- Devel - libvirt List Archives

[libvirt] [PATCH] format: suppress auto-generated DAC labels
by Marcelo Cerri 31 Aug '12

31 Aug '12

To avoid backward compatibility issues, this patch suppresses auto-generated DAC labels from XML. This change affects commands such as dumpxml and save. Signed-off-by: Marcelo Cerri <mhcerri(a)linux.vnet.ibm.com> --- src/conf/domain_conf.c | 13 ++++++++++++- src/conf/domain_conf.h | 1 + 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 42c3900..516821f 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -11231,6 +11231,12 @@ virSecurityLabelDefFormat(virBufferPtr buf, virSecurityLabelDefPtr def) if (def->type == VIR_DOMAIN_SECLABEL_DEFAULT) return; + /* To avoid backward compatibility issues, suppress DAC labels that are + * automatically generated. + */ + if (STREQ_NULLABLE(def->model, "dac") && def->implicit) + return; + virBufferAsprintf(buf, "<seclabel type='%s'", sectype); @@ -14982,6 +14988,7 @@ virSecurityLabelDefPtr virDomainDefGetSecurityLabelDef(virDomainDefPtr def, const char *model) { int i; + virSecurityLabelDefPtr seclabel = NULL; if (def == NULL || model == NULL) return NULL; @@ -14993,7 +15000,11 @@ virDomainDefGetSecurityLabelDef(virDomainDefPtr def, const char *model) return def->seclabels[i]; } - return virDomainDefAddSecurityLabelDef(def, model); + seclabel = virDomainDefAddSecurityLabelDef(def, model); + if (seclabel) + seclabel->implicit = true; + + return seclabel; } virSecurityDeviceLabelDefPtr diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 9ee57e1..3791e50 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -295,6 +295,7 @@ struct _virSecurityLabelDef { char *baselabel; /* base name of label string */ int type; /* virDomainSeclabelType */ bool norelabel; + bool implicit; /* true if seclabel is auto-added */ }; -- 1.7.12

