- Devel - libvirt List Archives

[libvirt] [PATCH][TCK] add tests for network interface transaction
by Xiaoqiang Hu 13 Mar '12

13 Mar '12

add tests for network interface transaction: interface_change_begin, interface_change_commit and interface_change_rollback --- .../networks/110-interface-change-transaction.t | 81 ++++++++++++++++++++ 1 files changed, 81 insertions(+), 0 deletions(-) create mode 100644 scripts/networks/110-interface-change-transaction.t diff --git a/scripts/networks/110-interface-change-transaction.t b/scripts/networks/110-interface-change-transaction.t new file mode 100644 index 0000000..f518d9f --- /dev/null +++ b/scripts/networks/110-interface-change-transaction.t @@ -0,0 +1,81 @@ +# -*- perl -*- +# +# Copyright (C) 2012-2013 Red Hat, Inc. +# Copyright (C) 2012-2013 Xiaoqiang Hu <xhu(a)redhat.com> +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +networks/110-interface-lifecycle.t: test transaction for changing the +configuration of one or more network interfaces + +=head1 DESCRIPTION + +The test case validates the transaction for changing the configuration +of one or more network interfaces + +=cut + +use strict; +use warnings; + +use Test::More tests => 2; + +use Sys::Virt::TCK; +use Test::Exception; + +my $network_script_dir = "/etc/sysconfig/network-scripts"; +my $test_interface_name = "ifcfg-interface-tck-test"; +my $test_interface_cfg = $network_script_dir."/".$test_interface_name; +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; + unlink $test_interface_cfg if -f $test_interface_cfg; +} + +my $ret; + +unlink $test_interface_cfg if -f $test_interface_cfg; + +eval { $conn->interface_change_begin(); }; +SKIP: { + skip "interface_change_begin/commit/rollback not implemented", 2 if $@ && err_not_implemented($@); + + $ret = system("cat <<EOF > $test_interface_cfg +DEVICE=\"interface-tck-test\" +BOOTPROTO=\"none\" +ONBOOT=\"no\" +EOF +"); + + $conn->interface_change_rollback(); + ok(! -e $test_interface_cfg, "interface rollback"); + + unlink $test_interface_cfg if -f $test_interface_cfg; + + $conn->interface_change_begin(); + + $ret = system("cat <<EOF > $test_interface_cfg +DEVICE=\"interface-tck-test\" +BOOTPROTO=\"none\" +ONBOOT=\"no\" +EOF +"); + + $conn->interface_change_commit(); + ok(-e $test_interface_cfg, "interface commit"); +} + +# end -- 1.7.1

1 0

[libvirt] [PATCH v2] apparmor: QEMU bridge helper policy updates
by Corey Bryant 13 Mar '12

13 Mar '12

This patch provides AppArmor policy updates for the QEMU bridge helper. The QEMU bridge helper is a SUID executable exec'd by QEMU that drops capabilities to CAP_NET_ADMIN and adds a tap device to a network bridge. For more details on the helper, please refer to: http://lists.gnu.org/archive/html/qemu-devel/2012-01/msg03562.html Signed-off-by: Corey Bryant <coreyb(a)linux.vnet.ibm.com> --- examples/apparmor/libvirt-qemu | 22 +++++++++++++++++++++- 1 files changed, 21 insertions(+), 1 deletions(-) diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index 10cdd36..c5a11b6 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -1,4 +1,4 @@ -# Last Modified: Mon Apr 5 15:11:27 2010 +# Last Modified: Fri Mar 9 14:43:22 2012 #include <abstractions/base> #include <abstractions/consoles> @@ -108,3 +108,23 @@ /bin/dash rmix, /bin/dd rmix, /bin/cat rmix, + + /usr/libexec/qemu-bridge-helper Cx, + + # child profile for bridge helper process + profile /usr/libexec/qemu-bridge-helper { + #include <abstractions/base> + + capability setuid, + capability setgid, + capability setpcap, + capability net_admin, + + network inet stream, + + /dev/net/tun rw, + /etc/qemu/** r, + owner @{PROC}/*/status r, + + /usr/libexec/qemu-bridge-helper rmix, + } -- 1.7.7

