auth) { struct qemud_socket *sock; mode_t oldmask; - gid_t oldgrp; char ebuf[1024]; if (VIR_ALLOC(sock) < 0) { @@ -579,21 +578,21 @@ static int qemudListenUnix(struct qemud_server *server, if (sock->addr.data.un.sun_path[0] == '@') sock->addr.data.un.sun_path[0] = '\0'; - oldgrp = getgid(); oldmask = umask(readonly ? ~unix_sock_ro_mask : ~unix_sock_rw_mask); - if (server->privileged && setgid(unix_sock_gid)) { - VIR_ERROR(_("Failed to set group ID to %d"), unix_sock_gid); - goto cleanup; - } - if (bind(sock->fd, &sock->addr.data.sa, sock->addr.len) < 0) { VIR_ERROR(_("Failed to bind socket to '%s': %s"), path, virStrerror(errno, ebuf, sizeof ebuf)); goto cleanup; } umask(oldmask); - if (server->privileged && setgid(oldgrp)) { - VIR_ERROR(_("Failed to restore group ID to %d"), oldgrp); + + /* chown() doesn't work for abstract sockets but we use them only + * if libvirtd runs unprivileged + */ + if (server->privileged && chown(path, -1, unix_sock_gid)) { + VIR_ERROR(_("Failed to change group ID of '%s' to %d: %s"), + path, unix_sock_gid, + virStrerror(errno, ebuf, sizeof ebuf)); goto cleanup; } -- 1.7.4.rc1

3 4

[libvirt] [PATCH v3] Refactor the security drivers to simplify usage
by Daniel P. Berrange 10 Jan '11

