- Devel - libvirt List Archives

[libvirt] [PATCH v2 0/4] attach-interface: Learn net type='direct'
by Michal Privoznik 13 Feb '15

13 Feb '15

v2 Michal Privoznik (4): libvirt_private.syms: Expose virDomainNetTypeFromString virsh attach-interface: Use enum instead of arbitrary integers virsh attach-interface: Use virDomainNetType{From,To}String() virsh attach-interface: Allow macvtap hotplug src/libvirt_private.syms | 1 + tools/virsh-domain.c | 36 ++++++++++++++++++++++++++---------- tools/virsh.pod | 14 ++++++++------ 3 files changed, 35 insertions(+), 16 deletions(-) -- 2.0.5

4 7

[libvirt] [PATCH v3 1/2] security: introduce virSecurityManagerCheckAllLabel function
by Erik Skultety 13 Feb '15

13 Feb '15

We do have a check for valid per-domain security model, however we still do permit an invalid security model for a domain's device (those which are specified with <source> element). This patch introduces a new function virSecurityManagerCheckAllLabel which compares user specified security model against currently registered security drivers. That being said, it also permits 'none' being specified as a device security model. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1165485 --- src/libvirt_private.syms | 1 + src/lxc/lxc_process.c | 3 ++ src/qemu/qemu_process.c | 6 +++ src/security/security_manager.c | 89 +++++++++++++++++++++++++++++++++++++++++ src/security/security_manager.h | 2 + 5 files changed, 101 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 645aef1..e98e813 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -955,6 +955,7 @@ virSecurityDriverLookup; # security/security_manager.h +virSecurityManagerCheckAllLabel; virSecurityManagerClearSocketLabel; virSecurityManagerGenLabel; virSecurityManagerGetBaseLabel; diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 19ea7f3..52b7f41 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -1135,6 +1135,9 @@ int virLXCProcessStart(virConnectPtr conn, vm->def->seclabels[0]->type == VIR_DOMAIN_SECLABEL_DEFAULT) vm->def->seclabels[0]->type = VIR_DOMAIN_SECLABEL_NONE; + if (virSecurityManagerCheckAllLabel(driver->securityManager, vm->def) < 0) + goto cleanup; + if (virSecurityManagerGenLabel(driver->securityManager, vm->def) < 0) { virDomainAuditSecurityLabel(vm, false); goto cleanup; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 43a64a1..1d4e957 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4488,6 +4488,10 @@ int qemuProcessStart(virConnectPtr conn, NULL) < 0) goto cleanup; + VIR_DEBUG("Checking domain and device security labels"); + if (virSecurityManagerCheckAllLabel(driver->securityManager, vm->def) < 0) + goto cleanup; + /* If you are using a SecurityDriver with dynamic labelling, then generate a security label for isolation */ VIR_DEBUG("Generating domain security label (if required)"); @@ -5488,6 +5492,8 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, } } + if (virSecurityManagerCheckAllLabel(driver->securityManager, vm->def) < 0) + goto error; if (virSecurityManagerGenLabel(driver->securityManager, vm->def) < 0) goto error; diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 302f54d..68ed85b 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -703,6 +703,95 @@ virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr, } +static int virSecurityManagerCheckSecurityModel(char *secmodel, + void *opaque) +{ + size_t i; + virSecurityManagerPtr mgr = opaque; + virSecurityManagerPtr *sec_managers = NULL; + + if ((sec_managers = virSecurityManagerGetNested(mgr)) == NULL) + return -1; + + if (STREQ_NULLABLE(secmodel, "none")) + return 0; + + for (i = 0; sec_managers[i]; i++) { + if (STREQ_NULLABLE(secmodel, + sec_managers[i]->drv->name)) { + return 0; + } + } + + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Unable to find security driver for model %s"), + secmodel); + return -1; +} + + +static int +virSecurityManagerCheckSecurityDiskLabel(virDomainDiskDefPtr disk, + void *opaque) +{ + size_t i; + + for (i = 0; i < disk->src->nseclabels; i++) { + if (virSecurityManagerCheckSecurityModel(disk->src->seclabels[i]->model, + opaque) < 0) + return -1; + } + + return 0; +} + + +static int +virSecurityManagerCheckSecurityChardevLabel(virDomainChrDefPtr dev, + void *opaque) +{ + size_t i; + + for (i = 0; i < dev->nseclabels; i++) { + if (virSecurityManagerCheckSecurityModel(dev->seclabels[i]->model, + opaque) < 0) + return -1; + } + + return 0; +} + + +static int +virSecurityManagerCheckSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainChrDefPtr dev, + void *opaque) +{ + return virSecurityManagerCheckSecurityChardevLabel(dev, opaque); +} + + +int virSecurityManagerCheckAllLabel(virSecurityManagerPtr mgr, + virDomainDefPtr vm) +{ + size_t i; + + for (i = 0; i < vm->ndisks; i++) { + if (virSecurityManagerCheckSecurityDiskLabel(vm->disks[i], + mgr) < 0) + return -1; + } + + if (virDomainChrDefForeach(vm, + true, + virSecurityManagerCheckSecurityChardevCallback, + mgr) < 0) + return -1; + + return 0; +} + + int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr, virDomainDefPtr vm, diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 156f882..13468db 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -111,6 +111,8 @@ int virSecurityManagerReserveLabel(virSecurityManagerPtr mgr, pid_t pid); int virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr, virDomainDefPtr sec); +int virSecurityManagerCheckAllLabel(virSecurityManagerPtr mgr, + virDomainDefPtr sec); int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr, virDomainDefPtr sec, const char *stdin_path); -- 1.9.3

