- Devel - libvirt List Archives

[libvirt] [PATCH v9 00/17] Add support for TPM emulator
by Stefan Berger 07 Jun '18

07 Jun '18

This series of patches adds support for the TPM emulator backend that is available in QEMU and based on swtpm + libtpms. It allows to attach a TPM 1.2 or 2.0 to a QEMU VM. sVirt labels are used for labeling the swtpm process, its Unix socket, and log file with the same label that the QEMU process gets. Besides that swtpm is added to the emulator cgroup to restrict its CPU usage. The device XML can be changed from a TPM 1.2 to a TPM 2.0 and back to a TPM 1.2. The device state is not removed during those changes but only when the domain is undefined. The swtpm needs persistent storage to store its state. For that I am using the uuid of the VM as part of the path since the name of the VM can be changed. Logfiles, PID files, and socket names are based on the name of the VM, though. Stefan v8->v9: - changed TPM 2 to 2.0 and version='2' in XML to version='2.0' - squashed v8 15/18 patch into v9 10/17. - Followed Ján Tomko's suggestions - updated AppArmor related patch v7->v8: - Delaying this series for 4.5; adjusted references to 4.4 - Fixed a test case since version='1.2' is now formatted as well - Appended patches for AppArmor and auditing - Appended patches that improve / fix existing code - patch for validating the TPM configuration rather than overwriting it; a particular case is the CRB interface does not work with a TPM 1.2 - swtpm_setup can be run for a TPM 2 in unprivileged mode as well v6->v7: - followed Jan Tomko's suggestion with resulting changing to patch 10/12. - re-added missing parts related to swtpm_setup and TPM that got lost in v4 v5->v6: - Addressed John Ferlan's comments - rebased on latest tip - Added patch 12. v4->v5: - Addressed John Ferlan's, Boris Fiuczysnki's and Marc Hartmayer's comments - rebased on latest tip v3->v4: - Addressed John Ferlan's comments - Fixed bugs I found while testing - rebased on latest tip Stefan Berger (17): conf: Add support for external swtpm TPM emulator to domain XML qemu: Extend QEMU capabilities with 'tpm-emulator' util: Implement virFileChownFiles() security: Add DAC and SELinux security for tpm-emulator qemu: Extend qemu_conf with tpm-emulator support qemu: Extend QEMU with external TPM support qemu: Add support for external swtpm TPM emulator tests: Add test cases for external swtpm TPM emulator security: Label the external swtpm with SELinux labels conf: Add support for choosing emulation of a TPM 2.0 qemu: Add swtpm to emulator cgroup news: Update news with new TPM emulator feature security: Add swtpm paths to the domain's AppArmor profile qemu: Run swtpm_setup in unprivileged mode for a TPM 2.0 conf: Audit TPM emulator device at domain startup conf: Use resrc=tpm in case of TPM passthrough following docs conf: Use virDomainChrSourceDefClear() rather than VIR_FREE() docs/auditlog.html.in | 2 +- docs/formatdomain.html.in | 47 +- docs/news.xml | 13 + docs/schemas/domaincommon.rng | 17 + examples/apparmor/libvirt-qemu | 3 + libvirt.spec.in | 2 + src/conf/domain_audit.c | 20 +- src/conf/domain_conf.c | 56 +- src/conf/domain_conf.h | 16 + src/libvirt_private.syms | 3 + src/qemu/Makefile.inc.am | 10 + src/qemu/libvirtd_qemu.aug | 5 + src/qemu/qemu.conf | 8 + src/qemu/qemu_capabilities.c | 5 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 36 + src/qemu/qemu_cgroup.h | 2 + src/qemu/qemu_command.c | 34 +- src/qemu/qemu_conf.c | 43 + src/qemu/qemu_conf.h | 6 + src/qemu/qemu_domain.c | 36 +- src/qemu/qemu_extdevice.c | 180 ++++ src/qemu/qemu_extdevice.h | 59 ++ src/qemu/qemu_process.c | 16 + src/qemu/qemu_security.c | 69 ++ src/qemu/qemu_security.h | 11 + src/qemu/qemu_tpm.c | 925 +++++++++++++++++++++ src/qemu/qemu_tpm.h | 56 ++ src/qemu/test_libvirtd_qemu.aug.in | 2 + src/security/security_dac.c | 7 + src/security/security_driver.h | 7 + src/security/security_manager.c | 36 + src/security/security_manager.h | 6 + src/security/security_selinux.c | 172 ++++ src/security/security_stack.c | 40 + src/security/virt-aa-helper.c | 45 + src/util/virfile.c | 55 ++ src/util/virfile.h | 3 + tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 + .../tpm-emulator-tpm2.x86_64-latest.args | 33 + tests/qemuxml2argvdata/tpm-emulator-tpm2.xml | 30 + .../tpm-emulator.x86_64-latest.args | 33 + tests/qemuxml2argvdata/tpm-emulator.xml | 30 + tests/qemuxml2argvtest.c | 16 +- tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml | 34 + tests/qemuxml2xmloutdata/tpm-emulator.xml | 34 + tests/qemuxml2xmltest.c | 1 + 51 files changed, 2251 insertions(+), 19 deletions(-) create mode 100644 src/qemu/qemu_extdevice.c create mode 100644 src/qemu/qemu_extdevice.h create mode 100644 src/qemu/qemu_tpm.c create mode 100644 src/qemu/qemu_tpm.h create mode 100644 tests/qemuxml2argvdata/tpm-emulator-tpm2.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/tpm-emulator-tpm2.xml create mode 100644 tests/qemuxml2argvdata/tpm-emulator.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/tpm-emulator.xml create mode 100644 tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml create mode 100644 tests/qemuxml2xmloutdata/tpm-emulator.xml -- 2.14.3

