- Devel - libvirt List Archives

[libvirt] Per-guest configurable user/group for QEMU processes
by Marcelo Cerri 11 Jun '12

11 Jun '12

Hi, This set of patches updates the libvirt's security driver mechanism to support per-guest configurable user and group for QEMU processes running together with other security drivers, such as SELinux and AppArmor. This patches implement the changes discussed in the following thread: https://www.redhat.com/archives/libvir-list/2012-February/msg00990.html Regards, Marcelo Cerri

3 22

[libvirt] [PATCH] rpc: Fix memleak in virNetMessageEncodeHeader
by Michal Privoznik 11 Jun '12

11 Jun '12

My latest patch for RPC rework (a2c304f6872) introduced a memory leak. virNetMessageEncodeHeader() is calling VIR_ALLOC_N(msg->buffer, ...) despite fact, that msg->buffer isn't VIR_FREE()'d on all paths calling the function. Therefore, rather than injecting free statement switch to VIR_REALLOC_N(). --- src/rpc/virnetmessage.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/rpc/virnetmessage.c b/src/rpc/virnetmessage.c index dc4c212..82d5f8d 100644 --- a/src/rpc/virnetmessage.c +++ b/src/rpc/virnetmessage.c @@ -219,7 +219,7 @@ int virNetMessageEncodeHeader(virNetMessagePtr msg) unsigned int len = 0; msg->bufferLength = VIR_NET_MESSAGE_MAX + VIR_NET_MESSAGE_LEN_MAX; - if (VIR_ALLOC_N(msg->buffer, msg->bufferLength) < 0) { + if (VIR_REALLOC_N(msg->buffer, msg->bufferLength) < 0) { virReportOOMError(); goto cleanup; } -- 1.7.8.5

2 2

[libvirt] [PATCH] snapshot: avoid virsh crash with older servers
by Eric Blake 11 Jun '12

11 Jun '12

Commits 51082301, 16d7b39, and 521cc447 introduced support for 'virsh snapshot-list --from' when talking to a server older than 0.9.5, but broke support for plain 'virsh snapshot-list' for the same old server in the process. Because the code is not properly gated, we end up with a SIGSEGV during a strcmp with a NULL argument. * tools/virsh.c (cmdSnapshotList): Don't waste time on fallbacks when --from is not present. --- Caveat: I tested by manually setting ctl->useSnapshotOld=true in virsh.c, rather than actually loading an older libvirtd, but I'm confident that the results would be the same. tools/virsh.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index abcfbff..0453b95 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -16740,10 +16740,10 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) qsort(&names[0], actual, sizeof(char*), namesorter); - if (tree || ctl->useSnapshotOld) { + if (tree || (from && ctl->useSnapshotOld)) { parents = vshCalloc(ctl, sizeof(char *), actual); for (i = (from && !ctl->useSnapshotOld); i < actual; i++) { - if (ctl->useSnapshotOld && STREQ(names[i], from)) { + if (from && ctl->useSnapshotOld && STREQ(names[i], from)) { start_index = i; continue; } @@ -16765,7 +16765,8 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) char indentBuf[INDENT_BUFLEN]; for (i = 0 ; i < actual ; i++) { memset(indentBuf, '\0', sizeof(indentBuf)); - if (ctl->useSnapshotOld ? STREQ(names[i], from) : !parents[i]) + if ((from && ctl->useSnapshotOld) ? STREQ(names[i], from) : + !parents[i]) cmdNodeListDevicesPrint(ctl, names, parents, @@ -16834,7 +16835,7 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) } for (i = 0; i < actual; i++) { - if (ctl->useSnapshotOld && + if (from && ctl->useSnapshotOld && (descendants ? !names[i] : STRNEQ_NULLABLE(parents[i], from))) continue; -- 1.7.10.2

2 2

[libvirt] [PATCH] Only migrate profile in non-privileged libvirtd instance
by Daniel P. Berrange 11 Jun '12

11 Jun '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Only the non-privileged libvirtd instance uses $HOME. So avoid running the code for migrating to XDG directories unless using a non-privileged libvirtd --- daemon/libvirtd.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index d5ad05e..de6c96e 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -783,6 +783,8 @@ static int migrateProfile(void) int ret = -1; mode_t old_umask; + VIR_DEBUG("Checking if user profile needs migrating"); + if (!(home = virGetUserDirectory())) goto cleanup; @@ -795,6 +797,9 @@ static int migrateProfile(void) goto cleanup; if (!virFileIsDir(old_base) || virFileExists(config_dir)) { + VIR_DEBUG("No old profile in '%s' / " + "new profile directory already present '%s'", + old_base, config_dir); ret = 0; goto cleanup; } @@ -830,6 +835,7 @@ static int migrateProfile(void) goto cleanup; } + VIR_DEBUG("Profile migrated from %s to %s", old_base, config_dir); ret = 0; cleanup: @@ -1063,7 +1069,8 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } - if (migrateProfile() < 0) + if (!privileged && + migrateProfile() < 0) exit(EXIT_FAILURE); if (config->host_uuid && -- 1.7.10.2

2 1

[libvirt] [PATCH] Fix privileges on /var/run/libvirt directory
by Daniel P. Berrange 11 Jun '12