1 0

[libvirt] [PATCH v1 1/8] New functions for virBitmap
by Hu Tao 31 Aug '12

31 Aug '12

In many places we store bitmap info in a chunk of data (pointed to by a char *), and have redundant codes to set/unset bits. This patch extends virBitmap, and convert those codes to use virBitmap in subsquent patches. --- .gitignore | 1 + src/libvirt_private.syms | 10 ++ src/util/bitmap.c | 391 +++++++++++++++++++++++++++++++++++++++++++++- src/util/bitmap.h | 23 +++ tests/Makefile.am | 8 +- tests/virbitmaptest.c | 134 ++++++++++++++++ 6 files changed, 562 insertions(+), 5 deletions(-) create mode 100644 tests/virbitmaptest.c diff --git a/.gitignore b/.gitignore index 5041ddf..9aaa1f5 100644 --- a/.gitignore +++ b/.gitignore @@ -155,6 +155,7 @@ /tests/storagebackendsheepdogtest /tests/utiltest /tests/viratomictest +/tests/virbitmaptest /tests/virauthconfigtest /tests/virbuftest /tests/virdrivermoduletest diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 27eb43e..9c27218 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -7,11 +7,21 @@ # bitmap.h virBitmapAlloc; +virBitmapAllocFromData; +virBitmapClearAll; virBitmapClearBit; +virBitmapCmp; +virBitmapCopy; +virBitmapFormat; virBitmapFree; virBitmapGetBit; +virBitmapIsAllSet; +virBitmapParse; +virBitmapSetAll; virBitmapSetBit; +virBitmapSize; virBitmapString; +virBitmapToData; # buf.h diff --git a/src/util/bitmap.c b/src/util/bitmap.c index 53a8a38..2e668c6 100644 --- a/src/util/bitmap.c +++ b/src/util/bitmap.c @@ -33,15 +33,17 @@ #include "bitmap.h" #include "memory.h" #include "buf.h" +#include "util.h" +#include "c-ctype.h" struct _virBitmap { size_t size; - unsigned long *map; + unsigned char *map; }; -#define VIR_BITMAP_BITS_PER_UNIT ((int) sizeof(unsigned long) * CHAR_BIT) +#define VIR_BITMAP_BITS_PER_UNIT ((int) sizeof(unsigned char) * CHAR_BIT) #define VIR_BITMAP_UNIT_OFFSET(b) ((b) / VIR_BITMAP_BITS_PER_UNIT) #define VIR_BITMAP_BIT_OFFSET(b) ((b) % VIR_BITMAP_BITS_PER_UNIT) #define VIR_BITMAP_BIT(b) (1UL << VIR_BITMAP_BIT_OFFSET(b)) @@ -129,6 +131,12 @@ int virBitmapClearBit(virBitmapPtr bitmap, size_t b) return 0; } +/* Helper function. caller must ensure b < bitmap->size */ +static bool bitmapIsset(virBitmapPtr bitmap, size_t b) +{ + return !!(bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] & VIR_BITMAP_BIT(b)); +} + /** * virBitmapGetBit: * @bitmap: Pointer to bitmap @@ -145,7 +153,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result) if (bitmap->size <= b) return -1; - *result = !!(bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] & VIR_BITMAP_BIT(b)); + *result = bitmapIsset(bitmap, b); return 0; } @@ -168,7 +176,7 @@ char *virBitmapString(virBitmapPtr bitmap) VIR_BITMAP_BITS_PER_UNIT; while (sz--) { - virBufferAsprintf(&buf, "%0*lx", + virBufferAsprintf(&buf, "%0*hx", VIR_BITMAP_BITS_PER_UNIT / 4, bitmap->map[sz]); } @@ -180,3 +188,378 @@ char *virBitmapString(virBitmapPtr bitmap) return virBufferContentAndReset(&buf); } + +/** + * virBitmapFormat: + * @bitmap: the bitmap + * + * This function is the counterpart of virBitmapParse. This function creates + * a human-readable string representing the bits in bitmap. + * + * See virBitmapParse for the format of @str. + * + * Returns the string on success or NULL otherwise. Caller should call + * VIR_FREE to free the string. + */ +char *virBitmapFormat(virBitmapPtr bitmap) +{ + virBuffer buf =VIR_BUFFER_INITIALIZER; + int first = -1; + int start, cur; + int ret; + bool isset; + + if (!bitmap) + return NULL; + + cur = 0; + start = -1; + while (cur < bitmap->size) { + ret = virBitmapGetBit(bitmap, cur, &isset); + if (ret != 0) + goto error; + else if (isset) { + if (start == -1) + start = cur; + } else if (start != -1) { + if (!first) + virBufferAddLit(&buf, ","); + else + first = 0; + if (cur == start + 1) + virBufferAsprintf(&buf, "%d", start); + else + virBufferAsprintf(&buf, "%d-%d", start, cur - 1); + start = -1; + } + cur++; + } + + if (start != -1) { + if (!first) + virBufferAddLit(&buf, ","); + if (cur == start + 1) + virBufferAsprintf(&buf, "%d", start); + else + virBufferAsprintf(&buf, "%d-%d", start, cur - 1); + } + + if (virBufferError(&buf)) { +error: + virBufferFreeAndReset(&buf); + return NULL; + } + + return virBufferContentAndReset(&buf); +} + +/** + * virBitmapParse: + * @str: points to a string representing a human-readable bitmap + * @bitmap: a bitmap created from @str + * @bitmapSize: the upper limit of num of bits in created bitmap + * + * This function is the counterpart of virBitmapFormat. This function creates + * a bitmap, in which bits are set according to the content of @str. + * + * @str is a comma separated string of fields N, which means a number of bit + * to set, and ^N, which means to unset the bit, and N-M for ranges of bits + * to set. + * + * Returns the number of bits set in @bitmap, or -1 in case of error. + */ + +int virBitmapParse(const char *str, + char sep, + virBitmapPtr *bitmap, + size_t bitmapSize) +{ + int ret = 0; + int neg = 0; + const char *cur; + char *tmp; + int i, start, last; + + if (!str) + return -1; + + cur = str; + virSkipSpaces(&cur); + + if (*cur == 0) + return -1; + + *bitmap = virBitmapAlloc(bitmapSize); + if (!*bitmap) + return -1; + + while (*cur != 0 && *cur != sep) { + /* + * 3 constructs are allowed: + * - N : a single CPU number + * - N-M : a range of CPU numbers with N < M + * - ^N : remove a single CPU number from the current set + */ + if (*cur == '^') { + cur++; + neg = 1; + } + + if (!c_isdigit(*cur)) + goto parse_error; + + if (virStrToLong_i(cur, &tmp, 10, &start) < 0) + goto parse_error; + if (start < 0) + goto parse_error; + + cur = tmp; + + virSkipSpaces(&cur); + + if (*cur == ',' || *cur == 0 || *cur == sep) { + if (neg) { + if (bitmapIsset(*bitmap, start)) { + ignore_value(virBitmapClearBit(*bitmap, start)); + ret--; + } + } else { + if (!bitmapIsset(*bitmap, start)) { + ignore_value(virBitmapSetBit(*bitmap, start)); + ret++; + } + } + } else if (*cur == '-') { + if (neg) + goto parse_error; + + cur++; + virSkipSpaces(&cur); + + if (virStrToLong_i(cur, &tmp, 10, &last) < 0) + goto parse_error; + if (last < start) + goto parse_error; + + cur = tmp; + + for (i = start; i <= last; i++) { + if (!bitmapIsset(*bitmap, i)) { + ignore_value(virBitmapSetBit(*bitmap, i)); + ret++; + } + } + + virSkipSpaces(&cur); + } + + if (*cur == ',') { + cur++; + virSkipSpaces(&cur); + neg = 0; + } else if(*cur == 0 || *cur == sep) { + break; + } else { + goto parse_error; + } + } + + return ret; + +parse_error: + virBitmapFree(*bitmap); + *bitmap = NULL; + return -1; +} + +/** + * virBitmapCopy: + * @src: the source bitmap. + * + * Makes a copy of bitmap @src. + * + * returns the copied bitmap on success, or NULL otherwise. Caller + * should call virBitmapFree to free the returned bitmap. + */ +virBitmapPtr virBitmapCopy(virBitmapPtr src) +{ + virBitmapPtr dst; + size_t sz; + + sz = (src->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + if (VIR_ALLOC(dst) < 0) + return NULL; + + if (VIR_ALLOC_N(dst->map, sz) < 0) { + VIR_FREE(dst); + return