- Devel - libvirt List Archives

[libvirt] [PATCH] Skip the 'copyright-check' on -maint branches
by Daniel P. Berrange 10 Feb '14

10 Feb '14

The maint branches will often have out of date copyright headers so we must skip the 'sc_copyright_check' rule there. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- cfg.mk | 11 +++++++++++ 1 file changed, 11 insertions(+) Perhaps there's a better way to detect -maint branches than the logic I tried. diff --git a/cfg.mk b/cfg.mk index 207dfeb..47c7798 100644 --- a/cfg.mk +++ b/cfg.mk @@ -88,6 +88,17 @@ else distdir: sc_vulnerable_makefile_CVE-2012-3386.z endif +GIT_BRANCH := $(shell if test -d $(srcdir)/.git; then \ + cd $(srcdir) && \ + (git status -s -b | grep '\#\#' | \ + sed -e 's/.*-maint/-maint/'); fi) + +# We fully expect -maint branches to have out of date +# copyright dates, so we must skip that check +ifeq ($(GIT_BRANCH),-maint) + local-checks-to-skip += sc_copyright_check +endif + # Files that should never cause syntax check failures. VC_LIST_ALWAYS_EXCLUDE_REGEX = \ (^(HACKING|docs/(news\.html\.in|.*\.patch))|\.po)$$ -- 1.8.5.3

3 4

[libvirt] [PATCH] docs: grammar fixes in formatdomain
by Chen Hanxiao 10 Feb '14

10 Feb '14

From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> Some grammar fixes. s/namespace,set/namespace, set s/container being allowed/container are allowed s/the <code>uid/The <code>uid Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- docs/formatdomain.html.in | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index fd02864..34993bb 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -286,18 +286,18 @@ <p> - If you want to enable user namespace,set the <code>idmap</code> element. - the <code>uid</code> and <code>gid</code> elements have three attributes: + If you want to enable user namespace, set the <code>idmap</code> element. + The <code>uid</code> and <code>gid</code> elements have three attributes: </p> <dl> <dt><code>start</code></dt> - <dd>First user id in container.</dd> + <dd>First user ID in container.</dd> <dt><code>target</code></dt> - <dd>The first user id in container will be mapped to this target user - id in host.</dd> + <dd>The first user ID in container will be mapped to this target user + ID in host.</dd> <dt><code>count</code></dt> - <dd>How many users in container being allowed to map to host's user.</dd> + <dd>How many users in container are allowed to map to host's user.</dd> </dl> <pre> -- 1.8.2.1

2 1

[libvirt] [PATCH] maint: fix line numbers in check-aclrules reports
by Roman Bogorodskiy 10 Feb '14

10 Feb '14

Reset line numbering on each input file in check-aclrules.pl. Otherwise it reports wrong line numbers in its error messages. Signed-off-by: Yuri Myasoedov <ymyasoedov(a)yandex.ru> --- src/check-aclrules.pl | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/check-aclrules.pl b/src/check-aclrules.pl index f54b934..9151e6a 100755 --- a/src/check-aclrules.pl +++ b/src/check-aclrules.pl @@ -254,6 +254,8 @@ while (<>) { $brace += $count; $count = s/}//g; $brace -= $count; +} continue { + close ARGV if eof; } exit $status; -- 1.8.4.3

2 1

[libvirt] [PATCH] build: correctly check for SOICGIFVLAN GET_VLAN_VID_CMD command
by Laine Stump 10 Feb '14