11 Jun '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Previous commit commit 32a9aac2e04c991340b66c855a1095e4e6445e54 Author: William Jon McCann <william.jon.mccann(a)gmail.com> Date: Thu May 3 12:36:27 2012 -0400 Use XDG Base Directories instead of storing in home directory Accidentally changed the umask when creating /var/run/libvirt to 077. This prevents /var/run/libvirt being readable by non-root, which is required for non-root to connect to libvirtd. Fix the code so that umask 077 is only used for the non-privileged libvirtd instance. --- daemon/libvirtd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index de6c96e..c1ee3f4 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -1131,7 +1131,10 @@ int main(int argc, char **argv) { goto cleanup; } - old_umask = umask(077); + if (privileged) + old_umask = umask(022); + else + old_umask = umask(077); if (virFileMakePath(run_dir) < 0) { char ebuf[1024]; VIR_ERROR(_("unable to create rundir %s: %s"), run_dir, -- 1.7.10.2

2 1

[libvirt] [patch]make rundir permission equals to socket permission to support unprivileged access
by Royce Lv 11 Jun '12

11 Jun '12

Libvirt-socket-rw and libvirt-socket-ro are not used only for libvirt or root user, but also for unprivileged application such as vdsm, Restrain the rundir only read/search for libvirt prevent comunication with unprivileged client,change rundir the permission equals to the sockets permission. See bug: https://bugzilla.redhat.com/show_bug.cgi?id=828073 Signed-off-by: lvroyce <lvroyce(a)linux.vnet.ibm.com> --- daemon/libvirtd.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index c74cd43..6095072 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -293,7 +293,7 @@ daemonUnixSocketPaths(struct daemonConfig *config, if (!(rundir = virGetUserRuntimeDirectory())) goto error; - old_umask = umask(077); + old_umask = umask(022); if (virFileMakePath(rundir) < 0) { umask(old_umask); goto error;

3 4

[libvirt] Multiple KVM virtio console is not working.
by Pankaj Rawat 10 Jun '12

10 Jun '12

Let me explain our scenario: We need to provide multiple console options so that from Host, user can login into the KVM guest using different console. Environment - Fedora 17 (Host), Fedora 17 (Guest) Libvirt version installed - 0.9.11 On Host, we have edit the guest XMl file and added for the multiple virtio console entry: <console type='pty'> <target type='virtio'/> </console> <console type='pty'> <target type='virtio'/> </console> We are able to connect to guest via serial console device. works fine. #virsh console guest We are unable to connect to guest via virtio console. Not working. #virsh console --devname console1 guest We login using the serial console into guest and check the lsmod command, So the virtio console driver module is not loaded. Also the getty process is not running for different virtio console devices. So i manually load the virtio console (virtio_console.ko) module -> Even then i am unable to login using the virtio console. In the guest, /dev/hvc[0-7] is present. Pls tell us whether we are missing any configuration or settings on Host/Guest side. Regards Pankaj Rawat DISCLAIMER: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or NECHCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of NECHCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. . -----------------------------------------------------------------------------------------------------------------------

1 0

[libvirt] [PATCH] LXC: fix memory leak in lxcContainerMountFSBlockAuto
by Gao feng 10 Jun '12

10 Jun '12

we forgot to free fslist,just add VIR_FREE(fslist). Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_container.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index cd15ca4..297bd6d 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -969,6 +969,7 @@ retry: cleanup: VIR_FREE(line); + VIR_FREE(fslist); VIR_FORCE_FCLOSE(fp); return ret; } -- 1.7.7.6

2 1

[libvirt] [PATCH] LXC: fix incorrect parameter of mount in lxcContainerMountFSBind
by Gao feng 10 Jun '12

10 Jun '12

when do remount,the source and target should be the same values specified in the initial mount() call. So change fs->dst to src. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_container.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 506eb43..cd15ca4 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -744,7 +744,7 @@ static int lxcContainerMountFSBind(virDomainFSDefPtr fs, if (fs->readonly) { VIR_DEBUG("Binding %s readonly", fs->dst); - if (mount(fs->dst, fs->dst, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) { + if (mount(src, fs->dst, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) { virReportSystemError(errno, _("Failed to make directory %s readonly"), fs->dst); -- 1.7.7.6

2 1

[libvirt] [PATCH] LXC: delete unused variable src in lxcContainerMountBasicFS
by Gao feng 10 Jun '12

10 Jun '12

there is no code use the variable "src" in lxcContainerMountBasicFS. so delete it and VIR_FREE. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_container.c | 7 +------ 1 files changed, 1 insertions(+), 6 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index fb59694..506eb43 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -456,7 +456,6 @@ static int lxcContainerMountBasicFS(virDomainDefPtr def, VIR_DEBUG("Mounting basic filesystems pivotRoot=%d", pivotRoot); for (i = 0 ; i < ARRAY_CARDINALITY(mnts) ; i++) { - char *src = NULL; const char *srcpath = NULL; VIR_DEBUG("Processing %s -> %s", @@ -473,21 +472,17 @@ static int lxcContainerMountBasicFS(virDomainDefPtr def, /* Skip if mount doesn't exist in source */ if ((srcpath[0] == '/') && - (access(srcpath, R_OK) < 0)) { - VIR_FREE(src); + (access(srcpath, R_OK) < 0)) continue; - } VIR_DEBUG("Mount %s on %s type=%s flags=%x, opts=%s", srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts); if (mount(srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts) < 0) { - VIR_FREE(src); virReportSystemError(errno, _("Failed to mount %s on %s type %s"), mnts[i].src, mnts[i].dst, NULLSTR(mnts[i].type)); goto cleanup; } - VIR_FREE(src); } if (pivotRoot) { -- 1.7.7.6

2 1