10 Jan '11

The current security driver usage requires horrible code like if (driver->securityDriver && driver->securityDriver->domainSetSecurityHostdevLabel && driver->securityDriver->domainSetSecurityHostdevLabel(driver->securityDriver, vm, hostdev) < 0) This pair of checks for NULL clutters up the code, making the driver calls 2 lines longer than they really need to be. The goal of the patchset is to change the calling convention to simply if (virSecurityManagerSetHostdevLabel(driver->securityDriver, vm, hostdev) < 0) The first check for 'driver->securityDriver' being NULL is removed by introducing a 'no op' security driver that will always be present if no real driver is enabled. This guarentees driver->securityDriver != NULL. The second check for 'driver->securityDriver->domainSetSecurityHostdevLabel' being non-NULL is hidden in a new abstraction called virSecurityManager. This separates the driver callbacks, from main internal API. The addition of a virSecurityManager object, that is separate from the virSecurityDriver struct also allows for security drivers to carry state / configuration information directly. Thus the DAC/Stack drivers from src/qemu which used to pull config from 'struct qemud_driver' can now be moved into the 'src/security' directory and store their config directly. * src/qemu/qemu_conf.h, src/qemu/qemu_driver.c: Update to use new virSecurityManager APIs * src/qemu/qemu_security_dac.c, src/qemu/qemu_security_dac.h src/qemu/qemu_security_stacked.c, src/qemu/qemu_security_stacked.h: Move into src/security directory * src/security/security_stack.c, src/security/security_stack.h, src/security/security_dac.c, src/security/security_dac.h: Generic versions of previous QEMU specific drivers * src/security/security_apparmor.c, src/security/security_apparmor.h, src/security/security_driver.c, src/security/security_driver.h, src/security/security_selinux.c, src/security/security_selinux.h: Update to take virSecurityManagerPtr object as the first param in all callbacks * src/security/security_nop.c, src/security/security_nop.h: Stub implementation of all security driver APIs. * src/security/security_manager.h, src/security/security_manager.c: New internal API for invoking security drivers * src/libvirt.c: Add missing debug for security APIs --- po/POTFILES.in | 2 +- src/Makefile.am | 12 +- src/libvirt.c | 4 + src/libvirt_private.syms | 34 ++- src/qemu/qemu_conf.h | 6 +- src/qemu/qemu_driver.c | 167 ++++------ src/qemu/qemu_hotplug.c | 84 ++--- src/qemu/qemu_security_dac.c | 576 ------------------------------ src/qemu/qemu_security_dac.h | 22 -- src/qemu/qemu_security_stacked.c | 418 ---------------------- src/qemu/qemu_security_stacked.h | 22 -- src/security/security_apparmor.c | 152 ++++++--- src/security/security_apparmor.h | 2 + src/security/security_dac.c | 713 ++++++++++++++++++++++++++++++++++++++ src/security/security_dac.h | 36 ++ src/security/security_driver.c | 125 ++----- src/security/security_driver.h | 95 +++--- src/security/security_manager.c | 317 +++++++++++++++++ src/security/security_manager.h | 95 +++++ src/security/security_nop.c | 185 ++++++++++ src/security/security_nop.h | 27 ++ src/security/security_selinux.c | 145 +++++--- src/security/security_selinux.h | 2 +- src/security/security_stack.c | 401 +++++++++++++++++++++ src/security/security_stack.h | 33 ++ 25 files changed, 2207 insertions(+), 1468 deletions(-) delete mode 100644 src/qemu/qemu_security_dac.c delete mode 100644 src/qemu/qemu_security_dac.h delete mode 100644 src/qemu/qemu_security_stacked.c delete mode 100644 src/qemu/qemu_security_stacked.h create mode 100644 src/security/security_dac.c create mode 100644 src/security/security_dac.h create mode 100644 src/security/security_manager.c create mode 100644 src/security/security_manager.h create mode 100644 src/security/security_nop.c create mode 100644 src/security/security_nop.h create mode 100644 src/security/security_stack.c create mode 100644 src/security/security_stack.h diff --git a/po/POTFILES.in b/po/POTFILES.in index 3d7bc8b..3521ba6 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -61,10 +61,10 @@ src/qemu/qemu_hotplug.c src/qemu/qemu_monitor.c src/qemu/qemu_monitor_json.c src/qemu/qemu_monitor_text.c -src/qemu/qemu_security_dac.c src/remote/remote_driver.c src/secret/secret_driver.c src/security/security_apparmor.c +src/security/security_dac.c src/security/security_driver.c src/security/security_selinux.c src/security/virt-aa-helper.c diff --git a/src/Makefile.am b/src/Makefile.am index c13724a..f8b8434 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -288,11 +288,7 @@ QEMU_DRIVER_SOURCES = \ qemu/qemu_monitor_json.h \ qemu/qemu_driver.c qemu/qemu_driver.h \ qemu/qemu_bridge_filter.c \ - qemu/qemu_bridge_filter.h \ - qemu/qemu_security_stacked.h \ - qemu/qemu_security_stacked.c \ - qemu/qemu_security_dac.h \ - qemu/qemu_security_dac.c + qemu/qemu_bridge_filter.h XENAPI_DRIVER_SOURCES = \ xenapi/xenapi_driver.c xenapi/xenapi_driver.h \ @@ -390,7 +386,11 @@ NWFILTER_DRIVER_SOURCES = \ # Security framework and drivers for various models SECURITY_DRIVER_SOURCES = \ - security/security_driver.h security/security_driver.c + security/security_driver.h security/security_driver.c \ + security/security_nop.h security/security_nop.c \ + security/security_stack.h security/security_stack.c \ + security/security_dac.h security/security_dac.c \ + security/security_manager.h security/security_manager.c SECURITY_DRIVER_SELINUX_SOURCES = \ security/security_selinux.h security/security_selinux.c diff --git a/src/libvirt.c b/src/libvirt.c index 89b37c5..a4789bc 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -5642,6 +5642,8 @@ virDomainGetSecurityLabel(virDomainPtr domain, virSecurityLabelPtr seclabel) { virConnectPtr conn; + VIR_DOMAIN_DEBUG(domain, "seclabel=%p", seclabel); + if (!VIR_IS_CONNECTED_DOMAIN(domain)) { virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); virDispatchError(NULL); @@ -5684,6 +5686,8 @@ error: int virNodeGetSecurityModel(virConnectPtr conn, virSecurityModelPtr secmodel) { + DEBUG("conn=%p secmodel=%p", conn, secmodel); + if (!VIR_IS_CONNECT(conn)) { virLibConnError(NULL, VIR_ERR_INVALID_CONN, __FUNCTION__); virDispatchError(NULL); diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 19e581c..e9b8cb7 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -701,13 +701,33 @@ virSecretDefParseFile; virSecretDefParseString; -# security.h -virSecurityDriverGetDOI; -virSecurityDriverGetModel; -virSecurityDriverInit; -virSecurityDriverSetDOI; -virSecurityDriverStartup; -virSecurityDriverVerify; +# security_driver.h +virSecurityDriverLookup; + + +# security_manager.h +virSecurityManagerClearSocketLabel; +virSecurityManagerFree; +virSecurityManagerGenLabel; +virSecurityManagerGetDOI; +virSecurityManagerGetModel; +virSecurityManagerGetProcessLabel; +virSecurityManagerNew; +virSecurityManagerNewStack; +virSecurityManagerNewDAC; +virSecurityManagerReleaseLabel; +virSecurityManagerReserveLabel; +virSecurityManagerRestoreImageLabel; +virSecurityManagerRestoreAllLabel; +virSecurityManagerRestoreHostdevLabel; +virSecurityManagerRestoreSavedStateLabel; +virSecurityManagerSetAllLabel; +virSecurityManagerSetImageLabel; +virSecurityManagerSetHostdevLabel; +virSecurityManagerSetProcessLabel; +virSecurityManagerSetSavedStateLabel; +virSecurityManagerSetSocketLabel; +virSecurityManagerVerify; # storage_conf.h diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 83ddedd..5a5748b 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -35,7 +35,7 @@ # include "domain_conf.h" # include "domain_event.h" # include "threads.h" -# include "security/security_driver.h" +# include "security/security_manager.h" # include "cgroup.h" # include "pci.h" # include "cpu_conf.h" @@ -114,9 +114,7 @@ struct qemud_driver { int domainEventDispatching; char *securityDriverName; - virSecurityDriverPtr securityDriver; - virSecurityDriverPtr securityPrimaryDriver; - virSecurityDriverPtr securitySecondaryDriver; + virSecurityManagerPtr securityManager; char *saveImageFormat; char *dumpImageFormat; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index e915705..24e9162 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -73,8 +73,6 @@ #include "pci.h" #include "hostusb.h" #include "processinfo.h" -#include "qemu_security_stacked.h" -#include "qemu_security_dac.h" #include "libvirt_internal.h" #include "xml.h" #include "cpu/cpu.h" @@ -861,10 +859,7 @@ qemuConnectMonitor(struct qemud_driver *driver, virDomainObjPtr vm) qemuDomainObjPrivatePtr priv = vm->privateData; int ret = -1; - if (driver->securityDriver && - driver->securityDriver->domainSetSecuritySocketLabel && - driver->securityDriver->domainSetSecuritySocketLabel - (driver->securityDriver,vm) < 0) { + if (virSecurityManagerSetSocketLabel(driver->securityManager, vm) < 0) { VIR_ERROR(_("Failed to set security context for monitor for %s"), vm->def->name); goto error; @@ -882,10 +877,7 @@ qemuConnectMonitor(struct qemud_driver *driver, virDomainObjPtr vm) if (priv->mon == NULL) virDomainObjUnref(vm); - if (driver->securityDriver && - driver->securityDriver->domainClearSecuritySocketLabel && - driver->securityDriver->domainClearSecuritySocketLabel - (driver->securityDriver,vm) < 0) { + if (virSecurityManagerClearSocketLabel(driver->securityManager, vm) < 0) { VIR_ERROR(_("Failed to clear security context for monitor for %s"), vm->def->name); goto error; @@ -954,10 +946,7 @@ qemuReconnectDomain(void *payload, const char *name ATTRIBUTE_UNUSED, void *opaq goto error; } - if (driver->securityDriver && - driver->securityDriver->domainReserveSecurityLabel && - driver->securityDriver->domainReserveSecurityLabel(driver->securityDriver, - obj) < 0) + if (virSecurityManagerReserveLabel(driver->securityManager, obj) < 0) goto error; if (qemudVMFiltersInstantiate(conn, obj->def)) @@ -995,35 +984,34 @@ qemuReconnectDomains(virConnectPtr conn, struct qemud_driver *driver) static int -qemudSecurityInit(struct qemud_driver *qemud_drv) +qemuSecurityInit(struct qemud_driver *driver) { - int ret; - virSecurityDriverPtr security_drv; - - qemuSecurityStackedSetDriver(qemud_drv); - qemuSecurityDACSetDriver(qemud_drv); + virSecurityManagerPtr mgr = virSecurityManagerNew(driver->securityDriverName, + driver->allowDiskFormatProbing); + if (!mgr) + goto error; - ret = virSecurityDriverStartup(&security_drv, - qemud_drv->securityDriverName, - qemud_drv->allowDiskFormatProbing); - if (ret == -1) { - VIR_ERROR0(_("Failed to start security driver")); - return -1; - } + if (driver->privileged) { + virSecurityManagerPtr dac = virSecurityManagerNewDAC(driver->user, + driver->group, + driver->allowDiskFormatProbing, + driver->dynamicOwnership); + if (!dac) + goto error; - /* No primary security driver wanted to be enabled: just setup - * the DAC driver on its own */ - if (ret == -2) { - qemud_drv->securityDriver = &qemuDACSecurityDriver; - VIR_INFO0(_("No security driver available")); + if (!(driver->securityManager = virSecurityManagerNewStack(mgr, + dac))) + goto error; } else { - qemud_drv->securityPrimaryDriver = security_drv; - qemud_drv->securitySecondaryDriver = &qemuDACSecurityDriver; - qemud_drv->securityDriver = &qemuStackedSecurityDriver; - VIR_INFO("Initialized security driver %s", security_drv->name); + driver->securityManager = mgr; } return 0; + +error: + VIR_ERROR0("Failed to initialize security drivers"); + virSecurityManagerFree(mgr); + return -1; } @@ -1057,21 +1045,20 @@ qemuCreateCapabilities(virCapsPtr oldcaps, } /* Security driver data */ - if (driver->securityPrimaryDriver) { - const char *doi, *model; - - doi = virSecurityDriverGetDOI(driver->securityPrimaryDriver); - model = virSecurityDriverGetModel(driver->securityPrimaryDriver); + const char *doi, *model; + doi = virSecurityManagerGetDOI(driver->securityManager); + model = virSecurityManagerGetModel(driver->securityManager); + if (STRNEQ(model, "none")) { if (!(caps->host.secModel.model = strdup(model))) goto no_memory; if (!(caps->host.secModel.doi = strdup(doi))) goto no_memory; - - VIR_DEBUG("Initialized caps for security driver \"%s\" with " - "DOI \"%s\"", model, doi); } + VIR_DEBUG("Initialized caps for security driver \"%s\" with " + "DOI \"%s\"", model, doi); + return caps; no_memory: @@ -1336,7 +1323,7 @@ qemudStartup(int privileged) { } VIR_FREE(driverConf); - if (qemudSecurityInit(qemu_driver) < 0) + if (qemuSecurityInit(qemu_driver) < 0) goto error; if ((qemu_driver->caps = qemuCreateCapabilities(NULL, @@ -1555,10 +1542,11 @@ qemudShutdown(void) { VIR_FREE(qemu_driver->spicePassword); VIR_FREE(qemu_driver->hugetlbfs_mount); VIR_FREE(qemu_driver->hugepage_path); - VIR_FREE(qemu_driver->securityDriverName); VIR_FREE(qemu_driver->saveImageFormat); VIR_FREE(qemu_driver->dumpImageFormat); + virSecurityManagerFree(qemu_driver->securityManager); + ebtablesContextFree(qemu_driver->ebtables); if (qemu_driver->cgroupDeviceACL) { @@ -2573,9 +2561,7 @@ static int qemudSecurityHook(void *data) { if (qemudInitCpuAffinity(h->vm) < 0) return -1; - if (h->driver->securityDriver && - h->driver->securityDriver->domainSetSecurityProcessLabel && - h->driver->securityDriver->domainSetSecurityProcessLabel(h->driver->securityDriver, h->vm) < 0) + if (virSecurityManagerSetProcessLabel(h->driver->securityManager, h->vm) < 0) return -1; return 0; @@ -2660,22 +2646,16 @@ static int qemudStartVMDaemon(virConnectPtr conn, /* If you are using a SecurityDriver with dynamic labelling, then generate a security label for isolation */ DEBUG0("Generating domain security label (if required)"); - if (driver->securityDriver && - driver->securityDriver->domainGenSecurityLabel) { - ret = driver->securityDriver->domainGenSecurityLabel(driver->securityDriver, - vm); - qemuDomainSecurityLabelAudit(vm, ret >= 0); - if (ret < 0) - goto cleanup; + if (virSecurityManagerGenLabel(driver->securityManager, vm) < 0) { + qemuDomainSecurityLabelAudit(vm, false); + goto cleanup; } + qemuDomainSecurityLabelAudit(vm, true); DEBUG0("Generating setting domain security labels (if required)"); - if (driver->securityDriver && - driver->securityDriver->domainSetSecurityAllLabel && - driver->securityDriver->domainSetSecurityAllLabel(driver->securityDriver, - vm, stdin_path) < 0) { + if (virSecurityManagerSetAllLabel(driver->securityManager, + vm, stdin_path) < 0) goto cleanup; - } /* Ensure no historical cgroup for this VM is lying around bogus * settings */ @@ -3057,14 +3037,9 @@ static void qemudShutdownVMDaemon(struct qemud_driver *driver, } /* Reset Security Labels */ - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityAllLabel) - driver->securityDriver->domainRestoreSecurityAllLabel(driver->securityDriver, - vm, migrated); - if (driver->securityDriver && - driver->securityDriver->domainReleaseSecurityLabel) - driver->securityDriver->domainReleaseSecurityLabel(driver->securityDriver, - vm); + virSecurityManagerRestoreAllLabel(driver->securityManager, + vm, migrated); + virSecurityManagerReleaseLabel(driver->securityManager, vm); /* Clear out dynamically assigned labels */ if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) { @@ -3568,7 +3543,7 @@ static virDomainPtr qemudDomainCreate(virConnectPtr conn, const char *xml, VIR_DOMAIN_XML_INACTIVE))) goto cleanup; - if (virSecurityDriverVerify(def) < 0) + if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; if (virDomainObjIsDuplicate(&driver->domains, def, 1) < 0) @@ -4471,10 +4446,8 @@ static int qemudDomainSaveFlag(struct qemud_driver *driver, virDomainPtr dom, } if ((!bypassSecurityDriver) && - driver->securityDriver && - driver->securityDriver->domainSetSavedStateLabel && - driver->securityDriver->domainSetSavedStateLabel(driver->securityDriver, - vm, path) == -1) + virSecurityManagerSetSavedStateLabel(driver->securityManager, + vm, path) < 0) goto endjob; if (header.compressed == QEMUD_SAVE_FORMAT_RAW) { @@ -4507,10 +4480,8 @@ static int qemudDomainSaveFlag(struct qemud_driver *driver, virDomainPtr dom, goto endjob; if ((!bypassSecurityDriver) && - driver->securityDriver && - driver->securityDriver->domainRestoreSavedStateLabel && - driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver, - vm, path) == -1) + virSecurityManagerRestoreSavedStateLabel(driver->securityManager, + vm, path) < 0) VIR_WARN("failed to restore save state label on %s", path); if (cgroup != NULL) { @@ -4552,10 +4523,8 @@ endjob: } if ((!bypassSecurityDriver) && - driver->securityDriver && - driver->securityDriver->domainRestoreSavedStateLabel && - driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver, - vm, path) == -1) + virSecurityManagerRestoreSavedStateLabel(driver->securityManager, + vm, path) < 0) VIR_WARN("failed to restore save state label on %s", path); } @@ -4779,10 +4748,8 @@ static int doCoreDump(struct qemud_driver *driver, goto cleanup; } - if (driver->securityDriver && - driver->securityDriver->domainSetSavedStateLabel && - driver->securityDriver->domainSetSavedStateLabel(driver->securityDriver, - vm, path) == -1) + if (virSecurityManagerSetSavedStateLabel(driver->securityManager, + vm, path) < 0) goto cleanup; qemuDomainObjEnterMonitorWithDriver(driver, vm); @@ -4814,10 +4781,8 @@ static int doCoreDump(struct qemud_driver *driver, if (ret < 0) goto cleanup; - if (driver->securityDriver && - driver->securityDriver->domainRestoreSavedStateLabel && - driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver, - vm, path) == -1) + if (virSecurityManagerRestoreSavedStateLabel(driver->securityManager, + vm, path) < 0) goto cleanup; cleanup: @@ -5434,10 +5399,8 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec * QEMU monitor hasn't seen SIGHUP/ERR on poll(). */ if (virDomainObjIsActive(vm)) { - if (driver->securityDriver && - driver->securityDriver->domainGetSecurityProcessLabel && - driver->securityDriver->domainGetSecurityProcessLabel(driver->securityDriver, - vm, seclabel) < 0) { + if (virSecurityManagerGetProcessLabel(driver->securityManager, + vm, seclabel) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to get security label")); goto cleanup; @@ -5461,10 +5424,12 @@ static int qemudNodeGetSecurityModel(virConnectPtr conn, int ret = 0; qemuDriverLock(driver); - if (!driver->securityPrimaryDriver) { - memset(secmodel, 0, sizeof (*secmodel)); + memset(secmodel, 0, sizeof(*secmodel)); + + /* NULL indicates no driver, which we treat as + * success, but simply return no data in *secmodel */ + if (driver->caps->host.secModel.model == NULL) goto cleanup; - } p = driver->caps->host.secModel.model; if (strlen(p) >= VIR_SECURITY_MODEL_BUFLEN-1) { @@ -5840,10 +5805,8 @@ qemudDomainSaveImageStartVM(virConnectPtr conn, ret = 0; out: - if (driver->securityDriver && - driver->securityDriver->domainRestoreSavedStateLabel && - driver->securityDriver->domainRestoreSavedStateLabel(driver->securityDriver, - vm, path) == -1) + if (virSecurityManagerRestoreSavedStateLabel(driver->securityManager, + vm, path) < 0) VIR_WARN("failed to restore save state label on %s", path); return ret; @@ -6372,7 +6335,7 @@ static virDomainPtr qemudDomainDefine(virConnectPtr conn, const char *xml) { VIR_DOMAIN_XML_INACTIVE))) goto cleanup; - if (virSecurityDriverVerify(def) < 0) + if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; if ((dupVM = virDomainObjIsDuplicate(&driver->domains, def, 0)) < 0) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 827bcaf..1dc036c 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -83,10 +83,8 @@ int qemuDomainChangeEjectableMedia(struct qemud_driver *driver, return -1; } - if (driver->securityDriver && - driver->securityDriver->domainSetSecurityImageLabel && - driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerSetImageLabel(driver->securityManager, + vm, disk) < 0) return -1; if (!