10 Feb '14

In order to make a client-only build successful on RHEL4, commit 3ed2e54 modified src/util/virnetdev.c so that the functional version of virNetDevGetVLanID() was only compiled if GET_VLAN_VID_CMD was defined. However, it is *never* defined, but is only an enum value, so the proper version was no longer compiled even on platforms that support it. This resulted in the vlan tag not being properly set for guest traffic on VEPA mode guest macvtap interfaces that were bound to a vlan interface (that's the only place that libvirt currently uses virNetDevGetVLanID) Since there is no way to compile conditionally based on the presence of an enum value, this patch modifies configure.ac to check for said enum value with AC_TRY_COMPILE(), and #defines HAVE_GET_VLAN_VID_CMD if it's successful compiling a test program that uses GET_VLAN_VID_CMD. We can then make the compilation of virNetDevGetVLanID() conditional on that #define instead. --- configure.ac | 10 ++++++++++ src/util/virnetdev.c | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 7ecbee9..fcd0170 100644 --- a/configure.ac +++ b/configure.ac @@ -2470,6 +2470,16 @@ if test "$with_virtualport" != "no"; then fi AM_CONDITIONAL([WITH_VIRTUALPORT], [test "$with_virtualport" = "yes"]) +AC_MSG_CHECKING([for GET_VLAN_VID_CMD in /usr/linux/if_vlan.h]) +AC_TRY_COMPILE([ #include <linux/if_vlan.h> ], + [ int x = GET_VLAN_VID_CMD; ], + [ have_get_vlan_vid_cmd=yes ], + [ have_get_vlan_vid_cmd=no ]) +if test "$have_get_vlan_vid_cmd" = "yes"; then + AC_DEFINE_UNQUOTED([HAVE_GET_VLAN_VID_CMD], 1, + [whether the kernel SIOCGIFVLAN ioctl supports GET_VLAN_VID_CMD]) +fi +AC_MSG_RESULT([$have_get_vlan_vid_cmd]) dnl netlink library diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index e74fc5f..72f52c7 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2007-2013 Red Hat, Inc. + * Copyright (C) 2007-2014 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -732,7 +732,7 @@ int virNetDevGetIndex(const char *ifname ATTRIBUTE_UNUSED, #endif /* ! SIOCGIFINDEX */ -#if defined(SIOCGIFVLAN) && defined(HAVE_STRUCT_IFREQ) && defined(GET_VLAN_VID_CMD) +#if defined(SIOCGIFVLAN) && defined(HAVE_STRUCT_IFREQ) && defined(HAVE_GET_VLAN_VID_CMD) int virNetDevGetVLanID(const char *ifname, int *vlanid) { struct vlan_ioctl_args vlanargs = { -- 1.8.5.3

3 3

[libvirt] [PATCH] virNetworkLoadState: Disallow mangled 'floor' element
by Michal Privoznik 10 Feb '14

10 Feb '14

In the network status XML we may have the <floor/> element with the 'sum' attribute. The attribute represents sum of all 'floor'-s of computed over each interface connected to the network (this is needed to guarantee certain bandwidth for certain domain). The sum is therefore a number. However, if the number was mangled (e.g. by an user's interference to network status file), we've just ignored it without refusing to parse such file. This was all due to 'goto error' missing. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/conf/network_conf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index e59938c..dd3fa19 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -2959,6 +2959,7 @@ virNetworkLoadState(virNetworkObjListPtr nets, _("Malformed 'floor_sum' attribute: %s"), floor_sum); VIR_FREE(floor_sum); + goto error; } VIR_FREE(floor_sum); } -- 1.8.5.3

2 2

[libvirt] [PATCH v2 0/3] Network hooks
by Michal Privoznik 10 Feb '14

10 Feb '14

Yet another version, this time with more hooks (after the network is started, on interface plug and unplug) and tainting. Michal Privoznik (3): networkStartNetwork: Be more verbose network: Introduce start and shutdown hooks network: Taint networks that are using hook script docs/hooks.html.in | 60 ++++++++++++--- src/conf/network_conf.c | 16 ++++ src/conf/network_conf.h | 17 +++++ src/libvirt_private.syms | 3 + src/lxc/lxc_driver.c | 4 +- src/lxc/lxc_process.c | 6 +- src/network/bridge_driver.c | 179 +++++++++++++++++++++++++++++++++++++++----- src/network/bridge_driver.h | 14 ++-- src/qemu/qemu_command.c | 2 +- src/qemu/qemu_hotplug.c | 14 ++-- src/qemu/qemu_process.c | 2 +- src/util/virhook.c | 13 +++- src/util/virhook.h | 11 +++ 13 files changed, 292 insertions(+), 49 deletions(-) -- 1.8.5.2

4 14

[libvirt] [PATCH] qemu: Use correct permissions when determining the image chain
by Peter Krempa 10 Feb '14