NULL; + } + + memcpy(dst->map, src->map, sz); + dst->size = src->size; + + return dst; +} + +/** + * virBitmapAllocFromData: + * @data: the data + * @len: len of @data in byte + * + * Allocate a bitmap from a chunk of data containing bits + * information + * + * Returns a pointer to the allocated bitmap or NULL if + * memory cannot be allocated. + */ +virBitmapPtr virBitmapAllocFromData(void *data, int len) +{ + virBitmapPtr bitmap; + + bitmap = virBitmapAlloc(len * CHAR_BIT); + if (!bitmap) + return NULL; + + memcpy(bitmap->map, data, len); + + return bitmap; +} + +/** + * virBitmapToData: + * @data: the data + * @len: len of @data in byte + * + * Convert a bitmap to a chunk of data containing bits information. + * Data consists of sequential bytes, with lower bytes containing + * lower bits. + * + * Returns 0 on success, -1 otherwise. + */ +int virBitmapToData(virBitmapPtr bitmap, char **data, int *dataLen) +{ + size_t sz; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + if (VIR_ALLOC_N(*data, sz) < 0) + return -1; + + memcpy(*data, bitmap->map, sz); + *dataLen = sz; + + return 0; +} + +/** + * virBitmapCmp: + * @b1: bitmap 1 + * @b2: bitmap 2 + * + * Compares two bitmaps. Returns true if two bitmaps have exactly + * the same set of bits set, otherwise false. + */ +bool virBitmapCmp(virBitmapPtr b1, virBitmapPtr b2) +{ + virBitmapPtr b; + size_t sz1, sz2, sz; + int i; + + sz1 = (b1->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + sz2 = (b2->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + sz = sz1 < sz2 ? sz1 : sz2; + + for (i = 0; i < sz; i++) { + if (b1->map[i] != b2->map[i]) + return false; + } + + b = sz1 > sz ? b1 : b2; + sz = sz1 > sz ? sz1 : sz2; + for (; i < sz; i++) { + if (b->map[i]) + return false; + } + + return true; +} + +size_t virBitmapSize(virBitmapPtr bitmap) +{ + return bitmap->size; +} + +/** + * virBitmapSetAll: + * @bitmap: the bitmap + * + * set all bits in @bitmap. + */ +void virBitmapSetAll(virBitmapPtr bitmap) +{ + int i; + size_t sz; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + for (i = 0; i < sz; i++) + bitmap->map[i] = -1; +} + +/** + * virBitmapClearAll: + * @bitmap: the bitmap + * + * clear all bits in @bitmap. + */ +void virBitmapClearAll(virBitmapPtr bitmap) +{ + int i; + size_t sz; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + for (i = 0; i < sz; i++) + bitmap->map[i] = 0; +} + +/** + * virBitmapIsAllSet: + * @bitmap: the bitmap to check + * + * check if all bits in @bitmap are set. + */ +bool virBitmapIsAllSet(virBitmapPtr bitmap) +{ + int i; + int unusedBits; + size_t sz, tmp; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + unusedBits = sz * VIR_BITMAP_BITS_PER_UNIT - bitmap->size; + + tmp = sz; + if (unusedBits > 0) + tmp = sz - 1; + + for (i = 0; i < tmp; i++) + if (bitmap->map[i] != (unsigned char)-1) + return false; + + if (unusedBits > 0) { + if ((bitmap->map[sz - 1] & ((1 << (VIR_BITMAP_BITS_PER_UNIT - unusedBits + 1)) - 1)) + != ((1 << (VIR_BITMAP_BITS_PER_UNIT - unusedBits + 1)) - 1)) + return false; + } + + return true; +} diff --git a/src/util/bitmap.h b/src/util/bitmap.h index c3e6222..4823604 100644 --- a/src/util/bitmap.h +++ b/src/util/bitmap.h @@ -62,4 +62,27 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result) char *virBitmapString(virBitmapPtr bitmap) ATTRIBUTE_NONNULL(1) ATTRIBUTE_RETURN_CHECK; +char *virBitmapFormat(virBitmapPtr bitmap); + +int virBitmapParse(const char *str, + char sep, + virBitmapPtr *bitmap, + size_t bitmapSize); + +virBitmapPtr virBitmapCopy(virBitmapPtr