(driveAlias = qemuDeviceDriveHostAlias(origdisk, qemuCmdFlags))) @@ -115,10 +113,8 @@ int qemuDomainChangeEjectableMedia(struct qemud_driver *driver, if (ret < 0) goto error; - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityImageLabel && - driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver, - vm, origdisk) < 0) + if (virSecurityManagerRestoreImageLabel(driver->securityManager, + vm, origdisk) < 0) VIR_WARN("Unable to restore security label on ejected image %s", origdisk->src); VIR_FREE(origdisk->src); @@ -134,10 +130,8 @@ int qemuDomainChangeEjectableMedia(struct qemud_driver *driver, error: VIR_FREE(driveAlias); - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityImageLabel && - driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerRestoreImageLabel(driver->securityManager, + vm, disk) < 0) VIR_WARN("Unable to restore security label on new media %s", disk->src); return -1; } @@ -162,10 +156,8 @@ int qemuDomainAttachPciDiskDevice(struct qemud_driver *driver, } } - if (driver->securityDriver && - driver->securityDriver->domainSetSecurityImageLabel && - driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerSetImageLabel(driver->securityManager, + vm, disk) < 0) return -1; if (qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE) { @@ -232,10 +224,8 @@ error: qemuDomainPCIAddressReleaseAddr(priv->pciaddrs, &disk->info) < 0) VIR_WARN("Unable to release PCI address on %s", disk->src); - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityImageLabel && - driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerRestoreImageLabel(driver->securityManager, + vm, disk) < 0) VIR_WARN("Unable to restore security label on %s", disk->src); return -1; @@ -375,10 +365,8 @@ int qemuDomainAttachSCSIDisk(struct qemud_driver *driver, } - if (driver->securityDriver && - driver->securityDriver->domainSetSecurityImageLabel && - driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerSetImageLabel(driver->securityManager, + vm, disk) < 0) return -1; /* We should have an address already, so make sure */ @@ -464,10 +452,8 @@ error: VIR_FREE(devstr); VIR_FREE(drivestr); - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityImageLabel && - driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerRestoreImageLabel(driver->securityManager, + vm, disk) < 0) VIR_WARN("Unable to restore security label on %s", disk->src); return -1; @@ -492,10 +478,8 @@ int qemuDomainAttachUsbMassstorageDevice(struct qemud_driver *driver, } } - if (driver->securityDriver && - driver->securityDriver->domainSetSecurityImageLabel && - driver->securityDriver->domainSetSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerSetImageLabel(driver->securityManager, + vm, disk) < 0) return -1; if (!disk->src) { @@ -551,10 +535,8 @@ error: VIR_FREE(devstr); VIR_FREE(drivestr); - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityImageLabel && - driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver, - vm, disk) < 0) + if (virSecurityManagerRestoreImageLabel(driver->securityManager, + vm, disk) < 0) VIR_WARN("Unable to restore security label on %s", disk->src); return -1; @@ -979,10 +961,8 @@ int qemuDomainAttachHostDevice(struct qemud_driver *driver, } - if (driver->securityDriver && - driver->securityDriver->domainSetSecurityHostdevLabel && - driver->securityDriver->domainSetSecurityHostdevLabel(driver->securityDriver, - vm, hostdev) < 0) + if (virSecurityManagerSetHostdevLabel(driver->securityManager, + vm, hostdev) < 0) return -1; switch (hostdev->source.subsys.type) { @@ -1008,10 +988,8 @@ int qemuDomainAttachHostDevice(struct qemud_driver *driver, return 0; error: - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityHostdevLabel && - driver->securityDriver->domainRestoreSecurityHostdevLabel(driver->securityDriver, - vm, hostdev) < 0) + if (virSecurityManagerRestoreHostdevLabel(driver->securityManager, + vm, hostdev) < 0) VIR_WARN0("Unable to restore host device labelling on hotplug fail"); return -1; @@ -1183,10 +1161,8 @@ int qemuDomainDetachPciDiskDevice(struct qemud_driver *driver, virDomainDiskDefFree(detach); - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityImageLabel && - driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver, - vm, dev->data.disk) < 0) + if (virSecurityManagerRestoreImageLabel(driver->securityManager, + vm, dev->data.disk) < 0) VIR_WARN("Unable to restore security label on %s", dev->data.disk->src); if (cgroup != NULL) { @@ -1263,10 +1239,8 @@ int qemuDomainDetachSCSIDiskDevice(struct qemud_driver *driver, virDomainDiskDefFree(detach); - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityImageLabel && - driver->securityDriver->domainRestoreSecurityImageLabel(driver->securityDriver, - vm, dev->data.disk) < 0) + if (virSecurityManagerRestoreImageLabel(driver->securityManager, + vm, dev->data.disk) < 0) VIR_WARN("Unable to restore security label on %s", dev->data.disk->src); if (cgroup != NULL) { @@ -1699,10 +1673,8 @@ int qemuDomainDetachHostDevice(struct qemud_driver *driver, return -1; } - if (driver->securityDriver && - driver->securityDriver->domainRestoreSecurityHostdevLabel && - driver->securityDriver->domainRestoreSecurityHostdevLabel(driver->securityDriver, - vm, dev->data.hostdev) < 0) + if (virSecurityManagerRestoreHostdevLabel(driver->securityManager, + vm, dev->data.hostdev) < 0) VIR_WARN0("Failed to restore host device labelling"); return ret; diff --git a/src/qemu/qemu_security_dac.c b/src/qemu/qemu_security_dac.c deleted file mode 100644 index 6b6170a..0000000 --- a/src/qemu/qemu_security_dac.c +++ /dev/null @@ -1,576 +0,0 @@ -/* - * Copyright (C) 2010 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * QEMU POSIX DAC security driver - */ -#include <config.h> -#include <sys/types.h> -#include <sys/stat.h> -#include <fcntl.h> - -#include "qemu_security_dac.h" -#include "qemu_conf.h" -#include "datatypes.h" -#include "virterror_internal.h" -#include "util.h" -#include "memory.h" -#include "logging.h" -#include "pci.h" -#include "hostusb.h" -#include "storage_file.h" - -#define VIR_FROM_THIS VIR_FROM_QEMU - -static struct qemud_driver *driver; - -void qemuSecurityDACSetDriver(struct qemud_driver *newdriver) -{ - driver = newdriver; -} - - -static int -qemuSecurityDACSetOwnership(const char *path, int uid, int gid) -{ - VIR_INFO("Setting DAC user and group on '%s' to '%d:%d'", path, uid, gid); - - if (chown(path, uid, gid) < 0) { - struct stat sb; - int chown_errno = errno; - - if (stat(path, &sb) >= 0) { - if (sb.st_uid == uid && - sb.st_gid == gid) { - /* It's alright, there's nothing to change anyway. */ - return 0; - } - } - - if (chown_errno == EOPNOTSUPP) { - VIR_INFO("Setting user and group to '%d:%d' on '%s' not supported by filesystem", - uid, gid, path); - } else if (chown_errno == EPERM) { - VIR_INFO("Setting user and group to '%d:%d' on '%s' not permitted", - uid, gid, path); - } else if (chown_errno == EROFS) { - VIR_INFO("Setting user and group to '%d:%d' on '%s' not possible on readonly filesystem", - uid, gid, path); - } else { - virReportSystemError(chown_errno, - _("unable to set user and group to '%d:%d' on '%s'"), - uid, gid, path); - return -1; - } - } - return 0; -} - -static int -qemuSecurityDACRestoreSecurityFileLabel(const char *path) -{ - struct stat buf; - int rc = -1; - char *newpath = NULL; - - VIR_INFO("Restoring DAC user and group on '%s'", path); - - if (virFileResolveLink(path, &newpath) < 0) { - virReportSystemError(errno, - _("cannot resolve symlink %s"), path); - goto err; - } - - if (stat(newpath, &buf) != 0) - goto err; - - /* XXX record previous ownership */ - rc = qemuSecurityDACSetOwnership(newpath, 0, 0); - -err: - VIR_FREE(newpath); - return rc; -} - - -static int -qemuSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, - const char *path, - size_t depth ATTRIBUTE_UNUSED, - void *opaque ATTRIBUTE_UNUSED) -{ - return qemuSecurityDACSetOwnership(path, driver->user, driver->group); -} - - -static int -qemuSecurityDACSetSecurityImageLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, - virDomainDiskDefPtr disk) - -{ - if (!driver->privileged || !driver->dynamicOwnership) - return 0; - - return virDomainDiskDefForeachPath(disk, - driver->allowDiskFormatProbing, - false, - qemuSecurityDACSetSecurityFileLabel, - NULL); -} - - -static int -qemuSecurityDACRestoreSecurityImageLabelInt(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, - virDomainDiskDefPtr disk, - int migrated) -{ - if (!driver->privileged || !driver->dynamicOwnership) - return 0; - - /* Don't restore labels on readoly/shared disks, because - * other VMs may still be accessing these - * Alternatively we could iterate over all running - * domains and try to figure out if it is in use, but - * this would not work for clustered filesystems, since - * we can't see running VMs using the file on other nodes - * Safest bet is thus to skip the restore step. - */ - if (disk->readonly || disk->shared) - return 0; - - if (!disk->src || disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK) - return 0; - - /* If we have a shared FS & doing migrated, we must not - * change ownership, because that kills access on the - * destination host which is sub-optimal for the guest - * VM's I/O attempts :-) - */ - if (migrated) { - int rc = virStorageFileIsSharedFS(disk->src); - if (rc < 0) - return -1; - if (rc == 1) { - VIR_DEBUG("Skipping image label restore on %s because FS is shared", - disk->src); - return 0; - } - } - - return qemuSecurityDACRestoreSecurityFileLabel(disk->src); -} - - -static int -qemuSecurityDACRestoreSecurityImageLabel(virSecurityDriverPtr drv, - virDomainObjPtr vm, - virDomainDiskDefPtr disk) -{ - return qemuSecurityDACRestoreSecurityImageLabelInt(drv, vm, disk, 0); -} - - -static int -qemuSecurityDACSetSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, - const char *file, - void *opaque ATTRIBUTE_UNUSED) -{ - return qemuSecurityDACSetOwnership(file, driver->user, driver->group); -} - - -static int -qemuSecurityDACSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, - const char *file, - void *opaque ATTRIBUTE_UNUSED) -{ - return qemuSecurityDACSetOwnership(file, driver->user, driver->group); -} - - -static int -qemuSecurityDACSetSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - virDomainHostdevDefPtr dev) - -{ - int ret = -1; - - if (!driver->privileged || !driver->dynamicOwnership) - return 0; - - if (dev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS) - return 0; - - switch (dev->source.subsys.type) { - case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: { - usbDevice *usb = usbGetDevice(dev->source.subsys.u.usb.bus, - dev->source.subsys.u.usb.device); - - if (!usb) - goto done; - - ret = usbDeviceFileIterate(usb, qemuSecurityDACSetSecurityUSBLabel, vm); - usbFreeDevice(usb); - break; - } - - case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: { - pciDevice *pci = pciGetDevice(dev->source.subsys.u.pci.domain, - dev->source.subsys.u.pci.bus, - dev->source.subsys.u.pci.slot, - dev->source.subsys.u.pci.function); - - if (!pci) - goto done; - - ret = pciDeviceFileIterate(pci, qemuSecurityDACSetSecurityPCILabel, vm); - pciFreeDevice(pci); - - break; - } - - default: - ret = 0; - break; - } - -done: - return ret; -} - - -static int -qemuSecurityDACRestoreSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, - const char *file, - void *opaque ATTRIBUTE_UNUSED) -{ - return qemuSecurityDACRestoreSecurityFileLabel(file); -} - - -static int -qemuSecurityDACRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, - const char *file, - void *opaque ATTRIBUTE_UNUSED) -{ - return qemuSecurityDACRestoreSecurityFileLabel(file); -} - - -static int -qemuSecurityDACRestoreSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, - virDomainHostdevDefPtr dev) - -{ - int ret = -1; - - if (!driver->privileged || !driver->dynamicOwnership) - return 0; - - if (dev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS) - return 0; - - switch (dev->source.subsys.type) { - case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: { - usbDevice *usb = usbGetDevice(dev->source.subsys.u.usb.bus, - dev->source.subsys.u.usb.device); - - if (!usb) - goto done; - - ret = usbDeviceFileIterate(usb, qemuSecurityDACRestoreSecurityUSBLabel, NULL); - usbFreeDevice(usb); - - break; - } - - case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: { - pciDevice *pci = pciGetDevice(dev->source.subsys.u.pci.domain, - dev->source.subsys.u.pci.bus, - dev->source.subsys.u.pci.slot, - dev->source.subsys.u.pci.function); - - if (!pci) - goto done; - - ret = pciDeviceFileIterate(pci, qemuSecurityDACRestoreSecurityPCILabel, NULL); - pciFreeDevice(pci); - - break; - } - - default: - ret = 0; - break; - } - -done: - return ret; -} - - -static int -qemuSecurityDACSetChardevLabel(virDomainObjPtr vm, - virDomainChrDefPtr dev) - -{ - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; - char *in = NULL, *out = NULL; - int ret = -1; - - if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC) - return 0; - - switch (dev->type) { - case VIR_DOMAIN_CHR_TYPE_DEV: - case VIR_DOMAIN_CHR_TYPE_FILE: - ret = qemuSecurityDACSetOwnership(dev->data.file.path, driver->user, driver->group); - break; - - case VIR_DOMAIN_CHR_TYPE_PIPE: - if ((virAsprintf(&in, "%s.in", dev->data.file.path) < 0) || - (virAsprintf(&out, "%s.out", dev->data.file.path) < 0)) { - virReportOOMError(); - goto done; - } - if ((qemuSecurityDACSetOwnership(in, driver->user, driver->group) < 0) || - (qemuSecurityDACSetOwnership(out, driver->user, driver->group) < 0)) - goto done; - ret = 0; - break; - - default: - ret = 0; - break; - } - -done: - VIR_FREE(in); - VIR_FREE(out); - return ret; -} - -static int -qemuSecurityDACRestoreChardevLabel(virDomainObjPtr vm, - virDomainChrDefPtr dev) - -{ - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; - char *in = NULL, *out = NULL; - int ret = -1; - - if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC) - return 0; - - switch (dev->type) { - case VIR_DOMAIN_CHR_TYPE_DEV: - case VIR_DOMAIN_CHR_TYPE_FILE: - ret = qemuSecurityDACRestoreSecurityFileLabel(dev->data.file.path); - break; - - case VIR_DOMAIN_CHR_TYPE_PIPE: - if ((virAsprintf(&out, "%s.out", dev->data.file.path) < 0) || - (virAsprintf(&in, "%s.in", dev->data.file.path) < 0)) { - virReportOOMError(); - goto done; - } - if ((qemuSecurityDACRestoreSecurityFileLabel(out) < 0) || - (qemuSecurityDACRestoreSecurityFileLabel(in) < 0)) - goto done; - ret = 0; - break; - - default: - ret = 0; - break; - } - -done: - VIR_FREE(in); - VIR_FREE(out); - return ret; -} - - -static int -qemuSecurityDACRestoreChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, - virDomainChrDefPtr dev, - void *opaque) -{ - virDomainObjPtr vm = opaque; - - return qemuSecurityDACRestoreChardevLabel(vm, dev); -} - - -static int -qemuSecurityDACRestoreSecurityAllLabel(virSecurityDriverPtr drv, - virDomainObjPtr vm, - int migrated) -{ - int i; - int rc = 0; - - if (!driver->privileged || !driver->dynamicOwnership) - return 0; - - VIR_DEBUG("Restoring security label on %s migrated=%d", - vm->def->name, migrated); - - for (i = 0 ; i < vm->def->nhostdevs ; i++) { - if (qemuSecurityDACRestoreSecurityHostdevLabel(drv, - vm, - vm->def->hostdevs[i]) < 0) - rc = -1; - } - for (i = 0 ; i < vm->def->ndisks ; i++) { - if (qemuSecurityDACRestoreSecurityImageLabelInt(drv, - vm, - vm->def->disks[i], - migrated) < 0) - rc = -1; - } - - if (virDomainChrDefForeach(vm->def, - false, - qemuSecurityDACRestoreChardevCallback, - vm) < 0) - rc = -1; - - if (vm->def->os.kernel && - qemuSecurityDACRestoreSecurityFileLabel(vm->def->os.kernel) < 0) - rc = -1; - - if (vm->def->os.initrd && - qemuSecurityDACRestoreSecurityFileLabel(vm->def->os.initrd) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityDACSetChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, - virDomainChrDefPtr dev, - void *opaque) -{ - virDomainObjPtr vm = opaque; - - return qemuSecurityDACSetChardevLabel(vm, dev); -} - - -static int -qemuSecurityDACSetSecurityAllLabel(virSecurityDriverPtr drv, - virDomainObjPtr vm, - const char *stdin_path ATTRIBUTE_UNUSED) -{ - int i; - - if (!driver->privileged || !driver->dynamicOwnership) - return 0; - - for (i = 0 ; i < vm->def->ndisks ; i++) { - /* XXX fixme - we need to recursively label the entriy tree :-( */ - if (vm->def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR) - continue; - if (qemuSecurityDACSetSecurityImageLabel(drv, - vm, - vm->def->disks[i]) < 0) - return -1; - } - for (i = 0 ; i < vm->def->nhostdevs ; i++) { - if (qemuSecurityDACSetSecurityHostdevLabel(drv, - vm, - vm->def->hostdevs[i]) < 0) - return -1; - } - - if (virDomainChrDefForeach(vm->def, - true, - qemuSecurityDACSetChardevCallback, - vm) < 0) - return -1; - - if (vm->def->os.kernel && - qemuSecurityDACSetOwnership(vm->def->os.kernel, - driver->user, - driver->group) < 0) - return -1; - - if (vm->def->os.initrd && - qemuSecurityDACSetOwnership(vm->def->os.initrd, - driver->user, - driver->group) < 0) - return -1; - - return 0; -} - - -static int -qemuSecurityDACSetSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, - const char *savefile) -{ - if (!driver->privileged) - return 0; - - return qemuSecurityDACSetOwnership(savefile, driver->user, driver->group); -} - - -static int -qemuSecurityDACRestoreSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, - const char *savefile) -{ - if (!driver->privileged || !driver->dynamicOwnership) - return 0; - - return qemuSecurityDACRestoreSecurityFileLabel(savefile); -} - - -static int -qemuSecurityDACSetProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) -{ - DEBUG("Dropping privileges of VM to %d:%d", driver->user, driver->group); - - if (!driver->privileged) - return 0; - - if (virSetUIDGID(driver->user, driver->group) < 0) - return -1; - - return 0; -} - - - -virSecurityDriver qemuDACSecurityDriver = { - .name = "qemuDAC", - - .domainSetSecurityProcessLabel = qemuSecurityDACSetProcessLabel, - - .domainSetSecurityImageLabel = qemuSecurityDACSetSecurityImageLabel, - .domainRestoreSecurityImageLabel = qemuSecurityDACRestoreSecurityImageLabel, - - .domainSetSecurityAllLabel = qemuSecurityDACSetSecurityAllLabel, - .domainRestoreSecurityAllLabel = qemuSecurityDACRestoreSecurityAllLabel, - - .domainSetSecurityHostdevLabel = qemuSecurityDACSetSecurityHostdevLabel, - .domainRestoreSecurityHostdevLabel = qemuSecurityDACRestoreSecurityHostdevLabel, - - .domainSetSavedStateLabel = qemuSecurityDACSetSavedStateLabel, - .domainRestoreSavedStateLabel = qemuSecurityDACRestoreSavedStateLabel, -}; diff --git a/src/qemu/qemu_security_dac.h b/src/qemu/qemu_security_dac.h deleted file mode 100644 index a742f7a..0000000 --- a/src/qemu/qemu_security_dac.h +++ /dev/null @@ -1,22 +0,0 @@ -/* - * Copyright (C) 2010 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * QEMU POSIX DAC security driver - */ - -#include "security/security_driver.h" -#include "qemu_conf.h" - -#ifndef __QEMU_SECURITY_DAC -# define __QEMU_SECURITY_DAC - -extern virSecurityDriver qemuDACSecurityDriver; - -void qemuSecurityDACSetDriver(struct qemud_driver *driver); - -#endif /* __QEMU_SECURITY_DAC */ diff --git a/src/qemu/qemu_security_stacked.c b/src/qemu/qemu_security_stacked.c deleted file mode 100644 index 432d095..0000000 --- a/src/qemu/qemu_security_stacked.c +++ /dev/null @@ -1,418 +0,0 @@ -/* - * Copyright (C) 2010 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * QEMU stacked security driver - */ - -#include <config.h> -#include <sys/types.h> -#include <sys/stat.h> -#include <fcntl.h> - -#include "qemu_security_stacked.h" - -#include "qemu_conf.h" -#include "datatypes.h" -#include "virterror_internal.h" -#include "util.h" -#include "memory.h" -#include "logging.h" -#include "pci.h" -#include "hostusb.h" -#include "storage_file.h" - -#define VIR_FROM_THIS VIR_FROM_QEMU - - -static struct qemud_driver *driver; - -void qemuSecurityStackedSetDriver(struct qemud_driver *newdriver) -{ - driver = newdriver; -} - - -static int -qemuSecurityStackedVerify(virDomainDefPtr def) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainSecurityVerify && - driver->securitySecondaryDriver->domainSecurityVerify(def) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainSecurityVerify && - driver->securityPrimaryDriver->domainSecurityVerify(def) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedGenLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainGenSecurityLabel && - driver->securitySecondaryDriver->domainGenSecurityLabel(driver->securitySecondaryDriver, - vm) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainGenSecurityLabel && - driver->securityPrimaryDriver->domainGenSecurityLabel(driver->securityPrimaryDriver, - vm) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedReleaseLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainReleaseSecurityLabel && - driver->securitySecondaryDriver->domainReleaseSecurityLabel(driver->securitySecondaryDriver, - vm) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainReleaseSecurityLabel && - driver->securityPrimaryDriver->domainReleaseSecurityLabel(driver->securityPrimaryDriver, - vm) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedReserveLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainReserveSecurityLabel && - driver->securitySecondaryDriver->domainReserveSecurityLabel(driver->securitySecondaryDriver, - vm) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainReserveSecurityLabel && - driver->securityPrimaryDriver->domainReserveSecurityLabel(driver->securityPrimaryDriver, - vm) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedSetSecurityImageLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - virDomainDiskDefPtr disk) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainSetSecurityImageLabel && - driver->securitySecondaryDriver->domainSetSecurityImageLabel(driver->securitySecondaryDriver, - vm, disk) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainSetSecurityImageLabel && - driver->securityPrimaryDriver->domainSetSecurityImageLabel(driver->securityPrimaryDriver, - vm, disk) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedRestoreSecurityImageLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - virDomainDiskDefPtr disk) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainRestoreSecurityImageLabel && - driver->securitySecondaryDriver->domainRestoreSecurityImageLabel(driver->securitySecondaryDriver, - vm, disk) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainRestoreSecurityImageLabel && - driver->securityPrimaryDriver->domainRestoreSecurityImageLabel(driver->securityPrimaryDriver, - vm, disk) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedSetSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - virDomainHostdevDefPtr dev) - -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainSetSecurityHostdevLabel && - driver->securitySecondaryDriver->domainSetSecurityHostdevLabel(driver->securitySecondaryDriver, - vm, dev) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainSetSecurityHostdevLabel && - driver->securityPrimaryDriver->domainSetSecurityHostdevLabel(driver->securityPrimaryDriver, - vm, dev) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedRestoreSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - virDomainHostdevDefPtr dev) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel && - driver->securitySecondaryDriver->domainRestoreSecurityHostdevLabel(driver->securitySecondaryDriver, - vm, dev) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel && - driver->securityPrimaryDriver->domainRestoreSecurityHostdevLabel(driver->securityPrimaryDriver, - vm, dev) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedSetSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - const char *stdin_path) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainSetSecurityAllLabel && - driver->securitySecondaryDriver->domainSetSecurityAllLabel(driver->securitySecondaryDriver, - vm, stdin_path) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainSetSecurityAllLabel && - driver->securityPrimaryDriver->domainSetSecurityAllLabel(driver->securityPrimaryDriver, - vm, stdin_path) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - int migrated) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainRestoreSecurityAllLabel && - driver->securitySecondaryDriver->domainRestoreSecurityAllLabel(driver->securitySecondaryDriver, - vm, migrated) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainRestoreSecurityAllLabel && - driver->securityPrimaryDriver->domainRestoreSecurityAllLabel(driver->securityPrimaryDriver, - vm, migrated) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedSetSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - const char *savefile) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainSetSavedStateLabel && - driver->securitySecondaryDriver->domainSetSavedStateLabel(driver->securitySecondaryDriver, - vm, savefile) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainSetSavedStateLabel && - driver->securityPrimaryDriver->domainSetSavedStateLabel(driver->securityPrimaryDriver, - vm, savefile) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedRestoreSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - const char *savefile) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainRestoreSavedStateLabel && - driver->securitySecondaryDriver->domainRestoreSavedStateLabel(driver->securitySecondaryDriver, - vm, savefile) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainRestoreSavedStateLabel && - driver->securityPrimaryDriver->domainRestoreSavedStateLabel(driver->securityPrimaryDriver, - vm, savefile) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedSetProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainSetSecurityProcessLabel && - driver->securitySecondaryDriver->domainSetSecurityProcessLabel(driver->securitySecondaryDriver, - vm) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainSetSecurityProcessLabel && - driver->securityPrimaryDriver->domainSetSecurityProcessLabel(driver->securityPrimaryDriver, - vm) < 0) - rc = -1; - - return rc; -} - -static int -qemuSecurityStackedGetProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - virSecurityLabelPtr seclabel) -{ - int rc = 0; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainGetSecurityProcessLabel && - driver->securityPrimaryDriver->domainGetSecurityProcessLabel(driver->securityPrimaryDriver, - vm, - seclabel) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedSetSocketLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm) -{ - int rc = 0; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainSetSecuritySocketLabel && - driver->securityPrimaryDriver->domainSetSecuritySocketLabel(driver->securityPrimaryDriver, - vm) < 0) - rc = -1; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainSetSecuritySocketLabel && - driver->securitySecondaryDriver->domainSetSecuritySocketLabel(driver->securitySecondaryDriver, - vm) < 0) - rc = -1; - - return rc; -} - - -static int -qemuSecurityStackedClearSocketLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, - virDomainObjPtr vm) -{ - int rc = 0; - - if (driver->securitySecondaryDriver && - driver->securitySecondaryDriver->domainClearSecuritySocketLabel && - driver->securitySecondaryDriver->domainClearSecuritySocketLabel(driver->securitySecondaryDriver, - vm) < 0) - rc = -1; - - if (driver->securityPrimaryDriver && - driver->securityPrimaryDriver->domainClearSecuritySocketLabel && - driver->securityPrimaryDriver->domainClearSecuritySocketLabel(driver->securityPrimaryDriver, - vm) < 0) - rc = -1; - - return rc; -} - - -virSecurityDriver qemuStackedSecurityDriver = { - .name = "qemuStacked", - .domainSecurityVerify = qemuSecurityStackedVerify, - - .domainGenSecurityLabel = qemuSecurityStackedGenLabel, - .domainReleaseSecurityLabel = qemuSecurityStackedReleaseLabel, - .domainReserveSecurityLabel = qemuSecurityStackedReserveLabel, - - .domainGetSecurityProcessLabel = qemuSecurityStackedGetProcessLabel, - .domainSetSecurityProcessLabel = qemuSecurityStackedSetProcessLabel, - - .domainSetSecurityImageLabel = qemuSecurityStackedSetSecurityImageLabel, - .domainRestoreSecurityImageLabel = qemuSecurityStackedRestoreSecurityImageLabel, - - .domainSetSecurityAllLabel = qemuSecurityStackedSetSecurityAllLabel, - .domainRestoreSecurityAllLabel = qemuSecurityStackedRestoreSecurityAllLabel, - - .domainSetSecurityHostdevLabel = qemuSecurityStackedSetSecurityHostdevLabel, - .domainRestoreSecurityHostdevLabel = qemuSecurityStackedRestoreSecurityHostdevLabel, - - .domainSetSavedStateLabel = qemuSecurityStackedSetSavedStateLabel, - .domainRestoreSavedStateLabel = qemuSecurityStackedRestoreSavedStateLabel, - - .domainClearSecuritySocketLabel = qemuSecurityStackedClearSocketLabel, - .domainSetSecuritySocketLabel = qemuSecurityStackedSetSocketLabel, -}; diff --git a/src/qemu/qemu_security_stacked.h b/src/qemu/qemu_security_stacked.h deleted file mode 100644 index 07f76d5..0000000 --- a/src/qemu/qemu_security_stacked.h +++ /dev/null @@ -1,22 +0,0 @@ -/* - * Copyright (C) 2010 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * QEMU stacked security driver - */ - -#include "security/security_driver.h" -#include "qemu_conf.h" - -#ifndef __QEMU_SECURITY_STACKED -# define __QEMU_SECURITY_STACKED - -extern virSecurityDriver qemuStackedSecurityDriver; - -void qemuSecurityStackedSetDriver(struct qemud_driver *driver); - -#endif /* __QEMU_SECURITY_DAC */ diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 468d0a3..d82ba73 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -1,4 +1,3 @@ - /* * AppArmor security driver for libvirt * Copyright (C) 2009-2010 Canonical Ltd. @@ -28,7 +27,6 @@ #include "internal.h" -#include "security_driver.h" #include "security_apparmor.h" #include "util.h" #include "memory.h" @@ -47,7 +45,7 @@ /* Data structure to pass to *FileIterate so we have everything we need */ struct SDPDOP { - virSecurityDriverPtr drv; + virSecurityManagerPtr mgr; virDomainObjPtr vm; }; @@ -158,7 +156,7 @@ profile_status_file(const char *str) * load (add) a profile. Will create one if necessary */ static int -load_profile(virSecurityDriverPtr drv, +load_profile(virSecurityManagerPtr mgr, const char *profile, virDomainObjPtr vm, const char *fn, @@ -169,7 +167,7 @@ load_profile(virSecurityDriverPtr drv, char *xml = NULL; int pipefd[2]; pid_t child; - const char *probe = virSecurityDriverGetAllowDiskFormatProbing(drv) + const char *probe = virSecurityManagerGetAllowDiskFormatProbing(mgr) ? "1" : "0"; if (pipe(pipefd) < -1) { @@ -300,7 +298,7 @@ cleanup: * NULL. */ static int -reload_profile(virSecurityDriverPtr drv, +reload_profile(virSecurityManagerPtr mgr, virDomainObjPtr vm, const char *fn, bool append) @@ -317,7 +315,7 @@ reload_profile(virSecurityDriverPtr drv, /* Update the profile only if it is loaded */ if (profile_loaded(secdef->imagelabel) >= 0) { - if (load_profile(drv, secdef->imagelabel, vm, fn, append) < 0) { + if (load_profile(mgr, secdef->imagelabel, vm, fn, append) < 0) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " "\'%s\'"), @@ -340,7 +338,7 @@ AppArmorSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, struct SDPDOP *ptr = opaque; virDomainObjPtr vm = ptr->vm; - if (reload_profile(ptr->drv, vm, file, true) < 0) { + if (reload_profile(ptr->mgr, vm, file, true) < 0) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " @@ -358,7 +356,7 @@ AppArmorSetSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, struct SDPDOP *ptr = opaque; virDomainObjPtr vm = ptr->vm; - if (reload_profile(ptr->drv, vm, file, true) < 0) { + if (reload_profile(ptr->mgr, vm, file, true) < 0) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " @@ -371,7 +369,7 @@ AppArmorSetSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, /* Called on libvirtd startup to see if AppArmor is available */ static int -AppArmorSecurityDriverProbe(void) +AppArmorSecurityManagerProbe(void) { char *template = NULL; int rc = SECURITY_DRIVER_DISABLE; @@ -403,21 +401,37 @@ AppArmorSecurityDriverProbe(void) * currently not used. */ static int -AppArmorSecurityDriverOpen(virSecurityDriverPtr drv, - bool allowDiskFormatProbing) +AppArmorSecurityManagerOpen(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +AppArmorSecurityManagerClose(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) { - virSecurityDriverSetDOI(drv, SECURITY_APPARMOR_VOID_DOI); - virSecurityDriverSetAllowDiskFormatProbing(drv, allowDiskFormatProbing); return 0; } +static const char * +AppArmorSecurityManagerGetModel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return SECURITY_APPARMOR_NAME; +} + +static const char * +AppArmorSecurityManagerGetDOI(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return SECURITY_APPARMOR_VOID_DOI; +} + + /* Currently called in qemudStartVMDaemon to setup a 'label'. We look for and * use a profile based on the UUID, otherwise create one based on a template. * Keep in mind that this is called on 'start' with RestoreSecurityLabel being * called on shutdown. */ static int -AppArmorGenSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm) { int rc = -1; @@ -472,7 +486,7 @@ AppArmorGenSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, } static int -AppArmorSetSecurityAllLabel(virSecurityDriverPtr drv, +AppArmorSetSecurityAllLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, const char *stdin_path) { if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) @@ -480,7 +494,7 @@ AppArmorSetSecurityAllLabel(virSecurityDriverPtr drv, /* if the profile is not already loaded, then load one */ if (profile_loaded(vm->def->seclabel.label) < 0) { - if (load_profile(drv, vm->def->seclabel.label, vm, stdin_path, + if (load_profile(mgr, vm->def->seclabel.label, vm, stdin_path, false) < 0) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot generate AppArmor profile " @@ -496,7 +510,7 @@ AppArmorSetSecurityAllLabel(virSecurityDriverPtr drv, * running. */ static int -AppArmorGetSecurityProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +AppArmorGetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, virSecurityLabelPtr sec) { @@ -530,7 +544,7 @@ AppArmorGetSecurityProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, * more details. Currently called via qemudShutdownVMDaemon. */ static int -AppArmorReleaseSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +AppArmorReleaseSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; @@ -544,7 +558,7 @@ AppArmorReleaseSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, static int -AppArmorRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +AppArmorRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, int migrated ATTRIBUTE_UNUSED) { @@ -565,7 +579,7 @@ AppArmorRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, * LOCALSTATEDIR/log/libvirt/qemu/<vm name>.log */ static int -AppArmorSetSecurityProcessLabel(virSecurityDriverPtr drv, virDomainObjPtr vm) +AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; int rc = -1; @@ -574,12 +588,12 @@ AppArmorSetSecurityProcessLabel(virSecurityDriverPtr drv, virDomainObjPtr vm) if ((profile_name = get_profile_name(vm)) == NULL) return rc; - if (STRNEQ(drv->name, secdef->model)) { + if (STRNEQ(virSecurityManagerGetModel(mgr), secdef->model)) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("security label driver mismatch: " "\'%s\' model configured for domain, but " "hypervisor driver is \'%s\'."), - secdef->model, drv->name); + secdef->model, virSecurityManagerGetModel(mgr)); if (use_apparmor() > 0) goto clean; } @@ -597,19 +611,33 @@ AppArmorSetSecurityProcessLabel(virSecurityDriverPtr drv, virDomainObjPtr vm) return rc; } +static int +AppArmorSetSecuritySocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +AppArmorClearSecuritySocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + /* Called when hotplugging */ static int -AppArmorRestoreSecurityImageLabel(virSecurityDriverPtr drv, +AppArmorRestoreSecurityImageLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainDiskDefPtr disk ATTRIBUTE_UNUSED) { - return reload_profile(drv, vm, NULL, false); + return reload_profile(mgr, vm, NULL, false); } /* Called when hotplugging */ static int -AppArmorSetSecurityImageLabel(virSecurityDriverPtr drv, +AppArmorSetSecurityImageLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainDiskDefPtr disk) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; @@ -635,7 +663,7 @@ AppArmorSetSecurityImageLabel(virSecurityDriverPtr drv, /* update the profile only if it is loaded */ if (profile_loaded(secdef->imagelabel) >= 0) { - if (load_profile(drv, secdef->imagelabel, vm, disk->src, + if (load_profile(mgr, secdef->imagelabel, vm, disk->src, false) < 0) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " @@ -654,7 +682,8 @@ AppArmorSetSecurityImageLabel(virSecurityDriverPtr drv, } static int -AppArmorSecurityVerify(virDomainDefPtr def) +AppArmorSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainDefPtr def) { const virSecurityLabelDefPtr secdef = &def->seclabel; @@ -670,7 +699,7 @@ AppArmorSecurityVerify(virDomainDefPtr def) } static int -AppArmorReserveSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +AppArmorReserveSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm ATTRIBUTE_UNUSED) { /* NOOP. Nothing to reserve with AppArmor */ @@ -678,7 +707,7 @@ AppArmorReserveSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, } static int -AppArmorSetSecurityHostdevLabel(virSecurityDriverPtr drv, +AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainHostdevDefPtr dev) @@ -698,7 +727,7 @@ AppArmorSetSecurityHostdevLabel(virSecurityDriverPtr drv, if (VIR_ALLOC(ptr) < 0) return -1; - ptr->drv = drv; + ptr->mgr = mgr; ptr->vm = vm; switch (dev->source.subsys.type) { @@ -740,7 +769,7 @@ done: static int -AppArmorRestoreSecurityHostdevLabel(virSecurityDriverPtr drv, +AppArmorRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED) @@ -749,42 +778,57 @@ AppArmorRestoreSecurityHostdevLabel(virSecurityDriverPtr drv, if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC) return 0; - return reload_profile(drv, vm, NULL, false); + return reload_profile(mgr, vm, NULL, false); } static int -AppArmorSetSavedStateLabel(virSecurityDriverPtr drv, +AppArmorSetSavedStateLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, const char *savefile) { - return reload_profile(drv, vm, savefile, true); + return reload_profile(mgr, vm, savefile, true); } static int -AppArmorRestoreSavedStateLabel(virSecurityDriverPtr drv, +AppArmorRestoreSavedStateLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, const char *savefile ATTRIBUTE_UNUSED) { - return reload_profile(drv, vm, NULL, false); + return reload_profile(mgr, vm, NULL, false); } virSecurityDriver virAppArmorSecurityDriver = { - .name = SECURITY_APPARMOR_NAME, - .probe = AppArmorSecurityDriverProbe, - .open = AppArmorSecurityDriverOpen, - .domainSecurityVerify = AppArmorSecurityVerify, - .domainSetSecurityImageLabel = AppArmorSetSecurityImageLabel, - .domainRestoreSecurityImageLabel = AppArmorRestoreSecurityImageLabel, - .domainGenSecurityLabel = AppArmorGenSecurityLabel, - .domainReserveSecurityLabel = AppArmorReserveSecurityLabel, - .domainReleaseSecurityLabel = AppArmorReleaseSecurityLabel, - .domainGetSecurityProcessLabel = AppArmorGetSecurityProcessLabel, - .domainSetSecurityProcessLabel = AppArmorSetSecurityProcessLabel, - .domainRestoreSecurityAllLabel = AppArmorRestoreSecurityAllLabel, - .domainSetSecurityAllLabel = AppArmorSetSecurityAllLabel, - .domainSetSecurityHostdevLabel = AppArmorSetSecurityHostdevLabel, - .domainRestoreSecurityHostdevLabel = AppArmorRestoreSecurityHostdevLabel, - .domainSetSavedStateLabel = AppArmorSetSavedStateLabel, - .domainRestoreSavedStateLabel = AppArmorRestoreSavedStateLabel, + 0, + SECURITY_APPARMOR_NAME, + AppArmorSecurityManagerProbe, + AppArmorSecurityManagerOpen, + AppArmorSecurityManagerClose, + + AppArmorSecurityManagerGetModel, + AppArmorSecurityManagerGetDOI, + + AppArmorSecurityVerify, + + AppArmorSetSecurityImageLabel, + AppArmorRestoreSecurityImageLabel, + + AppArmorSetSecuritySocketLabel, + AppArmorClearSecuritySocketLabel, + + AppArmorGenSecurityLabel, + AppArmorReserveSecurityLabel, + AppArmorReleaseSecurityLabel, + + AppArmorGetSecurityProcessLabel, + AppArmorSetSecurityProcessLabel, + + AppArmorSetSecurityAllLabel, + AppArmorRestoreSecurityAllLabel, + + AppArmorSetSecurityHostdevLabel, + AppArmorRestoreSecurityHostdevLabel, + + AppArmorSetSavedStateLabel, + AppArmorRestoreSavedStateLabel, }; diff --git a/src/security/security_apparmor.h b/src/security/security_apparmor.h index eb7e140..ffd8288 100644 --- a/src/security/security_apparmor.h +++ b/src/security/security_apparmor.h @@ -14,6 +14,8 @@ #ifndef __VIR_SECURITY_APPARMOR_H__ # define __VIR_SECURITY_APPARMOR_H__ +# include "security_driver.h" + extern virSecurityDriver virAppArmorSecurityDriver; # define AA_PREFIX "libvirt-" diff --git a/src/security/security_dac.c b/src/security/security_dac.c new file mode 100644 index 0000000..de5d011 --- /dev/null +++ b/src/security/security_dac.c @@ -0,0 +1,713 @@ +/* + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * POSIX DAC security driver + */ + +#include <config.