- Devel - libvirt List Archives

[libvirt] [PATCH 0/2] qemu: block: Unbreak node name detection
by Peter Krempa 25 Sep '17

25 Sep '17

I've messed up a refactor. See 2/2 for details. Peter Krempa (2): qemu: block: Don't lookup node names if they are already known qemu: block: Use correct alias when extracting disk node names src/qemu/qemu_block.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) -- 2.14.1

3 4

[libvirt] [PATCH go-xml] add VCPUs support in Domain
by zhenwei.pi 25 Sep '17

25 Sep '17

Signed-off-by: zhenwei.pi <zhenwei.pi(a)youruncloud.com> --- domain.go | 12 ++++++++++++ domain_test.go | 24 ++++++++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/domain.go b/domain.go index 3ab54a1..d81ac2a 100644 --- a/domain.go +++ b/domain.go @@ -533,6 +533,17 @@ type DomainVCPU struct { Value int `xml:",chardata"` } +type DomainVCPUsVCPU struct { + Id *uint `xml:"id,attr,omitempty"` + Enabled string `xml:"enabled,attr,omitempty"` + Hotpluggable string `xml:"hotpluggable,attr,omitempty"` + Order *uint `xml:"order,attr,omitempty"` +} + +type DomainVCPUs struct { + VCPU []DomainVCPUsVCPU `xml:"vcpu"` +} + type DomainCPUModel struct { Fallback string `xml:"fallback,attr,omitempty"` Value string `xml:",chardata"` @@ -678,6 +689,7 @@ type Domain struct { CurrentMemory *DomainMemory `xml:"currentMemory"` MaximumMemory *DomainMaxMemory `xml:"maxMemory"` VCPU *DomainVCPU `xml:"vcpu"` + VCPUs *DomainVCPUs `xml:"vcpus"` Resource *DomainResource `xml:"resource"` SysInfo *DomainSysInfo `xml:"sysinfo"` OS *DomainOS `xml:"os"` diff --git a/domain_test.go b/domain_test.go index 0ae9594..3ff1dc1 100644 --- a/domain_test.go +++ b/domain_test.go @@ -62,6 +62,10 @@ var tabletPort uint = 1 var nicAverage int = 1000 var nicBurst int = 10000 +var vcpuId0 uint = 0 +var vcpuOrder0 uint = 1 +var vcpuId1 uint = 1 + var domainTestData = []struct { Object Document Expected []string @@ -635,6 +639,22 @@ var domainTestData = []struct { Current: "1", Value: 2, }, + VCPUs: &DomainVCPUs{ + VCPU: []DomainVCPUsVCPU{ + DomainVCPUsVCPU{ + Id: &vcpuId0, + Enabled: "yes", + Hotpluggable: "no", + Order: &vcpuOrder0, + }, + DomainVCPUsVCPU{ + Id: &vcpuId1, + Enabled: "no", + Hotpluggable: "yes", + Order: nil, + }, + }, + }, Devices: &DomainDeviceList{ Interfaces: []DomainInterface{ DomainInterface{ @@ -656,6 +676,10 @@ var domainTestData = []struct { `<domain type="kvm">`, ` <name>test</name>`, ` <vcpu placement="static" cpuset="1-4,^3,6" current="1">2</vcpu>`, + ` <vcpus>`, + ` <vcpu id="0" enabled="yes" hotpluggable="no" order="1"></vcpu>`, + ` <vcpu id="1" enabled="no" hotpluggable="yes"></vcpu>`, + ` </vcpus>`, ` <devices>`, ` <interface type="network">`, ` <mac address="00:11:22:33:44:55"></mac>`, -- 2.7.4

2 1

[libvirt] [PATCH libvirt-cim 0/2] Small improvements
by Andrea Bolognani 25 Sep '17

25 Sep '17

The first patch will make it possible to have a nicer CI setup. The second one is just something that I couldn't help fixing while preparing the first one :) Andrea Bolognani (2): maint: Rename autoconfiscate.sh to autogen.sh README: Point to git repository README | 9 ++++++--- autoconfiscate.sh => autogen.sh | 0 2 files changed, 6 insertions(+), 3 deletions(-) rename autoconfiscate.sh => autogen.sh (100%) -- 2.13.5

4 10

[libvirt] [PATCH v2 00/14] Use secret objects to pass iSCSI passwords
by John Ferlan 24 Sep '17