src); + +virBitmapPtr virBitmapAllocFromData(void *data, int len); + +int virBitmapToData(virBitmapPtr bitmap, char **data, int *dataLen); + +bool virBitmapCmp(virBitmapPtr b1, virBitmapPtr b2); + +size_t virBitmapSize(virBitmapPtr bitmap); + +void virBitmapSetAll(virBitmapPtr bitmap); + +void virBitmapClearAll(virBitmapPtr bitmap); + +bool virBitmapIsAllSet(virBitmapPtr bitmap); + #endif diff --git a/tests/Makefile.am b/tests/Makefile.am index 8cf8015..ec436df 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -92,7 +92,8 @@ test_programs = virshtest sockettest \ viratomictest \ utiltest virnettlscontexttest shunloadtest \ virtimetest viruritest virkeyfiletest \ - virauthconfigtest + virauthconfigtest \ + virbitmaptest if WITH_SECDRIVER_SELINUX test_programs += securityselinuxtest @@ -562,6 +563,10 @@ viratomictest_SOURCES = \ viratomictest.c testutils.h testutils.c viratomictest_LDADD = $(LDADDS) +virbitmaptest_SOURCES = \ + virbitmaptest.c testutils.h testutils.c +virbitmaptest_LDADD = $(LDADDS) + jsontest_SOURCES = \ jsontest.c testutils.h testutils.c jsontest_LDADD = $(LDADDS) @@ -592,6 +597,7 @@ shunloadtest_SOURCES = \ shunloadtest_LDADD = $(LIB_PTHREAD) shunloadtest_DEPENDENCIES = libshunload.la + if WITH_CIL CILOPTFLAGS = CILOPTINCS = diff --git a/tests/virbitmaptest.c b/tests/virbitmaptest.c new file mode 100644 index 0000000..c688618 --- /dev/null +++ b/tests/virbitmaptest.c @@ -0,0 +1,134 @@ +/* + * Copyright (C) 2012 Fujitsu. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#include <config.h> + +#include <time.h> +#include <sched.h> + +#include "testutils.h" + +#include "bitmap.h" + +static int test1(const void *data ATTRIBUTE_UNUSED) +{ + virBitmapPtr bitmap; + int size; + int bit; + bool result; + + size = 1024; + bit = 100; + bitmap = virBitmapAlloc(size); + if (virBitmapSetBit(bitmap, bit) < 0) + return -1; + + if (virBitmapGetBit(bitmap, bit, &result) < 0) + return -1; + + if (!result) + return -1; + + if (virBitmapGetBit(bitmap, bit + 1, &result) < 0) + return -1; + + if (result) + return -1; + + return 0; +} + +bool testBit(virBitmapPtr bitmap, unsigned int start, unsigned int end) +{ + int i; + bool result; + + for (i = start; i <= end; i++) { + if (virBitmapGetBit(bitmap, i, &result) < 0) + return 0; + if (!result) + return 0; + } + + return 1; +} + +static int test2(const void *data ATTRIBUTE_UNUSED) +{ + const char *bitsString1 = "1-32,50,88-99,1021-1023"; + char *bitsString2 = NULL; + virBitmapPtr bitmap = NULL; + int ret = -1; + int size = 1024; + + if (virBitmapParse(bitsString1, 0, &bitmap, size) < 0) + goto error; + + if (!testBit(bitmap, 1, 32)) + goto error; + if (!testBit(bitmap, 50, 50)) + goto error; + if (!testBit(bitmap, 88, 99)) + goto error; + if (!testBit(bitmap, 1021, 1023)) + goto error; + + if (testBit(bitmap, 0, 0)) + goto error; + if (testBit(bitmap, 33,49)) + goto error; + if (testBit(bitmap, 51,87)) + goto error; + if (testBit(bitmap, 100,1020)) + goto error; + + bitsString2 = virBitmapFormat(bitmap); + if (strcmp(bitsString1, bitsString2)) + goto error; + + virBitmapSetAll(bitmap); + if (!testBit(bitmap, 0, size - 1)) + goto error; + + virBitmapClearAll(bitmap); + if (testBit(bitmap, 0, size - 1)) + goto error; + + ret = 0; + +error: + virBitmapFree(bitmap); + VIR_FREE(bitsString2); + return ret; +} + +static int +mymain(void) +{ + int ret = 0; + + if (virtTestRun("test1", 1, test1, NULL) < 0) + ret = -1; + if (virtTestRun("test2", 1, test2, NULL) < 0) + ret = -1; + + return ret; +} + +VIRT_TEST_MAIN(mymain) -- 1.7.10.2

