- Devel - libvirt List Archives

[libvirt] [PATCH 0/1] virfile: added GPFS as shared fs
by dmichelotto 25 Feb '19

25 Feb '19

Added GPFS as shared file system recognized during live migration security checks. This patch is based on libvirt-4.5.0 distributed by CentOS 7.6.1810 via source rpm. The rpms builded fix our bug with GPFS. BUG: https://bugzilla.redhat.com/show_bug.cgi?id=1679528 dmichelotto (1): virfile: added GPFS as shared fs src/util/virfile.c | 9 ++++++++- src/util/virfile.h | 1 + tests/virfiledata/mounts3.txt | 1 + tests/virfilemock.c | 5 +++++ tests/virfiletest.c | 1 + 5 files changed, 16 insertions(+), 1 deletion(-) -- 2.20.1

3 3

[libvirt] [PATCH v4 0/4] qemu: Report better error on dump/migrate failure
by Andrea Bolognani 25 Feb '19

25 Feb '19

Changes from [v3]: * Make sure errors from virFileWrapperFdClose() result in an overall failure being bubbled up; * don't call virReportError() unless the function is going to report the failure through its return code as well; * revert b0c3e931804a more thoroughly. Changes from [v2]: * Move error reporting from virFileWrapperFdFree() to virFileWrapperFdClose(). Changes from [v1]: * Use VIR_FREE() followed by VIR_ALLOC_N() instead of manually setting the last (and only) byte of the array returned by VIR_REALLOC_N() to zero. [v3] https://www.redhat.com/archives/libvir-list/2019-February/msg01069.html [v2] https://www.redhat.com/archives/libvir-list/2019-February/msg00782.html [v1] https://www.redhat.com/archives/libvir-list/2019-February/msg00156.html Andrea Bolognani (4): util: Make it safe to call virFileWrapperFdClose() multiple times qemu: Always call virFileWrapperFdClose() util: Move error reporting back to virFileWrapperFdClose() util: Report error in virFileWrapperFdClose() src/qemu/qemu_driver.c | 16 ++++++++++------ src/util/virfile.c | 22 ++++++++++++++++------ 2 files changed, 26 insertions(+), 12 deletions(-) -- 2.20.1

2 5

[libvirt] [PATCH] util: fix heap-buffer-overflow in virFileWrapperFdFree
by Jay Zhou 25 Feb '19

25 Feb '19

From: Jing Wu <wujing42(a)huawei.com> Some functions like doCoreDump call virFileWrapperFdNew to execute async cmds, if a step after virFileWrapperFdNew failed, the func may skip virFileWrapperFdClose and jump to cleanup label to call virFileWrapperFdFree directly. If the child process of the cmd is running and asyncioThread is polling, cmd->errbuf have been alloced at least one byte but not yet operate (*cmd->errbuf)[errlen] = '\0', access of wfd->err_msg in virFileWrapperFdFree at this time will cause risk of heap-buffer-overflow. So, we need to put VIR_WARN(wfd->err_msg) after VIR_FREE(wfd->err_msg). Besides, since virCommandFree has included virCommandAbort, there is no need to call virCommandAbort extraly. Signed-off-by: Jing Wu <wujing42(a)huawei.com> Signed-off-by: Jay Zhou <jianjay.zhou(a)huawei.com> --- src/util/virfile.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/util/virfile.c b/src/util/virfile.c index f6f9e4c..d488158 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -347,13 +347,12 @@ virFileWrapperFdFree(virFileWrapperFdPtr wfd) if (!wfd) return; + virCommandFree(wfd->cmd); + if (wfd->err_msg && *wfd->err_msg) VIR_WARN("iohelper reports: %s", wfd->err_msg); - virCommandAbort(wfd->cmd); - VIR_FREE(wfd->err_msg); - virCommandFree(wfd->cmd); VIR_FREE(wfd); } -- 1.8.3.1

2 1

[libvirt] [PATCH 0/2] tools: console: a fix and improvment
by Nikolay Shirokovskiy 25 Feb '19

25 Feb '19

Nikolay Shirokovskiy (2): tools: console: cleanup console on errors in main thread tools: console: pass stream/fd errors to user tools/virsh-console.c | 220 ++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 169 insertions(+), 51 deletions(-) -- 1.8.3.1

2 6

[libvirt] [python PATCH] Fix virDomainPinIOThread typed params check
by Pavel Hrdina 25 Feb '19

25 Feb '19

The VIR_DOMAIN_IOTHREAD_POLL_SHRINK is unsigned int. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1680546 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- Pushed under trivial rule. libvirt-override.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt-override.c b/libvirt-override.c index f7b2f6b..857c018 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -1684,7 +1684,7 @@ libvirt_virDomainPinIOThread(PyObject *self ATTRIBUTE_UNUSED, static virPyTypedParamsHint virPyDomainSetIOThreadParams[] = { { VIR_DOMAIN_IOTHREAD_POLL_MAX_NS, VIR_TYPED_PARAM_ULLONG }, { VIR_DOMAIN_IOTHREAD_POLL_GROW, VIR_TYPED_PARAM_UINT }, - { VIR_DOMAIN_IOTHREAD_POLL_SHRINK, VIR_TYPED_PARAM_ULLONG }, + { VIR_DOMAIN_IOTHREAD_POLL_SHRINK, VIR_TYPED_PARAM_UINT }, }; static PyObject * -- 2.20.1