24 Sep '17

v1: https://www.redhat.com/archives/libvir-list/2017-September/msg00100.html Other than patch 1 from v1, everything changed... Don't bother comparing. Highlights - * Two patches of essentially movement of virSecretUsageType because I found (as seen in patch 2) that a previous patch altered the API being used to format the <secret type='%s'.../> field. * The next 8 patches add XML parsing for "auth/secret" and "encryption/ secret" processing as a child of the _virStorageSource and then move the private data from qemuDomainDiskPrivatePtr to a new private data for qemuDomainDiskSrcPrivatePtr. * Patch11 is "somewhat" of an add on and not necessary for this series, but while I was thinking about it and because I believe it'll be useful for some other work - I added a hash lookaside table to be able to map the domain disk source secret objects to the usageType and secret by usage or UUID that was used to generate them. The output in the running XML on my host looks like: <diskSecretObjectAlias> <diskObject alias='hostdev0-secret0'> <secret type='iscsi' usage='libvirtiscsi'/> </diskObject> <diskObject alias='virtio-disk2-secret0'> <secret type='iscsi' usage='libvirtiscsi'/> </diskObject> </diskSecretObjectAlias> My thought was that since the username is included in the object already that it wouldn't have to be saved, but it could be as well. * Patch12 is the capabilities change from patch 1 of v1 with the one minor addition to add the capability to the qemu2.10 replies/xml. * Patch13 is the adjust in virstoragefile and virstoragetest to fetch and format the user/password-secret objects similar to how RBD did this. Guess where I tripped across the virSecretUsageTypeToString issue... * Patch14 handles all the magic in order to use AES secrets for both SCSI disk and hostdev including command line and hotplug. Of "possible concern": * I found no "easy way" manage whether the secret information was a child of disk or disk->src, so I moved everything on output to disk->src even if it was read as a child of disk. The concern here for me is migration and save files... If the domain xml changes - an older libvirt could "lose" the secret information since it wouldn't be a child of disk. It is possible to keep the "top-level" as a child of disk and then any backingStore would be able to have their own. But I figured I'd give the move or else a shot first. John Ferlan (14): util: Move virSecretUsageType to virsecret.h util: Fix secret generation in virStorageSourceParseRBDColonString conf: Add/Allow parsing the auth in the disk source conf: Move auth formatting to disk source docs: Add news article regarding auth placement qemu: Introduce privateData for _virStorageSource conf: Add/Allow parsing the encryption in the disk source conf: Move LUKS encryption formatting to disk source docs: Add news article for encryption in disk source qemu: Move encinfo from private disk to private disk src qemu: Add disk secret object hash table to _qemuDomainObjPrivate qemu: Get capabilities to use iscsi password-secret argument util: Add iSCSI auth/password-secret processing qemu: Use secret objects to pass iSCSI passwords docs/formatdomain.html.in | 81 +++-- docs/news.xml | 24 ++ docs/schemas/domaincommon.rng | 50 ++- src/conf/domain_conf.c | 142 ++++++++- src/conf/domain_conf.h | 1 + src/conf/secret_conf.c | 4 +- src/conf/secret_conf.h | 2 - src/qemu/qemu_block.c | 64 +++- src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 85 ++++- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_domain.c | 351 ++++++++++++++++++++- src/qemu/qemu_domain.h | 25 +- src/qemu/qemu_hotplug.c | 97 +++++- src/qemu/qemu_parse_command.c | 2 +- src/storage/storage_driver.c | 1 + src/util/virsecret.c | 2 + src/util/virsecret.h | 3 + src/util/virstoragefile.c | 34 +- src/util/virstoragefile.h | 3 + .../qemuargv2xml-disk-drive-network-iscsi-auth.xml | 6 +- .../qemuargv2xml-disk-drive-network-rbd-auth.xml | 6 +- tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.ppc64le.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml | 1 + ...xml2argv-disk-drive-network-iscsi-auth-AES.args | 41 +++ ...uxml2argv-disk-drive-network-iscsi-auth-AES.xml | 43 +++ ...v-disk-drive-network-iscsi-source-auth-both.xml | 36 +++ ...2argv-disk-drive-network-iscsi-source-auth.args | 31 ++ ...l2argv-disk-drive-network-iscsi-source-auth.xml | 43 +++ ...rgv-disk-drive-network-rbd-source-auth-both.xml | 45 +++ ...ml2argv-disk-drive-network-rbd-source-auth.args | 29 ++ ...xml2argv-disk-drive-network-rbd-source-auth.xml | 42 +++ ...ml2argv-hostdev-scsi-virtio-iscsi-auth-AES.args | 45 +++ ...xml2argv-hostdev-scsi-virtio-iscsi-auth-AES.xml | 48 +++ .../qemuxml2argv-luks-disks-source-both.xml | 40 +++ .../qemuxml2argv-luks-disks-source.args | 62 ++++ .../qemuxml2argv-luks-disks-source.xml | 81 +++++ tests/qemuxml2argvtest.c | 16 + .../qemuxml2xmlout-disk-backing-chains-active.xml | 6 +- ...qemuxml2xmlout-disk-backing-chains-inactive.xml | 6 +- ...emuxml2xmlout-disk-drive-network-iscsi-auth.xml | 12 +- ...xmlout-disk-drive-network-iscsi-source-auth.xml | 47 +++ .../qemuxml2xmlout-disk-drive-network-rbd-auth.xml | 6 +- ...l2xmlout-disk-drive-network-rbd-source-auth.xml | 47 +++ .../qemuxml2xmlout-disk-source-pool-mode.xml | 3 - .../qemuxml2xmlout-luks-disks-source.xml | 84 +++++ .../qemuxml2xmlout-luks-disks.xml | 48 ++- tests/qemuxml2xmltest.c | 3 + tests/virstoragetest.c | 21 ++ tools/virsh-secret.c | 2 +- 53 files changed, 1756 insertions(+), 128 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-source-auth-both.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-source-auth.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-source-auth.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-rbd-source-auth-both.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-rbd-source-auth.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-rbd-source-auth.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-luks-disks-source-both.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-luks-disks-source.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-luks-disks-source.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-iscsi-source-auth.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-rbd-source-auth.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-luks-disks-source.xml mode change 120000 => 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-luks-disks.xml -- 2.13.5