1 19

[libvirt] [PATCH 0/4] travis: Various cleanups
by Andrea Bolognani 07 Jun '18

07 Jun '18

Just getting rid of some useless stuff and making the whole thing simpler and more consistent. Andrea Bolognani (4): travis: Skip macOS upgrade travis: Don't duplicate Docker invocation travis: Introduce MACOS_CMD travis: Rename DOCKER_CMD to LINUX_CMD .travis.yml | 65 ++++++++++++++++++++++++----------------------------- 1 file changed, 29 insertions(+), 36 deletions(-) -- 2.17.1

1 4

[libvirt] [PATCH] docs: remove git snapshot download links
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

The process used to build the snapshots no longer works because the box it runs on is outdated. Analysing the web logs shows the majority of traffic to these links is from search engine bots. With those removed, there is about 1 hit per day from (probable) humans. Most users needing a tarball are better served by using official releases. Those needing latest code are better served by using git checkout. The tarball snapshots are not compelling enough to invest time in fixing the script that produces them. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NB when pushing this, I would delete the existing files from the download location so we aren't left with stale files, and disable the (now broken) cronjob. docs/downloads.html.in | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/docs/downloads.html.in b/docs/downloads.html.in index 2956a4f60e..657cd6a6f8 100644 --- a/docs/downloads.html.in +++ b/docs/downloads.html.in @@ -433,21 +433,6 @@ <li><a href="https://libvirt.org/sources/">libvirt.org HTTPS server</a></li> </ul> - <h2><a id="hourly">Hourly development snapshots</a></h2> - - <p> - Once an hour, an automated snapshot is made from the git server - source tree. These snapshots should be usable, but we make no guarantees - about their stability; furthermore, they should NOT be - considered formal releases, and they may have transient security - problems that will not be assigned a CVE. - </p> - - <ul> - <li><a href="ftp://libvirt.org/libvirt/libvirt-git-snapshot.tar.xz">libvirt.org FTP server</a></li> - <li><a href="https://libvirt.org/sources/libvirt-git-snapshot.tar.xz">libvirt.org HTTP server</a></li> - </ul> - <h2><a id="schedule">Primary release schedule</a></h2> <p> -- 2.17.0

