- Devel - libvirt List Archives

[libvirt] [PATCH v3 0/2] m4: Run QEMU under a distro-specific user when possible
by Andrea Bolognani 26 Mar '19

26 Mar '19

Changes from [v2]: * add explicit fallback to root:root for unrecognized operating systems; * provide logging to help users understand why they ended up with root:root in the first place. Changes from [v1]: * use distro-specific user and group; * warn the user if they are going to be running QEMU as root. [v2] https://www.redhat.com/archives/libvir-list/2019-March/msg01737.html [v1] https://www.redhat.com/archives/libvir-list/2019-March/msg01707.html Andrea Bolognani (2): m4: Run QEMU under a distro-specific user when possible m4: Add warning when running QEMU as root m4/virt-driver-qemu.m4 | 45 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 3 deletions(-) -- 2.20.1

2 4

[libvirt] [PATCH v2 0/2] m4: Run QEMU under a distro-specific user when possible
by Andrea Bolognani 26 Mar '19

26 Mar '19

Changes from [v1]: * use distro-specific user and group; * warn the user if they are going to be running QEMU as root. [v1] https://www.redhat.com/archives/libvir-list/2019-March/msg01707.html Andrea Bolognani (2): m4: Run QEMU under a distro-specific user when possible m4: Add warning when running QEMU as root m4/virt-driver-qemu.m4 | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) -- 2.20.1

3 6

[libvirt] [PATCH] m4: Change default QEMU credentials to qemu:qemu
by Andrea Bolognani 26 Mar '19

26 Mar '19

Our current defaults are root:wheel on FreeBSD and macOS, root:root everywhere else. Looking at what downstream distributions actually do, we can see that these defaults are overriden the vast majority of the time, with a number of variations showing up in the wild: * qemu:qemu -> Used by CentOS, Fedora, Gentoo, OpenSUSE, RHEL and... As it turns out, our very own spec file :) * libvirt-qemu:libvirt-qemu -> Used by Debian. * libvirt-qemu:kvm -> Used by Ubuntu. * nobody:nobody -> Used by Arch Linux. Based on the above, we can conclude that qemu:qemu are the preferred credentials to be used when spawning a QEMU process, while our current defaults get very little love. Changing our defaults aligns with what most downstreams are actually doing, promotes running QEMU under a non-root user - which is a very good idea anyway - and shields random people building libvirt from source from unwittingly running their guests as root. Note that there are a very small number of downstreams that don't override our defaults: Alpine Linux, FreeBSD and macOS. Of those, only Alpine Linux is affected by this change; all three should arguably have been setting --with-qemu-user and --with-qemu-group explicitly regardless of this change. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- Proof that I'm not making any of this up ;) * Alpine Linux https://github.com/alpinelinux/aports/blob/master/main/libvirt/APKBUILD * Arch Linux https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=libvirt-git#n113 * CentOS https://git.centos.org/blob/rpms!libvirt.git/8d86411e5109d791edf49c7f43c08a… * Debian https://salsa.debian.org/libvirt-team/libvirt/blob/debian/sid/debian/rules#… * Fedora https://src.fedoraproject.org/rpms/libvirt/blob/f29/f/libvirt.spec#_204 * FreeBSD https://github.com/freebsd/freebsd-ports/blob/master/devel/libvirt/Makefile * Gentoo https://github.com/gentoo/gentoo/blob/master/app-emulation/libvirt/libvirt-… * macOS (Homebrew) https://github.com/Homebrew/homebrew-core/blob/master/Formula/libvirt.rb * OpenSUSE https://build.opensuse.org/package/view_file/openSUSE:Leap:15.0:Update/libv… * Ubuntu https://git.launchpad.net/ubuntu/+source/libvirt/tree/debian/rules?h=ubuntu… * Upstream https://libvirt.org/git/?p=libvirt.git;a=blob;f=libvirt.spec.in;h=b7a35a0fb… m4/virt-driver-qemu.m4 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/m4/virt-driver-qemu.m4 b/m4/virt-driver-qemu.m4 index cb05c34265..2a1b86e891 100644 --- a/m4/virt-driver-qemu.m4 +++ b/m4/virt-driver-qemu.m4 @@ -44,8 +44,8 @@ AC_DEFUN([LIBVIRT_DRIVER_CHECK_QEMU], [ default_qemu_user=root default_qemu_group=wheel else - default_qemu_user=root - default_qemu_group=root + default_qemu_user=qemu + default_qemu_group=qemu fi if test "x$with_qemu_user" = "xplatform dependent" ; then -- 2.20.1