2 3

[libvirt] QEMU capabilities vs machine types
by Michal Privoznik 13 Feb '15

13 Feb '15

Dear list, I've ran into the following bug [1]. The problem is, even though we check whether memory-backend-{ram,file} devices are supported, qemu fails to start. As I see it, on one hand, qemu lies about supported devices (when I imitated libvirt capabilities check by hand on the command line). But on the other hand, libvirt is using '-M none' so even if qemu is fixed, the domain would be unable to start anyway. So I believe my question is, does anybody have a bright idea how to fix this? I don't think we want to extend our capabilities from a list to a matrix (where a machine type would select a list). Moreover, querying and creating the matrix would take ages. But then again, machine type is important. Maybe not so for -x86_64 but for -arm definitely! Or? Michal 1: https://bugzilla.redhat.com/show_bug.cgi?id=1191567

3 5

[libvirt] [PATCH v3] lxc: fix show the wrong xml when guest start failed
by Luyao Huang 13 Feb '15

13 Feb '15

https://bugzilla.redhat.com/show_bug.cgi?id=1176503 When guest start failed, libvirt will keep the current vm->def, this will make a issue that we cannot get a right xml after guest start failed. And don't call the stop/release hook to do some other clean work. Call virLXCProcessCleanup to help us clean the source and call the hooks if start a vm failed Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- v2: use virLXCProcessCleanup to free the source and call the hook. v3: rework the patch to suit the virLXCProcessStart code changed. src/lxc/lxc_process.c | 76 ++++++++++++++++++++++----------------------------- 1 file changed, 32 insertions(+), 44 deletions(-) diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 01da344..1a6cfbb 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -1022,6 +1022,7 @@ int virLXCProcessStart(virConnectPtr conn, virCgroupPtr selfcgroup; int status; char *pidfile = NULL; + bool need_stop = false; if (virCgroupNewSelf(&selfcgroup) < 0) return -1; @@ -1259,6 +1260,7 @@ int virLXCProcessStart(virConnectPtr conn, goto cleanup; } + need_stop = true; priv->stopReason = VIR_DOMAIN_EVENT_STOPPED_FAILED; priv->wantReboot = false; vm->def->id = vm->pid; @@ -1272,20 +1274,20 @@ int virLXCProcessStart(virConnectPtr conn, if (VIR_CLOSE(handshakefds[1]) < 0) { virReportSystemError(errno, "%s", _("could not close handshake fd")); - goto error; + goto cleanup; } if (virCommandHandshakeWait(cmd) < 0) - goto error; + goto cleanup; /* Write domain status to disk for the controller to * read when it starts */ if (virDomainSaveStatus(driver->xmlopt, cfg->stateDir, vm) < 0) - goto error; + goto cleanup; /* Allow the child to exec the controller */ if (virCommandHandshakeNotify(cmd) < 0) - goto error; + goto cleanup; if (virAtomicIntInc(&driver->nactive) == 1 && driver->inhibitCallback) driver->inhibitCallback(true, driver->inhibitOpaque); @@ -1298,7 +1300,7 @@ int virLXCProcessStart(virConnectPtr conn, _("guest failed to start: %s"), out); } - goto error; + goto cleanup; } /* We know the cgroup must exist by this synchronization @@ -1310,13 +1312,13 @@ int virLXCProcessStart(virConnectPtr conn, vm->def->resource->partition : NULL, -1, &priv->cgroup) < 0) - goto error; + goto cleanup; if (!priv->cgroup) { virReportError(VIR_ERR_INTERNAL_ERROR, _("No valid cgroup for machine %s"), vm->def->name); - goto error; + goto cleanup; } /* And we can get the first monitor connection now too */ @@ -1329,17 +1331,17 @@ int virLXCProcessStart(virConnectPtr conn, virReportError(VIR_ERR_INTERNAL_ERROR, _("guest failed to start: %s"), ebuf); } - goto error; + goto cleanup; } if (autoDestroy && virCloseCallbacksSet(driver->closeCallbacks, vm, conn, lxcProcessAutoDestroy) < 0) - goto error; + goto cleanup; if (virDomainObjSetDefTransient(caps, driver->xmlopt, vm, false) < 0) - goto error; + goto cleanup; /* We don't need the temporary NIC names anymore, clear them */ virLXCProcessCleanInterfaces(vm->def); @@ -1358,47 +1360,38 @@ int virLXCProcessStart(virConnectPtr conn, * If the script raised an error abort the launch */ if (hookret < 0) - goto error; + goto cleanup; } rc = 0; cleanup: - if (rc != 0 && !err) - err = virSaveLastError(); - virCommandFree(cmd); if (VIR_CLOSE(logfd) < 0) { virReportSystemError(errno, "%s", _("could not close logfile")); rc = -1; } - for (i = 0; i < nveths; i++) { - if (rc != 0 && veths[i]) - ignore_value(virNetDevVethDelete(veths[i])); - VIR_FREE(veths[i]); - } if (rc != 0) { - if (vm->newDef) { - virDomainDefFree(vm->newDef); - vm->newDef = NULL; - } - if (priv->monitor) { - virObjectUnref(priv->monitor); - priv->monitor = NULL; - } - virDomainConfVMNWFilterTeardown(vm); - - virSecurityManagerRestoreAllLabel(driver->securityManager, - vm->def, false); - virSecurityManagerReleaseLabel(driver->securityManager, vm->def); - /* Clear out dynamically assigned labels */ - if (vm->def->nseclabels && - vm->def->seclabels[0]->type == VIR_DOMAIN_SECLABEL_DYNAMIC) { - VIR_FREE(vm->def->seclabels[0]->model); - VIR_FREE(vm->def->seclabels[0]->label); - VIR_FREE(vm->def->seclabels[0]->imagelabel); - VIR_DELETE_ELEMENT(vm->def->seclabels, 0, vm->def->nseclabels); + err = virSaveLastError(); + if (need_stop) { + virLXCProcessStop(driver, vm, VIR_DOMAIN_SHUTOFF_FAILED); + } else { + virSecurityManagerRestoreAllLabel(driver->securityManager, + vm->def, false); + virSecurityManagerReleaseLabel(driver->securityManager, vm->def); + /* Clear out dynamically assigned labels */ + if (vm->def->nseclabels && + vm->def->seclabels[0]->type == VIR_DOMAIN_SECLABEL_DYNAMIC) { + VIR_FREE(vm->def->seclabels[0]->model); + VIR_FREE(vm->def->seclabels[0]->label); + VIR_FREE(vm->def->seclabels[0]->imagelabel); + VIR_DELETE_ELEMENT(vm->def->seclabels, 0, vm->def->nseclabels); + } + virLXCProcessCleanup(driver, vm, VIR_DOMAIN_SHUTOFF_FAILED); } } + virCommandFree(cmd); + for (i = 0; i < nveths; i++) + VIR_FREE(veths[i]); for (i = 0; i < nttyFDs; i++) VIR_FORCE_CLOSE(ttyFDs[i]); VIR_FREE(ttyFDs); @@ -1415,11 +1408,6 @@ int virLXCProcessStart(virConnectPtr conn, } return rc; - - error: - err = virSaveLastError(); - virLXCProcessStop(driver, vm, VIR_DOMAIN_SHUTOFF_FAILED); - goto cleanup; } struct virLXCProcessAutostartData { -- 1.8.3.1