2 1

[libvirt] [PATCH] travis: Whitespace fixes
by Andrea Bolognani 07 Jun '18

07 Jun '18

Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- Pushed as embarrassingly trivial. .travis.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 771cd93604..ac0d48a606 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,7 +3,7 @@ language: generic branches: except: - - /^.*-maint$/ + - /^.*-maint$/ matrix: include: @@ -59,7 +59,6 @@ matrix: - find -name test-suite.log | xargs cat - echo '=== LOG FILE(S) END ===' - git: submodules: true -- 2.17.1

1 0

[libvirt] [PATCH v3] travis: switch to using Ubuntu 16.04 and 18.04
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

The container images provided by Travis only support Ubuntu 14.04, however, Travis has ability to run docker, which allows the build script to use arbitrary OS images. This takes advantage of that to convert the build over to Ubuntu 16.04 and 18.04 This is using the official Ubuntu provided images and installing extra build deps required, as we previously did with Travis container images. With the switch to Docker though, this can be improved, by building custom Docker images with all the deps pre-installed which will cut down build time. This can be driven from the package lists in libvirt-jenkins-ci repo, to remove the duplication. This work for future improvement though, this just does the minimal conversion to match what we already do, but with newer distro. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- .travis.yml | 214 +++++++++++++++++++++++++++++----------------------- 1 file changed, 118 insertions(+), 96 deletions(-) diff --git a/.travis.yml b/.travis.yml index c71411dcae..771cd93604 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,5 @@ -sudo: false -language: c -cache: ccache +sudo: required +language: generic branches: except: @@ -8,17 +7,38 @@ branches: matrix: include: - - compiler: gcc - dist: trusty + - services: + - docker env: - - PYTHON=$(which python2) - - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" - - compiler: clang - dist: trusty - env: - - PYTHON=$(which python3) + - IMAGE=ubuntu:18.04 - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=systemd" + script: + - docker run + --privileged + -v $(pwd):/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_CONFIGURE_FLAGS="$DISTCHECK_CONFIGURE_FLAGS" + "$IMAGE" + /bin/sh -xc "$DOCKER_CMD" + - services: + - docker + env: + - IMAGE=ubuntu:16.04 + - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" + script: + - docker run + --privileged + -v $(pwd):/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_CONFIGURE_FLAGS="$DISTCHECK_CONFIGURE_FLAGS" + "$IMAGE" + /bin/sh -xc "$DOCKER_CMD" - compiler: clang + language: c os: osx env: - PATH="/usr/local/opt/gettext/bin:/usr/local/opt/ccache/libexec:/usr/local/opt/rpcgen/bin:$PATH" @@ -27,80 +47,18 @@ matrix: - brew update - brew upgrade - brew install python ccache rpcgen yajl + before_script: + - ./autogen.sh --prefix=$(pwd)/install-root script: # We can't run make distcheck/syntax-check because they # fail on macOS, but doing 'install' and 'dist' gives us # some useful coverage - make -j3 && make -j3 install && make -j3 dist + after_failure: + - echo '=== LOG FILE(S) START ===' + - find -name test-suite.log | xargs cat + - echo '=== LOG FILE(S) END ===' -addons: - apt: - # Please keep this list sorted alphabetically - packages: - - augeas-tools - - autoconf - - automake - - autopoint - - bash-completion - - ccache - - dnsmasq-base - - dwarves - - ebtables - - gcc - - gettext - - glusterfs-client - - libacl1-dev - - libapparmor-dev - - libattr1-dev - - libaudit-dev - - libavahi-client-dev - - libblkid-dev - - libc6-dev - - libcap-ng-dev - - libc-dev-bin - - libcurl4-gnutls-dev - - libdbus-1-dev - - libdevmapper-dev - - libfuse-dev - - libgnutls-dev - - libnetcf-dev - - libnl-3-dev - - libnl-route-3-dev - - libnuma-dev - - libopenwsman-dev - - libparted-dev - - libpcap-dev - - libpciaccess-dev - - librbd-dev - - libreadline-dev - - libsanlock-dev - - libsasl2-dev - - libselinux1-dev - - libssh2-1-dev - - libssh-dev - - libtirpc-dev - - libtool - - libudev-dev - - libxen-dev - - libxml2-dev - - libxml2-utils - - libyajl-dev - - lvm2 - - make -# - nfs-common # broken on trusty since build #807 (2018-01-09) - - open-iscsi - - parted - - patch - - perl - - pkgconf - - policykit-1 - - qemu-utils - - radvd - - scrub - - sheepdog - - systemtap-sdt-dev - - xsltproc - - zfs-fuse git: submodules: true @@ -108,23 +66,87 @@ git: env: global: - VIR_TEST_DEBUG=1 - -before_script: - - ./autogen.sh --prefix=$(pwd)/install-root - -script: - - make -j3 && make -j3 syntax-check && make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=$DISTCHECK_CONFIGURE_FLAGS - -after_failure: - - echo '============================================================================' - - 'ver=$(sed -n "s/AC_INIT(\[libvirt\], \[$[0-9.]*$\],.*/\1/p" configure.ac); - if [ -f $(pwd)/tests/test-suite.log ]; then - cat $(pwd)/tests/test-suite.log; - elif [ -f libvirt-$ver/_build/tests/test-suite.log ]; then - cat libvirt-$ver/_build/tests/test-suite.log; - else - echo "=== NO LOG FILE FOUND ==="; - fi' + - DOCKER_CMD=" + apt-get update && + apt-get install -y \$PACKAGES && + ./autogen.sh && + make -j3 && + make -j3 syntax-check && + make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=\"\$DISTCHECK_CONFIGURE_FLAGS\" || + ( + echo '=== LOG FILE(S) START ===' + find -name test-suite.log | xargs cat + echo '=== LOG FILE(S) END ===' + exit 1 + ) + " + # Please keep this list sorted alphabetically + - PACKAGES=" + augeas-tools + autoconf + automake + autopoint + bash-completion + ccache + dnsmasq-base + dwarves + ebtables + gcc + gettext + git + glusterfs-client + libacl1-dev + libapparmor-dev + libattr1-dev + libaudit-dev + libavahi-client-dev + libblkid-dev + libc6-dev + libcap-ng-dev + libc-dev-bin + libdbus-1-dev + libdevmapper-dev + libfuse-dev + libgnutls28-dev + libnetcf-dev + libnl-3-dev + libnl-route-3-dev + libnuma-dev + libopenwsman-dev + libparted-dev + libpcap-dev + libpciaccess-dev + librbd-dev + libreadline-dev + libsanlock-dev + libsasl2-dev + libselinux1-dev + libssh2-1-dev + libssh-dev + libtirpc-dev + libtool + libudev-dev + libxen-dev + libxml2-dev + libxml2-utils + libyajl-dev + lvm2 + make + nfs-common + open-iscsi + parted + patch + perl + pkgconf + policykit-1 + qemu-utils + radvd + scrub + sheepdog + systemtap-sdt-dev + xsltproc + zfs-fuse + " notifications: irc: -- 2.17.0