3 8

[libvirt] [PATCH] virQEMUDriverPtr parameters clean up in function qemuExtTPMStart() in /src/qemu/qemu_tpm.c
by Humaid 26 Mar '19

26 Mar '19

--- src/qemu/qemu_tpm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 835a9caf46..b60e443f14 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -834,16 +834,16 @@ qemuExtTPMStartEmulator(virQEMUDriverPtr driver, int -qemuExtTPMStart(virQEMUDriverPtr driver, - virDomainObjPtr vm, +qemuExtTPMStart(virDomainObjPtr vm, qemuDomainLogContextPtr logCtxt) { int ret = 0; + qemuDomainObjPrivatePtr priv = vm->privateData; virDomainTPMDefPtr tpm = vm->def->tpm; switch (tpm->type) { case VIR_DOMAIN_TPM_TYPE_EMULATOR: - ret = qemuExtTPMStartEmulator(driver, vm, logCtxt); + ret = qemuExtTPMStartEmulator(priv->driver, vm, logCtxt); break; case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: case VIR_DOMAIN_TPM_TYPE_LAST: -- 2.17.1

6 8

[libvirt] [PATCH 0/2] qemu: Assume presence of 'set_password' and 'expire_password'
by Peter Krempa 26 Mar '19

26 Mar '19

Remove some dead code. Peter Krempa (2): qemu: Assume that 'set_password' and 'expire_password' are supported qemu: monitor: Remove unused qemuMonitor(JSON)SetVNCPassword src/qemu/qemu_hotplug.c | 20 ------------------- src/qemu/qemu_monitor.c | 16 ---------------- src/qemu/qemu_monitor.h | 2 -- src/qemu/qemu_monitor_json.c | 37 ------------------------------------ src/qemu/qemu_monitor_json.h | 2 -- tests/qemumonitorjsontest.c | 2 -- 6 files changed, 79 deletions(-) -- 2.20.1

3 5

[libvirt] [jenkins-ci PATCH] Stop building osinfo-db on CentOS 7
by Fabiano Fidêncio 26 Mar '19

26 Mar '19

osinfo-db tests are Python3 only. Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> --- jenkins/projects/osinfo-db.yaml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/jenkins/projects/osinfo-db.yaml b/jenkins/projects/osinfo-db.yaml index 87b6748..25a6621 100644 --- a/jenkins/projects/osinfo-db.yaml +++ b/jenkins/projects/osinfo-db.yaml @@ -1,7 +1,16 @@ --- - project: name: osinfo-db - machines: '{all_machines}' + # osinfo-db tests are Python 3 only, so they can't be built on + # CentOS 7; + machines: + - libvirt-debian-8 + - libvirt-debian-9 + - libvirt-fedora-28 + - libvirt-fedora-29 + - libvirt-fedora-rawhide + - libvirt-freebsd-11 + - libvirt-freebsd-12 title: osinfo database archive_format: xz git_url: '{git_urls[osinfo-db][default]}' -- 2.20.1

2 1

[libvirt] [jenkins-ci PATCH] guests: Update test dependencies for osinfo-db
by Fabiano Fidêncio 26 Mar '19

26 Mar '19

The new dependencies are: - python3 - python3-libxml2 - python3-pytest - python3-requests xmllint has been removed in favour of a own crafted test using python3-libmlx2 Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> --- guests/vars/projects/osinfo-db.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/guests/vars/projects/osinfo-db.yml b/guests/vars/projects/osinfo-db.yml index d9320a4..2c8a333 100644 --- a/guests/vars/projects/osinfo-db.yml +++ b/guests/vars/projects/osinfo-db.yml @@ -1,4 +1,7 @@ --- packages: - intltool - - xmllint + - python3 + - python3-libxml2 + - python3-pytest + - python3-requests -- 2.20.1

2 1

[libvirt] [PATCH] qemufirmwaretest: Produce better message on error
by Michal Privoznik 26 Mar '19