3 2

[libvirt] [PATCH] qemu: Copy console definition from serial
by Michal Privoznik 13 Mar '12

13 Mar '12

Now, when we support multiple consoles per domain, the vm->def->console[0] can still remain an alias for vm->def->serial[0]; However, we need to copy it's source definition as well otherwise we'll regress on virDomainOpenConsole. --- src/conf/domain_conf.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 2 + src/libvirt_private.syms | 1 + src/qemu/qemu_process.c | 19 +++++++++-- 4 files changed, 90 insertions(+), 4 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 6b78d97..9b2eb86 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -956,6 +956,78 @@ virDomainChrSourceDefClear(virDomainChrSourceDefPtr def) } } +int +virDomainChrSourceDefCopy(virDomainChrSourceDefPtr dest, + virDomainChrSourceDefPtr src) +{ + if (!dest || !src) + return -1; + + switch (src->type) { + case VIR_DOMAIN_CHR_TYPE_PTY: + case VIR_DOMAIN_CHR_TYPE_DEV: + case VIR_DOMAIN_CHR_TYPE_FILE: + case VIR_DOMAIN_CHR_TYPE_PIPE: + if (src->data.file.path && + !(dest->data.file.path = strdup(src->data.file.path))) { + virReportOOMError(); + return -1; + } + break; + + case VIR_DOMAIN_CHR_TYPE_UDP: + if (src->data.udp.bindHost && + !(dest->data.udp.bindHost = strdup(src->data.udp.bindHost))) { + virReportOOMError(); + return -1; + } + + if (src->data.udp.bindService && + !(dest->data.udp.bindService = strdup(src->data.udp.bindService))) { + virReportOOMError(); + return -1; + } + + if (src->data.udp.connectHost && + !(dest->data.udp.connectHost = strdup(src->data.udp.connectHost))) { + virReportOOMError(); + return -1; + } + + + if (src->data.udp.connectService && + !(dest->data.udp.connectService = strdup(src->data.udp.connectService))) { + virReportOOMError(); + return -1; + } + break; + + case VIR_DOMAIN_CHR_TYPE_TCP: + if (src->data.tcp.host && + !(dest->data.tcp.host = strdup(src->data.tcp.host))) { + virReportOOMError(); + return -1; + } + + if (src->data.tcp.service && + !(dest->data.tcp.service = strdup(src->data.tcp.service))) { + virReportOOMError(); + return -1; + } + break; + + case VIR_DOMAIN_CHR_TYPE_UNIX: + if (src->data.nix.path && + !(dest->data.nix.path = strdup(src->data.nix.path))) { + virReportOOMError(); + return -1; + } + break; + } + + return 0; +} + void virDomainChrSourceDefFree(virDomainChrSourceDefPtr def) { if (!def) diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index c360674..76a8dd7 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1662,6 +1662,8 @@ void virDomainNetDefFree(virDomainNetDefPtr def); void virDomainSmartcardDefFree(virDomainSmartcardDefPtr def); void virDomainChrDefFree(virDomainChrDefPtr def); void virDomainChrSourceDefFree(virDomainChrSourceDefPtr def); +int virDomainChrSourceDefCopy(virDomainChrSourceDefPtr src, + virDomainChrSourceDefPtr dest); void virDomainSoundDefFree(virDomainSoundDefPtr def); void virDomainMemballoonDefFree(virDomainMemballoonDefPtr def); void virDomainWatchdogDefFree(virDomainWatchdogDefPtr def); diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index b9d537e..e6ccf9d 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -242,6 +242,7 @@ virDomainChrConsoleTargetTypeToString; virDomainChrDefForeach; virDomainChrDefFree; virDomainChrDefNew; +virDomainChrSourceDefCopy; virDomainChrSourceDefFree; virDomainChrSpicevmcTypeFromString; virDomainChrSpicevmcTypeToString; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 2882ef8..e0b1824 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -1163,11 +1163,22 @@ qemuProcessFindCharDevicePTYs(virDomainObjPtr vm, for (i = 0 ; i < vm->def->nconsoles ; i++) { virDomainChrDefPtr chr = vm->def->consoles[i]; - if (chr->source.type == VIR_DOMAIN_CHR_TYPE_PTY && - chr->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_VIRTIO) { - if ((ret = qemuProcessExtractTTYPath(output, &offset, - &chr->source.data.file.path)) != 0) + /* For historical reasons, console[0] can be just an alias + * for serial[0]; That's why we need to update it as well */ + if (i == 0 && vm->def->nserials && + chr->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE && + chr->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL) { + if ((ret = virDomainChrSourceDefCopy(&chr->source, + &((vm->def->serials[0])->source))) != 0) return ret; + chr->source.type = VIR_DOMAIN_CHR_TYPE_PTY; + } else { + if (chr->source.type == VIR_DOMAIN_CHR_TYPE_PTY && + chr->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_VIRTIO) { + if ((ret = qemuProcessExtractTTYPath(output, &offset, + &chr->source.data.file.path)) != 0) + return ret; + } } } -- 1.7.3.4