2 30

[libvirt] [PATCH] apparmor: support finer-grained ptrace checks
by Jim Fehlig 24 Sep '17

24 Sep '17

Kernel 4.13 introduced finer-grained ptrace checks https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… When Apparmor is enabled and libvirtd is confined, attempting to start a domain fails virsh start test error: Failed to start domain test error: internal error: child reported: Kernel does not provide mount namespace: Permission denied The audit log contains type=AVC msg=audit(1505466699.828:534): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=6621 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="/usr/sbin/libvirtd" It was also noticed that simply connecting to libvirtd (e.g. virsh list) resulted in the following entries in the audit log type=AVC msg=audit(1505755799.975:65): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=1418 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="unconfined" type=AVC msg=audit(1505755799.976:66): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=1418 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="unconfined" Both Apparmor denials can be fixed by adding ptrace rules to the libvirtd profile. The new rules only grant trace permission. Resolves: https://bugzilla.suse.com/show_bug.cgi?id=1058847 Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- Even with debug enabled in libvirtd, I've had a hard time correlating a libvirtd action that results in the denied ptrace check seen in the audit log. I suspect it is related to accessing files in /proc as mentioned in the apparmor wiki http://wiki.apparmor.net/index.php/TechnicalDo_Proc_and_ptrace cc'ing some of the usual apparmor suspects for any words of wisdom. examples/apparmor/usr.sbin.libvirtd | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index acb59e071..ff84aa149 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -37,6 +37,10 @@ network packet dgram, network packet raw, + # Support finer-grained ptrace checks, which were enabled in kernel 4.13 + ptrace trace peer=/usr/sbin/libvirtd, + ptrace trace peer=unconfined, + # Very lenient profile for libvirtd since we want to first focus on confining # the guests. Guests will have a very restricted profile. / r, -- 2.14.1

4 13

[libvirt] [PATCH V2] apparmor: support ptrace checks
by Jim Fehlig 22 Sep '17

22 Sep '17

Kernel 4.13 introduced finer-grained ptrace checks https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… With kernel 4.13 and apparmor 2.11, simply starting libvirtd results in the following apparmor denial type=AVC msg=audit(1506112085.645:954): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=6984 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="unconfined" Attempting to start an unconfined domain results in type=AVC msg=audit(1506112301.227:1112): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=7498 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="/usr/sbin/libvirtd" And attempting to start a confined domain results in type=AVC msg=audit(1506112631.408:1312): apparmor="DENIED" operation="open" profile="virt-aa-helper" name="/etc/libnl/classid" pid=8283 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1506112631.530:1319): apparmor="DENIED" operation="open" profile="virt-aa-helper" name="/etc/libnl/classid" pid=8289 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1506112632.186:1324): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=8342 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="libvirt-66154842-e926-4f92-92f0-1c1bf61dd1ff" Add ptrace rules to allow the trace operations. Resolves: https://bugzilla.suse.com/show_bug.cgi?id=1058847 Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- examples/apparmor/usr.sbin.libvirtd | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index acb59e071..6088db294 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -37,6 +37,10 @@ network packet dgram, network packet raw, + ptrace (trace) peer=unconfined, + ptrace (trace) peer=/usr/sbin/libvirtd, + ptrace (tace) peer=(label=@{profile_name}), + # Very lenient profile for libvirtd since we want to first focus on confining # the guests. Guests will have a very restricted profile. / r, -- 2.14.1