2 2

[libvirt] [PATCH] util: Implement and use virFileIsRegular() rather than d_type
by Stefan Berger 07 Jun '18

07 Jun '18

The dirent's d_type field is not portable to all platforms. So we have to use stat() to determine the type of file for the functions that need to be cross-platform. Fix virFileChownFiles() by calling the new virFileIsRegular() function. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/libvirt_private.syms | 1 + src/util/virfile.c | 17 +++++++++++++---- src/util/virfile.h | 1 + 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 43bbdef8f1..b4ab1f3629 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1796,6 +1796,7 @@ virFileIsDir; virFileIsExecutable; virFileIsLink; virFileIsMountPoint; +virFileIsRegular; virFileIsSharedFS; virFileIsSharedFSType; virFileLength; diff --git a/src/util/virfile.c b/src/util/virfile.c index e41881f6c9..12b41a64e0 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -1851,6 +1851,15 @@ virFileIsDir(const char *path) return (stat(path, &s) == 0) && S_ISDIR(s.st_mode); } + +bool +virFileIsRegular(const char *path) +{ + struct stat s; + return (stat(path, &s) == 0) && S_ISREG(s.st_mode); +} + + /** * virFileExists: Check for presence of file * @path: Path of file to check @@ -3005,12 +3014,13 @@ int virFileChownFiles(const char *name, return -1; while ((direrr = virDirRead(dir, &ent, name)) > 0) { - if (ent->d_type != DT_REG) - continue; - + VIR_FREE(path); if (virAsprintf(&path, "%s/%s", name, ent->d_name) < 0) goto cleanup; + if (!virFileIsRegular(path)) + continue; + if (chown(path, uid, gid) < 0) { virReportSystemError(errno, _("cannot chown '%s' to (%u, %u)"), @@ -3018,7 +3028,6 @@ int virFileChownFiles(const char *name, (unsigned int) gid); goto cleanup; } - VIR_FREE(path); } if (direrr < 0) diff --git a/src/util/virfile.h b/src/util/virfile.h index c7a32c30a8..59c14b97a6 100644 --- a/src/util/virfile.h +++ b/src/util/virfile.h @@ -194,6 +194,7 @@ off_t virFileLength(const char *path, int fd) ATTRIBUTE_NONNULL(1); bool virFileIsDir (const char *file) ATTRIBUTE_NONNULL(1); bool virFileExists(const char *file) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NOINLINE; bool virFileIsExecutable(const char *file) ATTRIBUTE_NONNULL(1); +bool virFileIsRegular(const char *file) ATTRIBUTE_NONNULL(1); enum { VIR_FILE_SHFS_NFS = (1 << 0), -- 2.14.4

3 4

[libvirt] [PATCH] qemu_tpm: Drop needles include of cap-ng.h
by Michal Privoznik 07 Jun '18

07 Jun '18

qemu_tpm.c is not calling any capng_* functions. Let's drop this include then. This also fixes a build failure without capng. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Pushed under build breaker and trivial rules. src/qemu/qemu_tpm.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 2349fa92d9..278b262c48 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -25,7 +25,6 @@ #include <sys/types.h> #include <unistd.h> #include <fcntl.h> -#include <cap-ng.h> #include "qemu_extdevice.h" #include "qemu_domain.h" -- 2.16.4

1 1

[libvirt] Mystery of qemu being unable to open NBD Unix domain socket in current directory
by Richard W.M. Jones 07 Jun '18