5 12

[libvirt] [PATCH 0/4] Introduce jobs for storage driver
by Michal Privoznik 13 Mar '12

13 Mar '12

Disk operations can take ages to finish. Therefore users might want to abort such job, e.g. because host is going down for maintenance. This patch set is trying to allow this kind of behaviour. The inspiration was taken from qemu driver. How it works: An API that is known to run for a long time, e.g. volume allocation, wiping, have to find a pool which volume belongs to. If the pool was found it is locked. During this time the storage driver is locked. Now the API is preparing for taking the operation. Ideally, it would be sufficient to have only volume locked, but it requires far more changes to code. Just before the API is about to take the long term action, storageBeginJob[WithPool] is called. This wait on a condition specific for a volume. Similar to QEMU driver, wait is limited in time. Timeout is set to 30 seconds. Upon successful job acquire, a counter in the pool is incremented so the pool is prevented from destroy, undef; Then the pool is unlocked. After API finishes it's work, it calls storageEndJob[WithPool] which reset job structure in the volume, re-locks the pool, decrement the counter and broadcasts on the condition. Meanwhile, if the long term action is done internally, it should be done in a cycle so we can check if job abort wasn't signalized. If it is done by external program, we can virCommandAbort() it. Several improvements can be made, but I think this is good for start. NB, I've implemented job aborting for the both APIs using streams, however wasn't very successful with aborting a stream from the daemon site. Michal Privoznik (4): storage: Introduce virStorageVolAbortJob virsh: Expose virStorageVolAbortJob storage: Implement jobs for storage driver storage: Implement virStorageVolAbortJob include/libvirt/libvirt.h.in | 3 + src/conf/storage_conf.c | 12 ++ src/conf/storage_conf.h | 29 +++- src/driver.h | 5 + src/libvirt.c | 49 +++++ src/libvirt_private.syms | 4 + src/libvirt_public.syms | 1 + src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 8 +- src/remote_protocol-structs | 5 + src/storage/storage_backend.c | 53 +++--- src/storage/storage_backend_fs.c | 8 +- src/storage/storage_driver.c | 408 ++++++++++++++++++++++++++++++-------- src/storage/storage_driver.h | 7 + tools/virsh.c | 39 ++++ 15 files changed, 516 insertions(+), 116 deletions(-) -- 1.7.8.5

2 6

[libvirt] [PATCH] vmware: detect when a domain was shut down from the inside
by Jean-Baptiste Rouault 13 Mar '12

