- Devel - libvirt List Archives

[libvirt] [PATCH] AppArmor: Allow libvirtd to kill unconfined processes
by intrigeri+libvirt＠boum.org 17 Jan '18

17 Jan '18

From: intrigeri <intrigeri+libvirt(a)boum.org> On startup libvirtd runs a number of QEMU processes unconfined such as: /usr/bin/qemu-system-x86_64 -S -no-user-config -nodefaults -nographic -machine none,accel=kvm:tcg -qmp unix:/var/lib/libvirt/qemu/capabilities.monitor.sock,server,nowait -pidfile /var/lib/libvirt/qemu/capabilities.pidfile -daemonize libvirtd needs to be allowed to kill these processes, otherwise they remain running. --- examples/apparmor/usr.sbin.libvirtd | 1 + 1 file changed, 1 insertion(+) diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index a1083b0410..0ddec3f6e2 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -63,6 +63,7 @@ signal (send) peer=/usr/sbin/dnsmasq, signal (read, send) peer=libvirt-*, + signal (send) set=("kill") peer=unconfined, # Very lenient profile for libvirtd since we want to first focus on confining # the guests. Guests will have a very restricted profile. -- 2.15.1

4 3

[libvirt] [PATCH libvirt] qemu: Fix segmentation fault when attaching a non iSCSI host device
by Marc Hartmayer 17 Jan '18

17 Jan '18

Add a check if it's a iSCSI hostdev and if it's not then don't use the union member 'iscsi'. The segmentation fault occured when accessing secinfo->type, but this can vary from case to case. Signed-off-by: Marc Hartmayer <mhartmay(a)linux.vnet.ibm.com> Reviewed-by: Bjoern Walk <bwalk(a)linux.vnet.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy(a)linux.vnet.ibm.com> --- src/qemu/qemu_hotplug.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 6dc16a1054af..83d0e1c71a8e 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -2343,8 +2343,7 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn, bool secobjAdded = false; virJSONValuePtr secobjProps = NULL; virDomainHostdevSubsysSCSIPtr scsisrc = &hostdev->source.subsys.u.scsi; - virDomainHostdevSubsysSCSIiSCSIPtr iscsisrc = &scsisrc->u.iscsi; - qemuDomainStorageSourcePrivatePtr srcPriv; + qemuDomainStorageSourcePrivatePtr srcPriv = NULL; qemuDomainSecretInfoPtr secinfo = NULL; if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE_SCSI_GENERIC)) { @@ -2386,7 +2385,8 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn, if (qemuDomainSecretHostdevPrepare(conn, priv, hostdev) < 0) goto cleanup; - srcPriv = QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(iscsisrc->src); + if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) + srcPriv = QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(scsisrc->u.iscsi.src); if (srcPriv) secinfo = srcPriv->secinfo; if (secinfo && secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES) { -- 2.13.4

2 2

[libvirt] [PATCH] remove bogus casts of arg to g_object_ref
by Daniel P. Berrange 17 Jan '18

17 Jan '18

Latest version of glib uses typeof() magic to cast the return value of g_object_ref to match its argument, instead of returning a 'void *'. A few places in the code were casting the arg to G_OBJECT() which was then incompatible with the variable we assigned the result to. The parameter casts were always redundant so just remove them. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- libvirt-gconfig/libvirt-gconfig-object.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libvirt-gconfig/libvirt-gconfig-object.c b/libvirt-gconfig/libvirt-gconfig-object.c index 851e35c..ca2c6e6 100644 --- a/libvirt-gconfig/libvirt-gconfig-object.c +++ b/libvirt-gconfig/libvirt-gconfig-object.c @@ -572,7 +572,7 @@ gvir_config_object_set_node_content(GVirConfigObject *object, node = gvir_config_object_replace_child(object, node_name); g_return_if_fail(node != NULL); } else { - node = g_object_ref(G_OBJECT(object)); + node = g_object_ref(object); } encoded_data = xmlEncodeEntitiesReentrant(node->priv->node->doc, (xmlChar *)value); @@ -896,7 +896,7 @@ gvir_config_object_attach(GVirConfigObject *parent, GVirConfigObject *child, gbo child->priv->doc = NULL; } if (parent->priv->doc != NULL) { - child->priv->doc = g_object_ref(G_OBJECT(parent->priv->doc)); + child->priv->doc = g_object_ref(parent->priv->doc); } } -- 2.14.3

1 1

[libvirt] New GIT repos for libvirt wiki & virt tools planet
by Daniel P. Berrange 17 Jan '18