07 Jun '18

I'm chasing down a very frustrating bug which only happens on i686 & Koji during the nbdkit tests and seemingly nowhere else. Anyway this is what I've been able to put together: The libguestfs appliance (guest) is created with this XML snippet: <disk device="disk" type="network"> <source protocol="nbd"> <host transport="unix" socket="cow.sock"/> </source> <target dev="sda" bus="scsi"/> <driver name="qemu" type="raw" cache="writeback"/> <address type="drive" controller="0" bus="0" target="0" unit="0"/> </disk> It fails to start with the error: internal error: process exited while connecting to monitor: 2018-06-06T17:02:54.450507Z qemu-system-i386: -drive file=nbd+unix://?socket=cow.sock,format=raw,if=none,id=drive-scsi0-0-0-0,cache=writeback: Failed to connect socket cow.sock: No such file or directory [code=1 int1=-1] The socket definitely exists in the directory of the program running libvirt. I verified that by adding ls -l commands to the build: srwxr-xr-x. 1 mockbuild mockbuild 0 Jun 6 17:02 cow.sock Permissions on the containing directories are fine (the whole lot is running as mockbuild): + pwd /builddir/build/BUILD/nbdkit-1.3.1/tests + ls -ld /builddir drwx------. 5 mockbuild mockbuild 4096 Jun 6 17:00 /builddir + ls -ld /builddir/build drwxr-xr-x. 9 mockbuild mockbuild 4096 Jun 6 16:57 /builddir/build + ls -ld /builddir/build/BUILD drwxrwxr-x. 3 mockbuild 1000 4096 Jun 6 16:59 /builddir/build/BUILD + ls -ld /builddir/build/BUILD/nbdkit-1.3.1 drwxr-xr-x. 11 mockbuild mockbuild 4096 Jun 6 17:00 /builddir/build/BUILD/nbdkit-1.3.1 + ls -ld /builddir/build/BUILD/nbdkit-1.3.1/tests drwxr-xr-x. 4 mockbuild mockbuild 4096 Jun 6 17:02 /builddir/build/BUILD/nbdkit-1.3.1/tests The qemu log doesn't give any clues: 2018-06-06 17:02:54.412+0000: starting up libvirt version: 4.4.0, package: 1.fc29 (Fedora Project, 2018-06-05-11:53:38, buildvm-12.phx2.fedoraproject.org) qemu version: 2.12.0qemu-2.12.0-2.fc29, kernel: 4.16.8-300.fc28.x86_64, hostname: buildhw-10.phx2.fedoraproject.org LC_ALL=C PATH=/builddir/build/BUILD/nbdkit-1.3.1:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin HOME=/builddir USER=mockbuild LOGNAME=mockbuild QEMU_AUDIO_DRV=none TMPDIR=/var/tmp /usr/bin/qemu-system-i386 -name guest=guestfs-62ak9dzrjxfoctua,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/builddir/.config/libvirt/qemu/lib/domain-3-guestfs-62ak9dzrjxfo/master-key.aes -machine pc-i440fx-2.12,accel=tcg,usb=off,dump-guest-core=off -m 500 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 -uuid 6094da49-2def-4256-b901-e4fe5f1409c8 -display none -no-user-config -nodefaults -device sga -chardev socket,id=charmonitor,path=/builddir/.config/libvirt/qemu/lib/domain-3-guestfs-62ak9dzrjxfo/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-hpet -no-reboot -no-acpi -boot strict=on -kernel /var/tmp/.guestfs-1000/appliance.d/kernel -initrd /var/tmp/.guestfs-1000/appliance.d/initrd -append 'panic=1 noapic console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=vt100' -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x3 -drive 'file=nbd+unix://?socket=cow.sock,format=raw,if=none,id=drive-scsi0-0-0-0,cache=writeback' -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1,write-cache=on -drive file=/tmp/libguestfsprC4lc/overlay1.qcow2,format=qcow2,if=none,id=drive-scsi0-0-1-0,cache=unsafe -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=1,lun=0,drive=drive-scsi0-0-1-0,id=scsi0-0-1-0,write-cache=on -chardev socket,id=charserial0,path=/tmp/libguestfsj35K6W/console.sock -device isa-serial,chardev=charserial0,id=serial0 -chardev socket,id=charchannel0,path=/tmp/libguestfsj35K6W/guestfsd.sock -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=org.libguestfs.channel.0 -object rng-random,id=objrng0,filename=/dev/urandom -device virtio-rng-pci,rng=objrng0,id=rng0,bus=pci.0,addr=0x4 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny -msg timestamp=on 2018-06-06 17:02:54.412+0000: Domain id=3 is tainted: custom-argv 2018-06-06T17:02:54.450507Z qemu-system-i386: -drive file=nbd+unix://?socket=cow.sock,format=raw,if=none,id=drive-scsi0-0-0-0,cache=writeback: Failed to connect socket cow.sock: No such file or directory 2018-06-06 17:02:54.453+0000: shutting down, reason=failed At this point I don't really have any ideas. Does libvirt now run qemu in a different directory? Does the error message mean something else apart from the file not existing? Also the nbd+unix syntax doesn't appear to be documented in qemu. Is this a new thing? Normally we use nbd:unix:... Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-p2v converts physical machines to virtual machines. Boot with a live CD or over the network (PXE) and turn machines into KVM guests. http://libguestfs.org/virt-v2v

3 5

Re: [libvirt] [PATCH v9 06/17] qemu: Extend QEMU with external TPM support
by bushuanshuan 07 Jun '18