13 Mar '12

This patch adds an internal function vmwareGetVMStatus to get the real state of the domain. This function is used in various places in the driver, in particular to detect when the domain has been shut down by the user with the "halt" command. --- src/vmware/vmware_driver.c | 83 +++++++++++++++++++++++++++++++++++++------- 1 files changed, 70 insertions(+), 13 deletions(-) diff --git a/src/vmware/vmware_driver.c b/src/vmware/vmware_driver.c index 56e9d2d..6f75f86 100644 --- a/src/vmware/vmware_driver.c +++ b/src/vmware/vmware_driver.c @@ -28,6 +28,7 @@ #include "datatypes.h" #include "virfile.h" #include "memory.h" +#include "util.h" #include "uuid.h" #include "command.h" #include "vmx.h" @@ -181,6 +182,50 @@ vmwareGetVersion(virConnectPtr conn, unsigned long *version) } static int +vmwareGetVMStatus(struct vmware_driver *driver, + virDomainObjPtr vm, + int *status, + int *reason) +{ + virCommandPtr cmd; + char *outbuf; + char *vmxAbsolutePath; + int state; + int ret = -1; + + cmd = virCommandNewArgList(VMRUN, "-T", vmw_types[driver->type], + "list", NULL); + virCommandSetOutputBuffer(cmd, &outbuf); + if (virCommandRun(cmd, NULL) < 0) + goto cleanup; + + state = virDomainObjGetState(vm, reason); + + if (virFileResolveAllLinks(((vmwareDomainPtr) vm->privateData)->vmxPath, + &vmxAbsolutePath) == -1) + goto cleanup; + + if (strstr(outbuf, vmxAbsolutePath)) { + /* If the vmx path is in the output, the domain is running or + * is paused but we have no way to detect if it is paused or not. */ + if (state == VIR_DOMAIN_PAUSED) + *status = state; + else + *status = VIR_DOMAIN_RUNNING; + } else { + *status = VIR_DOMAIN_SHUTOFF; + } + + ret = 0; + +cleanup: + virCommandFree(cmd); + VIR_FREE(outbuf); + VIR_FREE(vmxAbsolutePath); + return ret; +} + +static int vmwareStopVM(struct vmware_driver *driver, virDomainObjPtr vm, virDomainShutoffReason reason) @@ -212,12 +257,6 @@ vmwareStartVM(struct vmware_driver *driver, virDomainObjPtr vm) }; const char *vmxPath = ((vmwareDomainPtr) vm->privateData)->vmxPath; - if (virDomainObjGetState(vm, NULL) != VIR_DOMAIN_SHUTOFF) { - vmwareError(VIR_ERR_OPERATION_INVALID, "%s", - _("domain is not in shutoff state")); - return -1; - } - vmwareSetSentinal(cmd, vmw_types[driver->type]); vmwareSetSentinal(cmd, vmxPath); if (!((vmwareDomainPtr) vm->privateData)->gui) @@ -317,6 +356,7 @@ vmwareDomainShutdownFlags(virDomainPtr dom, { struct vmware_driver *driver = dom->conn->privateData; virDomainObjPtr vm; + int status; int ret = -1; virCheckFlags(0, -1); @@ -331,7 +371,10 @@ vmwareDomainShutdownFlags(virDomainPtr dom, goto cleanup; } - if (virDomainObjGetState(vm, NULL) != VIR_DOMAIN_RUNNING) { + if (vmwareGetVMStatus(driver, vm, &status, NULL) == -1) + goto cleanup; + + if (status != VIR_DOMAIN_RUNNING) { vmwareError(VIR_ERR_INTERNAL_ERROR, "%s", _("domain is not in running state")); goto cleanup; @@ -467,6 +510,7 @@ vmwareDomainReboot(virDomainPtr dom, unsigned int flags) VMRUN, "-T", PROGRAM_SENTINAL, "reset", PROGRAM_SENTINAL, "soft", NULL }; + int status; int ret = -1; virCheckFlags(0, -1); @@ -485,8 +529,10 @@ vmwareDomainReboot(virDomainPtr dom, unsigned int flags) vmwareSetSentinal(cmd, vmw_types[driver->type]); vmwareSetSentinal(cmd, vmxPath); + if (vmwareGetVMStatus(driver, vm, &status, NULL) == -1) + goto cleanup; - if (virDomainObjGetState(vm, NULL) != VIR_DOMAIN_RUNNING) { + if (status != VIR_DOMAIN_RUNNING) { vmwareError(VIR_ERR_INTERNAL_ERROR, "%s", _("domain is not in running state")); goto cleanup; @@ -582,6 +628,7 @@ vmwareDomainCreateWithFlags(virDomainPtr dom, { struct vmware_driver *driver = dom->conn->privateData; virDomainObjPtr vm; + int status; int ret = -1; virCheckFlags(0, -1); @@ -596,7 +643,10 @@ vmwareDomainCreateWithFlags(virDomainPtr dom, goto cleanup; } - if (virDomainObjIsActive(vm)) { + if (vmwareGetVMStatus(driver, vm, &status, NULL) == -1) + goto cleanup; + + if (status != VIR_DOMAIN_SHUTOFF) { vmwareError(VIR_ERR_OPERATION_INVALID, "%s", _("Domain is already running")); goto cleanup; @@ -623,6 +673,7 @@ vmwareDomainUndefineFlags(virDomainPtr dom, { struct vmware_driver *driver = dom->conn->privateData; virDomainObjPtr vm; + int status; int ret = -1; virCheckFlags(0, -1); @@ -645,7 +696,10 @@ vmwareDomainUndefineFlags(virDomainPtr dom, goto cleanup; } - if (virDomainObjIsActive(vm)) { + if (vmwareGetVMStatus(driver, vm, &status, NULL) == -1) + goto cleanup; + + if (status == VIR_DOMAIN_RUNNING) { vm->persistent = 0; } else { virDomainRemoveInactive(&driver->domains, vm); @@ -902,6 +956,7 @@ vmwareDomainGetInfo(virDomainPtr dom, virDomainInfoPtr info) { struct vmware_driver *driver = dom->conn->privateData; virDomainObjPtr vm; + int state; int ret = -1; vmwareDriverLock(driver); @@ -914,7 +969,10 @@ vmwareDomainGetInfo(virDomainPtr dom, virDomainInfoPtr info) goto cleanup; } - info->state = virDomainObjGetState(vm, NULL); + if (vmwareGetVMStatus(driver, vm, &state, NULL) == -1) + goto cleanup; + + info->state = state; info->cpuTime = 0; info->maxMem = vm->def->mem.max_balloon; info->memory = vm->def->mem.cur_balloon; @@ -949,8 +1007,7 @@ vmwareDomainGetState(virDomainPtr dom, goto cleanup; } - *state = virDomainObjGetState(vm, reason); - ret = 0; + ret = vmwareGetVMStatus(driver, vm, state, reason); cleanup: if (vm) -- 1.7.8.3