1 0

[libvirt] [libvirt-go PATCH 0/3] Introduce recent DomainSnapshotXML and DomainSaveImageXML flags
by Erik Skultety 25 Feb '19

25 Feb '19

Unfortunately, in order to support the new flags, the last patch introduces an API breakage as the convention we use for the bindings is to also enforce types for flags. Erik Skultety (3): Introduce DomainSnapshotXMLFlags constant Introduce DomainSaveImageXMLFlags constant Enforce new flags types in DomainSaveImageGetXMLDesc and GetXMLDesc connect.go | 2 +- domain.go | 8 +++++++- domain_compat.h | 8 ++++++++ domain_snapshot.go | 8 +++++++- domain_snapshot_wrapper.h | 2 +- 5 files changed, 24 insertions(+), 4 deletions(-) -- 2.20.1

3 13

[libvirt] [PATCH 0/2] further apparmor handling of opengl
by Christian Ehrhardt 25 Feb '19

25 Feb '19

Further testing with opengl enabled graphics showed that we need much more rules than we initially added. Upstream apparmor has abstractions [1][2] for the majority of what we'd need, but those are in no Distribution yet so we can't rely on them. But we can add rules "like those known ones" matching what our testing shows as needed when we add a gl enabled device. There is no overly critical access opened by this, but still we continue to only add those to the guests that have gl enabled. The most "discussion worthy" part of it most likely are the wildcards into /dev/devices/... but they are rather specific and read only - furthermore retracing those in advance starting from the rendernode most likely is rather error prone, so I went with the wildcards. Example apparmor denials can be found in the launchpad bug [3] [1]: https://gitlab.com/apparmor/apparmor/blob/master/profiles/apparmor.d/abstra… [2]: https://gitlab.com/apparmor/apparmor/blob/master/profiles/apparmor.d/abstra… [3]: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1815452 Christian Ehrhardt (2): security: aa-helper: allow virt-aa-helper to read /dev/dri security: aa-helper: generate more rules for gl devices .../apparmor/usr.lib.libvirt.virt-aa-helper | 3 +++ src/security/virt-aa-helper.c | 20 ++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.17.1

2 11

[libvirt] [PATCH v2 0/3] bhyve: implement MSRs ignore unknown writes feature
by Roman Bogorodskiy 24 Feb '19

24 Feb '19

Changes from v1: * Replaced <msrs ignoreUnknownWrites='yes'/> with <msrs unknown="ignore|fault"/> Roman Bogorodskiy (3): conf: introduce 'msrs' feature bhyve: implement ignore unknown MSRs feature news: document bhyve msrs feature docs/drvbhyve.html.in | 22 +++++++++++ docs/formatdomain.html.in | 1 + docs/news.xml | 10 +++++ docs/schemas/domaincommon.rng | 14 +++++++ src/bhyve/bhyve_command.c | 4 ++ src/conf/domain_conf.c | 38 +++++++++++++++++++ src/conf/domain_conf.h | 16 ++++++++ src/qemu/qemu_domain.c | 1 + .../bhyvexml2argvdata/bhyvexml2argv-msrs.args | 10 +++++ .../bhyvexml2argv-msrs.ldargs | 3 ++ .../bhyvexml2argvdata/bhyvexml2argv-msrs.xml | 26 +++++++++++++ tests/bhyvexml2argvtest.c | 1 + .../bhyvexml2xmlout-msrs.xml | 36 ++++++++++++++++++ tests/bhyvexml2xmltest.c | 1 + 14 files changed, 183 insertions(+) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-msrs.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-msrs.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-msrs.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-msrs.xml -- 2.20.1

2 7

[libvirt] [PATCH 0/2] cputest: Update python scripts for parsing CPU data
by Jiri Denemark 22 Feb '19

22 Feb '19

Jiri Denemark (2): cputest: Adapt scripts to split cpu_map cputest: Use python3 in CPU parser scripts tests/cputestdata/cpu-cpuid.py | 24 +++++++++++------------- tests/cputestdata/cpu-reformat.py | 2 +- 2 files changed, 12 insertions(+), 14 deletions(-) -- 2.20.1

2 3

[libvirt] [PATCH] nwfilter: allow for different format of IPv6 netmask/prefix in ebtables output
by Laine Stump 22 Feb '19