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> + +#include "security_dac.h" +#include "virterror_internal.h" +#include "util.h" +#include "memory.h" +#include "logging.h" +#include "pci.h" +#include "hostusb.h" +#include "storage_file.h" + +#define VIR_FROM_THIS VIR_FROM_SECURITY + +typedef struct _virSecurityDACData virSecurityDACData; +typedef virSecurityDACData *virSecurityDACDataPtr; + +struct _virSecurityDACData { + uid_t user; + gid_t group; + bool dynamicOwnership; +}; + +void virSecurityDACSetUser(virSecurityManagerPtr mgr, + uid_t user) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + priv->user = user; +} + +void virSecurityDACSetGroup(virSecurityManagerPtr mgr, + gid_t group) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + priv->group = group; +} + +void virSecurityDACSetDynamicOwnership(virSecurityManagerPtr mgr, + bool dynamicOwnership) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + priv->dynamicOwnership = dynamicOwnership; +} + +static virSecurityDriverStatus +virSecurityDACProbe(void) +{ + return SECURITY_DRIVER_ENABLE; +} + +static int +virSecurityDACOpen(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +virSecurityDACClose(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + + +static const char * virSecurityDACGetModel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return "dac"; +} + +static const char * virSecurityDACGetDOI(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return "0"; +} + +static int +virSecurityDACSetOwnership(const char *path, int uid, int gid) +{ + VIR_INFO("Setting DAC user and group on '%s' to '%d:%d'", path, uid, gid); + + if (chown(path, uid, gid) < 0) { + struct stat sb; + int chown_errno = errno; + + if (stat(path, &sb) >= 0) { + if (sb.st_uid == uid && + sb.st_gid == gid) { + /* It's alright, there's nothing to change anyway. */ + return 0; + } + } + + if (chown_errno == EOPNOTSUPP) { + VIR_INFO("Setting user and group to '%d:%d' on '%s' not supported by filesystem", + uid, gid, path); + } else if (chown_errno == EPERM) { + VIR_INFO("Setting user and group to '%d:%d' on '%s' not permitted", + uid, gid, path); + } else if (chown_errno == EROFS) { + VIR_INFO("Setting user and group to '%d:%d' on '%s' not possible on readonly filesystem", + uid, gid, path); + } else { + virReportSystemError(chown_errno, + _("unable to set user and group to '%d:%d' on '%s'"), + uid, gid, path); + return -1; + } + } + return 0; +} + +static int +virSecurityDACRestoreSecurityFileLabel(const char *path) +{ + struct stat buf; + int rc = -1; + char *newpath = NULL; + + VIR_INFO("Restoring DAC user and group on '%s'", path); + + if (virFileResolveLink(path, &newpath) < 0) { + virReportSystemError(errno, + _("cannot resolve symlink %s"), path); + goto err; + } + + if (stat(newpath, &buf) != 0) + goto err; + + /* XXX record previous ownership */ + rc = virSecurityDACSetOwnership(newpath, 0, 0); + +err: + VIR_FREE(newpath); + return rc; +} + + +static int +virSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, + const char *path, + size_t depth ATTRIBUTE_UNUSED, + void *opaque) +{ + virSecurityManagerPtr mgr = opaque; + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + return virSecurityDACSetOwnership(path, priv->user, priv->group); +} + + +static int +virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDiskDefPtr disk) + +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + if (!priv->dynamicOwnership) + return 0; + + return virDomainDiskDefForeachPath(disk, + virSecurityManagerGetAllowDiskFormatProbing(mgr), + false, + virSecurityDACSetSecurityFileLabel, + mgr); +} + + +static int +virSecurityDACRestoreSecurityImageLabelInt(virSecurityManagerPtr mgr, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDiskDefPtr disk, + int migrated) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + if (!priv->dynamicOwnership) + return 0; + + /* Don't restore labels on readoly/shared disks, because + * other VMs may still be accessing these + * Alternatively we could iterate over all running + * domains and try to figure out if it is in use, but + * this would not work for clustered filesystems, since + * we can't see running VMs using the file on other nodes + * Safest bet is thus to skip the restore step. + */ + if (disk->readonly || disk->shared) + return 0; + + if (!disk->src) + return 0; + + /* If we have a shared FS & doing migrated, we must not + * change ownership, because that kills access on the + * destination host which is sub-optimal for the guest + * VM's I/O attempts :-) + */ + if (migrated) { + int rc = virStorageFileIsSharedFS(disk->src); + if (rc < 0) + return -1; + if (rc == 1) { + VIR_DEBUG("Skipping image label restore on %s because FS is shared", + disk->src); + return 0; + } + } + + return virSecurityDACRestoreSecurityFileLabel(disk->src); +} + + +static int +virSecurityDACRestoreSecurityImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainDiskDefPtr disk) +{ + return virSecurityDACRestoreSecurityImageLabelInt(mgr, vm, disk, 0); +} + + +static int +virSecurityDACSetSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, + const char *file, + void *opaque) +{ + virSecurityManagerPtr mgr = opaque; + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + return virSecurityDACSetOwnership(file, priv->user, priv->group); +} + + +static int +virSecurityDACSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, + const char *file, + void *opaque) +{ + virSecurityManagerPtr mgr = opaque; + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + return virSecurityDACSetOwnership(file, priv->user, priv->group); +} + + +static int +virSecurityDACSetSecurityHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainHostdevDefPtr dev) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int ret = -1; + + if (!priv->dynamicOwnership) + return 0; + + if (dev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS) + return 0; + + switch (dev->source.subsys.type) { + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: { + usbDevice *usb = usbGetDevice(dev->source.subsys.u.usb.bus, + dev->source.subsys.u.usb.device); + + if (!usb) + goto done; + + ret = usbDeviceFileIterate(usb, virSecurityDACSetSecurityUSBLabel, mgr); + usbFreeDevice(usb); + break; + } + + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: { + pciDevice *pci = pciGetDevice(dev->source.subsys.u.pci.domain, + dev->source.subsys.u.pci.bus, + dev->source.subsys.u.pci.slot, + dev->source.subsys.u.pci.function); + + if (!pci) + goto done; + + ret = pciDeviceFileIterate(pci, virSecurityDACSetSecurityPCILabel, mgr); + pciFreeDevice(pci); + + break; + } + + default: + ret = 0; + break; + } + +done: + return ret; +} + + +static int +virSecurityDACRestoreSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, + const char *file, + void *opaque ATTRIBUTE_UNUSED) +{ + return virSecurityDACRestoreSecurityFileLabel(file); +} + + +static int +virSecurityDACRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, + const char *file, + void *opaque ATTRIBUTE_UNUSED) +{ + return virSecurityDACRestoreSecurityFileLabel(file); +} + + +static int +virSecurityDACRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainHostdevDefPtr dev) + +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int ret = -1; + + if (!priv->dynamicOwnership) + return 0; + + if (dev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS) + return 0; + + switch (dev->source.subsys.type) { + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: { + usbDevice *usb = usbGetDevice(dev->source.subsys.u.usb.bus, + dev->source.subsys.u.usb.device); + + if (!usb) + goto done; + + ret = usbDeviceFileIterate(usb, virSecurityDACRestoreSecurityUSBLabel, mgr); + usbFreeDevice(usb); + + break; + } + + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: { + pciDevice *pci = pciGetDevice(dev->source.subsys.u.pci.domain, + dev->source.subsys.u.pci.bus, + dev->source.subsys.u.pci.slot, + dev->source.subsys.u.pci.function); + + if (!pci) + goto done; + + ret = pciDeviceFileIterate(pci, virSecurityDACRestoreSecurityPCILabel, mgr); + pciFreeDevice(pci); + + break; + } + + default: + ret = 0; + break; + } + +done: + return ret; +} + + +static int +virSecurityDACSetChardevLabel(virSecurityManagerPtr mgr, + virDomainChrDefPtr dev) + +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + char *in = NULL, *out = NULL; + int ret = -1; + + switch (dev->type) { + case VIR_DOMAIN_CHR_TYPE_DEV: + case VIR_DOMAIN_CHR_TYPE_FILE: + ret = virSecurityDACSetOwnership(dev->data.file.path, priv->user, priv->group); + break; + + case VIR_DOMAIN_CHR_TYPE_PIPE: + if ((virAsprintf(&in, "%s.in", dev->data.file.path) < 0) || + (virAsprintf(&out, "%s.out", dev->data.file.path) < 0)) { + virReportOOMError(); + goto done; + } + if ((virSecurityDACSetOwnership(in, priv->user, priv->group) < 0) || + (virSecurityDACSetOwnership(out, priv->user, priv->group) < 0)) + goto done; + ret = 0; + break; + + default: + ret = 0; + break; + } + +done: + VIR_FREE(in); + VIR_FREE(out); + return ret; +} + +static int +virSecurityDACRestoreChardevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainChrDefPtr dev) +{ + char *in = NULL, *out = NULL; + int ret = -1; + + switch (dev->type) { + case VIR_DOMAIN_CHR_TYPE_DEV: + case VIR_DOMAIN_CHR_TYPE_FILE: + ret = virSecurityDACRestoreSecurityFileLabel(dev->data.file.path); + break; + + case VIR_DOMAIN_CHR_TYPE_PIPE: + if ((virAsprintf(&out, "%s.out", dev->data.file.path) < 0) || + (virAsprintf(&in, "%s.in", dev->data.file.path) < 0)) { + virReportOOMError(); + goto done; + } + if ((virSecurityDACRestoreSecurityFileLabel(out) < 0) || + (virSecurityDACRestoreSecurityFileLabel(in) < 0)) + goto done; + ret = 0; + break; + + default: + ret = 0; + break; + } + +done: + VIR_FREE(in); + VIR_FREE(out); + return ret; +} + + +static int +virSecurityDACRestoreChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainChrDefPtr dev, + void *opaque) +{ + virSecurityManagerPtr mgr = opaque; + + return virSecurityDACRestoreChardevLabel(mgr, dev); +} + + +static int +virSecurityDACRestoreSecurityAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + int migrated) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int i; + int rc = 0; + + if (!priv->dynamicOwnership) + return 0; + + + VIR_DEBUG("Restoring security label on %s migrated=%d", + vm->def->name, migrated); + + for (i = 0 ; i < vm->def->nhostdevs ; i++) { + if (virSecurityDACRestoreSecurityHostdevLabel(mgr, + vm, + vm->def->hostdevs[i]) < 0) + rc = -1; + } + for (i = 0 ; i < vm->def->ndisks ; i++) { + if (virSecurityDACRestoreSecurityImageLabelInt(mgr, + vm, + vm->def->disks[i], + migrated) < 0) + rc = -1; + } + + if (virDomainChrDefForeach(vm->def, + false, + virSecurityDACRestoreChardevCallback, + vm) < 0) + rc = -1; + + if (vm->def->os.kernel && + virSecurityDACRestoreSecurityFileLabel(vm->def->os.kernel) < 0) + rc = -1; + + if (vm->def->os.initrd && + virSecurityDACRestoreSecurityFileLabel(vm->def->os.initrd) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityDACSetChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainChrDefPtr dev, + void *opaque) +{ + virSecurityManagerPtr mgr = opaque; + + return virSecurityDACSetChardevLabel(mgr, dev); +} + + +static int +virSecurityDACSetSecurityAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *stdin_path ATTRIBUTE_UNUSED) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int i; + + if (!priv->dynamicOwnership) + return 0; + + for (i = 0 ; i < vm->def->ndisks ; i++) { + /* XXX fixme - we need to recursively label the entire tree :-( */ + if (vm->def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR) + continue; + if (virSecurityDACSetSecurityImageLabel(mgr, + vm, + vm->def->disks[i]) < 0) + return -1; + } + for (i = 0 ; i < vm->def->nhostdevs ; i++) { + if (virSecurityDACSetSecurityHostdevLabel(mgr, + vm, + vm->def->hostdevs[i]) < 0) + return -1; + } + + if (virDomainChrDefForeach(vm->def, + true, + virSecurityDACSetChardevCallback, + vm) < 0) + return -1; + + if (vm->def->os.kernel && + virSecurityDACSetOwnership(vm->def->os.kernel, + priv->user, + priv->group) < 0) + return -1; + + if (vm->def->os.initrd && + virSecurityDACSetOwnership(vm->def->os.initrd, + priv->user, + priv->group) < 0) + return -1; + + return 0; +} + + +static int +virSecurityDACSetSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + const char *savefile) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + return virSecurityDACSetOwnership(savefile, priv->user, priv->group); +} + + +static int +virSecurityDACRestoreSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + const char *savefile) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + if (!priv->dynamicOwnership) + return 0; + + return virSecurityDACRestoreSecurityFileLabel(savefile); +} + + +static int +virSecurityDACSetProcessLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + DEBUG("Dropping privileges of VM to %d:%d", priv->user, priv->group); + + if (virSetUIDGID(priv->user, priv->group) < 0) + return -1; + + return 0; +} + + +static int +virSecurityDACVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +virSecurityDACGenLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +virSecurityDACReleaseLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +virSecurityDACReserveLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +virSecurityDACGetProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virSecurityLabelPtr seclabel ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +virSecurityDACSetSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + + +static int +virSecurityDACClearSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + + +virSecurityDriver virSecurityDriverDAC = { + sizeof(virSecurityDACData), + "virDAC", + + virSecurityDACProbe, + virSecurityDACOpen, + virSecurityDACClose, + + virSecurityDACGetModel, + virSecurityDACGetDOI, + + virSecurityDACVerify, + + virSecurityDACSetSecurityImageLabel, + virSecurityDACRestoreSecurityImageLabel, + + virSecurityDACSetSocketLabel, + virSecurityDACClearSocketLabel, + + virSecurityDACGenLabel, + virSecurityDACReserveLabel, + virSecurityDACReleaseLabel, + + virSecurityDACGetProcessLabel, + virSecurityDACSetProcessLabel, + + virSecurityDACSetSecurityAllLabel, + virSecurityDACRestoreSecurityAllLabel, + + virSecurityDACSetSecurityHostdevLabel, + virSecurityDACRestoreSecurityHostdevLabel, + + virSecurityDACSetSavedStateLabel, + virSecurityDACRestoreSavedStateLabel, +}; diff --git a/src/security/security_dac.h b/src/security/security_dac.h new file mode 100644 index 0000000..ccd9d1c --- /dev/null +++ b/src/security/security_dac.h @@ -0,0 +1,36 @@ +/* + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * POSIX DAC security driver + */ + +#include "security_driver.h" + +#ifndef __VIR_SECURITY_DAC +# define __VIR_SECURITY_DAC + +extern virSecurityDriver virSecurityDriverDAC; + +void virSecurityDACSetUser(virSecurityManagerPtr mgr, + uid_t user); +void virSecurityDACSetGroup(virSecurityManagerPtr mgr, + gid_t group); + +void virSecurityDACSetDynamicOwnership(virSecurityManagerPtr mgr, + bool dynamic); + +#endif /* __VIR_SECURITY_DAC */ diff --git a/src/security/security_driver.c b/src/security/security_driver.c index 9e32fa4..4df73d7 100644 --- a/src/security/security_driver.c +++ b/src/security/security_driver.c @@ -14,6 +14,7 @@ #include <string.h> #include "virterror_internal.h" +#include "logging.h" #include "security_driver.h" #ifdef WITH_SECDRIVER_SELINUX @@ -24,116 +25,56 @@ # include "security_apparmor.h" #endif +#include "security_nop.h" + static virSecurityDriverPtr security_drivers[] = { #ifdef WITH_SECDRIVER_SELINUX - &virSELinuxSecurityDriver, + &virSecurityDriverSELinux, #endif #ifdef WITH_SECDRIVER_APPARMOR &virAppArmorSecurityDriver, #endif - NULL + &virSecurityDriverNop, /* Must always be last, since it will always probe */ }; -int -virSecurityDriverVerify(virDomainDefPtr def) -{ - unsigned int i; - const virSecurityLabelDefPtr secdef = &def->seclabel; - - if (!secdef->model || - STREQ(secdef->model, "none")) - return 0; - - for (i = 0; security_drivers[i] != NULL ; i++) { - if (STREQ(security_drivers[i]->name, secdef->model)) { - return security_drivers[i]->domainSecurityVerify(def); - } - } - virSecurityReportError(VIR_ERR_XML_ERROR, - _("invalid security model '%s'"), secdef->model); - return -1; -} - -int -virSecurityDriverStartup(virSecurityDriverPtr *drv, - const char *name, - bool allowDiskFormatProbing) +virSecurityDriverPtr virSecurityDriverLookup(const char *name) { - unsigned int i; + virSecurityDriverPtr drv = NULL; + int i; - if (name && STREQ(name, "none")) - return -2; + VIR_DEBUG("name=%s", NULLSTR(name)); - for (i = 0; security_drivers[i] != NULL ; i++) { + for (i = 0; i < ARRAY_CARDINALITY(security_drivers) && !drv ; i++) { virSecurityDriverPtr tmp = security_drivers[i]; - if (name && STRNEQ(tmp->name, name)) - continue; - - switch (tmp->probe()) { - case SECURITY_DRIVER_ENABLE: - virSecurityDriverInit(tmp); - if (tmp->open(tmp, allowDiskFormatProbing) == -1) { - return -1; - } else { - *drv = tmp; - return 0; + if (name) { + if (STREQ(tmp->name, name)) { + drv = tmp; + break; + } + } else { + switch (tmp->probe()) { + case SECURITY_DRIVER_ENABLE: + VIR_DEBUG("Probed name=%s", tmp->name); + drv = tmp; + break; + + case SECURITY_DRIVER_DISABLE: + VIR_DEBUG("Not enabled name=%s", tmp->name); + break; + + default: + return NULL; } - break; - - case SECURITY_DRIVER_DISABLE: - break; - - default: - return -1; } } - return -2; -} - -/* - * Helpers - */ -void -virSecurityDriverInit(virSecurityDriverPtr drv) -{ - memset(&drv->_private, 0, sizeof drv->_private); -} -int -virSecurityDriverSetDOI(virSecurityDriverPtr