3 3

[libvirt] [PATCH] apparmor: QEMU bridge helper policy updates
by Corey Bryant 13 Mar '12

13 Mar '12

This patch provides AppArmor policy updates for the QEMU bridge helper. The QEMU bridge helper is a SUID executable exec'd by QEMU that drops capabilities to CAP_NET_ADMIN and adds a tap device to a network bridge. For more details on the helper, please refer to: http://lists.gnu.org/archive/html/qemu-devel/2012-01/msg03562.html Signed-off-by: Corey Bryant <coreyb(a)linux.vnet.ibm.com> --- examples/apparmor/libvirt-qemu | 22 +++++++++++++++++++++- 1 files changed, 21 insertions(+), 1 deletions(-) diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index 10cdd36..ee9ba5d 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -1,4 +1,4 @@ -# Last Modified: Mon Apr 5 15:11:27 2010 +# Last Modified: Fri Mar 9 14:43:22 2012 #include <abstractions/base> #include <abstractions/consoles> @@ -108,3 +108,23 @@ /bin/dash rmix, /bin/dd rmix, /bin/cat rmix, + + /usr/libexec/qemu-bridge-helper Cx, + + # child profile for bridge helper process + profile /usr/libexec/qemu-bridge-helper { + #include <abstractions/base> + + capability setuid, + capability setgid, + capability setpcap, + capability net_admin, + + network inet stream, + + /dev/net/tun rw, + /etc/qemu/** r, + @{PROC}/*/status r, + + /usr/libexec/qemu-bridge-helper rmix, + } -- 1.7.7

2 3

[libvirt] Restart2: [PATCH RFC 0/8] qemu: Cache results of parsing qemu help output
by Lee Schermerhorn 13 Mar '12

13 Mar '12

Restart of send failed at patch 8. Not sure that one is needed, but try, try again. FYI: failure is: smtplib.SMTPSenderRefused: (452, '4.3.1 Insufficient system storage', ...