3 2

[libvirt] [PATCH 0/2] Support mrg_rxbuf attribute for virtio-net devices
by Ján Tomko 12 Feb '15

12 Feb '15

For https://bugzilla.redhat.com/show_bug.cgi?id=1186886 Ján Tomko (2): Add mrg_rxbuf option to virtio interfaces Wire up mrg_rxbuf option for qemu docs/formatdomain.html.in | 6 +++++- docs/schemas/domaincommon.rng | 5 +++++ src/conf/domain_conf.c | 14 ++++++++++++++ src/conf/domain_conf.h | 1 + src/qemu/qemu_command.c | 4 ++++ src/qemu/qemu_hotplug.c | 1 + .../qemuxml2argv-net-virtio-disable-offloads.args | 2 +- .../qemuxml2argv-net-virtio-disable-offloads.xml | 2 +- 8 files changed, 32 insertions(+), 3 deletions(-) -- 2.0.5

2 3

[libvirt] [PATCH 0/5 v2] parallels: Better bridged network interfaces support and some fixes
by Maxim Nestratov 12 Feb '15

12 Feb '15

v2 changes: - syntax check fixed - patches reordered and split - dealing with failed bridged network information fixed Maxim Nestratov (4): parallels: don't forget to unlock domain if unregister fails parallels: better bridge network interface support parallels: fix home directory for VMs parallels: fix initialization of parallels driver Mikhail Feoktistov (1): parallels: set cpu mode when applying xml configuration

1 5

[libvirt] [PATCH] virprocess: fix MinGW build and RHEL-5 build
by Pavel Hrdina 12 Feb '15

12 Feb '15

Commit b6a2828e introduced new functions to set process scheduler. There is a small typo in ELSE path for systems where scheduler is not available. Also some of the definitions were introduced later in kernel. For example RHEL-5 is running on kernel 2.6.18, but SCHED_IDLE was introduces in 2.6.23 [1] and SCHED_BATCH in 2.6.16 [1]. We should not count only on existence of function sched_setscheduler(), we must also check for existence of used macros as they might not be defined. [1] see 'man 7 sched' Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/util/virprocess.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/util/virprocess.c b/src/util/virprocess.c index b3e5435..342bf40 100644 --- a/src/util/virprocess.c +++ b/src/util/virprocess.c @@ -1062,7 +1062,7 @@ virProcessExitWithStatus(int status) exit(value); } -#if HAVE_SCHED_SETSCHEDULER +#if HAVE_SCHED_SETSCHEDULER && defined(SCHED_BATCH) && defined(SCHED_IDLE) static int virProcessSchedTranslatePolicy(virProcessSchedPolicy policy) @@ -1092,7 +1092,9 @@ virProcessSchedTranslatePolicy(virProcessSchedPolicy policy) } int -virProcessSetScheduler(pid_t pid, virProcessSchedPolicy policy, int priority) +virProcessSetScheduler(pid_t pid, + virProcessSchedPolicy policy, + int priority) { struct sched_param param = {0}; int pol = virProcessSchedTranslatePolicy(policy); @@ -1144,7 +1146,7 @@ virProcessSetScheduler(pid_t pid, virProcessSchedPolicy policy, int priority) int virProcessSetScheduler(pid_t pid ATTRIBUTE_UNUSED, - int policy, + virProcessSchedPolicy policy, int priority ATTRIBUTE_UNUSED) { if (!policy) -- 2.0.5