2 13

[libvirt] [PATCH] conf: Fix parsing of seclabels without model
by Marcelo Cerri 31 Aug '12

31 Aug '12

With this patch libvirt tries to assign a model to seclabels when model is missing. Libvirt will look up at host's capabilities and assign a model in order to each seclabel that doesn't have a model assigned. This patch fixes: 1. The problem with existing guests that have a seclabel defined in its XML. 2. A XML parse error when a guest is restored. Signed-off-by: Marcelo Cerri <mhcerri(a)linux.vnet.ibm.com> --- src/conf/domain_conf.c | 56 ++++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 27 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 224aec5..5316b59 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3102,22 +3102,10 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, def->baselabel = p; } - /* Only parse model, if static labelling, or a base - * label is set, or doing active XML - */ - if (def->type == VIR_DOMAIN_SECLABEL_STATIC || - def->baselabel || - (!(flags & VIR_DOMAIN_XML_INACTIVE) && - def->type != VIR_DOMAIN_SECLABEL_NONE)) { - - p = virXPathStringLimit("string(./@model)", - VIR_SECURITY_MODEL_BUFLEN-1, ctxt); - if (p == NULL && def->type != VIR_DOMAIN_SECLABEL_NONE) { - virReportError(VIR_ERR_XML_ERROR, - "%s", _("missing security model")); - } - def->model = p; - } + /* Always parse model */ + p = virXPathStringLimit("string(./@model)", + VIR_SECURITY_MODEL_BUFLEN-1, ctxt); + def->model = p; return def; @@ -3129,10 +3117,12 @@ error: static int virSecurityLabelDefsParseXML(virDomainDefPtr def, xmlXPathContextPtr ctxt, + virCapsPtr caps, unsigned int flags) { - int i = 0, n; + int i, j, n; xmlNodePtr *list = NULL, saved_node; + virCapsHostPtr host = &caps->host; /* Check args and save context */ if (def == NULL || ctxt == NULL) @@ -3159,14 +3149,26 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, ctxt->node = saved_node; VIR_FREE(list); - /* Checking missing model information - * when there is more than one seclabel */ - if (n > 1) { - for(; n; n--) { - if (def->seclabels[n - 1]->model == NULL) { + /* Check missing model information */ + for (i = j = 0; i < n; i++) { + /* If model is missing, try to assign it based on driver's + * capabilities. + */ + if (def->seclabels[i]->model == NULL) { + /* Check if there's any host's security model that wasn't + * assigned yet. + */ + if (j >= host->nsecModels) { virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing security model " - "when using multiple labels")); + _("missing security model and " + "it can't be assigned based on " + "host's capabilities")); + goto error; + } + /* Copy model from host. */ + def->seclabels[i]->model = strdup(host->secModels[j++].model); + if (def->seclabels[i]->model == NULL) { + virReportOOMError(); goto error; } } @@ -3175,8 +3177,8 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, error: ctxt->node = saved_node; - for (; i > 0; i--) { - virSecurityLabelDefFree(def->seclabels[i - 1]); + for (i = 0; i < n; i++) { + virSecurityLabelDefFree(def->seclabels[i]); } VIR_FREE(def->seclabels); def->nseclabels = 0; @@ -8166,7 +8168,7 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps, /* analysis of security label, done early even though we format it * late, so devices can refer to this for defaults */ - if (virSecurityLabelDefsParseXML(def, ctxt, flags) == -1) + if (virSecurityLabelDefsParseXML(def, ctxt, caps, flags) == -1) goto error; /* Extract domain memory */ -- 1.7.12

3 13

[libvirt] [PATCH] Fix issue of PF brought down if VF is 8021.Qbh and pci passthrough
by Nishank Trivedi 31 Aug '12