22 Feb '19

The iptables-ebtables package is meant as a drop-in replacement for the native ebtables package, but it formats some items in the -L output differently, leading to failure of scripts that depend on the output of ebtables -L. In particular: with old ebtables IPv6 prefixes are output as a netmask (e.g.: "/ffff:fc00") with iptables-ebtables IPv6 prefixes are always output as a numeric prefix (e.g. "/22"), and suppressed completely if the prefix is /128. This difference is also described in https://bugzilla.redhat.com/show_bug.cgi?id=1674536 "old" ebtables upstream has just accepted a patch to change its output to match that of iptables-ebtables: https://marc.info/?l=netfilter-devel&m=155000828923204&w=2 so it makes sense for libvirt-tck to accept the new format (as well as the old). As with the patch for fixing up MAC addresses with leading 0s, this patch also uses sed to apply a substitution to the scraped output of ebtables -L. However, rather than keeping the comparison (expected) output in the old (netmask) form, it is changed to the new (prefix) form, and the sed commands change netmasks to prefixes. (This works out better because in some cases we need to replace [all ff's] with "", and it's not possible to do that in the opposite direction :-) Signed-off-by: Laine Stump <laine(a)laine.org> --- NB: ebtables upstream hasn't changed the format of MAC addresses (yet). Also, some new errors have cropped up when running these same tests on RHEL8, but I think they are due to some new "real" bug in iptables-ebtables, since the xml2fwallout tests all succeed when run individually. .../nwfilterxml2fwallout/comment-test.fwall | 4 ++-- .../nwfilterxml2fwallout/hex-data-test.fwall | 4 ++-- .../nwfilterxml2fwallout/ipv6-test.fwall | 18 +++++++++--------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall index d87843b..4f467bf 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall @@ -2,9 +2,9 @@ -i vnet0 -j libvirt-I-vnet0 #ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" -o vnet0 -j libvirt-O-vnet0 -#ebtables -t nat -L libvirt-I-vnet0 | sed s/01:02:03:04:05:06/1:2:3:4:5:6/g | sed s/0a:0b:0c:0d:0e:0f/a:b:c:d:e:f/g | grep -v "^Bridge" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 | sed 's#/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000#/113#g' | sed 's#/ffff:fc00::#/22#g' | sed s/01:02:03:04:05:06/1:2:3:4:5:6/g | sed s/0a:0b:0c:0d:0e:0f/a:b:c:d:e:f/g | grep -v "^Bridge" | grep -v "^$" -p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT --p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/22 --ip6-dst ::10.1.0.0/113 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT -p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT #ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" -p 0x1234 -j ACCEPT diff --git a/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall index 56d3956..0cd9a8d 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall @@ -2,9 +2,9 @@ -i vnet0 -j libvirt-I-vnet0 #ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" -o vnet0 -j libvirt-O-vnet0 -#ebtables -t nat -L libvirt-I-vnet0 | sed s/01:02:03:04:05:06/1:2:3:4:5:6/g | sed s/0a:0b:0c:0d:0e:0f/a:b:c:d:e:f/g | grep -v "^Bridge" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 | sed 's#/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000#/113#g' | sed 's#/ffff:fc00::#/22#g' | sed s/01:02:03:04:05:06/1:2:3:4:5:6/g | sed s/0a:0b:0c:0d:0e:0f/a:b:c:d:e:f/g | grep -v "^Bridge" | grep -v "^$" -p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT --p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/22 --ip6-dst ::10.1.0.0/113 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT -p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT #ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" -p 0x1234 -j ACCEPT diff --git a/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall index 7d42f9a..d4dc627 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall @@ -2,12 +2,12 @@ -i vnet0 -j libvirt-I-vnet0 #ebtables -t nat -L POSTROUTING | grep vnet0 -o vnet0 -j libvirt-O-vnet0 -#ebtables -t nat -L libvirt-I-vnet0 | sed s/01:02:03:04:05:06/1:2:3:4:5:6/g | grep -v "^Bridge" | grep -v "^$" --p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT --p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT --p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT --p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT -#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" --p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT --p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT --p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-I-vnet0 | sed 's#/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff##g' | sed 's#/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000#/113#g' | sed 's#/ffff:ffff:ffff:ffff:8000::#/65#g' | sed 's#/ffff:fc00::#/22#g' | sed s/01:02:03:04:05:06/1:2:3:4:5:6/g | grep -v "^Bridge" | grep -v "^$" +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/22 --ip6-dst ::10.1.0.0/113 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/65 --ip6-dst 1::2 --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/65 --ip6-dst 1::2 --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/65 --ip6-dst 1::2 --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | sed 's#/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff##g' | sed 's#/ffff:ffff:ffff:ffff:8000::#/65#g' | grep -v "^Bridge" | grep -v "^$" +-p IPv6 --ip6-src 1::2 --ip6-dst a:b:c::/65 --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2 --ip6-dst a:b:c::/65 --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2 --ip6-dst a:b:c::/65 --ip6-proto mux -j ACCEPT -- 2.20.1

2 3