1 1

[libvirt] [PATCH libvirt-ci] libvirt-cim: Deal with autoconfiscate.sh rename
by Andrea Bolognani 22 Sep '17

22 Sep '17

The new name is the more standard autogen.sh. Still not enough to switch to autotools-*-job, but it's something. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- The relevant patch[1] has been ACKed[2] but not pushed yet, because I figured it's better to have the CI setup updated first. [1] https://www.redhat.com/archives/libvir-list/2017-September/msg00813.html [2] https://www.redhat.com/archives/libvir-list/2017-September/msg00819.html projects/libvirt-cim.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/libvirt-cim.yaml b/projects/libvirt-cim.yaml index 82a8127..77c4b1d 100644 --- a/projects/libvirt-cim.yaml +++ b/projects/libvirt-cim.yaml @@ -13,7 +13,7 @@ - generic-build-job: parent_jobs: 'libvirt-master-build' command: | - ./autoconfiscate.sh + ./autogen.sh ./configure --prefix=$VIRT_PREFIX make -j{smp} make -j{smp} install -- 2.13.5

2 1

[libvirt] [PATCH] libvirt_nss.c: Fix typo in aiforaf()
by Michal Privoznik 22 Sep '17

22 Sep '17

In my previous commit of b1d87f9ad96f I've made a typo breaking the FreeBSD build. s/ipAaddr/ipAddr/ Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Pushed under trivial & build breaker rules. This time I've even tested it on my FreeBSD machine. tools/nss/libvirt_nss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/nss/libvirt_nss.c b/tools/nss/libvirt_nss.c index da4bf79a4..49dc621ab 100644 --- a/tools/nss/libvirt_nss.c +++ b/tools/nss/libvirt_nss.c @@ -643,7 +643,7 @@ aiforaf(const char *name, int af, struct addrinfo *pai, struct addrinfo **aip) hints.ai_family = af; if (getaddrinfo(ipAddr, NULL, &hints, &res0)) { - VIR_FREE(ipAaddr); + VIR_FREE(ipAddr); addrList++; continue; } @@ -655,7 +655,7 @@ aiforaf(const char *name, int af, struct addrinfo *pai, struct addrinfo **aip) while ((*aip)->ai_next) *aip = (*aip)->ai_next; - VIR_FREE(ipAaddr); + VIR_FREE(ipAddr); addrList++; } } -- 2.13.5

1 0

[libvirt] [PATCH] apparmor: delete profile on VM shutdown
by Guido Günther 22 Sep '17

22 Sep '17

instead of only unloading it. This makes sure old profiles don't pile up in /etc/apparmor.d/libvirt and we get updates to modified templates on VM restart. --- src/security/security_apparmor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 5afe0c5c85..1db94c632f 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -220,7 +220,7 @@ remove_profile(const char *profile) { int rc = -1; const char * const argv[] = { - VIRT_AA_HELPER, "-R", "-u", profile, NULL + VIRT_AA_HELPER, "-D", "-u", profile, NULL }; if (virRun(argv, NULL) == 0) -- 2.14.1

2 2

[libvirt] [PATCH 0/2] qemu: don't update cpu unconditionally for migratable flag
by Nikolay Shirokovskiy 22 Sep '17

22 Sep '17

First patch is just a refactoring. Nikolay Shirokovskiy (2): qemu: make explicit that formatting migratable imposes secure qemu: don't update cpu unconditionally for migratable flag src/qemu/qemu_domain.c | 27 ++++++++++++++------------- src/qemu/qemu_domain.h | 4 ---- src/qemu/qemu_driver.c | 6 +----- src/qemu/qemu_migration.c | 4 +--- src/qemu/qemu_migration_cookie.c | 1 - 5 files changed, 16 insertions(+), 26 deletions(-) -- 1.8.3.1

3 10