26 Mar '19

If qemuFirmwareFetchConfigs() returned more or less paths than expected all that we see is the following error message: Expected 5 paths, got 7 While it is technically correct (the best kind of correct), we can do better: Unexpected path (i=0). Expected /some/path got /some/other/path Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/qemufirmwaretest.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/tests/qemufirmwaretest.c b/tests/qemufirmwaretest.c index 340344ebba..2b5cbf649b 100644 --- a/tests/qemufirmwaretest.c +++ b/tests/qemufirmwaretest.c @@ -66,6 +66,7 @@ testFWPrecedence(const void *opaque ATTRIBUTE_UNUSED) PREFIX "/share/qemu/firmware/61-ovmf.json", PREFIX "/share/qemu/firmware/70-aavmf.json", }; + const size_t nexpected = ARRAY_CARDINALITY(expected); if (VIR_STRDUP(fakehome, abs_srcdir "/qemufirmwaredata/home/user/.config") < 0) return -1; @@ -81,17 +82,15 @@ testFWPrecedence(const void *opaque ATTRIBUTE_UNUSED) } nfwList = virStringListLength((const char **)fwList); - if (nfwList != ARRAY_CARDINALITY(expected)) { - fprintf(stderr, "Expected %zu paths, got %zu\n", - ARRAY_CARDINALITY(expected), nfwList); - return -1; - } - for (i = 0; i < ARRAY_CARDINALITY(expected); i++) { - if (STRNEQ_NULLABLE(expected[i], fwList[i])) { + for (i = 0; i < MAX(nfwList, nexpected); i++) { + const char *e = i < nexpected ? expected[i] : NULL; + const char *f = i < nfwList ? fwList[i] : NULL; + + if (STRNEQ_NULLABLE(e, f)) { fprintf(stderr, "Unexpected path (i=%zu). Expected %s got %s \n", - i, expected[i], NULLSTR(fwList[i])); + i, NULLSTR(e), NULLSTR(f)); return -1; } } -- 2.19.2

2 1

[libvirt] [PATCH v2] news: Document kernel requirements for virtual networks
by Michal Privoznik 25 Mar '19

25 Mar '19

After 7431b3eb9a05068e4b libvirt requires "filter", "nat" and "mangle" tables to exist for both IPv4 and IPv6. This fact was missed in the news.xml and since we don't have any better place to advertise that let's update old news. This was refined in 686803a1a2e and since that is not released yet create a new entry documenting the refinement. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Even though the v1 was ACKed, I'm sending v2 because things have changed since then. The difference to v1 then is that I've introduced a new news entry for the current release mentioning the refinement. IMO this reflects the reality the best: 5.1.0, which is released and doesn't contain the fix does require all 6 tables (even though Dan created v5.1.0-maint branch where he backported the fix). docs/news.xml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/news.xml b/docs/news.xml index 5c3028e10b..83e965e0f3 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -124,6 +124,18 @@ Report class information for PCI node device capability. </summary> </change> + <change> + <summary> + Split setup of IPv4 and IPv6 top level chain + </summary> + <description> + The requirement resulting from private chains improvement done + in <code>v5.1.0</code> was refined so that only tables from + corresponding IP version are required. This means that if a + network doesn't have <code>IPv6</code> enabled then those + tables are not required. + </description> + </change> </section> <section title="Bug fixes"> </section> @@ -202,7 +214,9 @@ Historically firewall rules for virtual networks were added straight into the base chains. This works but has a number of bugs and design limitations. To address them, libvirt now puts - firewall rules into its own chains. + firewall rules into its own chains. Note that with this change the + <code>filter</code>, <code>nat</code> and <code>mangle</code> tables + are required for both <code>IPv4</code> and <code>IPv6</code>. </description> </change> <change> -- 2.19.2

2 1

[libvirt] [PATCH] news: Document kernel requirements for virtual networks
by Michal Privoznik 25 Mar '19

25 Mar '19

After 7431b3eb9a05068e4b libvirt requires "filter", "nat" and "mangle" tables to exist for both IPv4 and IPv6. This fact was missed in the news.xml and since we don't have any better place to advertise that let's update old news. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- docs/news.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/news.xml b/docs/news.xml index 81466c3d55..8321ed8c43 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -146,7 +146,9 @@ Historically firewall rules for virtual networks were added straight into the base chains. This works but has a number of bugs and design limitations. To address them, libvirt now puts - firewall rules into its own chains. + firewall rules into its own chains. Note that with this change the + <code>filter</code>, <code>nat</code> and <code>mangle</code> tables + are required for both <code>IPv4</code> and <code>IPv6</code>. </description> </change> <change> -- 2.19.2

4 3