drv, - const char *doi) -{ - if (strlen(doi) >= VIR_SECURITY_DOI_BUFLEN) { + if (!drv) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, - _("%s: DOI \'%s\' is " - "longer than the maximum allowed length of %d"), - __func__, doi, VIR_SECURITY_DOI_BUFLEN - 1); - return -1; + _("Security driver %s not found"), + NULLSTR(name)); + return NULL; } - strcpy(drv->_private.doi, doi); - return 0; -} - -const char * -virSecurityDriverGetDOI(virSecurityDriverPtr drv) -{ - return drv->_private.doi; -} -const char * -virSecurityDriverGetModel(virSecurityDriverPtr drv) -{ - return drv->name; -} - -void virSecurityDriverSetAllowDiskFormatProbing(virSecurityDriverPtr drv, - bool allowDiskFormatProbing) -{ - drv->_private.allowDiskFormatProbing = allowDiskFormatProbing; -} - -bool virSecurityDriverGetAllowDiskFormatProbing(virSecurityDriverPtr drv) -{ - return drv->_private.allowDiskFormatProbing; + return drv; } diff --git a/src/security/security_driver.h b/src/security/security_driver.h index d768f32..e5a8d41 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -16,6 +16,8 @@ # include "internal.h" # include "domain_conf.h" +# include "security_manager.h" + /* * Return values for security driver probing: the driver will determine * whether it should be enabled or disabled. @@ -29,104 +31,91 @@ typedef enum { typedef struct _virSecurityDriver virSecurityDriver; typedef virSecurityDriver *virSecurityDriverPtr; -typedef struct _virSecurityDriverState virSecurityDriverState; -typedef virSecurityDriverState *virSecurityDriverStatePtr; - typedef virSecurityDriverStatus (*virSecurityDriverProbe) (void); -typedef int (*virSecurityDriverOpen) (virSecurityDriverPtr drv, - bool allowDiskFormatProbing); -typedef int (*virSecurityDomainRestoreImageLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDriverOpen) (virSecurityManagerPtr mgr); +typedef int (*virSecurityDriverClose) (virSecurityManagerPtr mgr); + +typedef const char *(*virSecurityDriverGetModel) (virSecurityManagerPtr mgr); +typedef const char *(*virSecurityDriverGetDOI) (virSecurityManagerPtr mgr); + +typedef int (*virSecurityDomainRestoreImageLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainDiskDefPtr disk); -typedef int (*virSecurityDomainSetSocketLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainSetSocketLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm); -typedef int (*virSecurityDomainClearSocketLabel)(virSecurityDriverPtr drv, +typedef int (*virSecurityDomainClearSocketLabel)(virSecurityManagerPtr mgr, virDomainObjPtr vm); -typedef int (*virSecurityDomainSetImageLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainSetImageLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainDiskDefPtr disk); -typedef int (*virSecurityDomainRestoreHostdevLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainRestoreHostdevLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainHostdevDefPtr dev); -typedef int (*virSecurityDomainSetHostdevLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainSetHostdevLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainHostdevDefPtr dev); -typedef int (*virSecurityDomainSetSavedStateLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainSetSavedStateLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, const char *savefile); -typedef int (*virSecurityDomainRestoreSavedStateLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainRestoreSavedStateLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, const char *savefile); -typedef int (*virSecurityDomainGenLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainGenLabel) (virSecurityManagerPtr mgr, virDomainObjPtr sec); -typedef int (*virSecurityDomainReserveLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainReserveLabel) (virSecurityManagerPtr mgr, virDomainObjPtr sec); -typedef int (*virSecurityDomainReleaseLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainReleaseLabel) (virSecurityManagerPtr mgr, virDomainObjPtr sec); -typedef int (*virSecurityDomainSetAllLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainSetAllLabel) (virSecurityManagerPtr mgr, virDomainObjPtr sec, const char *stdin_path); -typedef int (*virSecurityDomainRestoreAllLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainRestoreAllLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, int migrated); -typedef int (*virSecurityDomainGetProcessLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainGetProcessLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm, virSecurityLabelPtr sec); -typedef int (*virSecurityDomainSetProcessLabel) (virSecurityDriverPtr drv, +typedef int (*virSecurityDomainSetProcessLabel) (virSecurityManagerPtr mgr, virDomainObjPtr vm); -typedef int (*virSecurityDomainSecurityVerify) (virDomainDefPtr def); +typedef int (*virSecurityDomainSecurityVerify) (virSecurityManagerPtr mgr, + virDomainDefPtr def); + struct _virSecurityDriver { + size_t privateDataLen; const char *name; virSecurityDriverProbe probe; virSecurityDriverOpen open; + virSecurityDriverClose close; + + virSecurityDriverGetModel getModel; + virSecurityDriverGetDOI getDOI; + virSecurityDomainSecurityVerify domainSecurityVerify; + + virSecurityDomainSetImageLabel domainSetSecurityImageLabel; virSecurityDomainRestoreImageLabel domainRestoreSecurityImageLabel; + virSecurityDomainSetSocketLabel domainSetSecuritySocketLabel; virSecurityDomainClearSocketLabel domainClearSecuritySocketLabel; - virSecurityDomainSetImageLabel domainSetSecurityImageLabel; + virSecurityDomainGenLabel domainGenSecurityLabel; virSecurityDomainReserveLabel domainReserveSecurityLabel; virSecurityDomainReleaseLabel domainReleaseSecurityLabel; + virSecurityDomainGetProcessLabel domainGetSecurityProcessLabel; virSecurityDomainSetProcessLabel domainSetSecurityProcessLabel; + virSecurityDomainSetAllLabel domainSetSecurityAllLabel; virSecurityDomainRestoreAllLabel domainRestoreSecurityAllLabel; - virSecurityDomainRestoreHostdevLabel domainRestoreSecurityHostdevLabel; + virSecurityDomainSetHostdevLabel domainSetSecurityHostdevLabel; + virSecurityDomainRestoreHostdevLabel domainRestoreSecurityHostdevLabel; + virSecurityDomainSetSavedStateLabel domainSetSavedStateLabel; virSecurityDomainRestoreSavedStateLabel domainRestoreSavedStateLabel; - - /* - * This is internally managed driver state and should only be accessed - * via helpers below. - */ - struct { - char doi[VIR_SECURITY_DOI_BUFLEN]; - bool allowDiskFormatProbing; - } _private; }; -/* Global methods */ -int virSecurityDriverStartup(virSecurityDriverPtr *drv, - const char *name, - bool allowDiskFormatProbing); - -int -virSecurityDriverVerify(virDomainDefPtr def); - -# define virSecurityReportError(code, ...) \ - virReportErrorHelper(NULL, VIR_FROM_SECURITY, code, __FILE__, \ - __FUNCTION__, __LINE__, __VA_ARGS__) - -/* Helpers */ -void virSecurityDriverInit(virSecurityDriverPtr drv); -int virSecurityDriverSetDOI(virSecurityDriverPtr drv, - const char *doi); -void virSecurityDriverSetAllowDiskFormatProbing(virSecurityDriverPtr drv, - bool allowDiskFormatProbing); -const char *virSecurityDriverGetDOI(virSecurityDriverPtr drv); -const char *virSecurityDriverGetModel(virSecurityDriverPtr drv); -bool virSecurityDriverGetAllowDiskFormatProbing(virSecurityDriverPtr drv); +virSecurityDriverPtr virSecurityDriverLookup(const char *name); #endif /* __VIR_SECURITY_H__ */ diff --git a/src/security/security_manager.c b/src/security/security_manager.c new file mode 100644 index 0000000..66cffb5 --- /dev/null +++ b/src/security/security_manager.c @@ -0,0 +1,317 @@ +/* + * security_manager.c: Internal security manager API + * + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#include <config.h> + + +#include "security_driver.h" +#include "security_stack.h" +#include "security_dac.h" +#include "virterror_internal.h" +#include "memory.h" +#include "logging.h" + +#define VIR_FROM_THIS VIR_FROM_SECURITY + + +struct _virSecurityManager { + virSecurityDriverPtr drv; + bool allowDiskFormatProbing; +}; + +static virSecurityManagerPtr virSecurityManagerNewDriver(virSecurityDriverPtr drv, + bool allowDiskFormatProbing) +{ + virSecurityManagerPtr mgr; + + if (VIR_ALLOC_VAR(mgr, char, drv->privateDataLen) < 0) { + virReportOOMError(); + return NULL; + } + + mgr->drv = drv; + mgr->allowDiskFormatProbing = allowDiskFormatProbing; + + if (drv->open(mgr) < 0) { + virSecurityManagerFree(mgr); + return NULL; + } + + return mgr; +} + +virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary, + virSecurityManagerPtr secondary) +{ + virSecurityManagerPtr mgr = + virSecurityManagerNewDriver(&virSecurityDriverStack, + virSecurityManagerGetAllowDiskFormatProbing(primary)); + + if (!mgr) + return NULL; + + virSecurityStackSetPrimary(mgr, primary); + virSecurityStackSetSecondary(mgr, secondary); + + return mgr; +} + +virSecurityManagerPtr virSecurityManagerNewDAC(uid_t user, + gid_t group, + bool allowDiskFormatProbing, + bool dynamicOwnership) +{ + virSecurityManagerPtr mgr = + virSecurityManagerNewDriver(&virSecurityDriverDAC, + allowDiskFormatProbing); + + if (!mgr) + return NULL; + + virSecurityDACSetUser(mgr, user); + virSecurityDACSetGroup(mgr, group); + virSecurityDACSetDynamicOwnership(mgr, dynamicOwnership); + + return mgr; +} + +virSecurityManagerPtr virSecurityManagerNew(const char *name, + bool allowDiskFormatProbing) +{ + virSecurityDriverPtr drv = virSecurityDriverLookup(name); + if (!drv) + return NULL; + + return virSecurityManagerNewDriver(drv, allowDiskFormatProbing); +} + + +void *virSecurityManagerGetPrivateData(virSecurityManagerPtr mgr) +{ + return ((char*)mgr) + sizeof(mgr); +} + + +void virSecurityManagerFree(virSecurityManagerPtr mgr) +{ + if (!mgr) + return; + + if (mgr->drv->close) + mgr->drv->close(mgr); + + VIR_FREE(mgr); +} + +const char * +virSecurityManagerGetDOI(virSecurityManagerPtr mgr) +{ + if (mgr->drv->getDOI) + return mgr->drv->getDOI(mgr); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return NULL; +} + +const char * +virSecurityManagerGetModel(virSecurityManagerPtr mgr) +{ + if (mgr->drv->getModel) + return mgr->drv->getModel(mgr); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return NULL; +} + +bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr) +{ + return mgr->allowDiskFormatProbing; +} + +int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainDiskDefPtr disk) +{ + if (mgr->drv->domainRestoreSecurityImageLabel) + return mgr->drv->domainRestoreSecurityImageLabel(mgr, vm, disk); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerSetSocketLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + if (mgr->drv->domainSetSecuritySocketLabel) + return mgr->drv->domainSetSecuritySocketLabel(mgr, vm); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerClearSocketLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + if (mgr->drv->domainClearSecuritySocketLabel) + return mgr->drv->domainClearSecuritySocketLabel(mgr, vm); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainDiskDefPtr disk) +{ + if (mgr->drv->domainSetSecurityImageLabel) + return mgr->drv->domainSetSecurityImageLabel(mgr, vm, disk); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainHostdevDefPtr dev) +{ + if (mgr->drv->domainRestoreSecurityHostdevLabel) + return mgr->drv->domainRestoreSecurityHostdevLabel(mgr, vm, dev); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainHostdevDefPtr dev) +{ + if (mgr->drv->domainSetSecurityHostdevLabel) + return mgr->drv->domainSetSecurityHostdevLabel(mgr, vm, dev); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerSetSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *savefile) +{ + if (mgr->drv->domainSetSavedStateLabel) + return mgr->drv->domainSetSavedStateLabel(mgr, vm, savefile); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerRestoreSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *savefile) +{ + if (mgr->drv->domainRestoreSavedStateLabel) + return mgr->drv->domainRestoreSavedStateLabel(mgr, vm, savefile); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + if (mgr->drv->domainGenSecurityLabel) + return mgr->drv->domainGenSecurityLabel(mgr, vm); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerReserveLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + if (mgr->drv->domainReserveSecurityLabel) + return mgr->drv->domainReserveSecurityLabel(mgr, vm); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + if (mgr->drv->domainReleaseSecurityLabel) + return mgr->drv->domainReleaseSecurityLabel(mgr, vm); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *stdin_path) +{ + if (mgr->drv->domainSetSecurityAllLabel) + return mgr->drv->domainSetSecurityAllLabel(mgr, vm, stdin_path); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerRestoreAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + int migrated) +{ + if (mgr->drv->domainRestoreSecurityAllLabel) + return mgr->drv->domainRestoreSecurityAllLabel(mgr, vm, migrated); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerGetProcessLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virSecurityLabelPtr sec) +{ + if (mgr->drv->domainGetSecurityProcessLabel) + return mgr->drv->domainGetSecurityProcessLabel(mgr, vm, sec); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerSetProcessLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + if (mgr->drv->domainSetSecurityProcessLabel) + return mgr->drv->domainSetSecurityProcessLabel(mgr, vm); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} + +int virSecurityManagerVerify(virSecurityManagerPtr mgr, + virDomainDefPtr def) +{ + if (mgr->drv->domainSecurityVerify) + return mgr->drv->domainSecurityVerify(mgr, def); + + virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + return -1; +} diff --git a/src/security/security_manager.h b/src/security/security_manager.h new file mode 100644 index 0000000..189b6b4 --- /dev/null +++ b/src/security/security_manager.h @@ -0,0 +1,95 @@ +/* + * security_manager.h: Internal security manager API + * + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#ifndef VIR_SECURITY_MANAGER_H__ +# define VIR_SECURITY_MANAGER_H__ + +# define virSecurityReportError(code, ...) \ + virReportErrorHelper(NULL, VIR_FROM_SECURITY, code, __FILE__, \ + __FUNCTION__, __LINE__, __VA_ARGS__) + + +typedef struct _virSecurityManager virSecurityManager; +typedef virSecurityManager *virSecurityManagerPtr; + +virSecurityManagerPtr virSecurityManagerNew(const char *name, + bool allowDiskFormatProbing); + +virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary, + virSecurityManagerPtr secondary); + +virSecurityManagerPtr virSecurityManagerNewDAC(uid_t user, + gid_t group, + bool allowDiskFormatProbing, + bool dynamicOwnership); + +void *virSecurityManagerGetPrivateData(virSecurityManagerPtr mgr); + +void virSecurityManagerFree(virSecurityManagerPtr mgr); + +const char *virSecurityManagerGetDOI(virSecurityManagerPtr mgr); +const char *virSecurityManagerGetModel(virSecurityManagerPtr mgr); +bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr); + +int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainDiskDefPtr disk); +int virSecurityManagerSetSocketLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm); +int virSecurityManagerClearSocketLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm); +int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainDiskDefPtr disk); +int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainHostdevDefPtr dev); +int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainHostdevDefPtr dev); +int virSecurityManagerSetSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *savefile); +int virSecurityManagerRestoreSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *savefile); +int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, + virDomainObjPtr sec); +int virSecurityManagerReserveLabel(virSecurityManagerPtr mgr, + virDomainObjPtr sec); +int virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr, + virDomainObjPtr sec); +int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr sec, + const char *stdin_path); +int virSecurityManagerRestoreAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + int migrated); +int virSecurityManagerGetProcessLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virSecurityLabelPtr sec); +int virSecurityManagerSetProcessLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm); +int virSecurityManagerVerify(virSecurityManagerPtr mgr, + virDomainDefPtr def); + +#endif /* VIR_SECURITY_MANAGER_H__ */ diff --git a/src/security/security_nop.c b/src/security/security_nop.c new file mode 100644 index 0000000..6d7cb47 --- /dev/null +++ b/src/security/security_nop.c @@ -0,0 +1,185 @@ +/* + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + */ + +#include <config.h> + +#include "security_nop.h" + +static virSecurityDriverStatus virSecurityDriverProbeNop(void) +{ + return SECURITY_DRIVER_ENABLE; +} + +static int virSecurityDriverOpenNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDriverCloseNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + +static const char * virSecurityDriverGetModelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return "none"; +} + +static const char * virSecurityDriverGetDOINop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return "0"; +} + +static int virSecurityDomainRestoreImageLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDiskDefPtr disk ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainSetSocketLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainClearSocketLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainSetImageLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDiskDefPtr disk ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainRestoreHostdevLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainSetHostdevLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainSetSavedStateLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + const char *savefile ATTRIBUTE_UNUSED) +{ + return 0; +} +static int virSecurityDomainRestoreSavedStateLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + const char *savefile ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainGenLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr sec ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainReserveLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr sec ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainReleaseLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr sec ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainSetAllLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr sec ATTRIBUTE_UNUSED, + const char *stdin_path ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainRestoreAllLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + int migrated ATTRIBUTE_UNUSED) +{ + return 0; +} +static int virSecurityDomainGetProcessLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED, + virSecurityLabelPtr sec ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainSetProcessLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainObjPtr vm ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int virSecurityDomainVerifyNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED) +{ + return 0; +} + +virSecurityDriver virSecurityDriverNop = { + 0, + "none", + virSecurityDriverProbeNop, + virSecurityDriverOpenNop, + virSecurityDriverCloseNop, + + virSecurityDriverGetModelNop, + virSecurityDriverGetDOINop, + + virSecurityDomainVerifyNop, + + virSecurityDomainSetImageLabelNop, + virSecurityDomainRestoreImageLabelNop, + + virSecurityDomainSetSocketLabelNop, + virSecurityDomainClearSocketLabelNop, + + virSecurityDomainGenLabelNop, + virSecurityDomainReserveLabelNop, + virSecurityDomainReleaseLabelNop, + + virSecurityDomainGetProcessLabelNop, + virSecurityDomainSetProcessLabelNop, + + virSecurityDomainSetAllLabelNop, + virSecurityDomainRestoreAllLabelNop, + + virSecurityDomainSetHostdevLabelNop, + virSecurityDomainRestoreHostdevLabelNop, + + virSecurityDomainSetSavedStateLabelNop, + virSecurityDomainRestoreSavedStateLabelNop, +}; diff --git a/src/security/security_nop.h b/src/security/security_nop.h new file mode 100644 index 0000000..589a75d --- /dev/null +++ b/src/security/security_nop.h @@ -0,0 +1,27 @@ +/* + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + */ + +#ifndef __VIR_SECURITY_NOP_H__ +# define __VIR_SECURITY_NOP_H__ + +# include "security_driver.h" + +extern virSecurityDriver virSecurityDriverNop; + +#endif /* __VIR_SECURITY_NOP_H__ */ diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 47da677..d06afde 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -160,7 +160,7 @@ SELinuxInitialize(void) } static int -SELinuxGenSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm) { int rc = -1; @@ -225,7 +225,7 @@ done: } static int -SELinuxReserveSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxReserveSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm) { security_context_t pctx; @@ -270,20 +270,34 @@ SELinuxSecurityDriverProbe(void) } static int -SELinuxSecurityDriverOpen(virSecurityDriverPtr drv, - bool allowDiskFormatProbing) +SELinuxSecurityDriverOpen(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return SELinuxInitialize(); +} + +static int +SELinuxSecurityDriverClose(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + + +static const char *SELinuxSecurityGetModel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return SECURITY_SELINUX_NAME; +} + +static const char *SELinuxSecurityGetDOI(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) { /* * Where will the DOI come from? SELinux configuration, or qemu * configuration? For the moment, we'll just set it to "0". */ - virSecurityDriverSetDOI(drv, SECURITY_SELINUX_VOID_DOI); - virSecurityDriverSetAllowDiskFormatProbing(drv, allowDiskFormatProbing); - return SELinuxInitialize(); + return SECURITY_SELINUX_VOID_DOI; } static int -SELinuxGetSecurityProcessLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxGetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, virSecurityLabelPtr sec) { @@ -415,7 +429,7 @@ err: } static int -SELinuxRestoreSecurityImageLabelInt(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxRestoreSecurityImageLabelInt(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, virDomainDiskDefPtr disk, int migrated) @@ -460,11 +474,11 @@ SELinuxRestoreSecurityImageLabelInt(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, static int -SELinuxRestoreSecurityImageLabel(virSecurityDriverPtr drv, +SELinuxRestoreSecurityImageLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainDiskDefPtr disk) { - return SELinuxRestoreSecurityImageLabelInt(drv, vm, disk, 0); + return SELinuxRestoreSecurityImageLabelInt(mgr, vm, disk, 0); } @@ -498,13 +512,13 @@ SELinuxSetSecurityFileLabel(virDomainDiskDefPtr disk, } static int -SELinuxSetSecurityImageLabel(virSecurityDriverPtr drv, +SELinuxSetSecurityImageLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, virDomainDiskDefPtr disk) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; - bool allowDiskFormatProbing = virSecurityDriverGetAllowDiskFormatProbing(drv); + bool allowDiskFormatProbing = virSecurityManagerGetAllowDiskFormatProbing(mgr); if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC) return 0; @@ -538,7 +552,7 @@ SELinuxSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, } static int -SELinuxSetSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxSetSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, virDomainHostdevDefPtr dev) @@ -607,7 +621,7 @@ SELinuxRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, } static int -SELinuxRestoreSecurityHostdevLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, virDomainHostdevDefPtr dev) @@ -756,7 +770,7 @@ SELinuxRestoreSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, static int -SELinuxRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, int migrated ATTRIBUTE_UNUSED) { @@ -770,13 +784,13 @@ SELinuxRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, return 0; for (i = 0 ; i < vm->def->nhostdevs ; i++) { - if (SELinuxRestoreSecurityHostdevLabel(drv, + if (SELinuxRestoreSecurityHostdevLabel(mgr, vm, vm->def->hostdevs[i]) < 0) rc = -1; } for (i = 0 ; i < vm->def->ndisks ; i++) { - if (SELinuxRestoreSecurityImageLabelInt(drv, + if (SELinuxRestoreSecurityImageLabelInt(mgr, vm, vm->def->disks[i], migrated) < 0) @@ -801,7 +815,7 @@ SELinuxRestoreSecurityAllLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, } static int -SELinuxReleaseSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxReleaseSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm) { const virSecurityLabelDefPtr secdef = &vm->def->seclabel; @@ -825,7 +839,7 @@ SELinuxReleaseSecurityLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, static int -SELinuxSetSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxSetSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, const char *savefile) { @@ -839,7 +853,7 @@ SELinuxSetSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, static int -SELinuxRestoreSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, +SELinuxRestoreSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainObjPtr vm, const char *savefile) { @@ -853,9 +867,19 @@ SELinuxRestoreSavedStateLabel(virSecurityDriverPtr drv ATTRIBUTE_UNUSED, static int -SELinuxSecurityVerify(virDomainDefPtr def) +SELinuxSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, + virDomainDefPtr def) { const virSecurityLabelDefPtr secdef = &def->seclabel; + if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { + virSecurityReportError(VIR_ERR_INTERNAL_ERROR, + _("security label driver mismatch: " + "'%s' model configured for domain, but " + "hypervisor driver is '%s'."), + secdef->model, virSecurityManagerGetModel(mgr)); + return -1; + } + if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC) { if (security_check_context(secdef->label) != 0) { virSecurityReportError(VIR_ERR_XML_ERROR, @@ -867,7 +891,7 @@ SELinuxSecurityVerify(virDomainDefPtr def) } static int -SELinuxSetSecurityProcessLabel(virSecurityDriverPtr drv, +SELinuxSetSecurityProcessLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm) { /* TODO: verify DOI */ @@ -876,12 +900,12 @@ SELinuxSetSecurityProcessLabel(virSecurityDriverPtr drv, if (vm->def->seclabel.label == NULL) return 0; - if (!STREQ(drv->name, secdef->model)) { + if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("security label driver mismatch: " "'%s' model configured for domain, but " "hypervisor driver is '%s'."), - secdef->model, drv->name); + secdef->model, virSecurityManagerGetModel(mgr)); if (security_getenforce() == 1) return -1; } @@ -898,7 +922,7 @@ SELinuxSetSecurityProcessLabel(virSecurityDriverPtr drv, } static int -SELinuxSetSecuritySocketLabel(virSecurityDriverPtr drv, +SELinuxSetSecuritySocketLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm) { /* TODO: verify DOI */ @@ -911,12 +935,12 @@ SELinuxSetSecuritySocketLabel(virSecurityDriverPtr drv, if (vm->def->seclabel.label == NULL) return 0; - if (!STREQ(drv->name, secdef->model)) { + if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("security label driver mismatch: " "'%s' model configured for domain, but " "hypervisor driver is '%s'."), - secdef->model, drv->name); + secdef->model, virSecurityManagerGetModel(mgr)); goto done; } @@ -969,7 +993,7 @@ done: } static int -SELinuxClearSecuritySocketLabel(virSecurityDriverPtr drv, +SELinuxClearSecuritySocketLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm) { /* TODO: verify DOI */ @@ -978,12 +1002,12 @@ SELinuxClearSecuritySocketLabel(virSecurityDriverPtr drv, if (vm->def->seclabel.label == NULL) return 0; - if (!STREQ(drv->name, secdef->model)) { + if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("security label driver mismatch: " "'%s' model configured for domain, but " "hypervisor driver is '%s'."), - secdef->model, drv->name); + secdef->model, virSecurityManagerGetModel(mgr)); if (security_getenforce() == 1) return -1; } @@ -1011,7 +1035,7 @@ SELinuxSetSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, static int -SELinuxSetSecurityAllLabel(virSecurityDriverPtr drv, +SELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm, const char *stdin_path) { @@ -1028,12 +1052,12 @@ SELinuxSetSecurityAllLabel(virSecurityDriverPtr drv, vm->def->disks[i]->src, vm->def->disks[i]->dst); continue; } - if (SELinuxSetSecurityImageLabel(drv, + if (SELinuxSetSecurityImageLabel(mgr, vm, vm->def->disks[i]) < 0) return -1; } for (i = 0 ; i < vm->def->nhostdevs ; i++) { - if (SELinuxSetSecurityHostdevLabel(drv, + if (SELinuxSetSecurityHostdevLabel(mgr, vm, vm->def->hostdevs[i]) < 0) return -1; @@ -1063,24 +1087,37 @@ SELinuxSetSecurityAllLabel(virSecurityDriverPtr drv, return 0; } -virSecurityDriver virSELinuxSecurityDriver = { - .name = SECURITY_SELINUX_NAME, - .probe = SELinuxSecurityDriverProbe, - .open = SELinuxSecurityDriverOpen, - .domainSecurityVerify = SELinuxSecurityVerify, - .domainSetSecurityImageLabel = SELinuxSetSecurityImageLabel, - .domainSetSecuritySocketLabel = SELinuxSetSecuritySocketLabel, - .domainClearSecuritySocketLabel = SELinuxClearSecuritySocketLabel, - .domainRestoreSecurityImageLabel = SELinuxRestoreSecurityImageLabel, - .domainGenSecurityLabel = SELinuxGenSecurityLabel, - .domainReserveSecurityLabel = SELinuxReserveSecurityLabel, - .domainReleaseSecurityLabel = SELinuxReleaseSecurityLabel, - .domainGetSecurityProcessLabel = SELinuxGetSecurityProcessLabel, - .domainSetSecurityProcessLabel = SELinuxSetSecurityProcessLabel, - .domainRestoreSecurityAllLabel = SELinuxRestoreSecurityAllLabel, - .domainSetSecurityAllLabel = SELinuxSetSecurityAllLabel, - .domainSetSecurityHostdevLabel = SELinuxSetSecurityHostdevLabel, - .domainRestoreSecurityHostdevLabel = SELinuxRestoreSecurityHostdevLabel, - .domainSetSavedStateLabel = SELinuxSetSavedStateLabel, - .domainRestoreSavedStateLabel = SELinuxRestoreSavedStateLabel, +virSecurityDriver virSecurityDriverSELinux = { + 0, + SECURITY_SELINUX_NAME, + SELinuxSecurityDriverProbe, + SELinuxSecurityDriverOpen, + SELinuxSecurityDriverClose, + + SELinuxSecurityGetModel, + SELinuxSecurityGetDOI, + + SELinuxSecurityVerify, + + SELinuxSetSecurityImageLabel, + SELinuxRestoreSecurityImageLabel, + + SELinuxSetSecuritySocketLabel, + SELinuxClearSecuritySocketLabel, + + SELinuxGenSecurityLabel, + SELinuxReserveSecurityLabel, + SELinuxReleaseSecurityLabel, + + SELinuxGetSecurityProcessLabel, + SELinuxSetSecurityProcessLabel, + + SELinuxSetSecurityAllLabel, + SELinuxRestoreSecurityAllLabel, + + SELinuxSetSecurityHostdevLabel, + SELinuxRestoreSecurityHostdevLabel, + + SELinuxSetSavedStateLabel, + SELinuxRestoreSavedStateLabel, }; diff --git a/src/security/security_selinux.h b/src/security/security_selinux.h index 056ba75..aa67421 100644 --- a/src/security/security_selinux.h +++ b/src/security/security_selinux.h @@ -13,6 +13,6 @@ #ifndef __VIR_SECURITY_SELINUX_H__ # define __VIR_SECURITY_SELINUX_H__ -extern virSecurityDriver virSELinuxSecurityDriver; +extern virSecurityDriver virSecurityDriverSELinux; #endif /* __VIR_SECURITY_SELINUX_H__ */ diff --git a/src/security/security_stack.c b/src/security/security_stack.c new file mode 100644 index 0000000..e8bb058 --- /dev/null +++ b/src/security/security_stack.c @@ -0,0 +1,401 @@ +/* + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Stacked security driver + */ + +#include <config.h> + +#include "security_stack.h" + +#include "virterror_internal.h" + +#define VIR_FROM_THIS VIR_FROM_SECURITY + +typedef struct _virSecurityStackData virSecurityStackData; +typedef virSecurityStackData *virSecurityStackDataPtr; + +struct _virSecurityStackData { + virSecurityManagerPtr primary; + virSecurityManagerPtr secondary; +}; + +void virSecurityStackSetPrimary(virSecurityManagerPtr mgr, + virSecurityManagerPtr primary) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + priv->primary = primary; +} + +void virSecurityStackSetSecondary(virSecurityManagerPtr mgr, + virSecurityManagerPtr secondary) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + priv->secondary = secondary; +} + +static virSecurityDriverStatus +virSecurityStackProbe(void) +{ + return SECURITY_DRIVER_ENABLE; +} + +static int +virSecurityStackOpen(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + +static int +virSecurityStackClose(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) +{ + return 0; +} + +static const char * +virSecurityStackGetModel(virSecurityManagerPtr mgr) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + return virSecurityManagerGetModel(priv->primary); +} + +static const char * +virSecurityStackGetDOI(virSecurityManagerPtr mgr) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + + return virSecurityManagerGetDOI(priv->primary); +} + +static int +virSecurityStackVerify(virSecurityManagerPtr mgr, + virDomainDefPtr def) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerVerify(priv->primary, def) < 0) + rc = -1; + + if (virSecurityManagerVerify(priv->secondary, def) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackGenLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerGenLabel(priv->primary, vm) < 0) + rc = -1; + +#if 0 + /* We don't allow secondary drivers to generate labels. + * This may have to change in the future, but requires + * changes elsewhere in domain_conf.c and capabilities.c + * XML formats first, to allow recording of multiple + * labels + */ + if (virSecurityManagerGenLabel(priv->secondary, vm) < 0) + rc = -1; +#endif + + return rc; +} + + +static int +virSecurityStackReleaseLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerReleaseLabel(priv->primary, vm) < 0) + rc = -1; +#if 0 + /* XXX See note in GenLabel */ + if (virSecurityManagerReleaseLabel(priv->secondary, vm) < 0) + rc = -1; +#endif + + return rc; +} + + +static int +virSecurityStackReserveLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerReserveLabel(priv->primary, vm) < 0) + rc = -1; +#if 0 + /* XXX See note in GenLabel */ + if (virSecurityManagerReserveLabel(priv->secondary, vm) < 0) + rc = -1; +#endif + + return rc; +} + + +static int +virSecurityStackSetSecurityImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainDiskDefPtr disk) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerSetImageLabel(priv->secondary, vm, disk) < 0) + rc = -1; + if (virSecurityManagerSetImageLabel(priv->primary, vm, disk) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackRestoreSecurityImageLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainDiskDefPtr disk) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerRestoreImageLabel(priv->secondary, vm, disk) < 0) + rc = -1; + if (virSecurityManagerRestoreImageLabel(priv->primary, vm, disk) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackSetSecurityHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainHostdevDefPtr dev) + +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerSetHostdevLabel(priv->secondary, vm, dev) < 0) + rc = -1; + if (virSecurityManagerSetHostdevLabel(priv->primary, vm, dev) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virDomainHostdevDefPtr dev) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerRestoreHostdevLabel(priv->secondary, vm, dev) < 0) + rc = -1; + if (virSecurityManagerRestoreHostdevLabel(priv->primary, vm, dev) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackSetSecurityAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *stdin_path) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerSetAllLabel(priv->secondary, vm, stdin_path) < 0) + rc = -1; + if (virSecurityManagerSetAllLabel(priv->primary, vm, stdin_path) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackRestoreSecurityAllLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + int migrated) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerRestoreAllLabel(priv->secondary, vm, migrated) < 0) + rc = -1; + if (virSecurityManagerRestoreAllLabel(priv->primary, vm, migrated) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackSetSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *savefile) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerSetSavedStateLabel(priv->secondary, vm, savefile) < 0) + rc = -1; + if (virSecurityManagerSetSavedStateLabel(priv->primary, vm, savefile) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackRestoreSavedStateLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + const char *savefile) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerRestoreSavedStateLabel(priv->secondary, vm, savefile) < 0) + rc = -1; + if (virSecurityManagerRestoreSavedStateLabel(priv->primary, vm, savefile) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackSetProcessLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerSetProcessLabel(priv->secondary, vm) < 0) + rc = -1; + if (virSecurityManagerSetProcessLabel(priv->primary, vm) < 0) + rc = -1; + + return rc; +} + +static int +virSecurityStackGetProcessLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm, + virSecurityLabelPtr seclabel) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + +#if 0 + if (virSecurityManagerGetProcessLabel(priv->secondary, vm, seclabel) < 0) + rc = -1; +#endif + if (virSecurityManagerGetProcessLabel(priv->primary, vm, seclabel) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackSetSocketLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerSetSocketLabel(priv->secondary, vm) < 0) + rc = -1; + if (virSecurityManagerSetSocketLabel(priv->primary, vm) < 0) + rc = -1; + + return rc; +} + + +static int +virSecurityStackClearSocketLabel(virSecurityManagerPtr mgr, + virDomainObjPtr vm) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + int rc = 0; + + if (virSecurityManagerClearSocketLabel(priv->secondary, vm) < 0) + rc = -1; + if (virSecurityManagerClearSocketLabel(priv->primary, vm) < 0) + rc = -1; + + return rc; +} + + +virSecurityDriver virSecurityDriverStack = { + sizeof(virSecurityStackData), + "stack", + virSecurityStackProbe, + virSecurityStackOpen, + virSecurityStackClose, + + virSecurityStackGetModel, + virSecurityStackGetDOI, + + virSecurityStackVerify, + + virSecurityStackSetSecurityImageLabel, + virSecurityStackRestoreSecurityImageLabel, + + virSecurityStackSetSocketLabel, + virSecurityStackClearSocketLabel, + + virSecurityStackGenLabel, + virSecurityStackReserveLabel, + virSecurityStackReleaseLabel, + + virSecurityStackGetProcessLabel, + virSecurityStackSetProcessLabel, + + virSecurityStackSetSecurityAllLabel, + virSecurityStackRestoreSecurityAllLabel, + + virSecurityStackSetSecurityHostdevLabel, + virSecurityStackRestoreSecurityHostdevLabel, + + virSecurityStackSetSavedStateLabel, + virSecurityStackRestoreSavedStateLabel, +}; diff --git a/src/security/security_stack.h b/src/security/security_stack.h new file mode 100644 index 0000000..bc83ff3 --- /dev/null +++ b/src/security/security_stack.h @@ -0,0 +1,33 @@ +/* + * Copyright (C) 2010-2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Stacked security driver + */ + +#include "security_driver.h" + +#ifndef __VIR_SECURITY_STACK +# define __VIR_SECURITY_STACK + +extern virSecurityDriver virSecurityDriverStack; + +void virSecurityStackSetPrimary(virSecurityManagerPtr mgr, + virSecurityManagerPtr primary); +void virSecurityStackSetSecondary(virSecurityManagerPtr mgr, + virSecurityManagerPtr secondary); + +#endif /* __VIR_SECURITY_DAC */ -- 1.7.3.4