07 Jun '18

... > +static int > +qemuExtTPMStartEmulator(virQEMUDriverPtr driver, > + virDomainDefPtr def, > + qemuDomainLogContextPtr logCtxt) > +{ ... > + if (!(cmd = qemuTPMEmulatorBuildCommand(tpm, def->name, def->uuid, > + driver->privileged, > + cfg->swtpm_user, > + cfg->swtpm_group))) > + goto cleanup; > + > + if (qemuExtDeviceLogCommand(logCtxt, cmd, "TPM Emulator") < 0) > + goto cleanup; > + > + virCommandSetErrorBuffer(cmd, &errbuf); > + > + if (virCommandRun(cmd, &exitstatus) < 0 || exitstatus != 0) { > + virReportError(VIR_ERR_INTERNAL_ERROR, > + _("Could not start 'swtpm'. exitstatus: %d, " > + "error: %s"), exitstatus, errbuf); > + goto cleanup; > + } Now that the sensitive data in NVRAM need to be protected, it might be a feasible way that swtpm uses the 'key' to encrypt it when VM shutdown. I wonder why don't use the key when swtpm process is launched here. Of course, we should avoid to let the key exposed in system log when we design the encryption scheme. Another question is: where we can store the key securely. Maybe physical TPM can help this. What do you think about this question? ... Thanks, Shuanshuan Bu

2 1

[libvirt] [PATCH] travis: switch to using Ubuntu 16.04 and 18.04
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