3 4

[libvirt] [PATCH] Added support for AMD Bulldozer CPU
by Martin Kletzander 13 Mar '12

13 Mar '12

AMD Bulldozer (or Opteron_G4 as called in QEMU) was added to the list of cpu models, flags were taken from upstream qemu cpu specifications and should be sorted by bit values (or first occurence in the feature specification part of cpu_map.xml). Based on QEMU upstream commit 885bb0369a4f0abe2c0185178f3cb347cb02cdf1. --- src/cpu/cpu_map.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 48 insertions(+), 0 deletions(-) diff --git a/src/cpu/cpu_map.xml b/src/cpu/cpu_map.xml index 6a6603b..8f80dd9 100644 --- a/src/cpu/cpu_map.xml +++ b/src/cpu/cpu_map.xml @@ -692,5 +692,53 @@ <feature name='misalignsse'/> <feature name='lahf_lm'/> </model> + + <model name='Opteron_G4'> + <vendor name='AMD'/> + <feature name='fpu'/> + <feature name='de'/> + <feature name='pse'/> + <feature name='tsc'/> + <feature name='msr'/> + <feature name='pae'/> + <feature name='mce'/> + <feature name='cx8'/> + <feature name='apic'/> + <feature name='sep'/> + <feature name='mtrr'/> + <feature name='pge'/> + <feature name='mca'/> + <feature name='cmov'/> + <feature name='pat'/> + <feature name='pse36'/> + <feature name='clflush'/> + <feature name='mmx'/> + <feature name='fxsr'/> + <feature name='sse'/> + <feature name='sse2'/> + <feature name='pni'/> + <feature name='pclmuldq'/> + <feature name='ssse3'/> + <feature name='cx16'/> + <feature name='sse4.1'/> + <feature name='sse4.2'/> + <feature name='popcnt'/> + <feature name='aes'/> + <feature name='xsave'/> + <feature name='avx'/> + <feature name='syscall'/> + <feature name='nx'/> + <feature name='pdpe1gb'/> + <feature name='rdtscp'/> + <feature name='lm'/> + <feature name='lahf_lm'/> + <feature name='svm'/> + <feature name='abm'/> + <feature name='sse4a'/> + <feature name='misalignsse'/> + <feature name='3dnowprefetch'/> + <feature name='xop'/> + <feature name='fma4'/> + </model> </arch> </cpus> -- 1.7.3.4

2 2

[libvirt] Postgresql binding to other localhosts by libra instances.
by Daniel J Walsh 13 Mar '12

13 Mar '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I see several postgresql instances trying to bind to 127.0.0.1 audit_log-ex-lg-node4.prod.rhcloud.com-2012-03-12 audit_log-ex-std-node18.prod.rhcloud.com-2012-03-12 audit_log-ex-std-node5.prod.rhcloud.com-2012-03-12 uid=6b44af7291524783ad6ed1bc1b55aed5 uid=8d3252d15512409c97f9d3b9167cc2bc uid=e1f70ff7ee3a438a8d513ca953a3dc7c -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEUEARECAAYFAk9fJIsACgkQrlYvE4MpobNSPACYlgWtte2TcatDKgsfaVbz8WSY XQCcCatA688MoFasF5sQUpQ6DSaNVKU= =WEVQ -----END PGP SIGNATURE-----

1 0

[libvirt] These two machines look like they have dontaudit rules disabled.
by Daniel J Walsh 13 Mar '12

13 Mar '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 audit_log-ex-std-node22.prod.rhcloud.com-2012-03-12 audit_log-ex-std-node24.prod.rhcloud.com-2012-03-12 semodule -B Will turn dontaudit rules back on. 22:31:32.791:507663) : avc: denied { siginh } for pid=15258 comm=trap-user scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:libra_t:s0:c5,c641 tclass=process grep siginh * | audit2allow #============= sshd_t ============== #!!!! This avc has a dontaudit rule in the current policy allow sshd_t libra_t:process siginh; -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk9fIj4ACgkQrlYvE4MpobM44gCeJEqC+EV3HN57pL2j/hv9hMYO cewAnjYiI6hehUpwqVEQJ3bX4Dz3eS95 =GqCQ -----END PGP SIGNATURE-----

1 0