2 3

[libvirt] Implementing VNC per VM access control lists
by Neil Wilson 10 Jan '11

10 Jan '11

Hi, At the moment SASL VNC authentication in libvirt allows any of the userids to access any of the VNC consoles on a particular libvirt host. There is a section in the qemu_command code marked "TODO: Support ACLs later" and we would really like the ability to have per VM user authorization to the VNC console from within libvirt. Essentially the people who are accessing the VNC consoles are not administrators and have no access to the Host server - so these ACLs need to be completely based on a separate list of userids to any access mechanism for the libvirtd itself. Given that the VNC restrictions are enforced within qemu from the monitor system, I'm presuming the authorization list is going to have to be passed in via XML and be capable of being updated throughout the life of a VM session. Unless there's another way of doing it... What's the feeling about how this feature should be provided within libvirt? If there is somebody out there who has a bit of time at the moment and fancies having a go at implementing this - and, of course, there is agreement on a specification here - then we'd look at sponsoring them to add the feature into Libvirt. Please put your hand up! Regards, Neil Wilson

4 14

[libvirt] virsh save command will throw an error when used with qemu
by oliver 10 Jan '11

10 Jan '11

Hey subscribers, I have a problem with the actual libvirt/virsh release and qemu-kvm 0.13. if i want to save the actual status of my virtual machine i get the following error: lserver ~ # virsh save windows /virtual/windows_ram error: Failed to save domain windows to /virtual/windows_ram error: internal error unable to execute QEMU command 'migrate': An undefined error has ocurred First i asked in OFTC but there was said, that this could be an error with the qemu console command. The system details: lserver ~ # uname -a Linux lserver 2.6.36.2 #2 SMP PREEMPT Wed Dec 29 02:58:41 Local time zone must be set-- x86_64 Intel(R) Core(TM) i5 CPU K 655 @ 3.20GHz GenuineIntel GNU/Linux lserver ~ # virsh --version 0.8.7 lserver ~ # qemu-kvm --version QEMU emulator version 0.13.0 (qemu-kvm-0.13.0), Copyright (c) 2003-2008 Fabrice Bellard root 28673 7.7 81.5 3184544 3092128 ? Sl Jan09 72:19 /usr/bin/qemu-system-x86_64 --enable-kvm -S -M pc-0.13 -enable-kvm -m 3000 -smp 2,sockets=2,cores=1,threads=1 -name windows -uuid 30c59551-5571-a177-9036-1d5d51cb76b2 -nodefconfig -nodefaults -chardev socket,id=monitor,path=/var/lib/libvirt/qemu/windows.monitor,server,nowait -mon chardev=monitor,mode=control -rtc base=localtime -boot c -drive file=/virtual/server2003.img,if=none,id=drive-ide0-0-0,format=raw -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 -netdev tap,fd=39,id=hostnet0 -device e1000,netdev=hostnet0,id=net0,mac=52:54:00:12:34:70,bus=pci.0,addr=0x3 -chardev pty,id=serial0 -device isa-serial,chardev=serial0 -usb -device usb-tablet,id=input0 -vnc 127.0.0.1:0 -k de -vga std -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4 It was for me not possible to get further debug info from libvirt. Best regards, Oliver Lott

1 0

[libvirt] Fwd: libvirtd and listen_addr
by Daniel Huhardeaux 09 Jan '11

09 Jan '11

Hello, got no reaction on this, I try again :-) -------- Message original -------- Sujet: libvirtd and listen_addr Date : Sat, 01 Jan 2011 11:33:55 +0100 De : Daniel Huhardeaux <tech(a)tootai.net> Pour : libvir-list(a)redhat.com Hi, at first, best wishes to all for this new year. We have a request: would it be possible to start libvirtd listen_addr *after* the VM network is up? We have VPN through different libvirt+kvm servers and want to virsh connect to the private VM network address of each server instead of his VPN IP. The problem is that libvirt doesn't start with unknown IP address. If network would be already up, libvirt could listen on this address. Regards libvirtd (libvirt) 0.8.3 - Debian stable + backports -- Daniel

3 10

[libvirt] libvirt 0.8.7 msys and xdr weirdness
by Justin Clift 08 Jan '11

08 Jan '11

Hi Matthias, Have you tried out libvirt 0.8.7 yet with your msys scripts? Giving it a shot here, but am hitting problems with the --with-remote part. ./configure isn't finding the XDR library. checking for xdrmem_create in -lportablexdr... no checking for library containing xdrmem_create... no configure: error: Cannot find a XDR library Wondering if you've had a chance to look at 0.8.7 with msys yet, and if you've come across the same problem? Regards and best wishes, Justin Clift

3 3

[libvirt] [PATCH 0/2] Update qemu password support
by Marc-André Lureau 08 Jan '11

08 Jan '11

Hi, Recently, QEMU learned set_password and expire_password monitor commands. http://qemu.com/qemu.git/commit/?id=7572150c189c6553c2448334116ab717680de66d The following patches make use of these new commands if available, and fallback on VNC-only password support. Marc-André Lureau (2): qemu: add set_password and expire_password monitor commands qemu: Update password support in the QEMU driver src/qemu/qemu_driver.c | 138 ++++++++++++++++++++++++++++++++++++------ src/qemu/qemu_monitor.c | 77 +++++++++++++++++++++++ src/qemu/qemu_monitor.h | 7 ++ src/qemu/qemu_monitor_json.c | 56 +++++++++++++++++ src/qemu/qemu_monitor_json.h | 7 ++ src/qemu/qemu_monitor_text.c | 69 +++++++++++++++++++++ src/qemu/qemu_monitor_text.h | 7 ++ 7 files changed, 343 insertions(+), 18 deletions(-) -- 1.7.3.4

2 3

[libvirt] RFC: exposing a config setting to force vhost-net support on/off
by Laine Stump 07 Jan '11

07 Jan '11

There's a request to allow libvirt to explicitly turn on/off the new vhost-net feature of virtio network cards. I see a few ways to do it, and am looking for opinions on which is best. (For the uninitiated, vhost-net is a new kernel-based virtio implementation that saves the overhead of having all network traffic be handled by the userlevel qemu process.) The original implementation of vhost-net support (what's been in libvirt for a few releases now) doesn't expose any knobs to the user - if the vhost-net kernel module is loaded, libvirt uses it for all virtio network devices of all newly created guests, and if the kernel module isn't loaded, it reverts to using the old user-level virtio. It's simple enough to put a bit of extra logic at the point where we make that decision. I see 3 possibilities: 1) default - use vhost-net if it's loaded, don't if it isn't (current behavior) 2) require - use vhost-net if it's loaded, and refuse to start the guest if it isn't (for those who want to be 100% sure they're using it) 3) disable - don't use vhost-net, whether or not it's loaded (to disable it, eg in case a compatibility problem is found between vhost-net and some particular guest) The question is how to describe that in the XML. Here's what a virtio network interface might look like currently: <devices> <interface type='network'> <source network='default'/> <model type='virtio'/> </interface> </devices> 1) One possibility (the simplest) would be to add an optional attribute to <model>: <devices> <interface type='network'> <source network='default'/> <model type='virtio' vhost='default|require|disable'/> (or 'default|on|off' ?) </interface> </devices> or maybe: <devices> <interface type='network'> <source network='default'/> <model type='virtio' mode='default|kernel|user'/> </interface> </devices> 2) Another possibility would be to define a new sub-element of<interface>, called "<driver>", similar to what's done in the storage device XML. In the future, other backend driver-related items could be placed there: <devices> <interface type='network'> <source network='default'/> <model type='virtio'/> <driver vhost='default|require|disable'/> (or "mode='default|kernel|user'") </interface> </devices> 3) A third method, which might make the XML file look less ugly if, in the future, there were *many* more configurable items for interface backends (this one was inspired by the<memtune> element): <devices> <interface type='network'> <source network='default'/> <model type='virtio'/> <driver> <vhost>default|require|disable</vhost> </driver> </interface> </devices> (we *might* want to consider naming it something other than "<driver>", eg"<tune>" or something like that, so that more things could be put in there. The problem with that is I don't really consider vhost a true "tunable", since as far as I'm aware, it's always faster to use kernel-level virtio than to bounce everything up to userspace; the setting in question is intended more for testing purposes, or to alleviate unforeseen compatibility problems). So, any opinions on these three possibilities (or an undescribed 4th?) What about the naming? I'm open to suggestions!

4 6