2 2

[libvirt] [PATCH] Fix a syntax error in the description text of libvirtd.conf
by Zhang Bo 12 Feb '15

12 Feb '15

not yet not -> not yet. Signed-off-by: Zhang Bo <oscar.zhangbo(a)huawei.com> --- daemon/libvirtd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemon/libvirtd.conf b/daemon/libvirtd.conf index d4f6a1c..069ef3a 100644 --- a/daemon/libvirtd.conf +++ b/daemon/libvirtd.conf @@ -272,7 +272,7 @@ # connection succeeds. #max_queued_clients = 1000 -# The maximum length of queue of accepted but not yet not +# The maximum length of queue of accepted but not yet # authenticated clients. The default value is zero, meaning # the feature is disabled. #max_anonymous_clients = 20 -- 1.7.12.4

2 1

[libvirt] [PATCHv2] libxl: set IP address when creating NIC
by Jihoon Kim 12 Feb '15

12 Feb '15

From: Ji-hoon Kim <relip(a)me.com> Currently libxlMakeNic() does not set ip address when creating NIC, this patch makes it to set ip address. Signed-off-by: Ji-hoon Kim <relip(a)me.com> --- src/libxl/libxl_conf.c | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 0555b91..e49715d 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1042,6 +1042,20 @@ libxlMakeNic(virDomainDefPtr def, if (VIR_STRDUP(x_nic->ifname, l_nic->ifname) < 0) return -1; + if (l_nic->nips == 1) { + char *ipStr = virSocketAddrFormat(&l_nic->ips[0]->address); + if (VIR_STRDUP(x_nic->ip, ipStr) < 0) { + VIR_FREE(ipStr); + return -1; + } + VIR_FREE(ipStr); + } + else if (l_nic->nips > 1) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Driver does not support setting multiple IP addresses")); + return -1; + } + switch (actual_type) { case VIR_DOMAIN_NET_TYPE_BRIDGE: if (VIR_STRDUP(x_nic->bridge, -- 1.7.1

3 3

[libvirt] [PATCH] util: make use of VIR_LOCK_SPACE_ACQUIRE_AUTOCREATE in virLockSpaceAcquireResource
by Shanzhi Yu 12 Feb '15

12 Feb '15

When create external disk snapshot with virtlock enabled, libvirtd will hang if flag VIR_LOCK_SPACE_ACQUIRE_AUTOCREATE is missed in virLockSpaceAcquireResource. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1191901 Signed-off-by: Shanzhi Yu <shyu(a)redhat.com> --- src/util/virlockspace.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/util/virlockspace.c b/src/util/virlockspace.c index 2366a74..25b4433 100644 --- a/src/util/virlockspace.c +++ b/src/util/virlockspace.c @@ -626,8 +626,10 @@ int virLockSpaceAcquireResource(virLockSpacePtr lockspace, virMutexLock(&lockspace->lock); if ((res = virHashLookup(lockspace->resources, resname))) { - if ((res->flags & VIR_LOCK_SPACE_ACQUIRE_SHARED) && - (flags & VIR_LOCK_SPACE_ACQUIRE_SHARED)) { + if (((res->flags & VIR_LOCK_SPACE_ACQUIRE_SHARED) && + (flags & VIR_LOCK_SPACE_ACQUIRE_SHARED)) || + ((res->flags & VIR_LOCK_SPACE_ACQUIRE_AUTOCREATE) && + (flags & VIR_LOCK_SPACE_ACQUIRE_AUTOCREATE))){ if (VIR_EXPAND_N(res->owners, res->nOwners, 1) < 0) goto cleanup; -- 1.8.3.1

2 2