The container images provided by Travis only support Ubuntu 14.04, however, Travis has ability to run docker, which allows the build script to use arbitrary OS images. This takes advantage of that to convert the build over to Ubuntu 16.04 and 18.04 This is using the official Ubuntu provided images and installing extra build deps required, as we previously did with Travis container images. With the switch to Docker though, this can be improved, by building custom Docker images with all the deps pre-installed which will cut down build time. This can be driven from the package lists in libvirt-jenkins-ci repo, to remove the duplication. This work for future improvement though, this just does the minimal conversion to match what we already do, but with newer distro. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- .travis.yml | 212 ++++++++++++++++++++++++++++------------------------ 1 file changed, 116 insertions(+), 96 deletions(-) diff --git a/.travis.yml b/.travis.yml index c71411dcae..15b5e933e9 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,5 @@ -sudo: false -language: c -cache: ccache +sudo: required +language: generic branches: except: @@ -8,17 +7,38 @@ branches: matrix: include: - - compiler: gcc - dist: trusty + - services: + - docker env: - - PYTHON=$(which python2) - - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" - - compiler: clang - dist: trusty + - DISTCHECK_FLAGS="--with-init-script=upstart" + before_install: + - docker pull berrange/test + - docker run + --privileged + -v `pwd`:/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_FLAGS="$DISTCHECK_FLAGS" + ubuntu:18.04 + /bin/sh -c "$DOCKER_CMD" + - services: + - docker env: - - PYTHON=$(which python3) - - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=systemd" + - DISTCHECK_FLAGS="--with-init-script=upstart" + before_install: + - docker pull berrange/test + - docker run + --privileged + -v `pwd`:/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_FLAGS="$DISTCHECK_FLAGS" + ubuntu:16.04 + /bin/sh -c "$DOCKER_CMD" - compiler: clang + language: c os: osx env: - PATH="/usr/local/opt/gettext/bin:/usr/local/opt/ccache/libexec:/usr/local/opt/rpcgen/bin:$PATH" @@ -27,80 +47,18 @@ matrix: - brew update - brew upgrade - brew install python ccache rpcgen yajl + before_script: + - ./autogen.sh --prefix=$(pwd)/install-root script: # We can't run make distcheck/syntax-check because they # fail on macOS, but doing 'install' and 'dist' gives us # some useful coverage - make -j3 && make -j3 install && make -j3 dist + after_failure: + - echo '=== LOG FILE(S) START ===' + - find -name test-suite.log | xargs cat + - echo '=== LOG FILE(S) END ===' -addons: - apt: - # Please keep this list sorted alphabetically - packages: - - augeas-tools - - autoconf - - automake - - autopoint - - bash-completion - - ccache - - dnsmasq-base - - dwarves - - ebtables - - gcc - - gettext - - glusterfs-client - - libacl1-dev - - libapparmor-dev - - libattr1-dev - - libaudit-dev - - libavahi-client-dev - - libblkid-dev - - libc6-dev - - libcap-ng-dev - - libc-dev-bin - - libcurl4-gnutls-dev - - libdbus-1-dev - - libdevmapper-dev - - libfuse-dev - - libgnutls-dev - - libnetcf-dev - - libnl-3-dev - - libnl-route-3-dev - - libnuma-dev - - libopenwsman-dev - - libparted-dev - - libpcap-dev - - libpciaccess-dev - - librbd-dev - - libreadline-dev - - libsanlock-dev - - libsasl2-dev - - libselinux1-dev - - libssh2-1-dev - - libssh-dev - - libtirpc-dev - - libtool - - libudev-dev - - libxen-dev - - libxml2-dev - - libxml2-utils - - libyajl-dev - - lvm2 - - make -# - nfs-common # broken on trusty since build #807 (2018-01-09) - - open-iscsi - - parted - - patch - - perl - - pkgconf - - policykit-1 - - qemu-utils - - radvd - - scrub - - sheepdog - - systemtap-sdt-dev - - xsltproc - - zfs-fuse git: submodules: true @@ -108,23 +66,85 @@ git: env: global: - VIR_TEST_DEBUG=1 - -before_script: - - ./autogen.sh --prefix=$(pwd)/install-root - -script: - - make -j3 && make -j3 syntax-check && make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=$DISTCHECK_CONFIGURE_FLAGS - -after_failure: - - echo '============================================================================' - - 'ver=$(sed -n "s/AC_INIT(\[libvirt\], \[$[0-9.]*$\],.*/\1/p" configure.ac); - if [ -f $(pwd)/tests/test-suite.log ]; then - cat $(pwd)/tests/test-suite.log; - elif [ -f libvirt-$ver/_build/tests/test-suite.log ]; then - cat libvirt-$ver/_build/tests/test-suite.log; - else - echo "=== NO LOG FILE FOUND ==="; - fi' + - DOCKER_CMD=" + apt-get update && + apt-get install -y \$PACKAGES && + ./autogen.sh --prefix=/build/install-root && + make -j 3 && + make -j 3 syntax-check && + make -j 3 distcheck DISTCHECK_CONFIGURE_FLAGS=\$DISTCHECK_FLAGS || + ( + echo '=== LOG FILE(S) START ===' + find -name test-suite.log | xargs cat + echo '=== LOG FILE(S) END ===' + exit 1 + ) + " + - PACKAGES=" + augeas-tools + autoconf + automake + autopoint + bash-completion + ccache + dnsmasq-base + dwarves + ebtables + gcc + gettext + git + glusterfs-client + libacl1-dev + libapparmor-dev + libattr1-dev + libaudit-dev + libavahi-client-dev + libblkid-dev + libc6-dev + libcap-ng-dev + libc-dev-bin + libdbus-1-dev + libdevmapper-dev + libfuse-dev + libgnutls28-dev + libnetcf-dev + libnl-3-dev + libnl-route-3-dev + libnuma-dev + libopenwsman-dev + libparted-dev + libpcap-dev + libpciaccess-dev + librbd-dev + libreadline-dev + libsanlock-dev + libsasl2-dev + libselinux1-dev + libssh2-1-dev + libssh-dev + libtirpc-dev + libtool + libudev-dev + libxen-dev + libxml2-dev + libxml2-utils + libyajl-dev + lvm2 + make + nfs-common + open-iscsi + parted + patch + perl + pkgconf + policykit-1 + qemu-utils + radvd + scrub + sheepdog + systemtap-sdt-dev + xsltproc + zfs-fuse" notifications: irc: -- 2.17.0

3 6