17 Jan '18

Hi Folks, Just let you all know that I've moved various libvirt related websites over to hosting on Red Hat's OpenShift v3 infrastructure. With the new v3 that is based on Kubernetes, I'm able to publish the GIT repos containing the core content & software setup. For wiki.libvirt.org: https://libvirt.org/git/?p=libvirt-wiki.git;a=summary For planet.virt-tools.org: https://libvirt.org/git/?p=virttools-planet.git;a=summary For www.virt-tools.org: https://libvirt.org/git/?p=virttools-web.git;a=summary These are setup to mirror to github, and with a github webhook installed. So if when changes to the *content*, it will get automatically deployed to the live site by OpenShift. NB, auto-deploy doesn't apply to the actual OpenShift configuration, only the static config. I still need to manualy deploy OpenShift config changes for security reasons :-) The key benefit here is that adding people to the blog aggregator on planet.virt-tools.org is now easier. Just send a patch for this file: https://libvirt.org/git/?p=virttools-planet.git;a=blob;f=updater/virt-tools… Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[libvirt] [PATCH] rpm: updates wrt min required fedora version
by Daniel P. Berrange 17 Jan '18

17 Jan '18

Update the min fedora to 25. Use a macro to record the min versions so that the later error message is always in sync with the earlier version check. Clarify the comment that refers to guessing of dist which does not actually happen. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- libvirt.spec.in | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 7e1b6a27d3..713961573a 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1,10 +1,12 @@ # -*- rpm-spec -*- # This spec file assumes you are building on a Fedora or RHEL version -# that's still supported by the vendor: that means Fedora 23 or newer, -# or RHEL 6 or newer. It may need some tweaks for other distros. -# If neither fedora nor rhel was defined, try to guess them from dist -%if (0%{?fedora} && 0%{?fedora} >= 23) || (0%{?rhel} && 0%{?rhel} >= 6) +# that's still supported by the vendor. It may work on other distros +# or versions, but no effort will be made to ensure that going forward. +%define min_rhel 6 +%define min_fedora 25 + +%if (0%{?fedora} && 0%{?fedora} >= %{min_fedora}) || (0%{?rhel} && 0%{?rhel} >= %{min_rhel}) %define supported_platform 1 %else %define supported_platform 0 @@ -1132,7 +1134,7 @@ rm -rf .git %build %if ! %{supported_platform} -echo "This RPM requires either Fedora >= 20 or RHEL >= 6" +echo "This RPM requires either Fedora >= %{min_fedora} or RHEL >= %{min_rhel}" exit 1 %endif -- 2.14.3

3 2

[libvirt] [PATCH] spec: enable bash completion only on new enough distros
by Pavel Hrdina 17 Jan '18

17 Jan '18

RHEL-6 doesn't have bash-completion package by default, it has to be installed from EPEL. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- libvirt.spec.in | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index d4ef116b2d..ef96888d09 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -87,6 +87,7 @@ %define with_libssh2 0%{!?_without_libssh2:0} %define with_wireshark 0%{!?_without_wireshark:0} %define with_libssh 0%{!?_without_libssh:0} +%define with_bash_completion 0%{!?_without_bash_completion:0} %define with_pm_utils 1 # Finally set the OS / architecture specific special cases @@ -190,6 +191,11 @@ %define with_libssh 0%{!?_without_libssh:1} %endif +# Enable bash-completion for new enough distros +%if 0%{?fedora} || 0%{?rhel} >= 7 + %define with_bash_completion 0%{!?_without_bash_completion:1} +%endif + %if %{with_qemu} || %{with_lxc} || %{with_uml} # numad is used to manage the CPU and memory placement dynamically, @@ -306,7 +312,9 @@ BuildRequires: xen-devel BuildRequires: libxml2-devel BuildRequires: libxslt BuildRequires: readline-devel +%if %{with_bash_completion} BuildRequires: bash-completion >= 2.0 +%endif BuildRequires: ncurses-devel BuildRequires: gettext BuildRequires: libtasn1-devel @@ -2048,7 +2056,9 @@ exit 0 %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp %{_datadir}/systemtap/tapset/libvirt_functions.stp +%if %{with_bash_completion} %{_datadir}/bash-completion/completions/vsh +%endif %if %{with_systemd} -- 2.14.3

2 1

[libvirt] [jenkins-ci PATCH] guests: install bash-completion when building libvirt
by Pavel Hrdina 17 Jan '18