10 Feb '14

The code took into account only the global permissions. The domains now support per-vm DAC lables and per-image DAC labels. Use the most specific label available. --- src/qemu/qemu_domain.c | 35 +++++++++++++++++++++++++++++++++-- src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 8 ++++---- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_process.c | 2 +- 5 files changed, 40 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index c947e2e..d45210b 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -2210,7 +2210,7 @@ qemuDomainCheckDiskPresence(virQEMUDriverPtr driver, if (!disk->src) continue; - if (qemuDomainDetermineDiskChain(driver, disk, false) >= 0 && + if (qemuDomainDetermineDiskChain(driver, vm, disk, false) >= 0 && qemuDiskChainCheckBroken(disk) >= 0) continue; @@ -2319,13 +2319,41 @@ qemuDiskChainCheckBroken(virDomainDiskDefPtr disk) return 0; } +static void +qemuDomainGetImageIds(virQEMUDriverConfigPtr cfg, + virDomainObjPtr vm, + virDomainDiskDefPtr disk, + uid_t *uid, gid_t *gid) +{ + virSecurityLabelDefPtr vmlabel; + virSecurityDeviceLabelDefPtr disklabel; + + if (cfg) { + if (uid) + *uid = cfg->user; + + if (gid) + *gid = cfg->group; + } + + if (vm && (vmlabel = virDomainDefGetSecurityLabelDef(vm->def, "dac"))) + virParseOwnershipIds(vmlabel->label, uid, gid); + + if ((disklabel = virDomainDiskDefGetSecurityLabelDef(disk, "dac"))) + virParseOwnershipIds(disklabel->label, uid, gid); +} + + int qemuDomainDetermineDiskChain(virQEMUDriverPtr driver, + virDomainObjPtr vm, virDomainDiskDefPtr disk, bool force) { virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); int ret = 0; + uid_t uid; + gid_t gid; if (!disk->src || disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK || @@ -2340,8 +2368,11 @@ qemuDomainDetermineDiskChain(virQEMUDriverPtr driver, goto cleanup; } } + + qemuDomainGetImageIds(cfg, vm, disk, &uid, &gid); + disk->backingChain = virStorageFileGetMetadata(disk->src, disk->format, - cfg->user, cfg->group, + uid, gid, cfg->allowDiskFormatProbing); if (!disk->backingChain) ret = -1; diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 84624f9..3826d0b 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -353,6 +353,7 @@ int qemuDomainCheckDiskPresence(virQEMUDriverPtr driver, int qemuDiskChainCheckBroken(virDomainDiskDefPtr disk); int qemuDomainDetermineDiskChain(virQEMUDriverPtr driver, + virDomainObjPtr vm, virDomainDiskDefPtr disk, bool force); diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 944facb..94844df 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6499,7 +6499,7 @@ qemuDomainChangeDiskMediaLive(virConnectPtr conn, if (qemuTranslateDiskSourcePool(conn, disk) < 0) goto end; - if (qemuDomainDetermineDiskChain(driver, disk, false) < 0) + if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0) goto end; if (qemuSetupDiskCgroup(vm, disk) < 0) @@ -14632,7 +14632,7 @@ qemuDomainBlockPivot(virConnectPtr conn, disk->src = disk->mirror; disk->format = disk->mirrorFormat; disk->backingChain = NULL; - if (qemuDomainDetermineDiskChain(driver, disk, false) < 0) { + if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0) { disk->src = oldsrc; disk->format = oldformat; disk->backingChain = oldchain; @@ -14983,7 +14983,7 @@ qemuDomainBlockCopy(virDomainObjPtr vm, goto endjob; } - if (qemuDomainDetermineDiskChain(driver, disk, false) < 0) + if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0) goto endjob; if ((flags & VIR_DOMAIN_BLOCK_REBASE_SHALLOW) && @@ -15190,7 +15190,7 @@ qemuDomainBlockCommit(virDomainPtr dom, const char *path, const char *base, disk->dst); goto endjob; } - if (qemuDomainDetermineDiskChain(driver, disk, false) < 0) + if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0) goto endjob; if (!top) { diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 4a885d2..7066be6 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -719,7 +719,7 @@ qemuDomainAttachDeviceDiskLive(virConnectPtr conn, if (qemuSetUnprivSGIO(dev) < 0) goto end; - if (qemuDomainDetermineDiskChain(driver, disk, false) < 0) + if (qemuDomainDetermineDiskChain(driver, vm, disk, false) < 0) goto end; if (qemuSetupDiskCgroup(vm, disk) < 0) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 8bcd98e..c1f60cd 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -997,7 +997,7 @@ qemuProcessHandleBlockJob(qemuMonitorPtr mon ATTRIBUTE_UNUSED, if ((type == VIR_DOMAIN_BLOCK_JOB_TYPE_PULL || type == VIR_DOMAIN_BLOCK_JOB_TYPE_COMMIT) && status == VIR_DOMAIN_BLOCK_JOB_COMPLETED) - qemuDomainDetermineDiskChain(driver, disk, true); + qemuDomainDetermineDiskChain(driver, vm, disk, true); if (disk->mirror && type == VIR_DOMAIN_BLOCK_JOB_TYPE_COPY && status == VIR_DOMAIN_BLOCK_JOB_READY) disk->mirroring = true; -- 1.8.5.3