31 Aug '12

If a 8021.Qbh network device supports SRIOV and its VF is being used in pci passthrough mode, when the guest is shutdown or destroyed, the PF inteface is also brought down. qemuDomainHostdevNetConfigRestore() finds out the PF for provided hostdev (which is VF) and passes it to virNetDevPortProfileDisassociate() as linkdev. Later, linkdev gets passed to virNetDevSetOnline() where the interface is brought down by clearing IFF_UP flag. Bringing down a PF, when only VF is being brought down is not expected behavior. This patch adds a check so that virNetDevSetOnline() is called only for PF and not if device is a VF. Signed-off-by: Nishank Trivedi <nistrive(a)cisco.com> --- src/util/virnetdevvportprofile.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/virnetdevvportprofile.c b/src/util/virnetdevvportprofile.c index 5213378..e231fca 100644 --- a/src/util/virnetdevvportprofile.c +++ b/src/util/virnetdevvportprofile.c @@ -1235,7 +1235,8 @@ virNetDevVPortProfileDisassociate(const char *macvtap_ifname, /* avoid disassociating twice */ if (vmOp == VIR_NETDEV_VPORT_PROFILE_OP_MIGRATE_IN_FINISH) break; - ignore_value(virNetDevSetOnline(linkdev, false)); + if (vf < 0) + ignore_value(virNetDevSetOnline(linkdev, false)); rc = virNetDevVPortProfileOp8021Qbh(linkdev, macvtap_macaddr, vf, virtPort, NULL, VIR_NETDEV_VPORT_PROFILE_LINK_OP_DISASSOCIATE); -- 1.7.11.4

3 2

[libvirt] [PATCH 1/1] Fix adding ports to OVS bridges without VLAN tags
by Kyle Mestery 31 Aug '12

31 Aug '12

The introduction of the new VLAN code, along with the fix from 5e465df6be8bcb00f0b4bff831e91f4042fae272, caused the addition of OVS ports to fail with the following message: ovs-vsctl: 00002|vsctl|ERR|: missing column name This fix takes into account the VLAN arguments are optional, and correctly sets up the command line to run the "ovs-vsctl" command to add ports to the OVS bridge. Signed-off-by: Kyle Mestery <kmestery(a)cisco.com> --- src/util/virnetdevopenvswitch.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index 00271a0..fcf6d91 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -104,9 +104,15 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, } cmd = virCommandNew(OVSVSCTL); + + virCommandAddArgList(cmd, "--", "--may-exist", "add-port", + brname, ifname, NULL); + + if (virBufferCurrentContent(&buf) != "") + virCommandAddArgList(cmd, virBufferCurrentContent(&buf), NULL); + if (ovsport->profileID[0] == '\0') { - virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferCurrentContent(&buf), + virCommandAddArgList(cmd, "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, @@ -114,8 +120,7 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, "external-ids:iface-status=active", NULL); } else { - virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferCurrentContent(&buf), + virCommandAddArgList(cmd, "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, -- 1.7.11.4

3 3

[libvirt] [PATCH] Fix legacy xen driver when building without modules
by Jim Fehlig 30 Aug '12

30 Aug '12

When building without driver modules, I've noticed that the legacy xen driver no longer works. The attached patch fixes it, but I'm not sure if this is the correct fix. I need to do some more testing with and without modules, but wanted to raise this on the list for comments/suggestions. Thanks, Jim

2 4

[libvirt] [PATCH] nwfilter: fix loop generating too many rules
by Stefan Berger 30 Aug '12

30 Aug '12

The loop processing the trusted DHCP server generated one too many rules and added one final rules that accepted responses from all DHCP servers. Below patch fixes this. --- src/nwfilter/nwfilter_ebiptables_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3374,10 +3374,10 @@ ebtablesApplyDHCPOnlyRules(const char *i VIR_FREE(srcIPParam); - if (idx == num_dhcpsrvrs) - break; - idx++; + + if (idx >= num_dhcpsrvrs) + break; } virBufferAsprintf(&buf,