17 Jan '18

Libvirt recently added bash-completion support. On CentOS6 the package is available only from EPEL repositories. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- guests/vars/mappings.yml | 4 ++++ guests/vars/projects/libvirt.yml | 1 + 2 files changed, 5 insertions(+) diff --git a/guests/vars/mappings.yml b/guests/vars/mappings.yml index e669b6c..440123c 100644 --- a/guests/vars/mappings.yml +++ b/guests/vars/mappings.yml @@ -53,6 +53,10 @@ mappings: pkg: avahi rpm: avahi-devel + bash-completion: + default: bash-completion + CentOS6: + ccache: default: ccache CentOS: diff --git a/guests/vars/projects/libvirt.yml b/guests/vars/projects/libvirt.yml index 598dfc4..9f027f8 100644 --- a/guests/vars/projects/libvirt.yml +++ b/guests/vars/projects/libvirt.yml @@ -3,6 +3,7 @@ packages: - apparmor - augeas - avahi + - bash-completion - cyrus-sasl - device-mapper - dnsmasq -- 2.14.3

2 1

[libvirt] Entering freeze for libvirt-4.0.0
by Daniel Veillard 17 Jan '18

17 Jan '18

Hi all, as planned I just tagged the Release Candidate 1 in git for 4.0.0, I also pushed signed tarball and rpms to the usual place: ftp://libvirt.org/libvirt/ No issue found in my limited testing, weirdly the CI says master is red for 4 days but it build just fine here so there has to be something on jenkins: https://ci.centos.org/view/libvirt/ Please give it a try, I will likely push an RC2 end of Monday, and then we can have the final release around Wed if everything looks fine. Feedback on other architectures and OSes always welcome :-) thanks ! Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

2 2

[libvirt] [PATCH 0/3] Couple of build fixes for readline stuff
by Michal Privoznik 16 Jan '18

16 Jan '18

After I've merged bash completion patches, couple of build problems emerged. Michal Privoznik (3): vsh: Mark cmdComplete arguments as unused tools: Always compile {virsh,virt-admin}-completer.c m4: Check for rl_completion_quote_character m4/virt-readline.m4 | 13 +++++++++++++ tools/Makefile.am | 20 ++------------------ tools/vsh.c | 3 ++- 3 files changed, 17 insertions(+), 19 deletions(-) -- 2.13.6

4 14

[libvirt] [PATCH] check/add for mdev_types capability
by Dan Zheng 16 Jan '18

16 Jan '18

>From be62ea5394d52fa168079edc3aa7e558363a3026 Mon Sep 17 00:00:00 2001 From: Dan Zheng <dzheng(a)redhat.com> Date: Tue, 16 Jan 2018 12:21:21 +0800 Subject: [PATCH] nodedev: check/add for mdev_types capability This is similar to commit f44ec9c1. Commit id '500cbc06' introduced a new nested capability element of type 'mdev_types' and the ability to use the flag as a way to search for a specific subset of a 'pci' device - namely a 'mdev_types'. The code modified the virNodeDeviceCapMatch whichs allows for searching using the 'virsh nodedev-list [cap]' via virConnectListAllNodeDevices. However, the original patches did not account for other searches for the same capability key from virNodeDeviceNumOfCaps and virNodeDeviceListCaps using nodeDeviceNumOfCaps and nodeDeviceListCaps. This patch adds the check for the 'mdev_types' bits within a 'pci' device and allows the following python code to find the capabilities for the device: import libvirt conn = libvirt.openReadOnly('qemu:///system') devs = conn.listAllDevices() for dev in devs: if 'mdev_types' in dev.listCaps(): print dev.name(),dev.numOfCaps(),dev.listCaps() Signed-off-by: Dan Zheng <dzheng(a)redhat.com> --- src/node_device/node_device_driver.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c index facfeb6..6216a69 100644 --- a/src/node_device/node_device_driver.c +++ b/src/node_device/node_device_driver.c @@ -382,6 +382,12 @@ nodeDeviceNumOfCaps(virNodeDevicePtr device) VIR_NODE_DEV_CAP_FLAG_HBA_VPORT_OPS) ncaps++; } + if (caps->data.type == VIR_NODE_DEV_CAP_PCI_DEV) { + if (caps->data.pci_dev.flags & + VIR_NODE_DEV_CAP_FLAG_PCI_MDEV) + ncaps++; + } + } ret = ncaps; @@ -432,6 +438,15 @@ nodeDeviceListCaps(virNodeDevicePtr device, goto cleanup; } } + if (caps->data.type == VIR_NODE_DEV_CAP_PCI_DEV) { + if (ncaps < maxnames && + caps->data.pci_dev.flags & + VIR_NODE_DEV_CAP_FLAG_PCI_MDEV) { + if (VIR_STRDUP(names[ncaps++], + virNodeDevCapTypeToString(VIR_NODE_DEV_CAP_MDEV_TYPES)) < 0) + goto cleanup; + } + } } ret = ncaps; -- 1.8.3.1 -- Best Regards, Dan Zheng(郑丹) Red Hat Software (Beijing) Co. 9/F, North Tower C, Raycom Infotech Park No.2 Ke Xueyuan Nanlu, Haidian District Beijing 100190

2 1