2 2

[libvirt] why mac are different between inside and outside of vm
by yue 10 Feb '14

10 Feb '14

hi, all nwfilter has many rules which depends on mac of vm, but i find the mac address inside vm is different from mac outside of vm. outside mac: vnet0 Link encap:Ethernet HWaddr FE:54:00:71:15:7B , inside mac: eth0 Link encap:Ethernet HWaddr 52:54:00:71:15:7B ,virtio why? i am afraid that nwfilter use the wrong one. how nwfilter chooses mac? and what is the usage of vnet0's mac? thanks very much.

3 2

[libvirt] [PATCH v5] bhyve: add a basic driver
by Roman Bogorodskiy 10 Feb '14

10 Feb '14

Changes from v4: - Set acpi and apic flags based on domain definition - Add more detailed description about -H and -P flags of bhyve to justify theirs usage Roman Bogorodskiy (1): bhyve: add a basic driver configure.ac | 7 + daemon/libvirtd.c | 9 + include/libvirt/virterror.h | 1 + m4/virt-driver-bhyve.m4 | 57 +++++ po/POTFILES.in | 3 + src/Makefile.am | 30 +++ src/bhyve/bhyve_command.c | 279 ++++++++++++++++++++++ src/bhyve/bhyve_command.h | 41 ++++ src/bhyve/bhyve_driver.c | 566 ++++++++++++++++++++++++++++++++++++++++++++ src/bhyve/bhyve_driver.h | 28 +++ src/bhyve/bhyve_process.c | 216 +++++++++++++++++ src/bhyve/bhyve_process.h | 36 +++ src/bhyve/bhyve_utils.h | 48 ++++ src/conf/domain_conf.c | 3 +- src/conf/domain_conf.h | 1 + src/driver.h | 1 + src/libvirt.c | 3 + src/util/virerror.c | 1 + 18 files changed, 1329 insertions(+), 1 deletion(-) create mode 100644 m4/virt-driver-bhyve.m4 create mode 100644 src/bhyve/bhyve_command.c create mode 100644 src/bhyve/bhyve_command.h create mode 100644 src/bhyve/bhyve_driver.c create mode 100644 src/bhyve/bhyve_driver.h create mode 100644 src/bhyve/bhyve_process.c create mode 100644 src/bhyve/bhyve_process.h create mode 100644 src/bhyve/bhyve_utils.h -- 1.8.4.3

3 4

[libvirt] [PATCH 00/14] Avoid unsafe usage of /proc/$PID/root in LXC driver
by Daniel P. Berrange 10 Feb '14

10 Feb '14

This is a followup to Eric's original proposal https://www.redhat.com/archives/libvir-list/2013-December/msg01242.html The first 5 patches fix non-security bugs in the LXC hotplug code. Then there's a couple of helper patches. Finally the last 6 fix the actual security issue previously publically reported. Eric originally had a huge cleanup of virFork, but I'd prefer that be done afterwards, to minimize the backporting pain for stable branches. Daniel P. Berrange (13): Don't block use of USB with containers Fix path used for USB device attach with LXC Record hotplugged USB device in LXC live guest config Fix reset of cgroup when detaching USB device from LXC guests Disks are always block devices, never character devices Move check for cgroup devices ACL upfront in LXC hotplug Add virFileMakeParentPath helper function Add helper for running code in separate namespaces Avoid unsafe use of /proc/$PID/root in LXC disk hotplug Avoid unsafe use of /proc/$PID/root in LXC USB hotplug Avoid unsafe use of /proc/$PID/root in LXC block hostdev hotplug Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug Avoid unsafe use of /proc/$PID/root in LXC hotunplug code Eric Blake (1): Avoid unsafe use of /proc/$PID/root in LXC shutdown/reboot code src/conf/domain_conf.c | 1 + src/libvirt_private.syms | 2 + src/lxc/lxc_driver.c | 552 +++++++++++++++++++++++------------------------ src/util/virfile.c | 27 +++ src/util/virfile.h | 1 + src/util/virinitctl.c | 26 +-- src/util/virinitctl.h | 5 +- src/util/virprocess.c | 114 ++++++++++ src/util/virprocess.h | 11 + 9 files changed, 442 insertions(+), 297 deletions(-) -- 1.8.5.3

2 31