2 1

[libvirt] [PATCH] qemu: Clean up security driver initialisation and config file
by Peter Krempa 30 Aug '12

30 Aug '12

Commit d0c0e79ac646462aaa815f81ad324a0d3ef12954 left behind some dead code. (hasDAC can't be efectively set to true, because virSecurityManagerNew fails to load the "dac" driver) Also the configuration file for qemu driver still contains reference to the DAC driver that can't be enabled manualy. --- src/qemu/qemu.conf | 4 +++- src/qemu/qemu_driver.c | 16 ++++------------ 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index fb22b7c..d3175fa 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -162,7 +162,9 @@ # driver at the same time, for this use a list of names separated by # comma and delimited by square brackets. For example: # -# security_driver = [ "selinux", "dac" ] +# security_driver = [ "selinux", "apparmor" ] +# +# Note: The DAC security driver is always enabled. # #security_driver = "selinux" diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5d9f8c9..482a910 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -251,14 +251,10 @@ qemuSecurityInit(struct qemud_driver *driver) char **names; virSecurityManagerPtr mgr = NULL; virSecurityManagerPtr stack = NULL; - bool hasDAC = false; if (driver->securityDriverNames) { names = driver->securityDriverNames; while (names && *names) { - if (STREQ("dac", *names)) - hasDAC = true; - if (!(mgr = virSecurityManagerNew(*names, QEMU_DRIVER_NAME, driver->allowDiskFormatProbing, @@ -287,7 +283,7 @@ qemuSecurityInit(struct qemud_driver *driver) mgr = NULL; } - if (!hasDAC && driver->privileged) { + if (driver->privileged) { if (!(mgr = virSecurityManagerNewDAC(QEMU_DRIVER_NAME, driver->user, driver->group, @@ -296,13 +292,9 @@ qemuSecurityInit(struct qemud_driver *driver) driver->securityRequireConfined, driver->dynamicOwnership))) goto error; - if (!stack) { - if (!(stack = virSecurityManagerNewStack(mgr))) - goto error; - } else { - if (virSecurityManagerStackAddNested(stack, mgr) < 0) - goto error; - } + /* the stack is always initialized here */ + if (virSecurityManagerStackAddNested(stack, mgr) < 0) + goto error; mgr = NULL; } -- 1.7.12

2 3

[libvirt] [PATCH 0/2] Fix segfault and infinite loop when doing VCPU pinning
by Peter Krempa 30 Aug '12

30 Aug '12

See patch comments for details. Peter Krempa (2): qemu: Fix possible infinite loop and segfault on error path. vcpupin: Fix returning of arrays from virDomainVcpuPinAdd src/conf/domain_conf.c | 22 +++++++++++++--------- src/conf/domain_conf.h | 2 +- src/libxl/libxl_driver.c | 2 +- src/qemu/qemu_driver.c | 6 +++--- src/xen/xend_internal.c | 2 +- 5 files changed, 19 insertions(+), 15 deletions(-) -- 1.7.12

2 6

[libvirt] [PATCH] security: Re-apply commit ce53382ba28179d3a504b29b4f888b6e130d53f0
by Peter Krempa 30 Aug '12

30 Aug '12

Recent changes in the security driver discarded changes that fixed labeling un-confined guests. --- src/security/security_manager.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 367f7ad..07f5a9b 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -340,10 +340,12 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, } if (seclabel->type == VIR_DOMAIN_SECLABEL_DEFAULT) { - if (sec_managers[i]->defaultConfined) + if (sec_managers[i]->defaultConfined) { seclabel->type = VIR_DOMAIN_SECLABEL_DYNAMIC; - else + } else { seclabel->type = VIR_DOMAIN_SECLABEL_NONE; + seclabel->norelabel = true; + } } if ((seclabel->type == VIR_DOMAIN_SECLABEL_NONE) && -- 1.7.12

2 2